Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,195 questions
Microsoft Sentinel for SAP - No Audit Log Data - other data is visible
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 80%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGF%3C/text%3E%3C/svg%3E)
Gabel, Felix
20
Reputation points
Hello all,
we have a strange issue - we dont receive AUDIT LOG data in MS Sentinel for SAP - other data is successfully transferred:
SM19/SM20 is activated with content on SAP side (checked: https://learn.microsoft.com/de-de/azure/sentinel/sap/sap-deploy-troubleshoot#empty-or-no-audit-log-retrieved-with-no-special-error-messages) ST22/SM21 also no entries with the connection User - SU53 no entries for connection User.
Systemconfig file on docker connector VM:
In Omnilog file we have some strange entries regarding SMADENT_SID user (which is not our connection user) I dont know where they come from.
Do you have any ideas on this why we can not see any audit logs?
Felix
{count} votes
-
Gabel, Felix 20 Reputation points
2024-12-23T13:53:44.7033333+00:00 Any ideas?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
Givary-MSFT 34,521 Reputation points Microsoft Employee2024-12-26T04:43:03.95+00:00 @Gabel, Felix Thank you for reaching out to us, let me check with my team on this and revert back.
Sign in to comment
Sign in to answer