CUA Child system not getting updated

[Former Member]

Hi All,

Presently we have configured Solution Manager as the CUA Master & ECC,BI,CRM as the child system.But we are having some problems in the child system BI.When we are doing bulk changes in CUA, itu2019s not getting reflected in the child system.We are going to CUA Master in Su01.Then we are taking the user in change mode, and just saving it.Then it is working fine.Whther we need to run any report/background job for this which automatically updates??

[Former Member]

Yes we faced a similar issue :

You might have to look for a note to apply to resolve the issue, I dont remember the note number basically a correction.

look in SAP notes section of Service.sap.com

Also make sure the RFC is maintained and is consistent, check if the IDOC are propagating to the child system.

[Former Member]

Thanks Franklyn for such a quick response..Go to spau & check the applied note..Please suggest

[Former Member]

If you meant to say that the note is applied,

My best advice is DO NOT KEEP CUA AND SOLUTION MANAGER IN ONE SYSTEM.

Most of the time the RFC fails with too much work going on in Project mode on Solution manager.

Back to your question:

Check and let me know if any of the RFC is having a RED indicator for your child system

in case yes, disconnect that child system for a moment and try your bulk action from CUA.

Then reconnect the child system back on, try to see if you can perfrom user to role assignment from CUA

If it succeeds , try another bulk action including the child system you added just now.

I still feel you will have to apply a note/run a report to overcome this situation, even if it works with suggestions given by others this will be a recurring issue, so what we finally did is created a customized Zprogram to perfrom bulk loads.

The reason:say you have 10 child systems and you are trying to assign roles to just two child system , in our project it was jamming the traffick for other system.

Another thing you can try is when you are doing the bulk loads just identify only the client names you need to make the changes rather than picking all the clients. that also could solve your problem.

[Former Member]

>  My best advice is DO NOT KEEP CUA AND SOLUTION MANAGER IN ONE SYSTEM.
> 

???

Care to elaborate?

I am facing the same problem as the OP from time to time and the issue is -more or less- the parallel processing of IDOC-type USERCLONE. There are notes on this. One suggests to set the IDOCs to batch processing in WE20, but there are further steps you can consider - one of them would be to switch to qRFC (you would have to code a rule, of course) - but that has the disadvantage that the first erreanous IDOC is stopping the complete queue, which is slightly suboptimal.

I think it pays if you do a performance check on RFC-performance on the child system. Settings can be adjusted in RZ12 etc. I am not saying this will solve the issue, but it might. At least worth a try before you go to qRFC or total batchification à la note 557610.

If your SolMan has a bad overall performance due to 'project processing' ... de/attaching the child won't help. Every new system getting attached to the CUA master would provoke 'bulk processing' again ...

[Former Member]

> My best advice is DO NOT KEEP CUA AND SOLUTION MANAGER IN ONE SYSTEM.

I would also be interested to know where this speculation comes from...

Both CUA and SolMan should be on the higher releases / SP levels than the managed systems and with SolMan trusted RFC it make A LOT of sense to KEEP THEM TOGETHER so that you can have central control of user management "from Rome" (as in: all roads lead to Rome...).

Please show us the source of this information or correct it before it spreads another urban legend.

Cheers,

Julius

[Former Member]

Thank you for intervening, Julius. I appreciate it very much. I was starting to feel like a relic, not even worthy being yelled at, let alone argumented with. 🐵

[Former Member]

I think a lot of folks don't know about detatching the CUA during config changes...

[koehntopp]

Why would you not put CUA and SolMan on the same system?

That's the first time I heard that - most of my customers with CUA have it on the same system with no issues whatsoever...

Frank.

[Bernhard_SAP]

Hi Frank,

if you run your Solman as high availability system there should not be a problem. (you will need then also a 2- or 3-system Solution manager landscape )

But many companies won't do that. And then you have the question what happens during the solution manager downtimes (remember the famous SP18.......).

So that is the quesiton: how do you treat your SolMan - if like a real PRD-system there shall not be an issue.

Just some thoughts from my expirience as supporter...

b.rgds, Bernhard

[Former Member]

Hi Bernhard,

I agree that your HA-solution has some merit - however not many customers will see the need for the added cost - at least not when it comes to a SolMan. Partly this may be because SAP 'advertised' this product as 'just a monitoring system' and making the SolMan mandatory to 'just get some license-keys' in case of an upgrade did not help matters ... to establish the SolMan's credit of a 'real' productive environment.

