Where are user deletion logs stored on SAP?

Question

I want to know the date a user was deleted from SAP for a task automation. I am trying to pull user deletion data from SAP using Winshuttle Query.
Usually, I do this (manually) using the SUIM transaction, going for the change document for users and mark user deletion, execute and you would see the event for the user deletion from the change document.

As Winshuttle Query just brings out tables, I'd like to figure out which tables I need to relate to get this information. I've tried USH02 and USH04, where I see some changes, but nothing matches the date of the SUIM report; also I tried to relate data on CDHDR and CDPOS, but I couldn't figure out what the user events are, of even if they are there.
The specific question is, where is the SUIM report getting this data from? and can I pull it from a table?
Thanks in advance.

Suncatcher · Answer

I've tried USH02 and USH04, where I see some changes, but nothing matches the date of the SUIM report

This is because you didn't know how to see. There is a simple attribute that marks deleted user in USH04

Deleted user have first D letter in PROFS field. The only complication here is that PROFS is a raw LCHR field and you cannot filter it like WHERE profs LIKE 'D%'.
As far as I know, the same limitation applies both to HANA and ABAP CDS.
So the most easy way to get deleted user is:
SELECT bname, nrpro, profs
    INTO TABLE @DATA(deleted_users)
    FROM ush04
    WHERE modda BETWEEN '20200108' AND '20200708'.

DELETE deleted_users WHERE profs(1) <> 'D'.

P.S. Don't miss nrpro as selecting preceding INT before LCHR is mandatory (see Note 302788)
P.P.S. You can verify the result in report RSUSR100N called by SUIM under the hood, which uses FM SUSR_CHANGE_DOC_USERS which uses the same code from USH04.

Where are user deletion logs stored on SAP?

One Answer

Add your own answers!

Ask a Question