fingrc2014 balraj tipsandtricksforadministering

62
Tips and Tricks for Administering Your GRC Systems Prem Balraj SAP

Upload: zhangxiaoxiao2008

Post on 25-Apr-2017

251 views

Category:

Documents


1 download

TRANSCRIPT

Page 1: FINGRC2014 Balraj Tipsandtricksforadministering

Tips and Tricks for Administering Your GRC SystemsPrem BalrajSAP

Page 2: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 1

Agenda

1. Support Overview and Offerings 2. Finding Tools to Self-Serve3. Tips to Resolve Common Issues4. Learning Best Practices for Logging Incidents5. Wrap-up6. Appendix

Page 3: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 2

Quiz #1

Where is GRC Support located?

Page 4: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 3

Support

How customers see How it works

Page 5: FINGRC2014 Balraj Tipsandtricksforadministering

Support Overview and Offerings

Page 6: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 5

Your engagements for success, innovation, and growthLifetime Support by SAP

Leve

ls o

f eng

agem

ent

New

tech

nolo

giesSAP ActiveEmbedded

Enhanced support partnership for optimization of solutions and accelerating adoption of game changing technology

SAP MaxAttentionStrategic support partnership for continuous

business innovation and co-innovation

SAP Enterprise SupportThe foundation to implement,

operate & innovate better Co-

inno

vatio

n

Standard Support

Implement Better

InnovateBetter

Operate Better

Page 7: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 6

Implement Better

SAP Standard Support

SAP Standard Support

InnovateBetter

Operate Better

Reactive incident-driven support that provides a reliable response to technical disruptions

No Service Level Agreements

Continuous Quality Checks for Operations ( Max 2 )

Page 8: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 7

Implement Better

SAP Enterprise SupportThe foundation to implement, operate, and innovate better

SAP Enterprise SupportThe foundation to implement,

operate & innovate better

InnovateBetter

Operate Better

We can help you maximize the stability, availability, and performance of your entire solution landscape – all by harnessing the strength of our global engineering organization. Under our guidance, you can implement, operate, and innovate better.

Service Level Agreements

Continuous Quality Checks for Full Lifecycle

Page 9: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 8

SAP Support OfferingsMaximizing Your Success

7 x24 Support Advisory Center

Service Level Agreement

SAP Support Academy - Expert Guided Implementation for knowledge transfer

SAP Support Academy - Guided Self Services

Continuous Quality Checks (CQCs) and improvement services

Advanced Support for Enhancement Packages

Enterprise Support Report and Engagement Methodology

Global 7x24 Production Down Support

End-to-end Quality Management Standards

Implementation Quality Management

SAP Solution Manager under SAP Enterprise Support (incl. Application Lifecycle Management for the entire customer solution)

Basic Services

SAP Solution Manager under SAP Standard Support (Functional Baseline)

Continuous Improvement and Innovation

Problem Resolution

Knowledge Transfer

“Heart-Beat” monitoring by the SAP EarlyWatch® Alert service

SAP ENTERPRISE

SUPPORT

SAP STANDARDSUPPORT

Page 10: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 9

The SAP ActiveEmbedded AdvantageEmbedded support

Engineering Architect(one per engagement)

Technical QualityManagers(as needed)

• Develops and explains the roadmap of the engagement• Assists with development solution transition roadmaps• Drives value realization plan and engagement quality• Aligns at the executive level• Measures value realization (balanced scorecard

approach)

• Integrates with your teams (Customer Center of Expertise [Customer COE], PMO, etc.)

