Frequently Locked but unable to find the terminal name

[Former Member]

Guys,

In our system one dialog user and one system user are getting locked frequently due to incorrect log on (According to change document). If anybody tries from different terminal then how do I know the terminal name or IP Adrs.

Regards,

Ujjal

[Former Member]

Hi,

To find out the user's terminal ... u can go to SA38-->execute the report RSSTAT26 and now opens a new screen where it asks for the time interval and other details...

Fill them and execute

Then it shows the result screen...

...

In this screen if ur nt able to view the terminal name..u need to click on the Selection Fields tab and select the fields((Terminal iD) which u want to check and again execute...

[arpan_paik]

Looking for a ghost in your system? STAD might help you. But it is for last 48 hrs I believe.

Regards,

Arpan Paik

[Former Member]

Actually it was a shared ID, now its a key ID for the basis person so, very important to find out the IP.

[mvoros]

Have you tried to set up audit for that user in SM19?

Cheers

[Former Member]

If the terminal is a server, then you either need to audit that one... or if you can spot the user in SM04 then you can do a LAN ping to the SAPGui via transaction OS01.

In Sm04, also see the menus for more technical information (lots of infos there, if you are fast enough...).

Cheers,

Julius

[arpan_paik]

Well disregard my last post. STAD will show terminal ID (OS system ID) only if user is logged in to the system successfully. For failed attempt it won't show the terminal ID. What SM20 say? provided you activate the log for this user as said earlier in SM19.

Regards,

Arpan Paik

[Bernhard_SAP]

also SAP note 495911 and 171805 provide a possibility....

[Former Member]

Hi

Is there a possibility that one of the basis peeps has created a system user to RFC to the dialog user but has got the password wrong when running a background job?

Regards

David

[Former Member]

Hi Ujjal,

You can get the terminal name from SM20 log. Probably you need to add "With terminal name column" by checking the option under Goto--> layout on Sm20 initial screen.

You can also check RFCDES table and search the user ID (s) as a string (user etc) in the 'options' column of the table to see if that Id is used in any RFC. There is a possibility of it being used in an RFC which contains incorrect password of the user ID and hence locking the account frequently.

Thanks

Sandipan

[Former Member]

But I am unable to find the option to add "With terminal name column".

However from that table I haven't got the user ID. If it is shared with diff. RFC, then how do I know.

[Former Member]

Alt + G + L in SM20 will give you the option.

~Sri

[Former Member]

HI ,

You can check the logs in SM21. Here you can see logs which says "User locked due to incorrect logon". Double click on that and you can see the terminal.

If you have more application servers, then you have to check in all the application servers to find the log

Arun

[Former Member]

Arun,

It only gives a partial terminal name ..  the field is not long enough

any other idea ?

thanks