SAP audit log licensing in 2026. What is free, what is metered, and how it fits license audit preparation.

The ABAP security audit log and read access logging need no separate SAP license. BTP Audit Log charges per GB for data kept past the free 90 days and for all data your own applications write, so retention above policy is where waste sits.

What does SAP audit log licensing cover?

SAP audit log licensing covers three separate logging capabilities, and each is charged differently depending on where it lives. The security audit log and read access logging run inside the ABAP stack. The BTP Audit Log service runs in SAP's cloud and draws on your credits.

The security audit log

The security audit log records logons, transaction starts and user actions in the ABAP stack. It ships with the platform on premises and inside RISE managed systems at no separate charge.

On older releases you configure it in SM19 and read it in SM20. From SAP NetWeaver 7.50 the equivalents are RSAU_CONFIG and RSAU_READ_LOG, with RSAU_ADMIN for reorganizing and deleting log files. The profile parameter rsau/enable switches it on, and rsau/max_diskspace_local limits the local file size.

Read access logging

Read access logging (RAL) captures who viewed sensitive data such as personal or financial fields. It is included in many editions, usually as part of the NetWeaver license, but it takes configuration effort to scope correctly. Ask SAP to confirm the entitlement for your contract in writing.

You manage it in transaction SRALMANAGER, where each configuration names the fields and channels to record. A scope limited to bank details and salary fields produces far fewer entries than one covering every screen that shows a customer.

The BTP Audit Log service

The BTP Audit Log service records platform and application events in the cloud. SAP keeps the audit data its own BTP services generate for 90 days at no charge, then deletes it. Retention beyond that window is a paid extension under the premium edition service plan.

How is the audit log licensed across on premises, RISE, S/4HANA Cloud and BTP?

The same feature can be free, bundled or metered depending on the deployment, so match the cost model to where each system actually runs. A company with ECC on premises, S/4HANA in RISE and a handful of BTP subaccounts pays under all three models at once.

On premises

On premises, the security audit log and read access logging are platform features. You pay in storage and administration rather than license fees: disk, database growth, and Basis time spent on filters and cleanup.

RISE and S/4HANA Cloud

Inside RISE with SAP, base logging is bundled with a defined retention window. Extending retention or exporting logs beyond that window is a chargeable change. S/4HANA Cloud works the same way in both editions: audit logs sit inside retention windows that you extend at a cost.

RISE bundles a baseline retention that many customers exceed without noticing. The usual trigger is a security team request for longer retention or an export feed after signature, priced outside the original negotiation. Our guide to RISE hidden costs covers other charges that arrive the same way.

BTP credits

On SAP BTP, the Audit Log service draws on your cloud credits once you move past the free defaults. Volume and retention both drive consumption, so the cost scales with how long you keep data.

• SAP generated data. Audit data from SAP's BTP services is kept 90 days free per subaccount, then deleted automatically.
• Longer retention. You entitle the subaccount to the auditlog service on the premium plan, create an instance, and raise a support ticket on component BC-CP-CF-SEC-AUDITLG with the retention in days and a start date.
• Your own applications. Audit data written by applications you build on BTP has no free window and is charged per GB whatever the retention.
• Scope. Retention is configured per subaccount. There is no global account setting yet, so each subaccount carries its own period and its own bill.

SAP publishes the per GB price for the premium plan in the SAP Discovery Center. For how credits are sized and spent, see our guide to BTP credit cost optimization.

Where do the SAP audit log cost traps sit?

The traps are rarely in the logging itself. They sit in retention defaults, in duplicated feeds, and in charges that outlive the setting that created them.

Retention defaults

Retention is often set longer than policy requires, typically once during a project and never reviewed after go live. Every extra month of retained log volume is billable on BTP and chargeable in RISE.

Duplicate logging

Teams frequently log the same events to BTP, to a security platform and to a data lake. You then pay three times to answer one question that few people ask.

A typical chain: the security audit log feeds a SIEM, the same events go to SAP Enterprise Threat Detection, which carries its own license, and a third copy lands in an analytics store.

Charges that outlive the setting

Deleting the premium auditlog service instance does not stop storage charges on BTP. SAP stops charging only when you revoke the custom retention through a support ticket or delete the subaccount. Revoking removes all stored data older than 90 days, so export anything you must keep before you raise the ticket.

Why we advise against keeping every log as long as possible

The standard guidance is to retain everything for as long as possible, because storage looks cheap and auditors might ask. We disagree. In most BTP environments we reviewed, retention was set 3 to 5 times longer than any regulator or internal policy demanded, and the logs were never queried after the first weeks.

On a metered service that default is waste. Set retention to the actual policy requirement, route one authoritative copy to a single store, and treat anything beyond the legal minimum as a deliberate, costed choice with a named owner. An auditor checks your written retention policy and whether you followed it, and a longer period answers neither question.

Logging is a security duty. Retention is a budget decision, and the bill grows when that decision is left on its default with no owner.

How much does longer BTP audit log retention add?

Longer retention adds billable volume in direct proportion to the months you keep beyond the free 90 days. The hypothetical example below assumes the premium charge applies to SAP generated data held past those 90 days. Apply your own per GB rate from the Discovery Center or your order form to turn the volumes into dollars.

