fingrc2014 balraj tipsandtricksforadministering
TRANSCRIPT
Tips and Tricks for Administering Your GRC SystemsPrem BalrajSAP
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 1
Agenda
1. Support Overview and Offerings 2. Finding Tools to Self-Serve3. Tips to Resolve Common Issues4. Learning Best Practices for Logging Incidents5. Wrap-up6. Appendix
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 2
Quiz #1
Where is GRC Support located?
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 3
Support
How customers see How it works
Support Overview and Offerings
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 5
Your engagements for success, innovation, and growthLifetime Support by SAP
Leve
ls o
f eng
agem
ent
New
tech
nolo
giesSAP ActiveEmbedded
Enhanced support partnership for optimization of solutions and accelerating adoption of game changing technology
SAP MaxAttentionStrategic support partnership for continuous
business innovation and co-innovation
SAP Enterprise SupportThe foundation to implement,
operate & innovate better Co-
inno
vatio
n
Standard Support
Implement Better
InnovateBetter
Operate Better
© 2014 SAP AG. All rights reserved. 6
Implement Better
SAP Standard Support
SAP Standard Support
InnovateBetter
Operate Better
Reactive incident-driven support that provides a reliable response to technical disruptions
No Service Level Agreements
Continuous Quality Checks for Operations ( Max 2 )
© 2014 SAP AG. All rights reserved. 7
Implement Better
SAP Enterprise SupportThe foundation to implement, operate, and innovate better
SAP Enterprise SupportThe foundation to implement,
operate & innovate better
InnovateBetter
Operate Better
We can help you maximize the stability, availability, and performance of your entire solution landscape – all by harnessing the strength of our global engineering organization. Under our guidance, you can implement, operate, and innovate better.
Service Level Agreements
Continuous Quality Checks for Full Lifecycle
© 2014 SAP AG. All rights reserved. 8
SAP Support OfferingsMaximizing Your Success
7 x24 Support Advisory Center
Service Level Agreement
SAP Support Academy - Expert Guided Implementation for knowledge transfer
SAP Support Academy - Guided Self Services
Continuous Quality Checks (CQCs) and improvement services
Advanced Support for Enhancement Packages
Enterprise Support Report and Engagement Methodology
Global 7x24 Production Down Support
End-to-end Quality Management Standards
Implementation Quality Management
SAP Solution Manager under SAP Enterprise Support (incl. Application Lifecycle Management for the entire customer solution)
Basic Services
SAP Solution Manager under SAP Standard Support (Functional Baseline)
Continuous Improvement and Innovation
Problem Resolution
Knowledge Transfer
“Heart-Beat” monitoring by the SAP EarlyWatch® Alert service
SAP ENTERPRISE
SUPPORT
SAP STANDARDSUPPORT
© 2014 SAP AG. All rights reserved. 9
The SAP ActiveEmbedded AdvantageEmbedded support
Engineering Architect(one per engagement)
Technical QualityManagers(as needed)
• Develops and explains the roadmap of the engagement• Assists with development solution transition roadmaps• Drives value realization plan and engagement quality• Aligns at the executive level• Measures value realization (balanced scorecard
approach)
• Integrates with your teams (Customer Center of Expertise [Customer COE], PMO, etc.)
• Provides guidance on continuous improvement and innovation opportunities
• Accelerates knowledge transfer• Implements, drives, and manages the engineering
services delivery• Drives the day-to-day follow-ups and resolution of
top issues
© 2014 SAP AG. All rights reserved. 10
The SAP ActiveEmbedded AdvantageSAP Rapid Prototyping
Make your test drive through SAP Rapid Prototypingand leave your competitors behind …
SAP Rapid Prototyping in a nutshell:• Prototype solutions based on game changing technology
(e.g., SAP HANA) in a non-disruptive and safe way• Scoping based on your specific scenario and requirements• Knowledge transfer roadmap on supportability of game
changing technology• Quick ROI based on proven value• Requires that customers have a 90 day SAP Rapid
Prototyping license
SAP Rapid Prototyping delivered by SAP Active Global Support proves the value that SAP game changing technology and solutions can bring to your company within 90 days
© 2014 SAP AG. All rights reserved. 11
SAP MaxAttentionOur highest level of engagement
SAP MaxAttention provides a strategic partnership for continuous business improvements and co-innovation in a safe manner.