• Provides guidance on continuous improvement and innovation opportunities

• Accelerates knowledge transfer• Implements, drives, and manages the engineering

services delivery• Drives the day-to-day follow-ups and resolution of

top issues

Page 11: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 10

The SAP ActiveEmbedded AdvantageSAP Rapid Prototyping

Make your test drive through SAP Rapid Prototypingand leave your competitors behind …

SAP Rapid Prototyping in a nutshell:• Prototype solutions based on game changing technology

(e.g., SAP HANA) in a non-disruptive and safe way• Scoping based on your specific scenario and requirements• Knowledge transfer roadmap on supportability of game

changing technology• Quick ROI based on proven value• Requires that customers have a 90 day SAP Rapid

Prototyping license

SAP Rapid Prototyping delivered by SAP Active Global Support proves the value that SAP game changing technology and solutions can bring to your company within 90 days

Page 12: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG. All rights reserved. 11

SAP MaxAttentionOur highest level of engagement

SAP MaxAttention provides a strategic partnership for continuous business improvements and co-innovation in a safe manner.

• Includes all the services from SAP ActiveEmbedded

• Plus a specialized solution architecture, engineering expertise, strategic guidance, and execution support

• A comprehensive governance model with quarterly balance scorecard engagement tracking and:

• Executive sponsor from SAP AGS responsible for the overall success of the engagement

• Engineering Architect responsible for establishing a collaborative and customized strategy for delivery

• Multiple technical quality managers that includes a lead Technical Quality Manager providing day to day oversight of the execution of the MaxAttention strategy, along with additional Technical Quality Managers who provide specialized expertise during the engagement

Close collaboration

Page 13: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 12

Quiz #2

How many incidents come into GRC Support per month?

Page 14: FINGRC2014 Balraj Tipsandtricksforadministering

Finding Tools to Self-Serve

Page 15: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 14

Self-Serve Options

The fastest solution will always be the one you find yourself

SAP GRC has various outlets that you can use to try to solve issues on your own

These include:Product Documentation SAP Notes, Knowledgebase Articles and xSearchSAP Community Network (SCN)

Discussion forumQuick reference guidesHow to documents

There are also various tools which you can use to help troubleshoot GRC product issuesChecking Error logs and ST22SLG1 Log FiltersAutomated Notes Search Tool (ANST) tool

Page 16: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 15

Product Documentation

GRC Product documentation is available on the SAP Service Marketplacehttps://service.sap.com/support *Release and Upgrade info > Installation and Upgrade Guides > Analytics > Governance, Risk and ComplianceIncludes the following for all GRC products:

• Installation guides• Migration guides• Master guides• Configuration guides• User guides (for versions

less than 5.3)• Upgrade guides (if relevant)• Security guides• Operations guide

SAP Online Helphttp://help.sap.comAnalytics > Solutions for Governance, Risk and Compliance

For GRC Product Availability: http://service.sap.com/pam *

* Requires login credentials to the SAP Service Marketplace

Page 17: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 16

SAP Notes, Knowledgebase Articles, and xSearch

SAP Notes typically contain corrections to code related issues

KBAs contain non code related solutions to help resolve issues

xSearch is similar to a google search where multiple repositories are included in the search engine• SAP Notes & Knowledge Base Articles• SAP Support Portal content areas and

documents• Documentation• SAP Community Network Forums, Blogs and

Wikis• Consulting Content

It is important that when you enter your search criteria you be as detailed as possible. Copy and paste error messages, ABAP dumps, etc.

Page 18: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 17

SAP Community Network

The SAP Community Network (SCN) is a site where you can find information related to SAP products, features and processes. You can also collaborate and communicate with SAP Users and Experts across the world.

http://scn.sap.com/welcome

The SCN contains a GRC-specific Community which has:

Discussion Forums: This is a great place for bouncing “how to” questions off consultants and other GRC Users

How To Guides: Over 275 Guides that provide detailed instructions for some of the more difficult areas of GRC

http://scn.sap.com/community/grc

Page 19: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 18

How to check error logs and ST22

Before logging an incident, always check SLG1 and ST22 transactions in the GRC system and plugin system, if the issue is relevant in plugin

Filter the logs using the object and sub object in SLG1. If you do not know the exact object or sub object, you can use GR* in object field.

