Table of Contents

BTP Application Events Monitor

The BTP Application Events Monitor tracks and alerts on audit events within your SAP BTP Cloud Foundry environment. It allows for granular tracking of application lifecycle changes, security events, and operational actions by communicating with the Cloud Foundry V3 Audit Events API.

Prerequisites

API Endpoints used

Endpoint Purpose
POST /oauth/token Authentication via UAA
GET /v3/audit_events Retrieve audit events with time and type filters
GET /v3/apps Metadata discovery for GUID resolution

Key Features

Event Tracking

The monitor captures detailed information for every discovered event:

  1. Event Type: Lifecycle events (audit.app.update, audit.app.restaging), scaling, or custom BTP events.
  2. Actor Details: Identifies who (user or service) initiated the event.
  3. Target Info: Maps events to specific Application Names, Spaces, and Subdomains.
  4. Contextual Data: Captures reasons, exit descriptions, and instance IDs where available.

Flexible Filtering

  1. Event Type Filtering: Monitor specific events (e.g., only audit.app.crash) or use * for everything.
  2. Scope Control: Filter by Application Name, Space, or Subdomain using exact names or wildcards.
  3. Temporal Precision: Only processes new events since the last execution to prevent duplicate processing.

Alarm Capabilities

  1. Event-Based Alarming: Trigger an alarm immediately when an event matching your criteria is detected.
  2. Unique Identification: Each alarm is tied to the BTP Event GUID, ensuring multiple events of the same type in one cycle are all reported.
  3. Configurable Severity: Assign different severity levels (Warning, Critical) per configuration row.

How It Works

Data Collection Process

  1. Metadata Sync: The monitor ensures BTP metadata (GUIDs, Orgs, Spaces) is fresh to allow users to use human-readable names in the configuration instead of GUIDs.
  2. Request Generation: For each active row, a filtered API request is built using the created_ats[gt] parameter to fetch only events since the last successful run.
  3. Pagination: The runner automatically handles BTP API pagination (up to 10 pages) to ensure no events are missed during busy periods.
  4. Metadata Storage: Discovered events are stored as metadata (visible in the Event Log/Reports) even if alarms are disabled.

Configuration

Connection Settings

  1. Create a Web Service Connector:
  2. URL: Your BTP API endpoint (e.g., https://api.cf.eu10.hana.ondemand.com).
  3. Auth Type: Associate with a User Profile containing valid BTP credentials.

Monitor Configuration

  1. Open the monitor configuration.
  2. Click the “Load BTP Apps” button.
  3. The table will populate with known applications.
  4. Specify the Event Types you wish to monitor for those apps (e.g., audit.app.crash).

Method 2: Global/Wildcard Monitoring

To monitor all events across a whole space or subdomain:

  1. App Name: Set to *.
  2. Space / Subdomain: Enter a specific name to filter, or * for the entire subaccount.
  3. Event Types: Set to * to see every audit event.

Settings Reference

Field Description Default
Active Enable/disable this configuration row true
App Name Specific app name or _ _
Space Filter by BTP Space name _
Subdomain Filter by BTP Subdomain (Organization) _
Event Types Comma-separated list of types (e.g., audit.app.crash, audit.app.update) *
Metadata Store event details in the database true
Alarm Enable/disable alarm triggering for discovered events false
Severity Severity level if an event is found (1=Info, 2=Warning, 3=Critical) 2
Alarm tag Custom tag added to the triggered alarm

Collected Data (Metadata)

The monitor stores data under the category: BTP_APP_EVENTS

Field Description
TYPE The BTP Event type (e.g., audit.app.stop)
APP_NAME Name of the affected application
ACTOR_NAME User or system that triggered the event
CREATED_AT Timestamp of the event in BTP
SPACE_NAME BTP Space where the event occurred
REASON Optional reason provided by the BTP platform

Troubleshooting

Issue Resolution
No cache → skipping monitoring Ensure the Connector is valid and the “Load BTP Apps” action works. This usually indicates a connectivity or credential issue.
Alarms not triggering Check if the “Alarm” checkbox is checked for that specific row. If using “Event Types”, ensure the string matches the official BTP audit event type exactly.
Missing EventsThe monitor fetches events since its last execution. If the monitor was inactive for a long time, it will only look back at the last 60 minutes by default.
Events show “Unknown” Space/Subdomain This happens if an app was deleted or created very recently and is not yet in the local metadata cache. It will resolve once the cache refreshes (max 1 hour).