• Includes all the services from SAP ActiveEmbedded
• Plus a specialized solution architecture, engineering expertise, strategic guidance, and execution support
• A comprehensive governance model with quarterly balance scorecard engagement tracking and:
• Executive sponsor from SAP AGS responsible for the overall success of the engagement
• Engineering Architect responsible for establishing a collaborative and customized strategy for delivery
• Multiple technical quality managers that includes a lead Technical Quality Manager providing day to day oversight of the execution of the MaxAttention strategy, along with additional Technical Quality Managers who provide specialized expertise during the engagement
Close collaboration
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 12
Quiz #2
How many incidents come into GRC Support per month?
Finding Tools to Self-Serve
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 14
Self-Serve Options
The fastest solution will always be the one you find yourself
SAP GRC has various outlets that you can use to try to solve issues on your own
These include:Product Documentation SAP Notes, Knowledgebase Articles and xSearchSAP Community Network (SCN)
Discussion forumQuick reference guidesHow to documents
There are also various tools which you can use to help troubleshoot GRC product issuesChecking Error logs and ST22SLG1 Log FiltersAutomated Notes Search Tool (ANST) tool
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 15
Product Documentation
GRC Product documentation is available on the SAP Service Marketplacehttps://service.sap.com/support *Release and Upgrade info > Installation and Upgrade Guides > Analytics > Governance, Risk and ComplianceIncludes the following for all GRC products:
• Installation guides• Migration guides• Master guides• Configuration guides• User guides (for versions
less than 5.3)• Upgrade guides (if relevant)• Security guides• Operations guide
SAP Online Helphttp://help.sap.comAnalytics > Solutions for Governance, Risk and Compliance
For GRC Product Availability: http://service.sap.com/pam *
* Requires login credentials to the SAP Service Marketplace
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 16
SAP Notes, Knowledgebase Articles, and xSearch
SAP Notes typically contain corrections to code related issues
KBAs contain non code related solutions to help resolve issues
xSearch is similar to a google search where multiple repositories are included in the search engine• SAP Notes & Knowledge Base Articles• SAP Support Portal content areas and
documents• Documentation• SAP Community Network Forums, Blogs and
Wikis• Consulting Content
It is important that when you enter your search criteria you be as detailed as possible. Copy and paste error messages, ABAP dumps, etc.
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 17
SAP Community Network
The SAP Community Network (SCN) is a site where you can find information related to SAP products, features and processes. You can also collaborate and communicate with SAP Users and Experts across the world.
http://scn.sap.com/welcome
The SCN contains a GRC-specific Community which has:
Discussion Forums: This is a great place for bouncing “how to” questions off consultants and other GRC Users
How To Guides: Over 275 Guides that provide detailed instructions for some of the more difficult areas of GRC
http://scn.sap.com/community/grc
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 18
How to check error logs and ST22
Before logging an incident, always check SLG1 and ST22 transactions in the GRC system and plugin system, if the issue is relevant in plugin
Filter the logs using the object and sub object in SLG1. If you do not know the exact object or sub object, you can use GR* in object field.
Use time restriction to capture logs instead of running the report for whole day to get the exact error messages quickly
In some of the cases like workflow, you may not see the dump in screen but logged in ST22
Take the exact error message and search for any notes, KBAs or for any suggestions from SDN community
For ABAP dumps, go to “How to correct the error section” to get information or to get the exact string to search
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 19
SLG1 log filters – To filter the logs by component level
Use Object and Sub-object filters to retrieve the relevant logs
GRC objects and relevant sub-objects are annexed in appendix
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 20
How to check error logs for Simplified Access Request
This only applies for 10.1 Simplified Access Request and with Google ChromePress F12 button to open this debug window and go to Console menuCheck the logs for any issues like syntax error, connection issues, wrong dataAttach this log if you can’t resolve the issue on your own
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 21
Automated Notes Search Tool (ANST)
Use ANST to find the Notes for the following scenarios:
Errors for which a SAP Note with ABAP corrections exist
Errors caused by customer code
Errors caused by incorrect customizing
ANST is not only for users with a high degree of technical expertise
ANST is also a debugging tool as it helps identify the relevant ABAP objects for a program without previous knowledge of the process
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 22
More information on ANST
Installation:
The application was delivered during Q1 2013 in the following SAP_BASIS patches. In order to use this feature, you must be at these SP levels below:
• SAP_BASIS 700 SAPKB70028• SAP_BASIS 701 SAPKB70113 • SAP_BASIS 702 SAPKB70213 • SAP_BASIS 731 SAPKB73106
How to use ANST: https://websmp101.sap-ag.de/~sapidb/011000358700000533232013E/trainer/9_2_0_161/trainer.html *
Relevant SAP Notes –1818192: FAQs Automated Note Search Tool1778716: Advanced Note Search Tool1915529: ANST: New transaction code
* Requires login credentials to the SAP Service Marketplace
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 23
ANST Live Demo
Tips to resolve common issues
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 25
Email issues: You can check the SMTP settings by sending a test mail through “SAP Business Workplace.” If the entry is coming under SOST for this test mail then there is an error with GRC email configuration settings otherwise it is purely an issue with SMTP settings.
