📊 SAP ST03N - What It Does and Why Every Basis Team Needs It
Today we are going to explain SAP transaction ST03N - the Workload Monitor transaction used to track user login activity and review exactly which transactions a user has executed in the system. Observing user activity and reviewing transaction history is an important part of security, auditing, and performance work in any SAP landscape, which is why ST03N is one of the first monitoring transactions a Basis administrator gets comfortable with. In this guide we cover how to open ST03N, the exact menu path to reach the Workload Monitor, how to use Expert Mode to filter by instance, user, and date, how to read the resulting transaction report, and where ST03N fits alongside other monitoring tools. Whether you are a fresher learning SAP Basis monitoring for the first time or a functional consultant who simply needs to confirm what a user actually did in the system, this guide explains it step by step.
The ST03N transaction entry screen - the starting point for tracking and analysing user transaction history in SAP.
Track User Transactions
Step-by-step instructions to track which transactions a specific user has run, using the Workload Monitor in ST03N.
Filter By Day, Week, or Month
How to narrow a transaction history report down to a specific date range, instance, and individual user profile.
Expert Mode Explained
What Expert Mode unlocks inside ST03N, and how it differs from the basic workload overview screen.
⚙️ What Is ST03N? The Workload Monitor Transaction
ST03N is the standard SAP transaction code used to analyse system workload and user activity - the underlying performance data that shows who logged in, what they did, and how the system responded. It works in both SAP S/4HANA and the older SAP ERP ECC 6.0, since workload monitoring has been part of SAP Basis since well before either of these releases.
🔎 In Plain Terms
Every transaction executed in SAP leaves behind a performance record - which user ran it, which instance handled it, how long the database took to respond, and how long the screen took to render. ST03N is the screen administrators use to query that performance data, most commonly to confirm which transactions a specific user has been running, or to review overall system load across a day, week, or month.
Important: before pulling a user's transaction history in ST03N, make sure you have the right monitoring authorization in your system, and follow your company's data privacy and audit policies. Activity data on other users should be treated the same way as any other sensitive system log.
To get started, go to the SAP command field, type ST03N, and press Enter. The screen below is what you will land on once the transaction opens.
The ST03N entry screen, the starting point before navigating into the Workload Monitor to pull a user's transaction history.
The Key Areas You Will Use Inside ST03N
Once ST03N is open, there are a few areas that matter most for checking login and transaction history. Here is exactly what each one does.
The main entry point for performance analysis. Reached through the menu path System > Performance > SAP System Performance > Workload, this is where every workload-related report, including EV_00, lives.
The specific workload variant administrators click to begin a login and transaction history analysis. EV_00 opens the overview screen from which Expert Mode and the detailed filters become available.
A tab that unlocks granular filters - Instance, User, Date, and User Profile - letting an administrator narrow a system-wide report down to one specific person's activity.
Lets the administrator choose which application server's data to analyse, useful in landscapes with multiple instances where activity may be spread across more than one server.
Where a specific username is entered to filter the report. Selecting SAPSYS instead surfaces background and system-driven activity rather than a named individual's actions.
Controls how far back the report reaches and how the results are grouped, letting the same screen serve both a quick daily check and a longer monthly audit.
Response time data: alongside the transaction list itself, ST03N also exposes response times, database time, GUI time, and other performance metrics for each selection - useful not just for security checks but also for diagnosing why a particular transaction felt slow for a particular user.
🔑 How to Check User Login and Transaction History Using ST03N
Follow these steps exactly to track a user's transaction history in SAP ERP, S/4HANA, or ECC 6.0. Once you've done it a couple of times, the whole process takes well under a minute.
Open Transaction ST03N
Log in to SAP and type ST03N in the command field at the top left, then press Enter to open the Workload and Performance Statistics screen.
T-Code: ST03NNavigate to the Workload Node
Follow the menu path System > Performance > SAP System Performance > Workload. This opens the area where every workload-based report, including the one you need, is located.
Select EV_00 and Switch to Expert Mode
Click on EV_00 to open the workload overview, then click the Expert Mode tab. This is where the detailed search for login user transaction history actually happens.
Choose Instance, User, and Date
Inside Expert Mode, select the Instance, then choose the user you want to check - or select SAPSYS to see background and system-driven activity instead of one named person. Then pick the Date and User Profile.