Say you run five BTP subaccounts that each generate 8 GB of SAP generated audit data a month, 40 GB in total. Only the production subaccount falls under a policy that requires 12 months of retention. The other four need nothing beyond the free window.

Moving from the first row to the third cuts the billable volume from 1,320 GB to 72 GB, a reduction of about 95 percent, and the policy is still met. The saving comes from two decisions: matching the period to policy, and setting it only on the subaccount the policy covers.

A new setting takes the full retention period to reach these volumes. Audit data your own applications write is billed from the first GB, on top of these figures.

What have we seen in recent BTP and RISE logging reviews?

Across roughly 30 to 40 BTP and RISE reviews in 2024 and 2025, audit logging was a small but steady source of avoidable spend. It rarely tops a bill, which is why it survives renewal after renewal. Three patterns recurred.

• Retention defaults. BTP Audit Log retention defaults drove 15 to 30 percent of avoidable BTP credit burn on logging alone.
• Over retention. Customers kept logs 3 to 5 times longer than any policy or regulator required, about four times longer in the typical case.
• Consolidation. Moving logging to a single tenant cut audit log cost by 20 to 35 percent.

Taking the 35 reviews in our 2024 to 2025 files, the median logging credit waste we found was 28 percent. The companies that overpaid were rarely logging too much. They kept logs too long, in too many places, with no one reading them.

How do you check what your SAP audit logging costs today?

Start with the settings and the entitlements, because those decide the bill.

• ABAP filters. Run RSAU_CONFIG_SHOW, or check SM19 on older releases, to list active filters and the events they capture.
• ABAP storage. Check rsau/max_diskspace_local in RZ11 and the age of the oldest log files in RSAU_ADMIN or SM18.
• RAL scope. Open SRALMANAGER and list each active configuration with its fields and channels.
• BTP entitlements. In the BTP cockpit, look for the auditlog service on the premium plan in each subaccount's entitlements.
• Retention tickets. Search your support history in SAP for Me for tickets on component BC-CP-CF-SEC-AUDITLG. Each one set or changed a retention period.
• Actual reads. Ask the security team for query history against SAP log data older than 90 days in the SIEM and in the Audit Log Viewer.
• RISE terms. Find the retention window and export terms in your RISE contract documents, and list any service requests that extended them.

How do you right size SAP audit log spend at renewal?

Renewal is the moment to reset retention and consolidation, because credit commitments and RISE service terms are open again. Three steps carry most of the result.

Measure real query demand

Look at who actually reads the logs and when. If no one queries data older than 90 days, retention beyond that is paying to store an answer no one asks for.

Set retention to policy

Map retention to the legal and regulatory requirement for each log type. The SAP trust center guidance helps confirm what each compliance regime needs. Set the metered service to that figure instead of the maximum the platform allows.

Consolidate tenants

Route logging to one authoritative store per production environment. Where a regulator needs years of history, keep it in the one store built for that purpose and let the other copies expire.

What will the SAP account team say, and how should you reply?

1. "Regulators expect long retention." Ask which regulation and which clause. Your written policy sets the period for each log type, and you will size to it.
2. "Enterprise Threat Detection will give you better coverage of these logs." It may, but it is a separately licensed product that ingests the same events your SIEM already receives. Decide which store is authoritative first, and buy it only if it replaces a feed instead of adding one.
3. "Logging is bundled in RISE, so there is nothing to negotiate." The baseline is bundled. Ask for the retention window, the extension price and the export terms in the contract before you sign.
4. "Add headroom to the credit commitment so logging never runs short." Forecast logging on the reset settings and commit to that figure.

Which contract terms should you ask for?

• A written retention window per log type in the RISE service description, so any later request starts from an agreed baseline.
• A fixed price for retention extensions and log export for the full term, so a security request after signature is not priced in isolation.
• Log export at no charge in a standard format, including at contract end, so you can move history to your own store.
• A stated effective date when you shorten retention, with charges stopping on that date.
• Rollover of unused BTP credits into the next contract year, so lower logging consumption after the reset is not simply forfeited when the year closes.

Does the SAP audit log matter in SAP license audit preparation?

It plays an indirect role. SAP measures licenses with USMM and LAW, or SLAW in newer versions, and the security audit log is not part of that measurement. Switching logging on or off does not change what you owe.

The log still helps when you prepare. Logon records show which named users were active in the measurement period, which supports locking or reclassifying dormant accounts before the count. Our SAP license audit process 2026 guide shows how the formal process runs, and the SAP audit defense guide covers controlling the license measurement itself.

What to do next

1. Inventory. List every place SAP events are logged across on premises, RISE and BTP.
2. Pull settings. Record the current retention for each log store, including every BTP subaccount.
3. Map requirements. Match each log type to its real legal or regulatory retention requirement.
4. Reset retention. Set metered retention to that requirement and no higher.
5. Cut duplicates. Remove logging paths that answer the same question.
6. Forecast. Model BTP logging credit consumption against the new settings.
7. Get advice early. Engage independent SAP advisory before the next BTP or RISE renewal.

Frequently asked questions