SAP HANA Auditing

audit_hana_user_modifications.sql

-- On the database, enable auditing:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
        'auditing configuration',
        'global_auditing_state'
    ) = 'true' with reconfigure;
-- All audit logs should be directed to a database table called audit log in our scenario:
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'SYSTEM')
set (
        'auditing configuration',
        'default_audit_trail_type'
    ) = 'CSTABLE' with reconfigure;
-- Create an audit policy that records the creation, deletion, and modification of users:
-- Refer https://help.sap.com/viewer/b3ee5778bc2e4a089d3299b82ec762a7/LATEST/en-US/2a942546f16846d597177b3bfbd1df04.html for detailed system priveleges:
CREATE AUDIT POLICY "AUDIT-USER_MGMT" AUDITING ALL ALTER USER,
CREATE USER,
DROP USER LEVEL INFO;
-- Activate the newly formed audit policy:
ALTER AUDIT POLICY "AUDIT-USER_MGMT" ENABLE;
-- Query audit log for a more in-depth look at who modified what and when:
select TIMESTAMP,
    CONNECTION_ID,
    CLIENT_HOST,
    CLIENT_IP,
    USER_NAME,
    APPLICATION_NAME,
    APPLICATION_USER_NAME,
    EVENT_STATUS,
    STATEMENT_STRING
from audit_log
where audit_policy_name = 'AUDIT-USER_MGMT'
    and EVENT_ACTION = 'ALTER USER'
    and upper(statement_string) like '%ALTER USER XYZAPP%'
order by 1 desc
limit 10;