3129650 - Security audit logs do not show the correct transaction started

When using SM20 or RSAU_READ_LOG to evaluate the security audit logs, one of the following behaviors is observed:

• When starting transactions no AU3 security audit log event is recorded in some cases, e.g. when using /n<TCODE> or /o<TCODE> in the OK code field.
• The transaction field is not set correctly for all log entries of type AU3/AU4 written by the SAP kernel.
  For example the "Transaction Code" column shows entries S000 or SESSION_MANAGER.
   

SAP Netweaver

transaction started , KBA , BC-SEC-SAL , Security Audit Log , Problem