C_RSAU_LOG_API

DDL: C_RSAU_LOG_API SQL: C_RSAU_API Type: view Package: SECU

SIEM API for Security Audit Log

C_RSAU_LOG_API is a CDS View that provides data about "SIEM API for Security Audit Log" in SAP S/4HANA. It reads from 2 data sources (rsau_log, RSAU_LOG_DISP_FILT_X) and exposes 21 fields with key fields eventID, log_tstmp, slgmand, sid, counter. It has 3 associations to related views. It is exposed through 1 OData service (RSAU_LOG_API_SERVICE). Part of development package SECU.

Data Sources (2)

SourceAliasJoin Type
rsau_log _header from
RSAU_LOG_DISP_FILT_X flt inner

Associations (3)

CardinalityTargetAliasCondition
[0..1] I_RSAU_EVENTS_VH _events _events.EventID = _header.event
[0..*] tsl1d_attr _pseudo_attr _pseudo_attr.event = _header.event
[0..1] I_RSAU_UGROUP _usergrp ( _usergrp.bname = _header.slguser and _usergrp.mandt = _header.slgmand )

Annotations (3)

NameValueLevelField
AbapCatalog.sqlViewName C_RSAU_API view
AccessControl.authorizationCheck #MANDATORY view
EndUserText.label SIEM API for Security Audit Log view

OData Services (1)

ServiceBindingVersionContractRelease
RSAU_LOG_API_SERVICE RSAU_LOG_API V4 C2 C1

Fields (21)

KeyFieldSource TableSource FieldDescription
KEY eventID rsau_log event Time
KEY log_tstmp rsau_log log_tstmp Timestamp
KEY slgmand rsau_log slgmand Client
KEY sid rsau_log sid SID
KEY counter rsau_log counter Version
param_a Parameter A
param_b Parameter B
param_c Parameter C
param_d Parameter D
slgtc rsau_log slgtc Transaction Code
slgrepna rsau_log slgrepna Program
rsau_text
pseudo_vars _pseudo_attr var_set_1
slgltrm2 rsau_log slgltrm2 Terminal
sal_data rsau_log sal_data Variable Data
raw_text _events raw_text
UserID _usergrp bname User name
useralias _usergrp useralias Alias
email_adress _usergrp smtp_addr E-Mail Address
UserDescription _usergrp UserDescription Full Name
is_relevant

Derived SQL interpretation, reconstructed from the parsed view metadata (data sources, associations, and field mappings). SAP annotations are omitted and the structure is reformulated as SQL — this is a functional approximation, not the verbatim SAP source.

-- Derived SQL interpretation of CDS view C_RSAU_LOG_API.
-- Reconstructed from parsed metadata (data sources, associations, fields).
-- SAP annotations are omitted and the structure is reformulated as SQL;
-- this is a functional approximation, not the verbatim SAP source. Some join
-- conditions may be unavailable and a few CDS constructs are kept as-is.
-- SQL view name: C_RSAU_API

CREATE VIEW C_RSAU_LOG_API AS
SELECT
  _header.event AS eventID,
  _header.log_tstmp AS log_tstmp,
  _header.slgmand AS slgmand,
  _header.sid AS sid,
  _header.counter AS counter,
  cast( ' ' as abap.sstring( 255 )) AS param_a,
  cast( ' ' as abap.sstring( 255 )) AS param_b,
  cast( ' ' as abap.sstring( 255 )) AS param_c,
  cast( ' ' as abap.sstring( 255 )) AS param_d,
  _header.slgtc AS slgtc,
  _header.slgrepna AS slgrepna,
  cast( ' ' as abap.sstring( 1024 ) ) AS rsau_text,
  _pseudo_attr.var_set_1 AS pseudo_vars,
  _header.slgltrm2 AS slgltrm2,
  _header.sal_data AS sal_data,
  _events.raw_text AS raw_text,
  _usergrp.bname AS UserID,
  _usergrp.useralias AS useralias,
  _usergrp.smtp_addr AS email_adress,
  _usergrp.UserDescription AS UserDescription,
  'X' AS is_relevant
FROM rsau_log AS _header
INNER JOIN RSAU_LOG_DISP_FILT_X AS flt ON /* join condition not captured in parsed metadata */
LEFT OUTER JOIN I_RSAU_EVENTS_VH AS _events ON _events.EventID = _header.event  -- association [0..1]
LEFT OUTER JOIN tsl1d_attr AS _pseudo_attr ON _pseudo_attr.event = _header.event  -- association [0..*]
LEFT OUTER JOIN I_RSAU_UGROUP AS _usergrp ON ( _usergrp.bname = _header.slguser AND _usergrp.mandt = _header.slgmand )  -- association [0..1]
;