Use time restriction to capture logs instead of running the report for whole day to get the exact error messages quickly

In some of the cases like workflow, you may not see the dump in screen but logged in ST22

Take the exact error message and search for any notes, KBAs or for any suggestions from SDN community

For ABAP dumps, go to “How to correct the error section” to get information or to get the exact string to search

Page 20: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 19

SLG1 log filters – To filter the logs by component level

Use Object and Sub-object filters to retrieve the relevant logs

GRC objects and relevant sub-objects are annexed in appendix

Page 21: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 20

How to check error logs for Simplified Access Request

This only applies for 10.1 Simplified Access Request and with Google ChromePress F12 button to open this debug window and go to Console menuCheck the logs for any issues like syntax error, connection issues, wrong dataAttach this log if you can’t resolve the issue on your own

Page 22: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 21

Automated Notes Search Tool (ANST)

Use ANST to find the Notes for the following scenarios:

Errors for which a SAP Note with ABAP corrections exist

Errors caused by customer code

Errors caused by incorrect customizing

ANST is not only for users with a high degree of technical expertise

ANST is also a debugging tool as it helps identify the relevant ABAP objects for a program without previous knowledge of the process

Page 23: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 22

More information on ANST

Installation:

The application was delivered during Q1 2013 in the following SAP_BASIS patches. In order to use this feature, you must be at these SP levels below:

• SAP_BASIS 700 SAPKB70028• SAP_BASIS 701 SAPKB70113 • SAP_BASIS 702 SAPKB70213 • SAP_BASIS 731 SAPKB73106

How to use ANST: https://websmp101.sap-ag.de/~sapidb/011000358700000533232013E/trainer/9_2_0_161/trainer.html *

Relevant SAP Notes –1818192: FAQs Automated Note Search Tool1778716: Advanced Note Search Tool1915529: ANST: New transaction code

* Requires login credentials to the SAP Service Marketplace

Page 24: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 23

ANST Live Demo

Page 25: FINGRC2014 Balraj Tipsandtricksforadministering

Tips to resolve common issues

Page 26: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 25

Email issues: You can check the SMTP settings by sending a test mail through “SAP Business Workplace.” If the entry is coming under SOST for this test mail then there is an error with GRC email configuration settings otherwise it is purely an issue with SMTP settings.

File import issues, check input file for:Proper formattingMandatory fields are filled Illegal or junk characters UTF-8 format

Rule import issues: View rule file in advanced editors to check if the file got corrupted or has any junk data

Tips for common GRC issues

Page 27: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 26

Tips for workflow

Mandatory post-installation configuration: GRC_MSMP_CONFIGURATION BC Set has been enabledPerform Automatic Workflow CustomizingPerform Tasks Specific CustomizingActivate Event Linkage*Define number ranges for Access RequestsConnectors assigned to the PROV integration scenario

Stuck requests , Unknown Stage or Path issue:Verify post installation steps for deactivated tasks Check WF-BATCH User for Authorization or Validity issues Check SLG1 logs and ST22 for errors during time period

Page 28: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 27

Tips for workflow (cont.)

No agent found, check the following:Approver in role definition is in upper case as in GRCACUSER table Agent rule is correctly assigned in MSMPIf you have system line item, ensure routing rule is enabled for the system For BRF+ Agent rules, simulate to verify agent results

For additional log information, use transaction GRFNMW_DEBUG_MSG to set MSMP message log levels. Once set, you can use transaction GRFNMW_DBGMONITOR_WD to check detailed logs

If you still can’t find the root cause, follow SAP Note 1624069 to get more logs at file level. Make sure that you deactivate the debug logs once the problem is resolved otherwise you may run into issues with disc space

Page 29: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 28

Tips for Access Request

How to get completion date for a request:FINISHED_AT field from GRFNMWRTINST table stores the request completion date

LDAP Search or Sync issues:Check SLG1 and ST22 for errors Run LDAP trace to get the LDAP query (report RSLDAPTRACE)Execute the query in LDAP transaction to validate results • If you get any error or time out, try to fix the root cause and make sure that query return

results in LDAP transaction first• If the LDAP type is SUN_ONE, make sure group parameter mapping is LDAPNAME=SUN_ONE.