File import issues, check input file for:Proper formattingMandatory fields are filled Illegal or junk characters UTF-8 format
Rule import issues: View rule file in advanced editors to check if the file got corrupted or has any junk data
Tips for common GRC issues
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 26
Tips for workflow
Mandatory post-installation configuration: GRC_MSMP_CONFIGURATION BC Set has been enabledPerform Automatic Workflow CustomizingPerform Tasks Specific CustomizingActivate Event Linkage*Define number ranges for Access RequestsConnectors assigned to the PROV integration scenario
Stuck requests , Unknown Stage or Path issue:Verify post installation steps for deactivated tasks Check WF-BATCH User for Authorization or Validity issues Check SLG1 logs and ST22 for errors during time period
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 27
Tips for workflow (cont.)
No agent found, check the following:Approver in role definition is in upper case as in GRCACUSER table Agent rule is correctly assigned in MSMPIf you have system line item, ensure routing rule is enabled for the system For BRF+ Agent rules, simulate to verify agent results
For additional log information, use transaction GRFNMW_DEBUG_MSG to set MSMP message log levels. Once set, you can use transaction GRFNMW_DBGMONITOR_WD to check detailed logs
If you still can’t find the root cause, follow SAP Note 1624069 to get more logs at file level. Make sure that you deactivate the debug logs once the problem is resolved otherwise you may run into issues with disc space
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 28
Tips for Access Request
How to get completion date for a request:FINISHED_AT field from GRFNMWRTINST table stores the request completion date
LDAP Search or Sync issues:Check SLG1 and ST22 for errors Run LDAP trace to get the LDAP query (report RSLDAPTRACE)Execute the query in LDAP transaction to validate results • If you get any error or time out, try to fix the root cause and make sure that query return
results in LDAP transaction first• If the LDAP type is SUN_ONE, make sure group parameter mapping is LDAPNAME=SUN_ONE.
Default type is AD• Make sure the LDAP connector is pointing to correct LDAP server• Ensure field mapping is correct • Ensure user path is defined completely
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 29
Tips for User Access Review
UAR requests are not generated, confirm the following have completed successfully:Role SyncUser SyncAction Usage SyncRole Usage Sync
The following parameters must be configured in SPRO:2004 (Request Type for UAR)2005 (Default Priority) 2006 (Who are the reviewers?)
Verify:All roles in BRM are in completed statusRole owners are assigned correctly for roles and managers for usersCoordinators are assigned to reviewers (role owner/manager)“Update Workflow UAR Request” job has successfully completed
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 30
Tips for Alert Generation
Alerts are not generated, check to make sure the following has completed successfully:Role SyncUser SyncAction Usage Sync
Verify: Data is successfully updated in GRACACTUSAGE tableAll roles in BRM are in completed statusAlert Generation job successfully completedThere is data in GRACALHDR and GRACACTLOG tablesEmail status in SOST
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 31
Time out while retrieving change log issues:Implement SAP Note 1930470 to improve the performance for change log retrievalArchive CDHDR and CDPOS table if possibleCreate Indexes if required
To retrieve missing FF logs:Run report GRAC_EAM_TASK_TIMESTAMP_UPDATE (SAP Note 1953302) to change the timestamp to current timeRun report GRAC_EAM_LOG_SYNC_TIMEBASED (SAP Note 1934127) to retrieve the missing logs
Consolidated log is missing or workflow request not created :Apply SAP Note 1775432 if time zone is different in plugin systemIf the GRC system has plugin components installed, then both the SAP system time zone (STZAC) and Operating System time zone must be the same Check ST22 for any dumps in GRC and plugin systemsApply SAP Note 1855037 to get extra debug logs
Tips for Firefighter job issues
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 32
Tips for Risk Analysis troubleshooting
To troubleshoot the risk analysis issue, document the following information:
What is the user ID/role ID?
