Symptom
Even if many other applications are executed, only "S000" is displayed in the Application column.
Environment
S/4 HANA Public cloud
Resolution
It is by design. The list behavior of column Application in F4204A shows the ABAP starting point for the activity. In service oriented architecture most services starts from the root S000 via a system program like SAPMHTTP, SAPMSSYX, SAPMSYST...
For the non-public cloud environment, SAP provides some notes to extend the audit reporting with switch back feature, see Note 2191612 FAQ[43].
A public cloud environment with a Fiori frontend should never be requested to implement an SAP Note there.
See Also
SAP Note 2903873 - FAQ: Fiori App "Display Security Audit Log" (Public Cloud)
Keywords
Fiori App "Display Security Audit Log" (F4204A), F4204A, SAL, Application, transaction, S000, system menu , KBA , BC-SEC-SAL , Security Audit Log , How To