Pick the Date Range
Select which period you want to see the user's login history for - day, week, or month. Several other options are also available at this stage, including times, database statistics, parts of response times, GUI times, and full data views.
Open the Transaction Report
Select the specific user you filtered for and you'll see exactly which transactions that user has executed, including batch jobs and other system activity tied to their account.
Save the Analysis
Once the report looks the way you need it, use the Save option to store the selection for later, whether that's for an audit trail, a performance review, or a follow-up support ticket.
Here is what each stage actually looks like on screen, from the Workload Monitor through to Expert Mode and the final transaction report.
The Workload Monitor after selecting EV_00 - this is where the Expert Mode tab is clicked to begin the detailed search.
Expert Mode with the Instance, User (including SAPSYS), Date, and User Profile fields used to narrow down the report.
The resulting transaction report for the selected user, including batch job activity and other transactions utilised.
Tip: if your first report looks empty or incomplete, double check that the Instance and Date range actually cover the period when the user was active - a mismatched instance is the most common reason a transaction history search comes back blank.
📈 Reading the ST03N Workload Report Correctly
Pulling the report is only half the job - knowing what the columns actually mean is what makes ST03N useful rather than just a wall of numbers. A few categories show up in almost every analysis, and it helps to know what each one is telling you.
⚠️ Don't Confuse Activity Volume With a Problem
A user showing a high transaction count in ST03N is not, by itself, a red flag. Power users in finance, sales, or materials management can legitimately run the same transaction dozens of times a day. The numbers only become meaningful once you compare them against what that user's role is expected to do, or against a known incident you're investigating.
Response Times
Shows how long each transaction took to complete from the user's perspective, combining several smaller time segments into one overall figure.
Database Time
The portion of the response time spent waiting on the database. Consistently high database time across many users can point to a performance issue rather than a single user's behaviour.
GUI Time
Time spent rendering the screen on the user's side, useful for telling apart a slow network or client from a genuinely slow backend transaction.
Batch Activity
Background jobs tied to a user ID show up alongside their manually executed transactions, which is why a report can sometimes look busier than the person's actual screen time would suggest.
Cross-checking with other tools: if the ST03N report raises a question you can't fully answer from workload data alone - for example, exactly when a specific logon happened - the Security Audit Log (transaction SM20) is usually the next place to look, since it records logon events specifically rather than general performance statistics.
🧩 Real-World ST03N Scenarios Every Basis Team Will See
Reading the steps in isolation only tells half the story. In a live SAP landscape, requests to check user activity almost always arrive wrapped in some kind of context - a security review, a slow-running process someone is complaining about, or an auditor asking pointed questions. Walking through a few realistic situations makes the ST03N process far easier to apply when a request actually lands on your desk.
An internal or external auditor asks for confirmation that a specific user executed (or did not execute) a particular transaction on a particular date. Pulling that exact user, instance, and date combination through ST03N's Expert Mode gives a defensible, system-generated answer rather than relying on memory or a manager's assumption.
A user complains that a specific transaction is taking far too long to respond. Rather than guessing, the Basis team checks that user's response time, database time, and GUI time breakdown in ST03N to see whether the slowdown sits on the backend, the database, or the user's own network connection.
Someone notices unexpected system load and isn't sure whether a real person or a scheduled job is behind it. Selecting SAPSYS instead of a named user in ST03N surfaces background and batch activity separately, which usually resolves the confusion quickly.
As part of a routine performance review, the Basis team runs ST03N for a full month rather than a single day, looking for usage trends across instances and users rather than chasing one isolated incident. This wider view often surfaces patterns a single day's data would never reveal.
The pattern to notice: almost every real-world ST03N request boils down to one of three goals - confirming what a specific user did, diagnosing why something felt slow, or reviewing overall system trends. Once you can recognise which of the three you're dealing with, choosing the right Instance, User, and Date combination in Expert Mode becomes a quick decision rather than a guessing game.