What is the risk ID?
What is the transaction code combination that you feel is either reporting and shouldn’t be, or is not reporting and should be?
What plugin system is this related to?
Is this user expired or locked? Check the setting in SPRO for expired and locked users.
Is this a Reference user? Check the setting in SPRO for include Reference users.
Are you using NOT operator and expect violations to be reported?
Ensure action rules are loaded for the systemCheck the generated action rules in Rules Summary and make sure that the rules are generated properly for the Risk ID
Confirm that permission level rules are correctly built based on the permissions activated in each function
Check the generated permission rules using the Action rule detailed report
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 33
Tips for Risk Analysis troubleshooting (cont.)
Run Action Level analysis and permission level analysisIf the user shows at action level, but not at permission level, then focus on the permissionsIf the User doesn’t show up at action level, confirm whether the User has access to both transactions in the plugin
Run SUIM report in the plugin to confirm whether the user or role has the transaction codes in the risk
Review the field values in the permissions to ensure accuracyFrom the plugin system, search for the authorization object in SUIM and look at the possible valuesMake sure the permissions in ARA have the proper values based on the values available in the plugin systemEnsure leading 0’s are defined in the Activity fields (ACTVT must have 02 and not 2)
Run SUIM report for the User to confirm whether or not they have the access listedUsing the function definitions, run SUIM report for every authorization object enabled, one at a time to see if the user/role has the values configured in the rules
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 34
Tips for Risk Analysis performance issues
Batch Risk AnalysisDefine Critical Roles and Profiles (SAP_ALL/SAP_NEW)Verify configuration parameter ‘Ignore Critical Roles and Profiles’ is YESExclude unnecessary objects like expired, unused objects, administrators, super usersRun DB statistics and rebuild indexes if applicable for violation tablesMake sure you have the parallel background jobs configured
Ad hoc Risk AnalysisAvoid running for all objects or a large number of objectsRun as background job if you want to run more than few usersCleanup the temporary violations tables periodically (SAP Note 1744331)Download ad hoc risk analysis reports in background (SAP Note 1792254)
Risk Analysis from ARQFYI: Users with large numbers of authorizations may take some time, or may even time out
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 35
How to test Web Services
How to find the Portal plugin SP levelGo to WS Navigator -> Select GRACAuthMgmtWebServiceOutBinding and test for getConnector method (after SP9)
How to test IDM Web Services (option 1)Go to SE80 select package GRAC_DIRECTORY_SERVICESGo to Enterprise Services Service Provider click the Web service you want to checkGo to Service Definition menu and click testSelect the input as “Generate Request Template” and update the desired values and test
How to test IDM Web Services (option 2)Go to transaction SOAManager Click on Web Services ConfigurationSelect any of the GRC web services and click “Open Web Serivce Navigator for selected Binding”Enter the input values and test
How to test Portal Web ServicesGo to WS Navigator Select GRACAuthMgmtWebServiceOutBinding and run testSelect the method you like to test and input the values and test
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 36
Common dos and don’ts
Connector: Make sure that the connector name is meaningful and without any special characters (PRDCLNT100)
Role Upload File: Authorization source is mandatory while importing files with composite and single roles
Management Report: Drill down in Management reports only works for current month. If you have summary data for previous months it would show summary data but detailed data is only for current month.
Rule Maintenance: No more than 2-3 functions for a SOD riskDo not have a large number of rules using the OR conditionNot more than 1 function for critical action risk and critical permission riskDo not duplicate rules for different departments instead use organizational rules
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 37
Backward and plug-in compatibility
Backward Compatibility for Access Control 10.0The backward compatibility of GRCFND_A V1000 for Access Controls starts with Support Pack 10. Until SP10 both GRCFND_A and plugins GRCPINW & GRCPIERP need to be one the same level.