Default type is AD• Make sure the LDAP connector is pointing to correct LDAP server• Ensure field mapping is correct • Ensure user path is defined completely

Page 30: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 29

Tips for User Access Review

UAR requests are not generated, confirm the following have completed successfully:Role SyncUser SyncAction Usage SyncRole Usage Sync

The following parameters must be configured in SPRO:2004 (Request Type for UAR)2005 (Default Priority) 2006 (Who are the reviewers?)

Verify:All roles in BRM are in completed statusRole owners are assigned correctly for roles and managers for usersCoordinators are assigned to reviewers (role owner/manager)“Update Workflow UAR Request” job has successfully completed

Page 31: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 30

Tips for Alert Generation

Alerts are not generated, check to make sure the following has completed successfully:Role SyncUser SyncAction Usage Sync

Verify: Data is successfully updated in GRACACTUSAGE tableAll roles in BRM are in completed statusAlert Generation job successfully completedThere is data in GRACALHDR and GRACACTLOG tablesEmail status in SOST

Page 32: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 31

Time out while retrieving change log issues:Implement SAP Note 1930470 to improve the performance for change log retrievalArchive CDHDR and CDPOS table if possibleCreate Indexes if required

To retrieve missing FF logs:Run report GRAC_EAM_TASK_TIMESTAMP_UPDATE (SAP Note 1953302) to change the timestamp to current timeRun report GRAC_EAM_LOG_SYNC_TIMEBASED (SAP Note 1934127) to retrieve the missing logs

Consolidated log is missing or workflow request not created :Apply SAP Note 1775432 if time zone is different in plugin systemIf the GRC system has plugin components installed, then both the SAP system time zone (STZAC) and Operating System time zone must be the same Check ST22 for any dumps in GRC and plugin systemsApply SAP Note 1855037 to get extra debug logs

Tips for Firefighter job issues

Page 33: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 32

Tips for Risk Analysis troubleshooting

To troubleshoot the risk analysis issue, document the following information:

What is the user ID/role ID?

What is the risk ID?

What is the transaction code combination that you feel is either reporting and shouldn’t be, or is not reporting and should be?

What plugin system is this related to?

Is this user expired or locked? Check the setting in SPRO for expired and locked users.

Is this a Reference user? Check the setting in SPRO for include Reference users.

Are you using NOT operator and expect violations to be reported?

Ensure action rules are loaded for the systemCheck the generated action rules in Rules Summary and make sure that the rules are generated properly for the Risk ID

Confirm that permission level rules are correctly built based on the permissions activated in each function

Check the generated permission rules using the Action rule detailed report

Page 34: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 33

Tips for Risk Analysis troubleshooting (cont.)

Run Action Level analysis and permission level analysisIf the user shows at action level, but not at permission level, then focus on the permissionsIf the User doesn’t show up at action level, confirm whether the User has access to both transactions in the plugin

Run SUIM report in the plugin to confirm whether the user or role has the transaction codes in the risk

Review the field values in the permissions to ensure accuracyFrom the plugin system, search for the authorization object in SUIM and look at the possible valuesMake sure the permissions in ARA have the proper values based on the values available in the plugin systemEnsure leading 0’s are defined in the Activity fields (ACTVT must have 02 and not 2)

Run SUIM report for the User to confirm whether or not they have the access listedUsing the function definitions, run SUIM report for every authorization object enabled, one at a time to see if the user/role has the values configured in the rules

Page 35: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 34

Tips for Risk Analysis performance issues

Batch Risk AnalysisDefine Critical Roles and Profiles (SAP_ALL/SAP_NEW)Verify configuration parameter ‘Ignore Critical Roles and Profiles’ is YESExclude unnecessary objects like expired, unused objects, administrators, super usersRun DB statistics and rebuild indexes if applicable for violation tablesMake sure you have the parallel background jobs configured

