Critical Roles & RAR Background Jobs Question

[Former Member]

Hello,

I have the following queries, related to GRC AC 5.3 RAR.

1- I would like to include all roles starting with S* into critical roles.

My question is can I say S* in critical roles, OR do I have to manually enter each & every role starting with S* (Please note that currently we have around hundreds of roles starting with S and entering each of them manually is a tedious task).

2- We have several background jobs scheduled in RAR and when I click search button, I get a list of around 600 jobs executed in the past few months.

My question is can I purge the background jobs history in such a way that, when I click "SEARCH" button, I get only those background jobs, which have been executed in the past 1 week?

Thanks,

Haleem

[sunny_pahuja2 · Accepted solution]

Hi,

I am not sure about point 1. But in point 2, you can filter out the jobs on the basis of Last Run Date option while you are searching for jobs.

Thanks

Sunny

[Former Member · Accepted solution]

Hi Sunny,

In point 2, we can filter out the jobs on the basis of Last Run Date option while you are searching for jobs, but can we delete the old jobs based on the Last Run Option.

I know that we can delete the jobs by selecting them, but is there a way to delete all jobs older than 14 days?

Also, my question is if suppose I delete a full sync job which was scheduled monthly, then will that cause the full sync job to be disabled and will I have to reschedule that job again?

Thanks,

Haleem

[Former Member · Accepted solution]

Hello Abdul,

From the list of the jobs scheduled displayed, press the ctrl key on your keyboard + select the row. By having the ctrl key pressed you can select multiple row of entries (jobs scheduled) and then can click on the delete button to delete them simultaneously.

Regards, Varun

[Former Member · Accepted solution]

Thanks Varun for your answer and the UME Permission answers. I have awarded you with 6 points.

Before I marked this thread as answered, can you kindly advice on my first question.

 1- I would like to include all roles starting with S* into critical roles.
My question is can I say S* in critical roles, OR do I have to manually enter each & every role starting with S* (Please note that currently we have around hundreds of roles starting with S and entering each of them manually is a tedious task). 

Based on the above, does GRC AC 5.3 support wild card in selecting critical roles/ profiles etc in RAR "or" do I have to manually enter each & every role (currently we have thousands of roles in our system)?

Thanks for your help in advance.

Regards,

Haleem

[Former Member · Accepted solution]

Hello Abdul,

thanks for the points.

I have not tested this wildcards but i believe it should work as it is working in other part of the application (exclude objects during background job creation). If you put sap* then it would exclude all the objects starting with sap.

Regards, Varun

[Former Member · Accepted solution]

Hi,

I expect it to work with the S* values on critical roles.

Have you tried a test in a pre-production system to check this?

Simon

[Former Member · Accepted solution]

Hi Simon/ Varun,

I tried executing with S* previously in the critical roles section.

Then I executed full user/ role/ profile sync and then the full sync for batch risk analysis (users/ roles/ profiles/ critical roles actions etc) and then executed the management report.

After above activities, I got the correct no of users analyzed, but the no of roles analyzed were displayed as 0.

Then I removed the S from critical roles and manually entered few roles starting wtih S* and executed all the above steps of full sync jobs and management report, I got the correct no of users analyzed and the correct no of roles analyzed which is 2200.

So based on the above, the S* did not work and the management report skipped all the roles in the system and gave the report as no of roles analyzed as 0.

Do you know a workaround for this issue.

Thanks,

Haleem

[Former Member · Accepted solution]

Haleem,

In that case i would suggest you raise it with SAP support as this should be uniform within the application. When wildcards are working for exclude objects then it should work in other parts as well. You can create a mesage within the component GRC-SAC-SCC.

Regards, Varun

[Former Member · Accepted solution]

Hi Varun,

I created message with SAP in the component GRC-SAC-SCC and below is the response.

----

---

Dear Customer,

You have to manually enter each & every role in critical roles section and the exclude objects in management report section.

SAP GRC AC 5.3 SP11 does not support wildcard operations in critical roles/ profiles and exclude objects of management reports. We will support the wildcard in future SAP Versions of GRC.

Thanks

----

---

Based on the above message, I understand that I will have to enter all the roles manually for critical roles in critical roles section of RAR -> rule architect and exclude objects of management report section.

Thanks,

Haleem

[Former Member · Accepted solution]

Hello Abdul,

I guess if you will search the SAP Help portal for SAP Note based on criteria "Wildcard" Component GRC-SAC-SCC you will come up on a Note which tells about how wildcard is used in Exclude object of background jobs. This note will clearly state that if you use exclude object as SAP* then all the objects starting with SAP* will be excluded. However if you wish #SAP* then an object named SAP* only will be excluded. I do not remember the Note number exactly but it is there. I belive you can refer that note to SAP and ask them to recheck about wild card function in Background jobs If the note was there then i belive the functionality was also there in RAR 5.3 to exclude objects based on wildcards

Regards, Varun

[Former Member · Accepted solution]

Hi Varun,

Your advice is highly appreciated.

Can you kindly help me and let me know the OSS Note number.

Also I understand from your reply that if I say #SAP* then an object named SAP* only will be excluded.

AND

if I say #BATCH, then all the objects named BATCH will be excluded.

AND

if I say #BATCH, then all the objects named BATCH eg. CME_BATCH_ROLE will be excluded.

Please let me know, if I am right.

Thanks,

Haleem

[Former Member · Accepted solution]

Haleem,

Sorry, i do not have the note number. Please search the SAP SMP and you find it. This will clear your doubts as well.

Regards, Varun