SAP Knowledge Base Article - Public

3786519 - 'insufficient privilege' error when reading Datasphere audit log in HANA Database explorer

Symptom

In the HANA Database explorer of Datasphere tenant,  '[258]: insufficient privilege' error occurs when using Database analysis user to execute following SQL to read the Datasphere audit log table DPP_AUDIT_LOG.
SELECT * FROM "DWC_AUDIT_READER"."DPP_AUDIT_LOG" 

Environment

SAP Datasphere

Reproducing the Issue

  1. Enable Audit Log for Read/Change Operations in Space Management as per Logging Read and Change Actions for Audit.
  2. Deploy the space after enabling audit logs.
  3. Choose a space named for example 'AAA' that will contain the audit logs, and create an audit log view named for example 'BBB' using DPP_AUDIT_LOG from the DWC_AUDIT_READER schema as the source as per Monitor Object Changes with Activities.
  4. Confirm the created audit log view display audit log correctly.
  5. Create a Database Analysis user and connect to Open Database Explorer as per Create and use a system-level Database Analysis User.
  6. Open an SQL Console, and run following SQL:
    SELECT * FROM "DWC_AUDIT_READER"."DPP_AUDIT_LOG" 
  7. Error occurs:
    ---
    Error: (dberror) [258]: insufficient privilege: Detailed info for this error can be found with guid 'xxxxxxxxxxxxxxxxxxxxx'
    ----  

Cause

As per design, the Database Analysis user created from Datasphere does not have access to DB schema "DWC_AUDIT_READER", therefore it does not have sufficient privilege to exeute SELECT * FROM "DWC_AUDIT_READER"."DPP_AUDIT_LOG".

Resolution

To read audit data with a database analysis user in HANA Database explorer, create a view based on the table DPP_AUDIT_LOG in Datasphere space, and in HANA Database explorer query the view in the space schema, instead of querying DPP_AUDIT_LOG in schema DWC_AUDIT_READER directly.
For example, if the view ceated on top of local table DPP_AUDIT_LOG is View BBB, its space is AAA, then please run folllowig SQL instead to get the audit data result:
SELECT * FROM "AAA"."BBB" 

See Also

Keywords

datasphere audit log, DPP_AUDIT_LOG, application_user_name, technical user, sdc, secure data connector, replication flow, activities log, object-level changes, data-level changes, DWC_AUDIT_READER, insufficient privilege 258, viewer timeout three minutes, database analysis user, space schema view , KBA , DS-SM , Space Management , Problem

Product

SAP Datasphere all versions