RFC/CPIC Logon Failed, Reason = 1, Type = F

[Former Member]

In our SM20 security audit log, we are getting the following error every 5 minutes.

RFC/CPIC Logon Failed, Reason = 1, Type = F

The user listed is SAPSYS (client 000), but there is no such user (SU01).

The terminal name is the <host>.<domain> for one of our applications servers in production (there are two application servers, one with the error and one without).

In our QA environment, we have one application server and it too shows the error.

The error occurs every 5 minutes.

No ST22's or SM51's. We have not been able to line it up with a batch job (SM37) nor with Solution Manager items.

Any suggestions or thoughts?

[former_member59574 · Accepted solution]

Hi,

Please try do the following steps>

1. Start transaction RZ21.

2. Select "Method definitions".

3. Select the method CCMS_ORA_backup_arch_full_ct from the list.

4. Select and change the method.

5. Under "Release", remove the flag for "Data collection method".

6. Save your changes.

In case didn't help let me know.

best regards,

Peter

[Former Member · Accepted solution]

Hi. I just noticed your post. It is helpful. I think the information comes from OSS # 683417. The situation this workaround applies to is not our situation (our central instance is on the database server).

Having said that, I tried out the workaround in our Q environment and it does indeed stop the messages from appearing. So this prevents the critical message from showing up in SM20, however, it does not resolve the root cause of problem, which appears to be related to an internal RFC call (type F) and incorrect logon data (Reason 1).

In Production, we have a database server and two dialog servers. The SM20 messages seem to only come from one of the dialog servers (based on SM20 output of the terminal name). I believe these messages are new, starting at the time we created this new server. I was thinking that some sort of user/password combination is not set up. I thought it might be RFC related via SM59, but have not found what RFC it would be using. Could there be a file on the OS that has missing or incorrect user/password information?

James

[debasissahoo · Accepted solution]

James,

have a look at SAP note 662390.

Thanks,

Debasis.

[Former Member · Accepted solution]

Sounds almost like an exact match. We are using 700 though, not 620, 640, or other old releases.

Still, something to search on. Maybe even worth an SAP Message to see if the fix can be carried forward or not.

If you have more thoughts, please let me know.