Or so I think

However, that does not rectify such a generic statement as given by Franklin, who states that the you should never put your CUA on a productive SolMan that also runs 'other' things ... and in capital letters at that! I am still hoping for an explanation!

[Former Member]

This reminds me a bit of the tms domain controller debates with basis folks.

Actually, security is a real risk with solman's trusted RFC and the tms, but the availability is also a good argument to bring them into a more secure "zone".

But this is all urban legend stuff: which problems did Franklin have?

Cheers,

Julius

[Bernhard_SAP]

yep.... lets wait for Franklins example(s).....

maybe he has got some bad expiriences to share (I have some ideas already).

[Former Member]

> (I have some ideas already).

I can see someone reading up about transcendental meditation right now...

[Former Member]

Hi Frank,

First of all sorry, I just checked this message

This has been a issue with one of our customer even after applying notes, most of the security activities would be held up

atleast for 1 or 2 hours.

I have to look at my documentation its almost 11 months now I will search & will post the "Zprogram" name created to overcome this situation. Security team was forced to use the Zprogram since the solution manager team had to delink and link the RFC connections when we complained that none of the team members were able to use SU01 from CUA, it would result in user to role assignment mismatch after this activity. "The load of users was 22000+"

Regarding phasing out of CUA in my projects:

Most of the clients example: my past two clients and present preferred to use GRC(CUP) to do provisioning with a well defined process. Plan after "Go live" was to use GRC(CUP).

I will agree that from ABAP administration purpose CUA is a very efficient tool.

[Former Member]

Hi Das,

Check partner profile setting in WE20 for that particular BI system. Also confirm whats the IDOC status while doing bulk changes in CUA system.

[Former Member]

Das,

Did you check SCUL log?

Did you check RFC connections?

Logical system names?

Patner profile

Check the solutions/approach for this issue in CUA cookbook

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/d ocs/library/uuid/fe4f76cc-0601-0010-55a3-c4a1ab8397b1

http://sapwhiz.com/printdoc/1230/

Thanks,

Sri

[Former Member]

Das,

I forgot to mention earlier.

What are the SCUM settings? Since data is not getting distrubuted

For IDOC tracing use tcode BDM2 it provides the IDOC tracing from the central system to child sys. Even you can use We05.

Thanks,

Sri

[Former Member]

Distribution of the user Master Records

Logon to CUA system (Solution Manager)

Enter SE38 transaction code

Enter program name: - RSCCUSND

Execute (F8)

Enter receiving system details in selection options screen and execute program.

After completed program, synchronized all child system to CUA

CUA user master records will getting updated in child system

[Former Member]

Hi kanakaraj:

thanks for your help.

it's solved my problem.

[Former Member]

>

> Hi All,
> Presently we have configured Solution Manager as the CUA Master & ECC,BI,CRM as the child system.But we are having some problems in the child system BI.When we are doing bulk changes in CUA, itu2019s not getting reflected in the child system.We are going to CUA Master in Su01.Then we are  taking the user in change mode, and just saving it.Then it is working fine.Whther we need to run any report/background job for this which automatically updates??

Perhaps you have composite roles for your BI-child? Check in BD87 in that child whether you have IDOC's of type USERCLONE that are complainig about 'the role is already locked by <CUARFCUSER>. In which case you have several options. Study notes 399271, 557610, 805469 and maybe 159885. Consider the solutions given there ...

[Former Member]

Hi Das,

This is an usual problem in CUA when you have done mass changes to User master data.

1)You need to run SCUL first to push all idocs immediately and run BD87(need to select only userclone in message type) in child system.it is very important in child system to select only userclone in message type in BD87 as there may be other message type IDOCS also waiting in Queue.If you dont select user clone, all IDOCS in queue will be processed.

2)You can schedule a background job to push all IDOCS from CUA to child system on a periodic basis.The program name is RSEOUT00 and setup a variant for each child system.

Before you setup the background job, you need to check WE20 settings in CUA.You need to setup like collect all idocs in partner profile.

You can either execute step1 or step2 to process IDOCS to child system.

Thanks

Mohan

[Former Member]

Hi,

After assigning access to Users in CUA system,

1.Go to SCUL and give userids and execute + Select users and click distribute icon.

2. go to SM58 and check whether any idocs are pending, if you can still see the idocs even after pressing Refresh button there, then select edit -> execute LUWs and execute that.

3. Once all Idocs cleared in SM58, you can find the assigned roles in child systems.

4. Eventhough if you can not find them, then go to BD87 in child system, select partner as CUA system and execute, select the UserClone and press Process tab.

[Former Member]

thanks