Ad hoc Risk AnalysisAvoid running for all objects or a large number of objectsRun as background job if you want to run more than few usersCleanup the temporary violations tables periodically (SAP Note 1744331)Download ad hoc risk analysis reports in background (SAP Note 1792254)

Risk Analysis from ARQFYI: Users with large numbers of authorizations may take some time, or may even time out

Page 36: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 35

How to test Web Services

How to find the Portal plugin SP levelGo to WS Navigator -> Select GRACAuthMgmtWebServiceOutBinding and test for getConnector method (after SP9)

How to test IDM Web Services (option 1)Go to SE80 select package GRAC_DIRECTORY_SERVICESGo to Enterprise Services Service Provider click the Web service you want to checkGo to Service Definition menu and click testSelect the input as “Generate Request Template” and update the desired values and test

How to test IDM Web Services (option 2)Go to transaction SOAManager Click on Web Services ConfigurationSelect any of the GRC web services and click “Open Web Serivce Navigator for selected Binding”Enter the input values and test

How to test Portal Web ServicesGo to WS Navigator Select GRACAuthMgmtWebServiceOutBinding and run testSelect the method you like to test and input the values and test

Page 37: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 36

Common dos and don’ts

Connector: Make sure that the connector name is meaningful and without any special characters (PRDCLNT100)

Role Upload File: Authorization source is mandatory while importing files with composite and single roles

Management Report: Drill down in Management reports only works for current month. If you have summary data for previous months it would show summary data but detailed data is only for current month.

Rule Maintenance: No more than 2-3 functions for a SOD riskDo not have a large number of rules using the OR conditionNot more than 1 function for critical action risk and critical permission riskDo not duplicate rules for different departments instead use organizational rules

Page 38: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 37

Backward and plug-in compatibility

Backward Compatibility for Access Control 10.0The backward compatibility of GRCFND_A V1000 for Access Controls starts with Support Pack 10. Until SP10 both GRCFND_A and plugins GRCPINW & GRCPIERP need to be one the same level.

GRC Foundation is compatible with the following NW Plugin versions:

GRCFND_A GRCPINW and GRCPIERP702 702, 730, 731, 740

731 702, 730, 731, 740

Page 39: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 38

Quiz #4

What information should you include when logging an Incident?

Page 40: FINGRC2014 Balraj Tipsandtricksforadministering

Learning Best Practices for logging Incidents

Page 41: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 40

Perfect customer incidentContent of a incident

1. Installation and system number (incl. SID)

2. Select the correct componentTry to make the selection with subcomponents

3. S-user/user/person getting the error message

4. Step by step description including navigation and description of expected results

5. Screenshot of error message

6. Open service connection

7. Send login data (SAP Note 508140)

8. Carefully select the priority of a messageFor very high customer incidents you need to fill in the business impact. All questions need to be answered or otherwise the processor might lower the priority.

9. Ensure you log only one issue per incident (SAP Note 50048)

Access the topic directly via this Quick Link: http://service.sap.com/message *

For any problem with this application create a message under component: XX-SER-SAPSMP-IBX

Additional videos:

• How to create a “Perfect Customer Message” in SMP - YouTube Video

• www.youtube.com/watch?v=PerN6O7Kxbs

• How to request to close customer messages - YouTube Video

• www.youtube.com/watch?v=DQxG6UoYFuo

• How to search for old Messages in SMP - YouTube Video

• www.youtube.com/watch?v=1wuSMvKr-MM

* Requires login credentials to the SAP Service Marketplace

Page 42: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 41

Accelerate an incidentWhen issues become more urgent

What justifies an acceleration?

To avoid negative business impact, the problem solving becomes more urgent See SAP Note 67739 for more information on “priorities of problem messages“

What can you do?

