How to check what users have FF Access

1. Go to SE16
2. Give Table Name /VIRSA/ZFFUSERS
3. See the contents, it will tell what all users have FF IDs.

BI Dataload - Users that needn't be locked

DDIC
RFC*
EBY*
MDBTC
REDWOOD
BW*
PI*
NWDI*
*ADMIN*
j2ee_admin
wf-batch
tmsadm
FF_*

Defining ABAP ALV export format for spreadsheet

Users sometimes cannot export the data from SAP to spreadsheet in prescribed format, for eg. they are only able to see (MHTML)format while exporting to excel.

There is SAP Note 1080608 for the same. Also please find the below link for more details:

http://help.sap.com/saphelp_nw04/helpdata/en/66/79ad48157f11d2953700a0c930328a/content.htm

Sample process managing SAP environment

Please find below the Sample Process to manage SAP environment based on metrics and SLAs

Landscape

Project - Where implementation is taking place

BAU - Business As Usual (where actual Business is running)

The Project landscape has each and every system with integration that exists in BAU landscape.

Now all the developments that are done in Project are moved to BAU environment say in every 4-5 months, it is known as Cutover or Release 2/3/4/5 etc. Each release is for some new country or geographical area.

Now if the change has to be moved in BAU, there is a procedure that needs to be followed : (Eg. applying SAP notes)

1) There should be a change request (CRQ) created by the functional people that are facing the issue.

2) The transport requests are based on the above CRQ

3) Then there will be a developer designated who will implement that change say apply SAP note may be BASIS / ABAP against the transport request given above, they will fill in the checklist what action they will be performing. the checklist will contain the tester as well who will test the functionality after the note has been implemented in the system.

4) After applying notes, the developer will release the task of transport request not the transport request.

5) There will be a Change Advisory Board (CAB) who will approve the request till applying in Dev system the CRQ will be in draft mode, before implementing in test environment there should be RFA (Request for approval) for CAB and then after it gets approved and tested the same can be applied in production not before.


Please note in above scenario there is immense traceability on who has done what based on some ticket number which has all the documentation. The above scenario is fruitful in the scenarios where multiple 3rd party vendors are working in the same environment.

ZE3 ICM not coming up

There was a application server redesign activity last week where in we were involved in shutting down some application servers in backend /communication zones and changing parameters as per SAP TPO recommendations. But the issue came in where half of the processes in SM50 were showing in running status and other were in stopped status, when we reverted back the values of rdisp/wp_no_dia and btc it came again with correct status.

The logs were showing the database errors, we tried to connect to database and it showed connected to an idle instance even though the SAP system was working.

It immediately striked to us that database is not accepting more connections, we checked the value of V$session variable using following query;

The number of sessions the database was configured to allow

Select name, value from v$parameter WHERE name = 'sessions';

The number of sessions currently active

Select COUNT(*) from v$session;

for more info follow the below link
http://stackoverflow.com/questions/162255/how-to-check-the-maximum-number-of-allowed-connections-to-an-oracle-database


Though the connections were increased but still Business wanted justification on what basis the connections were increased.

We checked the ICM connection in SMICM in one of the instances was showing RED, we reverted the settings and it came up again, because of that the Adobe services and all JCo connections failed.

T77UU table for structural Authorization

Again we faced the issue, where all the OpCos were getting smoother response times from ESS in portal but only the newer ones (VGS) were not able to get the good response times when the employees checked there salaries /personal info/Bank Info from portal (29 secs) on an average.

First line of investigation was with BASIS Team only where we need to check the response times in Portal but we need WILY access for the same but indeed we checked from our side the CPU/Memory utilization for all application servers and we involved the Proxy Team as well to check the times.

We checked VAdmin Performance Tuning to check the stats but it was somewhere between 8ms -800ms not more than that.

Finally we did the trace of users getting the issue in ST05 (SQL and RFC trace) and sent the same to implementation partner for analysis. SAP also analyzed the same and came to conclusion that the client needs to maintain structural authorization data in table T77UU and T77PR.

This is the second post where structural Authorization again came to forefront in terms of issue resolution

MM IDocs got stuck

It was related to MM team the IDocs got stuck and even by manually processing the IDocs in background with program RBDAPP01, it was getting hung ( the job was running for infinite time.

We were checking the Idocs in transaction WE02 and putting 64 (Idocs ready to be processed) in "Current Status" and Message Type in "Logical Message", but the numbers were not reducing.

