Divanshu, thank you for the input!
The intention is to pull out the raw logs to an external event management system (SIEM) for further analysis in real-time or with a bit of delay.
I was wondering whether RZ20 may be a centralized analog for SM18/19/20/21 so it may be a one-stop-shop for logs' storage.
The exteral systems rely either on syslog (UDP protocol) interface or Common Event Format but some big-data crunchers can process raw files as well.
Do you feel here is a better way to pull out the logs/push them out of SAP environment?
I need ones from HR, SRM and CRM most of all.
Ivan