4 Replies Latest reply on Sep 8, 2016 7:50 AM by dahmed

    ESM Integration with SAP.



      We have implemented mcafee ESM as SIEM solution and are trying to integrate SAP with ESM. SAP Version is ECC 6. ESM Version is 9.3.2


      The mcafee ESM data source guide for SAP says that mcafee provides transport scripts (K900010.SEC & R900010.SEC)  which are to be loaded in SAP using

      using standard SAP procedures. We have been able to do this step and have loaded these scripts in SAP.


      However the next step is to change the configurable settings in the SAP Module User Interface and to select one of the following three options:

      1. Read from SAP audit logs
      2. User authorization changes.
      3. User master data changes


      However the guide does not clarify how to invoke the configuration page where the options described in the above step are visible and are to be selected.

      We are stuck at this step.


      kindly help us to proceed





      Rohit Sharma

        • 1. Re: ESM Integration with SAP.

          Hi Rohit,


          do you have been able to invoke the configuration page ? How can you do to go forward the procedure?


          I have the same doubts.




          • 2. Re: ESM Integration with SAP.


            I followed the above issue with My Integration partner and Mcafee without any avail.

            Finally after analysing the script , our ABAP expert found that the script provided by Mcafee creates a program called ZMCAFEE in the SAP.

            This program contains two Transaction codes:





            See the below image






            You can run the above transaction codes in the SAP command window. These T-Codes generate a report on user changes and role changes.

            which can be exported to the file system or desktop.

            • 3. Re: ESM Integration with SAP.

              Hi Support Team,

              How to mount to SAP Server (AIX) use NFS version 4.

              we do not use mount on Receiver (NFS Client) to NFS Server (SAP Server-AIX).

              I know key here NFS domain. But on SIEM we do not use command:

              #chnfsdom nfsdomain

              bash: chnfsdom: command not found


              Please suggest for me this case.

              Many thanks support.

              • 4. Re: ESM Integration with SAP.

                Hello All,


                I am trying to integrate SAP with SIEM, I have followed the process as mentioned in (McAfee_ESM_SAP_Config_Guide.pdf )

                I did run booth the




                It took more than 4 hrs. to complete this,once completed some out has displayed on the screen and saved them.

                Zmcafee output.jpg

                Now at the SIEM side Data source has added but SAP logs are not coming.

                There is no out put in the tcpdump (tcpdump –nni eth1 host x.x.x.x)  too. All though connectivity from SIEM to SAP is fine.


                Is am I missing any steps after the job finished, Any one has integrated and prepared some documents than pls. share it.


                I also fee that (McAfee_ESM_SAP_Config_Guide.pdf is incomplete document for this integration.


                Thanks in advance.

                Dilnawaz Ahmed