Upon Analysis, we came to know that there was a long running process on application server avggsqeh by user 10501828 which was indirectly holding a table lock on NRIV table.

How we got the clue ?

In t-code DB01 there were entries like HOLD and __WAIT, the application server which was holding the lock was avggsqeh but it was not relevant to our activity,"Linked Locks" button but it was showing up time and again when we clicked on anyhow we logged on to the application server and saw that there was a long running process there and we killed that after that everthing went on fine.

UID error while adding dialogue instance

Hi,

Last night we had an issue with this server where we were adding application servers as dialogue instances and it was throwing us the errors, viz changue uid of the user zb5adm as it doesn't match with zb1adm.

As on single host there were many installations we were trying to figure out the relationship between zb5adm and zb1adm..at last we figured out that someone has compied profiles from zb1 to zb5 in /sapmnt/ZB5/profile directory and system was confused to read multiple profiles in one profile directory.

At the OS level the SAP application can only see uid and not the usernames, so issue was resolved by removing the redundant ZB1 profiles from /sapmnt/ZB5/profile directory.

SAPJSF user locked for UME connection

The scenarion is that the user SAPJSF got locked in ABAP stack of PI ZX2, the reason being UME Tech Team changed password of that user, now in configtool the ume.master.password is configured with SAPJSF user earlier old password so it got locked.

Secondly ZX2 system has eight application servers, even after changing the password in Global configuration of configtool the SAPJSF user is getting locked in backend ABAP stack, guess what, all the RFC of local server nodes are configured with SAPJSF user old password.

Resolution

First we configured the configtool of Global configuration in CI with RFC_USER so that we can run the visual admin because visual admin will not respond because of locked SAPJSF user, secondly we logged on to each application server node "RFC Provider " service to change the password of SAPJSF user as the RFC are configured for each local node and cannot be configured globally.

Easy way to list out software components of System

Goto SE16
put in CVERS table name and list out its components, it will give you the software component versions at one go in table form, much more visible than going to system and then status.

PA20 and PA30 tcode execution is very slow

There was an issue in our Project some users were facing extraordinarily long response times while using transactions PA20 and PA30, the resolution was as follows:

Do you happen to have structural authorization implemented ? If yes, this can cause performance issue when doing authrorization checking. To resolve this (only if you have struct auth implemented) , the user id would need to be added in T77UU, and SAP utility to re-generate index for structural auth (RHBAUS00) to be run after .

Source : https://forums.sdn.sap.com/thread.jspa?threadID=1458192

Oracle Schema User Locked in trans.log ORA-28000

951167- ORA-28000: the account is locked

Problem
You cannot log on to the Oracle database and the program returns the message:

ORA-28000: the account is locked



Reason and Prerequisites

ORA-28000 is usually triggered because someone has previously attempted to log on several times using an incorrect password, which causes the logon to fail and returns ORA-01017. The number of allowed logon attempts is defined by the resource FAILED_LOGIN_ATTEMPTS in the profile. You can determine the current value of this parameter using the following query:

SELECT LIMIT FROM DBA_PROFILES
WHERE
PROFILE = 'DEFAULT' AND
RESOURCE_NAME = 'FAILED_LOGIN_ATTEMPTS';

Until Oracle 10.1, this parameter had the default value UNLIMITED, so that no ORA-28000 messages would normally occur. As of Oracle 10.2, this standard value has been set to 10.

A further option in the case of a locked user is an explicit lock as follows:

ALTER USER ACCOUNT LOCK;


Solution

To prevent ORA-28000 errors, and avoid similar problems in future, be aware of the following:

If you use Oracle 9i or earlier, do not manually restrict the authorizations of the default profile (also refer to Note 700548 (16)).
If FAILED_LOGIN_ATTEMPTS is not set to UNLIMITED, you can adjust it as follows:

ALTER PROFILE DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;
This is also possible for Oracle 10. 1 and earlier and Oracle 10.2 and later.

If a user is already locked, you can unlock it as follows:

ALTER USER ACCOUNT UNLOCK;
If the ORA-28000 error occurred due to a large number of failed logon attempts, you must check why these logon attempts were unsuccessful and returned the ORA-01017 error. The cause is often an incorrect configuration of the OPS$ mechanism. In this case, refer to Note 400241.

Why is it necessary to delete the tables ALCONSEG, ALSYSTEMS, DBSNP, MONI, OSMON, PAHI, SDBAD, SDBAP, SDBAR, TPFET, and TPHFT in an SAP System Refresh

Those tables contain information specific to the source system. On the target system this piece of information will be misleading or wrong.