GRC Foundation is compatible with the following NW Plugin versions:
GRCFND_A GRCPINW and GRCPIERP702 702, 730, 731, 740
731 702, 730, 731, 740
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 38
Quiz #4
What information should you include when logging an Incident?
Learning Best Practices for logging Incidents
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 40
Perfect customer incidentContent of a incident
1. Installation and system number (incl. SID)
2. Select the correct componentTry to make the selection with subcomponents
3. S-user/user/person getting the error message
4. Step by step description including navigation and description of expected results
5. Screenshot of error message
6. Open service connection
7. Send login data (SAP Note 508140)
8. Carefully select the priority of a messageFor very high customer incidents you need to fill in the business impact. All questions need to be answered or otherwise the processor might lower the priority.
9. Ensure you log only one issue per incident (SAP Note 50048)
Access the topic directly via this Quick Link: http://service.sap.com/message *
For any problem with this application create a message under component: XX-SER-SAPSMP-IBX
Additional videos:
• How to create a “Perfect Customer Message” in SMP - YouTube Video
• www.youtube.com/watch?v=PerN6O7Kxbs
• How to request to close customer messages - YouTube Video
• www.youtube.com/watch?v=DQxG6UoYFuo
• How to search for old Messages in SMP - YouTube Video
• www.youtube.com/watch?v=1wuSMvKr-MM
* Requires login credentials to the SAP Service Marketplace
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 41
Accelerate an incidentWhen issues become more urgent
What justifies an acceleration?
To avoid negative business impact, the problem solving becomes more urgent See SAP Note 67739 for more information on “priorities of problem messages“
What can you do?
Call SAP Customer Interaction Center (CIC) Local CIC numbers (available 24 x 7) can be found via:
SAP Note 560499 or Service Marketplace Ask to speed up the message by explaining the business impact
What you can expect
Customer Interaction Center (CIC) takes care of: Analysis the options to speed up the message
Accelerate
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 42
What justifies an escalation?To justify an escalation you need to explain the business impact!Find more information in SAP Note 90835Criticality has changed: Go-Live now imminent and jeopardized - Business impact now severe
What can you do?
Contact SAP’s Customer Interaction Center
Please be prepared to provide the following information:1. Productive system: Is the core business severely affected? (financial loss) Is there an extensive manual workaround? How many users are affected? How long has the problem been going on?
What you can expect
SAP incident escalation team ensures: Intensified attention and additional activity of support resources Increased coordination of internal incident handling Involvement of SAP Development or Backoffice, if needed Execution of action plan and frequent feedback
Escalate an incident Incident escalation via Customer Interaction Center
Critical incident occurs
Contact CIC
Escalation team takes over
SAP solves the issue
2. Test/development system: Which project? Live date, product and release? Showstopper: yes/no Is the go-live date affected?3. Point of contact: Work phone number (no 800x) Cell phone number and e-mail address
Key tip: Specifically ask to “have the escalation flag set“ and make sure system access is available and contact is named!
Escalate
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 43
What justifies a complaint?After the confirmation of a message, the customer wants to reach SAP’s attention about his dissatisfaction with:
Any of SAP’s support services (message solving, remote services) or
SAP products in general
What can you do?
Contact SAP‘s Customer Interaction Center
Please provide a detailed description of the issue (complaints must be in a written form)
What you can expect
SAP takes care of the issue: Acknowledgement of complaint receipt within 24 hours and analysis of complaint reasons
Involvement of responsible manager and processor for a detailed technical analysis
Establishment of necessary steps to avoid such incidents in the future
Provision of final statement
Recording and categorization of all complaints to detect weakness tendencies in quality of product and support provided
Based on these findings, management ensures continuous improvement
Customer is dissatisfied
Contact CIC
Complaint team takes over
Continuous improvement
Complain
Give feedback to SAPHow to complain about support or product?