Call SAP Customer Interaction Center (CIC) Local CIC numbers (available 24 x 7) can be found via:

SAP Note 560499 or Service Marketplace Ask to speed up the message by explaining the business impact

What you can expect

Customer Interaction Center (CIC) takes care of: Analysis the options to speed up the message

Accelerate

Page 43: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 42

What justifies an escalation?To justify an escalation you need to explain the business impact!Find more information in SAP Note 90835Criticality has changed: Go-Live now imminent and jeopardized - Business impact now severe

What can you do?

Contact SAP’s Customer Interaction Center

Please be prepared to provide the following information:1. Productive system: Is the core business severely affected? (financial loss) Is there an extensive manual workaround? How many users are affected? How long has the problem been going on?

What you can expect

SAP incident escalation team ensures: Intensified attention and additional activity of support resources Increased coordination of internal incident handling Involvement of SAP Development or Backoffice, if needed Execution of action plan and frequent feedback

Escalate an incident Incident escalation via Customer Interaction Center

Critical incident occurs

Contact CIC

Escalation team takes over

SAP solves the issue

2. Test/development system: Which project? Live date, product and release? Showstopper: yes/no Is the go-live date affected?3. Point of contact: Work phone number (no 800x) Cell phone number and e-mail address

Key tip: Specifically ask to “have the escalation flag set“ and make sure system access is available and contact is named!

Escalate

Page 44: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 43

What justifies a complaint?After the confirmation of a message, the customer wants to reach SAP’s attention about his dissatisfaction with:

Any of SAP’s support services (message solving, remote services) or

SAP products in general

What can you do?

Contact SAP‘s Customer Interaction Center

Please provide a detailed description of the issue (complaints must be in a written form)

What you can expect

SAP takes care of the issue: Acknowledgement of complaint receipt within 24 hours and analysis of complaint reasons

Involvement of responsible manager and processor for a detailed technical analysis

Establishment of necessary steps to avoid such incidents in the future

Provision of final statement

Recording and categorization of all complaints to detect weakness tendencies in quality of product and support provided

Based on these findings, management ensures continuous improvement

Customer is dissatisfied

Contact CIC

Complaint team takes over

Continuous improvement

Complain

Give feedback to SAPHow to complain about support or product?

Page 45: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 44

Required GRC information to save time

The more detailed information provided will reduce “ping-ponging” of the incidentKeep in mind, we process over 1000 messages a month and each customer’s implementation of our product is uniqueThe more detailed and the more information supplied up front, the faster Support can determine root cause and provide a solution, or for code related issues, pass on to IMS Development

Stepping through the issue and documenting each piece of the puzzle will allow GRC Support to isolate the cause of the issueIs it a new installation or upgrade? Is the upgrade is version level or SP level?Attach a Microsoft Word document that shows screen prints of every step you are performing that results in the errorDocument details along with the screen printsAny patterns in case of sporadic/intermittent issues and how often it occursIs this first time the issue arises? If so, have you done any upgrades, applied notes, changed any configuration?Provide the input values for any process, as input values are important to replicate any issues. For ex, risk analysis, request creation, HR trigger etc.What is your expectation of behavior ?Have you applied any notes or changed any configuration based on self service optionsAttach the logs captured in SLG1 or default traces

Page 46: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 45

Reduce connection issues with the Line Opener Program

In some cases, processing times are prolonged unnecessarily due to closed connections when the Support Engineer tries to access the system

With the Line Opener Program (LOP) this situation can be completely avoided

Support Engineers can access the customer system anytime as long as the LOP is active

Calls to multiple people (IT, third-party hosting, etc.) are no longer necessary

For more information on the LOP, refer to SAP Note 797124

Page 47: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 46

Quiz #5

What priorities should these incidents be?