Tables SDBAD, SDBAP, SDBAR are about backup history. Backups of the source system won't tell you anything about backups of the target system.

TPFET and TPHFT are about SAP instance profiles. You can't keep profiles of the source system; you will have to create new ones for the target system anyway.


Below tables:

SDBAP = SAP DBA Plan Table
SDBAR = SDBA Resource Table
SDBAH = Header table for DBA protocols
SDBAD = Detail table for DBA protocols

belong to sapdba. They contain the log information of the logs that
sapdba and BrBackup and BrArchive write. The sapdba -cleanup function
will enable you to delete the entries from the db-tables, as well as the
respective files in the operating system.

The tables
MONI = Monitor table
PAHI = History of OS system, DB and SAP parameters
ALAMO = Collector of alert events
OSMON = Operating system monitor data
DBSNP = Table for DB snapshots

contain statistical data tha can be displayed in transaction st04. They
can partially be deleted from within the R/3-System following
st04->Monitor->Performance->Database

Tables:
ALSYSTEMS:CCMS Central System Management: Remote Managed Systems

As they contain information related to that source system and will be misleading if copied to target system.

They can partially be deleted from within the R/3-System following
st04->Monitor->Performance->Database

If not work, you can truncate these tables with sqlplus.

sqlplus sapr3/sap
truncate table ;

There is another option to delete all the data with SE14, using database
utility.

Source : https://forums.sdn.sap.com/thread.jspa?threadID=1204044

Disconnecting System from CUA

Log on to the CUA central system for eg DE2 050 or EE2 050 and then run the report in SE38

RSDELCUA

then choose the system that you need to disconnect and then resynchronize.

GRC Java System Info has different link

When clicked on System Info link for SAP GRC 5.3 system (AS JAVA) took us to the below standard link :
http://server:port/monitoring/SystemInfo
but it gave us the below error :
Requested Resource [/SystemInfo] not found.
changed the above link to the following and it worked
http://server:port/sap/monitoring/SystemInfo

SAP Note 1086644 Pcd clean Inconsistencies in Portal

We can run PcdToolCheck.sh to check and clean Pcd Inconsistencies.

Gyan Session on MDM

The primary function of MDM includes:
Master Data Consolidation
- cleansing and de-duplication
- Data normalization including categorization and taxonomy mgt
- New interactive consolidation capabilities

T-Code to upload data in MDM through ECC MDMGX
There is a Ready folder that acts as a source for data staging

There are three important modules:

CI - MDS
App Server - Import Server - for input to MDM
App Server - Syndicate Server - for sending out data from MDM

The analogy for CI and App is only for shutting down and startup.

Operation Mode Simulation Errors

Sometimes the Operation Mode switching is not consistent. The number of Work processes shown in the RZ04 doesn't match with the actual work processes. Please follow the same to correct it :

Goto RZ03 -) Control -) Switch Operation Mode -) Simulation
If it is giving errors then you need to fix the same

Goto RZ04 -) Double click on any operation Mode -) Goto Settings -) Based on current status -) Existing Instances -) Set

now check the above step of RZ03 it should be green now and now you may actually switch operation modes in RZ03 Control tab and the WPs should match now.

Time Table TCode SM63

IDoc monitoring and manual Parallel Processing

We can monitor IDocs using T-code WE05
In current status put 64 (IDocs ready to be transferred to an application)
There you may see the IDocs with large segments that are stuck, make a note of their numbers
Go to SA38 and execute the program RBDAPP01
Give the IDoc number only and click on Program -) execute in background and select immediate
You may run many jobs parallely for the same when the job finishes it means the IDoc is processed.

Database Shutdown Process - Oracle

1. Connect to O/S (UNIX) using ora(SID)
2. Connect database #sqlplus "/as sysdba"
3. Check database name and database open mode
SQL) select name, open_mode from v$database;
4. Check database backup status using following command
SQL) select * from v$backup;
If status in not active then you may shutdown database using command
SQL) shutdown immediate
If status is active state then first cancel backup using command
SQL) alter database end backup;
after successful execution of this command database can be shutdown using command
SQL ) shutdown immediate;

5. Check any backint process in O/S level using command
$ps -ef grep backint grep ora(SID)
6. If there exists any process kill using following command
#kill -9 (PID)