⌨️ ST03N and Related SAP Monitoring T-Codes
| T-Code | Purpose |
|---|---|
| ST03N | Workload Monitor - analyse user transaction history, response times, and overall system performance by instance, user, and date. |
| SM20 | Security Audit Log - records security-relevant events such as logon attempts, authorization failures, and other audit-relevant activity. |
| SM04 | Shows currently logged-in users and the transactions they have active right now, as a live snapshot rather than historical data. |
| SM37 | Background job monitoring - view scheduled, running, and completed batch jobs, including which user or job step triggered each one. |
| SUIM | User Information System - search and report on users, roles, and authorizations across the system. |
| ST02 | Tune Summary - reviews SAP buffer and memory statistics, often checked alongside ST03N when diagnosing a wider performance issue. |
🛠️ Troubleshooting Common ST03N Problems
Even with the right steps followed, ST03N occasionally returns confusing or empty results that throw off a new administrator. The table below covers the issues that come up most often, along with what is usually causing each one.
| Symptom | Likely Cause and Fix |
|---|---|
| Report comes back completely empty | The selected Instance most likely doesn't match the application server the user was actually logged into during that period. Try selecting "All Instances" or check which server handled their session. |
| User's activity appears far higher than expected | Background jobs and batch activity tied to that user ID are often included alongside their manual transactions. Check the batch job breakdown before assuming the volume is unusual. |
| "Not authorized" error when opening ST03N | The logged-in user does not have the relevant monitoring authorization object assigned to their role. This needs to be resolved by the Basis team adjusting role assignments. |
| Date range selection seems to return data from the wrong period | Double check whether the system is interpreting the date in the expected format, and confirm the correct week or month was actually selected in Expert Mode rather than the default. |
| SAPSYS shows activity you can't explain | This is almost always scheduled background processing rather than a security concern. Cross-check with SM37 to see which specific batch jobs ran in that window. |
| Response time figures look unusually high for everyone | This may point to a system-wide performance issue rather than a single user's problem - check ST02 buffer statistics alongside ST03N before escalating it as a one-off ticket. |
When in doubt, widen the date range first. Most "I can't find this user's activity" questions are answered by checking a slightly wider window or different instance, rather than assuming the data simply doesn't exist.
✅ ST03N Best Practices - What to Do and What to Avoid
❓ SAP ST03N - Frequently Asked Questions
The most commonly searched questions about ST03N, user login history, and the Workload Monitor. Click each question to see the answer.
ST03N is the SAP Workload Monitor transaction used to analyse system performance and user activity. It lets administrators check which transactions a specific user has executed, how the system responded, and how overall workload is distributed across users, instances, and time periods.
Run transaction ST03N, follow the path System > Performance > SAP System Performance > Workload, open EV_00, switch to Expert Mode, then select the Instance, User, and Date range you want to analyse. The resulting report lists every transaction that user executed in that window.
Expert Mode is a tab inside the ST03N Workload Monitor that exposes detailed filtering options not shown on the basic screen, including selection by Instance, specific User, User Profile, and granular date ranges, so you can narrow a report down to one person's activity.
SAPSYS is a built-in system user representing background and automatic system processes rather than a real person. Selecting SAPSYS in ST03N typically surfaces batch jobs and internal system activity rather than activity from an individual named user.
Yes. After opening EV_00 and entering Expert Mode, you can choose to view workload and transaction statistics broken down by day, week, or month, depending on how far back the analysis needs to go and how granular the results should be.
From the SAP main menu, the path is System > Performance > SAP System Performance > Workload. This opens the Workload Monitor where EV_00 is selected to begin the analysis.
An ST03N transaction report can include the list of transactions a user ran, response times, database time, GUI time, and other performance metrics, along with batch job activity tied to that user or instance.
ST03N is most commonly used by SAP Basis administrators for performance monitoring, by security teams for audit and compliance checks, and by functional consultants who need to confirm whether a specific transaction was actually executed by a user.
ST03N works on the same underlying workload monitoring concept in both SAP S/4HANA and ECC 6.0, though S/4HANA systems may also offer newer HANA-specific monitoring tools alongside it for more detailed performance analysis.
ST03N focuses on workload and performance statistics, showing which transactions a user ran and how the system responded. SM20 is the Security Audit Log, focused specifically on security-relevant events such as logon attempts and authorization checks. They are often used together for a complete activity picture.
Yes. Like most monitoring transactions, ST03N requires the relevant authorization objects, typically held by SAP Basis administrators or the performance and security teams, since it exposes activity data for other users across the system.
Yes. After running an analysis in EV_00 and Expert Mode, the Save option lets you store the selection variant or export the resulting workload and transaction data for audit records or further review.