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 44
Required GRC information to save time
The more detailed information provided will reduce “ping-ponging” of the incidentKeep in mind, we process over 1000 messages a month and each customer’s implementation of our product is uniqueThe more detailed and the more information supplied up front, the faster Support can determine root cause and provide a solution, or for code related issues, pass on to IMS Development
Stepping through the issue and documenting each piece of the puzzle will allow GRC Support to isolate the cause of the issueIs it a new installation or upgrade? Is the upgrade is version level or SP level?Attach a Microsoft Word document that shows screen prints of every step you are performing that results in the errorDocument details along with the screen printsAny patterns in case of sporadic/intermittent issues and how often it occursIs this first time the issue arises? If so, have you done any upgrades, applied notes, changed any configuration?Provide the input values for any process, as input values are important to replicate any issues. For ex, risk analysis, request creation, HR trigger etc.What is your expectation of behavior ?Have you applied any notes or changed any configuration based on self service optionsAttach the logs captured in SLG1 or default traces
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 45
Reduce connection issues with the Line Opener Program
In some cases, processing times are prolonged unnecessarily due to closed connections when the Support Engineer tries to access the system
With the Line Opener Program (LOP) this situation can be completely avoided
Support Engineers can access the customer system anytime as long as the LOP is active
Calls to multiple people (IT, third-party hosting, etc.) are no longer necessary
For more information on the LOP, refer to SAP Note 797124
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 46
Quiz #5
What priorities should these incidents be?
Wrap-Up
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 48
7 Key Points to Take Home
• SAP has 4 Support Offerings to enhance your customer experience
• In order to save time, follow best practices when logging incidents and provide all of the
requested information up front
• When searching for SAP Notes, copy and paste error messages or ABAP syntax errors
• Use the Line Opener Program to reduce time lost due to maintaining system connections
• Backward compatibility was introduced as of AC 10.0 SP10
• Clean up or Archive your data for better performance
• Use Parallel Processing for background jobs and refrain from running multiple jobs at once
© 2014 SAP AG or an SAP affiliate company. All rights reserved.
Thank You
Contact information:
Prem BalrajSenior Support EngineerSAP Active Global [email protected]
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 50
Appendix
1. Providing System Information
2. Opening a Connection
3. Updating the Secure Area
4. Incident Priorities
5. SLG1 Log Filters
6. Useful SAP Notes and Links
7. Useful AC 10.X Notes
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 51
Provide System Information
Provide following informationSAP GRC Application that the issue relates toThe version of the SAP GRC applicationThe support package level of the SAP GRC applicationThe Basis level that SAP GRC application resides onThe System ID(s) for the systems that the issue occurs on
Examples of incidents with detailed information:
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 52
Open a Connection
Even with detailed documentation, Support may not be able to isolate the root causeConnection into your system allows us to recreate the issue and try to identify the issueEstablishing a connection allows multiple SAP support teams to review the issueIt is against SAP policy to use WebEx and other web conferencing methods to troubleshoot issuesSAP supports only Netviewer sessions
For Netviewer information, Refer to SAP Notes 1036616 and 1374789
For SAP GRC Access Control 5.X, both front-end (Java) and back-end (ABAP) is required
FOR GRC Access Control 10.X, R/3 connection and HTTP connection to the GRC system and R/3 connection to Plugin systems is required
You can also provide WTS connection and give us access to all GRC and Plugin systems from there
Front-end connection will be through HTTP or WTS connection typeWe may need multiple back-end connections opened if issue exists on multiple systems
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 53
Update the Secure Area
User IDs and passwords should be entered into the Secure logon area provided by SAP
Access data needs to be created only once per system and can then be used for each message referring to this system
SAP Note 508140 explains how the secure area works
If you have issues opening a connection, create a new message under component XX-SER-NET-HTL and they will assist
SAP Note 37178 provides some troubleshooting tips
Do not store any passwords in the actual incident itself
To identify the root cause for some issues, support may need full access. If the issue only happens only in production and per policy if you can’t give full access, you can ask for Z_DEV_DEBUG_ROLE from support and attach that role to support userid. This roles contains all the transactions and authorizations needed to analyze the issue.