Page 48: FINGRC2014 Balraj Tipsandtricksforadministering

Wrap-Up

Page 49: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 48

7 Key Points to Take Home

• SAP has 4 Support Offerings to enhance your customer experience

• In order to save time, follow best practices when logging incidents and provide all of the

requested information up front

• When searching for SAP Notes, copy and paste error messages or ABAP syntax errors

• Use the Line Opener Program to reduce time lost due to maintaining system connections

• Backward compatibility was introduced as of AC 10.0 SP10

• Clean up or Archive your data for better performance

• Use Parallel Processing for background jobs and refrain from running multiple jobs at once

Page 50: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved.

Thank You

Contact information:

Prem BalrajSenior Support EngineerSAP Active Global [email protected]

Page 51: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 50

Appendix

1. Providing System Information

2. Opening a Connection

3. Updating the Secure Area

4. Incident Priorities

5. SLG1 Log Filters

6. Useful SAP Notes and Links

7. Useful AC 10.X Notes

Page 52: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 51

Provide System Information

Provide following informationSAP GRC Application that the issue relates toThe version of the SAP GRC applicationThe support package level of the SAP GRC applicationThe Basis level that SAP GRC application resides onThe System ID(s) for the systems that the issue occurs on

Examples of incidents with detailed information:

Page 53: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 52

Open a Connection

Even with detailed documentation, Support may not be able to isolate the root causeConnection into your system allows us to recreate the issue and try to identify the issueEstablishing a connection allows multiple SAP support teams to review the issueIt is against SAP policy to use WebEx and other web conferencing methods to troubleshoot issuesSAP supports only Netviewer sessions

For Netviewer information, Refer to SAP Notes 1036616 and 1374789

For SAP GRC Access Control 5.X, both front-end (Java) and back-end (ABAP) is required

FOR GRC Access Control 10.X, R/3 connection and HTTP connection to the GRC system and R/3 connection to Plugin systems is required

You can also provide WTS connection and give us access to all GRC and Plugin systems from there

Front-end connection will be through HTTP or WTS connection typeWe may need multiple back-end connections opened if issue exists on multiple systems

Page 54: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 53

Update the Secure Area

User IDs and passwords should be entered into the Secure logon area provided by SAP

Access data needs to be created only once per system and can then be used for each message referring to this system

SAP Note 508140 explains how the secure area works

If you have issues opening a connection, create a new message under component XX-SER-NET-HTL and they will assist

SAP Note 37178 provides some troubleshooting tips

Do not store any passwords in the actual incident itself

To identify the root cause for some issues, support may need full access. If the issue only happens only in production and per policy if you can’t give full access, you can ask for Z_DEV_DEBUG_ROLE from support and attach that role to support userid. This roles contains all the transactions and authorizations needed to analyze the issue.

Page 55: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 54

Incident Priority

Please refer SAP Note 67739 Very High Extremely serious interruptions in normal operations (financial impact) • Absolute loss of system • Malfunctions of central production system functions • Delay of go-live or upgrade within three days �High • Serious interruptions in normal operations (financial impact)

Page 56: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 55

SLG1 log filters – To filter the logs by component level

OBJECT SUBOBJECT

GRAC AUTH, BATCH, HRTRIGGER, SOD_RISK_ANALYSIS, SPM, UAR

GRFN AC_PROV, AC_REP, API, AUTH, CASE_INT, FDS, IO_EXPORT, IO_IMPORT, IO_META, JOB, JOB_DESIGN, MDCHECK, MIGRATION, MSMP_WF_CN, MSMP_WF_NT, MSMP_WF_RT, OWP,POLICY, REPLACEMENT, REP_ENGINE, RISK_AGGR, RM_BANKING, SURVEY

GRPC API, AS_REORG, ATTACHMENTS_CLONING, ATTACHMENTS_DOWNLOAD, ATTACHMENTS_SERVICES, AUTHORIZE, CASE_INT, EVENT, NWBC, PLANNER, REPLACEMENT, SCHEDULER, SIGNOFF, SOD_CHECK

