According to the SAP Help Portal, you can collect two types of logs for an Emergency Access Management session: usage procedure log and security audit log. Usage procedure log is a log that records the actions performed by a firefighter during a firefighting session, such as transactions executed, reports generated, or changes made. Security audit log is a log that records the security-related events that occur during a firefighting session, such as logon attempts, password changes, or authorization checks.