SAP S/4 HANA Cloud - Public Edition Audit Logs

Overview

The SAP S/4HANA Cloud – Public Edition Audit Log Input collects system audit events from the SAP Audit Log Service, providing visibility into security-relevant activities across your cloud tenant. These logs capture authentication attempts, user activity, and internal system events, supporting security monitoring, forensic analysis, and compliance reporting.

This input is particularly valuable for tracking user logons, identifying support or system access, and correlating activity across time, systems, and users. By normalizing and enriching the logs, the data becomes ready for integration with the target SIEM or observability platform.

Data Collected

Field	Description
`event_id`	Audit event type (e.g. `"AU1"` for user logon activity).
`log_tstmp`	Timestamp of the event (in UTC).
`slgmand`	Client ID (Mandant) within the SAP system.
`sid`	System ID of the S/4HANA Cloud tenant.
`counter`	Internal counter (typically `0` for single-entry events).
`terminal_name`	Terminal name or IP address where the event originated.
`user_fullname`	Full name of the user performing the action (may include service user descriptions).
`user_Id`	Unique ID of the user.
`user_alias`	Alternate user alias, if available.
`email_adress`	User's email address (if provided in the audit log source).
`user_description`	Additional user information, often used for service accounts or support roles.
`param_a` to `param_d`	Parameters related to the action, often indicating logon type, method, or client context.
`slgrepna`	Program or transaction name that triggered the event (e.g., `RSBTCRTE`, `SAPMHTTP`).
`slgtc`	Transaction code or log group classification, if available.
`rsau_text`	Human-readable description of the event (e.g., “Logon successful (type = B, method = A)”).

Configuration

Importing the Client Certificate

Login to the PowerConnect Cloud web UI
Click on the Configuration tab
Click Certificates then Import Certificate

Enter an alias name then click Choose file and upload the client certificate file

Click Import
The certificate is now imported and ready to use

Adding an Audit Log Input to PowerConnect Cloud

Login to the PowerConnect Cloud web UI
Click on the Inputs link in the menu bar
Click the + button to add a new Input

Under Platform choose S/4HANA Cloud Public Edition
Then choose audit-log
Fill in the details previously obtained from creating the API user
Choose the output for the target platform
The input is now created