GRRM AGGR_RUN, ANILS_AUTOMATION, CLEANUP, CONTEXT, KRI, MIGRATION, RESPONSE_NOTIF, RESP_AUTOMATION, SURVEY

Page 57: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 56

Note # DescriptionReport issue to SAP560499 Global Support Customer Interaction – telephone, fax, e-mail16481 Contacts @ SAP 67739 Priorities of problem messages36677 Structure of components in SAPNet – SAP R/3 front end508140 Customer message – customer log-in data32736 24-hour support not possible in this language83020 What is consulting? What is support?873046 Processing of messages in English797124 LOP - Line Opener Program50048 Several questions reported in one messageTrouble with a message90835 SAP message escalation procedure 984434 How to speed up customer message processing Notes implementation357732 Entering development requestsFeedback to SAP736045 Complaints concerning SAP Service & Support

Useful SAP Notes

Page 58: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 57

Topic Quick Link

Support Welcome https://service.sap.de/support-welcome

Connect to SAP http://service.sap.com/access-support

Create Customer Incident Message http://service.sap.com/message

Data Administration http://service.sap.com/system-data

SAP Community Network http://scn.sap.com

SAP Notes Search http://service.sap.com/notes

Support Portal http://service.sap.com/support

Line Opener Program (Youtube) http://www.youtube.com/watch?v=c-cHAq8oVLY

Useful Links

Page 59: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 58

Note # DescriptionAC 10.0 1674530 Supported Browser and Operating Systems for GRC101603438 GRC AC 10.0 EP Plug-In (JAVA), supported NW versions1662113 Using Access Control 5.3 with your 10.0 plug in systems1099011 Limitations of using CUA with GRC Access Control 1638100 Print version Communication Failure: RFC Destination SALV_WD_EXPORT_PDF does not exist1644506 Connection timed out when opening requests1647402 Error No role storage space when opening a request 1674530 Supported Browser and Operating Systems for GRC 10 1900049 ABAP Dump TSV_TNEW_OCCURS_NO_ROLL_MEMORY1637515 GRC 10.0 - Not able to find the pre delivered BRF+ rules 1936775 Performance issue with Permission and Org Rule Analysis1958401 Rule generation job performance issue1966007 Incorrect Rule Generation for Logical Groups

AC 10.11931260 General Information: GRC Fact Sheets1961857 Master Note for SAP Access Control 10.1 - Support Pack 051953175 How to correct Errors when activating Access Control 10.1 BC Sets 1870233 Release Information Note for SAP Access Control 10.11929930 Release Information Note for UI for Access Control 10.11906015 AC 10.1 documentation corrections: install/upgrade guides

Useful AC 10.X SAP Notes

Page 60: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 59

Note # Description1936775 Performance issue with Permission and Org Rule Analysis1958401 Rule generation job performance issue1647908 Space Reclaiming procedure after deleting large data from DB1617487 No more storage space available for extending an internal table1584623 Parallel processing configuration in SOD batch risk analysis1583640 Profile parameters of memory management for SOD analysis1580877 Best practices in storage management for SOD analysis jobs1743367 GRAC_REPOSITORY_OBJECT_SYNC ending abnormally with SQL dumps484994 LDAP Connector blocked in case of lengthy operations

To get detailed information about sizing, visit https://service.sap.com/sizing -> Sizing Guidelines -> Analytics

AC 10.X Performance Issues Notes

Page 61: FINGRC2014 Balraj Tipsandtricksforadministering

© 2014 SAP AG or an SAP affiliate company. All rights reserved. 60

© 2014 SAP AG or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG or an SAP affiliate company.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG (or an SAP affiliate company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

National product specifications may vary.

These materials are provided by SAP AG or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP AG or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP AG or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

In particular, SAP AG or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP AG’s or its affiliated companies’ strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP AG or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.

Page 62: FINGRC2014 Balraj Tipsandtricksforadministering

Wellesley Information Services, 20 Carematrix Drive, Dedham, MA 02026 Copyright © 2014 Wellesley Information Services. All rights reserved.