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 54
Incident Priority
Please refer SAP Note 67739 Very High Extremely serious interruptions in normal operations (financial impact) • Absolute loss of system • Malfunctions of central production system functions • Delay of go-live or upgrade within three days �High • Serious interruptions in normal operations (financial impact)
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 55
SLG1 log filters – To filter the logs by component level
OBJECT SUBOBJECT
GRAC AUTH, BATCH, HRTRIGGER, SOD_RISK_ANALYSIS, SPM, UAR
GRFN AC_PROV, AC_REP, API, AUTH, CASE_INT, FDS, IO_EXPORT, IO_IMPORT, IO_META, JOB, JOB_DESIGN, MDCHECK, MIGRATION, MSMP_WF_CN, MSMP_WF_NT, MSMP_WF_RT, OWP,POLICY, REPLACEMENT, REP_ENGINE, RISK_AGGR, RM_BANKING, SURVEY
GRPC API, AS_REORG, ATTACHMENTS_CLONING, ATTACHMENTS_DOWNLOAD, ATTACHMENTS_SERVICES, AUTHORIZE, CASE_INT, EVENT, NWBC, PLANNER, REPLACEMENT, SCHEDULER, SIGNOFF, SOD_CHECK
GRRM AGGR_RUN, ANILS_AUTOMATION, CLEANUP, CONTEXT, KRI, MIGRATION, RESPONSE_NOTIF, RESP_AUTOMATION, SURVEY
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 56
Note # DescriptionReport issue to SAP560499 Global Support Customer Interaction – telephone, fax, e-mail16481 Contacts @ SAP 67739 Priorities of problem messages36677 Structure of components in SAPNet – SAP R/3 front end508140 Customer message – customer log-in data32736 24-hour support not possible in this language83020 What is consulting? What is support?873046 Processing of messages in English797124 LOP - Line Opener Program50048 Several questions reported in one messageTrouble with a message90835 SAP message escalation procedure 984434 How to speed up customer message processing Notes implementation357732 Entering development requestsFeedback to SAP736045 Complaints concerning SAP Service & Support
Useful SAP Notes
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 57
Topic Quick Link
Support Welcome https://service.sap.de/support-welcome
Connect to SAP http://service.sap.com/access-support
Create Customer Incident Message http://service.sap.com/message
Data Administration http://service.sap.com/system-data
SAP Community Network http://scn.sap.com
SAP Notes Search http://service.sap.com/notes
Support Portal http://service.sap.com/support
Line Opener Program (Youtube) http://www.youtube.com/watch?v=c-cHAq8oVLY
Useful Links
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 58
Note # DescriptionAC 10.0 1674530 Supported Browser and Operating Systems for GRC101603438 GRC AC 10.0 EP Plug-In (JAVA), supported NW versions1662113 Using Access Control 5.3 with your 10.0 plug in systems1099011 Limitations of using CUA with GRC Access Control 1638100 Print version Communication Failure: RFC Destination SALV_WD_EXPORT_PDF does not exist1644506 Connection timed out when opening requests1647402 Error No role storage space when opening a request 1674530 Supported Browser and Operating Systems for GRC 10 1900049 ABAP Dump TSV_TNEW_OCCURS_NO_ROLL_MEMORY1637515 GRC 10.0 - Not able to find the pre delivered BRF+ rules 1936775 Performance issue with Permission and Org Rule Analysis1958401 Rule generation job performance issue1966007 Incorrect Rule Generation for Logical Groups
AC 10.11931260 General Information: GRC Fact Sheets1961857 Master Note for SAP Access Control 10.1 - Support Pack 051953175 How to correct Errors when activating Access Control 10.1 BC Sets 1870233 Release Information Note for SAP Access Control 10.11929930 Release Information Note for UI for Access Control 10.11906015 AC 10.1 documentation corrections: install/upgrade guides
Useful AC 10.X SAP Notes
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 59
Note # Description1936775 Performance issue with Permission and Org Rule Analysis1958401 Rule generation job performance issue1647908 Space Reclaiming procedure after deleting large data from DB1617487 No more storage space available for extending an internal table1584623 Parallel processing configuration in SOD batch risk analysis1583640 Profile parameters of memory management for SOD analysis1580877 Best practices in storage management for SOD analysis jobs1743367 GRAC_REPOSITORY_OBJECT_SYNC ending abnormally with SQL dumps484994 LDAP Connector blocked in case of lengthy operations
To get detailed information about sizing, visit https://service.sap.com/sizing -> Sizing Guidelines -> Analytics
AC 10.X Performance Issues Notes
© 2014 SAP AG or an SAP affiliate company. All rights reserved. 60
© 2014 SAP AG or an SAP affiliate company. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG or an SAP affiliate company.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG (or an SAP affiliate company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP AG or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP AG or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP AG or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.
In particular, SAP AG or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP AG’s or its affiliated companies’ strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP AG or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.
Wellesley Information Services, 20 Carematrix Drive, Dedham, MA 02026 Copyright © 2014 Wellesley Information Services. All rights reserved.