Register a program locally with rfcexec

Earlier when we tested the RFC with external Ferrari (FAX) server it failed but when we registered the same RFC locally on central ZE1 server the RFC started working the command we used was as follows:

rfcexec -aZE1.100.ferrari -gR3-ZE1 -xsapgw01 &

here rfcexec is a program to register rfc

ZE1.100.ferrari is the name of RFC connection

R3-ZE1 is the hostname where we are registering the RFC program

sapgw01 is the name of the gateway

& the program is running in background

Send Mail through UNIX HP-UX

For sending mail through HP-UX please use the following command

#uuencode (filename) (filename) | mailx -s "subject" (email ID)

eg:

#uuencode FBISacc1 FBISacc1 | mailx -s "Filesend" manaskv@in.ibm.com

Additionally we can zip and unzip files in HP-UX with below commands:

#zip (zipfilename) (original filename)

#uzip (zipfilename)

Netstat to find out if the port is open or closed

You may use the below command to find if the port is open or closed on a UNIX system:
-) netstat -a grep PID
if the porcess says CLOSE_WAIT, it means that the port is blocked.

Shared memory error in java

If Java engine doesn't start and there is shared memory error and the java logs says that ORA-28000 Account is locked, then check by command desc dba_users and fire query
-) select username, account_status from dba_users;

to find out the status for sapsr3db user; If it is locked then unlock the same with command;
-) Alter user sapsr3db account unlock; ( Here sapsr3db is for Java alternatively sapsr3 will be for ABAP)
After the same gets unlocked there is a SAP Note 951167- ORA-28000; the account is locked you can prevent the same from unlocking again;
To check FAILED_LOGIN_ATTEMPTS profile ;

Select limit from dba_profiles where profile='DEFAULT' and resource_name ='FAILED_LOGIN_ATTEMPTS';

If the limit is not set to unlimited, you may set the same with the following command;
Alter profile DEFAULT LIMIT FAILED_LOGIN_ATTEMPTS UNLIMITED;
:)

tail command to follow the log file continuous upgrade

tail -f (name of log file)
( The tail -f command can be used to monitor the growth of a file being written by another process)

How to check configuration AIX including machine make

#prtconf more

What to monitor on Java System - nutshell

You may quickly monitor the java system by :
1) Accessing the URL
2) System Info - All processes are running
3) Default trace and application trace for Server0 and Dispatcher
4) JCMON
5) sappfparcheck for all java profiles

Standalone TREX Installation

If you are using a standalone TREX installation then configure the RFC with the central instance of ABAP not with the application server ( the same can happen if you have installed TREX on sam application server)

Other thing to keep in mind is that the https:// service should be running and if you install 32-bit TREX on a 64-bit system then there is a work around to do the same.

CSS T-Code to log on to customer system

STFK

New way of Installing Oracle along with OPatches

During installation of NWDI the ./sapinst stopped at the dialogue box where it says to install Oracle, we followed the following steps to install oracle:
1) Go to /oracle/JDI directory and deleted the 102_64 folder
2) copied already installed Oracle in the same instance CD2
/oracle/JDI # cp -pr /oracle/CD2/102_64 .
3) Changed the owner from oracd2:dba to orajdi:dba with following command
chown -R orajdi:dba 102_64
4) Go to the path /oracle/JDI/102_64/network/admin and delete all the files there as the installer will create new files as per the JDI Instance.
5) Click on OK to continue ./sapinst

Checking Usage Types from OS level

There are two ways to check the Usage Types i.e. what all components are installed on the Java engine.
Go to the url http://hostname:port/utl/UsageTypesInfo
If for any reason you are not able to log on to the Java engine then we may also check the same from OS level
Go to path /usr/sap/SID/config, and open the file usagetypes.properties, the first line USAGE= in this file will tell you what all usage types are installed
Example : USAGE=BI-Java\:EPC\:EP

Gateway service restart on AIX

Due to heavy load generated by TDMS_RFCs the gateway service on PRD CI hanged due to that there were many spool errors.
Solution
1. Logged on to CI
2. Found gateway service
ps -ef grep gw
found the process named gwrd (this is gateway service on AIX)
3. Killed the process with command
kill -2 PID of gateway service
4. ps -ef grep gw
again
it will show new gwrd process running.
(Actually dispatcher automatically restarts the gateway once it is killed)

BTCTRNS1 adn BTCTRNS2

We can use the following reports for de-scheduling and releasing the jobs before and after some activity. For more info follow the below link :
https://forums.sdn.sap.com/message.jspa?messageID=3999326