10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

Community

Ask a Question Write a Blog Post Login

Technical Articles

Johannes Goerlich
February 5, 2021 | 2 minute read

RFC Gateway security, part 6 –

Logging
 2  5  923
Follow

From my experience the RFC Gateway security is for many SAP Administrators still a
 Like not well understood topic. As a result many SAP systems lack for example of proper
defined ACLs to prevent malicious use.

 RSS Feed After an attack vector was published in the talk “SAP Gateway to Heaven” from
Mathieu Geli and Dmitry Chastuhin at OPDCA 2019 Dubai
(https://github.com/gelim/sap_ms) the RFC Gateway security is even more
important than ever. This publication got considerable public attention as
10KBLAZE.

With this blogpost series i try to give a comprehensive explanation of the RFC
Gateway Security:

Part 1: General questions about the RFC Gateway and RFC Gateway security.

Part 2: reginfo ACL in detail.

Part 3: secinfo ACL in detail.

Part 4: prxyinfo ACL in detail.

Part 5: ACLs and the RFC Gateway security.

https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 1/6
10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

Part 6: RFC Gateway Logging.

RFC Gateway Logging

What about logging functionality of the RFC
Gateway in general?
The logging in RFC Gateway is event based. The various event types are
specified by letters which are also used to configure the to be logged events.

These letters are reused in the log file to indicate which event type lead to the
log entry. The respective letter recurs as first character of a line in the log file.

Each line represents a logged event.

How to configure logging in the RFC Gateway?

Logging is configured by profile parameter ‘gw/logging’. This profile parameter
offers several sub-parameters where some of them are explained below.

While the RFC Gateway logging settings could also be adjusted on SAP
NetWeaver AS ABAP in transaction SMGW or in general by the command line
tool ‘gwmon’, only settings defined in the profile parameter are persistent.

Which usage types are covered by the logging?

As we learned in part 1 the RFC Gateway serves for different usage types. The
logging covers all these usage types. For some the logging is more detailed
than for others.

What events should be logged by the RFC

Gateway?
Logging is always a trade of between log volume and meaningful data for
forensics. For the RFC Gateway we should log at least the following events:

X = Start/stop of RFC Gateway, Log file rotation

S = Security events
https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 2/6
10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

Z = Rejected access without rules denied by implicit deny all rule

P = Dynamic Parameter Changes

E = External Programs

R = Registered programs

Which results in the sub-parameter ACTION=ERSZPX.

What about log file handling?

The RFC Gateway comes with a functionality to rotate log files

a) on a hourly, daily, weekly, monthly or yearly basis, defined in sub-parameter

‘SWITCHTF’ (the rotation happens at the first log event after midnight),

b) or depending on the file size, defined in sub-parameter ‘MAXSIZEKB’,

c) or a combination of both.

Log retention can be configured by sub-parameter ‘MAXFILES’ .

We could for example set MAXSIZEKB=0 – while making sure there is sufficient
disk space – in combination with MAXFILES=90 specifying the number of files
to be retained. With SWITCHTF=day this results in daily log rotation with 90
days log retention.

For a reliable log file handling the file name should be specified as unique as
possible, e.g., by setting the sub-parameter
LOGFILE=gw_log_$(SAPSYSTEMNAME)_$(INSTANCE_NAME)_$(SAPLOCALHOST)-
%y-%m-%d.

Anything specific to look for in this logs?

During the initial creation of custom ACLs we should consider to monitor the
log files for

‘secinfo accepted:’ and ‘secinfo denied:’,

‘reginfo accepted:, ‘reginfo denied:’, and ‘reginfo (no rule found):’
‘prxyinfo accepted:’ and ‘prxyinfo denied:’.

Later during day to day business we should consider to monitor the log files at
least for

‘secinfo (no rule found):’

https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 3/6
10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

‘reginfo (no rule found):’

‘prxyinfo denied:’
log entries starting with ‘E’
log entries starting with ‘P’

for suspicious activities while still collecting all events mentioned above for
forensics.

<–Previous

Alert Moderator

Assigned tags

SAP NetWeaver Application Server for ABAP

NW Client/Server Technology (CST)

SAP NetWeaver Application Server for Java

Security

RFC Gateway

Similar Blog Posts 

RFC Gateway security, part 1 - basic understanding
By Johannes Goerlich Jan 26, 2021

RFC Gateway security, part 5 - ACLs and the RFC Gateway security
By Johannes Goerlich Feb 03, 2021

RFC Gateway security, part 4 - prxyinfo ACL

By Johannes Goerlich Feb 01, 2021

https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 4/6
10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

Related Questions 
Gateway not connected to local R/3
By souradeep ghosal Aug 10, 2021

Massive creation of CPICTRC files in work directory

By Marie Renneke Jul 25, 2017

How to register an external program on gateway

By Former Member Sep 13, 2017

Join the Conversation 

SAP TechEd
Tune in for tech talk. Stay for inspiration. Upskill your future.

Coffee Corner
Join the new Coffee Corner Discussion Group.

2 Comments

You must be Logged on to comment or reply to a post.

Andreas Kirchebner
February 11, 2021 at 8:00 am

Hi Johannes,

thanks for this great blog series. I'm looking forward to read more from you.

Take care, Andreas

Like 1 | Share

https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 5/6
10/21/21, 1:14 PM RFC Gateway security, part 6 – Logging | SAP Blogs

Isaias Freitas
June 27, 2021 at 8:12 pm

Indeed, great blog series! Well done!

Like 0 | Share

Find us on

Privacy Terms of Use

Legal Disclosure Copyright

Trademark Cookie Preferences

Newsletter Support

https://blogs.sap.com/2021/02/05/rfc-gateway-security-part-6-logging/ 6/6