SAP HANA Cloud Auditing: Policies, Actions, and Review

01What SAP HANA Cloud auditing does

SAP HANA Cloud auditing records selected database activity so administrators can investigate access, compliance events, and changes to protected objects. The most important design decision is choosing audit actions that answer a defined security or operational question without producing unnecessary data.

Auditing is configured at the database level. Use SAP HANA Cloud Central to identify the relevant instance, then open the database with SAP HANA database explorer and use its SQL console to create and manage policies.

02Plan an audit policy

Start with the event you need to observe, the users or objects in scope, and the retention and review process that will apply to the resulting records. Group actions carefully: every action in one policy must belong to the same audit action group.

A policy can record all executions of a selected action, only successful executions, or only unsuccessful executions. Choose the narrowest status and action combination that supports the investigation or control objective. Broad policies can make review more difficult and increase audit data volume.

03Create and enable an audit policy

Run the policy statement from the SQL console in SAP HANA database explorer. A valid statement supplies exactly one audit status, an action list, and a level. For example:

CREATE AUDIT POLICY connect_audit AUDITING ALL CONNECT LEVEL INFO;
ALTER AUDIT POLICY connect_audit ENABLE;

The first statement defines the policy, while the second enables it. A newly created policy is disabled until an administrator explicitly runs the corresponding ALTER AUDIT POLICY <name> ENABLE statement.

04Choose audit status and level

ALL captures both successful and unsuccessful executions of the selected action. SUCCESSFUL and UNSUCCESSFUL restrict the policy to one outcome. The LEVEL specifies the severity level associated with the audit policy, so select a level that fits the monitoring and review process.

Do not combine multiple audit statuses in one statement. Also, an audit status must be followed by an action list; a statement that stops at AUDITING ALL is incomplete and does not define an executable policy.

05Review audit evidence

After enabling a policy, validate that the expected activity is being recorded and that the results are useful to reviewers. Compare audit records with controlled test activity, check unsuccessful access attempts, and document who reviews the records and how findings are escalated.

For related identity controls, see SAP HANA Cloud user management and SAP HANA user privileges. For operational follow-up, SAP HANA Cloud alerts can help administrators respond to relevant service conditions, while the audit policy itself remains a database SQL configuration.

06Troubleshoot common audit policy mistakes

If no records appear, confirm that the policy was enabled, the test activity matches the selected action, and the activity occurred in the intended database instance. If records are too broad, refine the action scope or status rather than creating several overlapping policies without a review plan.

Keep policy names, owners, purpose, selected actions, and review expectations in the organization’s security documentation. Revisit them when application behavior, access requirements, or compliance obligations change.