Profile not generated after system Upgrade.

[Former Member]

All,

I have a situation,

System : ECC 6.0

We have roles built in D and transported into Q and P environment.

All the roles did have the profiles generated and the authorizations tab was green until we upgraded the system.

After the upgrade atleast 10% of the roles on our P environment are showing Profiles not generated( yellow on the Auth. Tab).

But there are no user complaints about any T-code not working.

One more point is that any new role( generated ) on D and moved to Q also shows as profiles not generated on Q.

Any thoughts on this will be helpful.

I did find 1 or 2 threads on this topic, but not much of help.

please suggest.

Thanks

Vidyar

[Former Member]

If you have not transported the roles for a long time and profiles are being generated in Q and P, then it could be collisions of the profile names.

The transport log will have informed you of this, so check that.

Common causes are own inventions of profile names, down / upload tactics and a table called AGR_NUM_2 which you might not have maintained when installing the system landscape.

It is easy to fix, but can be time consuming if you have a crow's nest of roles.

Cheers,

Julius

[Former Member]

Julius,

Honestly I was not the Crow !

Joking!

I will find out how the nest was built and work on that,

But I did get your knowledge on this, thank you for the guidance and will update this ticket and points as I progress.

Thanks

Vidyar

[Former Member]

Julius,

Can you suggest the method to fix this issue.

Thanks

Vidyar

[Former Member]

You need to answer my questions first...

What does tp log say?

How many collisions?

Are they manually named?

Was agr_num_2 initialized and when?

If roles are maintained using "edit old status" then it will not be that easy - and you will need to be very brave if it is causing problems already. Fixing it might cause bigger disruptions...

You need to give more infos, otherwise it is dangerous to do something about it.

Cheers,

Julius

[Former Member]

Julius,

I just took up this responsibility, as the person working for 15 years has left, so I will definitely handle this with caution.

Status : 2 upgrades since 2002

2 transport paths.

1. What does tp log say?

I checked some of the roles and all of them have this error message as below.

(4: Warnings occurred. All the objects were transported successfully. Peculiarities occurred for certain objects. These might not have been intentional.)

2. How many collisions?

I could not find the number of collisions : There are 6 profiles created for one role I checked ( exapmle : Z_CUST..._00, 01,02,_03..till _06 )

3.Are they manually named?

Yes

4. Was agr_num_2 initialized and when?

Initialized. :Started with number 30,000 in one client and 60,000 in another client.

I am also going over with the Note :1380203 for naming for profiles.

Thanks

Vidyar

Edited by: VIDYAR on Apr 26, 2011 11:33 PM

[Former Member]

Bernhard made a good point which needs to be clarified first:

If the SU25 steps 2A and 2B were performed (which is good practice, generally...) then it will highlight roles which are only being edited in "old" status.

This is actually a good thing as well (you can test it in SUPC and exit without saving, or in SU25 Step 2c, but you need to deal with it carefully, particularly as you do now know whether objects were deleted...

99 times out of 100, you can throw the roles away and start over if you have this problem. It means you attempted a menu for the users but want to maintain everything manually behind it as "best guess" values in many "value" or "bolt on" roles which you search for in SUIM.

You have my sympathies...

Good luck,

Julius

[Former Member]

ps: You need top management commitment to fix these design errors, otherwise you are wasting your time on it (but you can bill them for lots of manual work and presentations and audits and "quick fixes" if you want to and they agree to threat symptoms instead of the root cause of the problem...).

Sorry for the rant

Julius

[Bernhard_SAP]

(4: Warnings occurred. All the objects were transported successfully. Peculiarities occurred for certain objects. These might not have been intentional.)

-->that's not good.

Check in detail the import log (expand completely) to identify the objects. As long the RC is not 0, you could have these problems!

(in the past the consistency checks at import did not exist...)

b.rgds, Bernhard

Edited by: Bernhard Hochreiter on Apr 27, 2011 12:23 PM

[Former Member]

Julius,

I am discussing with business, about the things involved in fixing them.

Planning to suggest a rebuild, as the security upgrade was not done properly.

thank you for your input.

Thanks

Vidyar

[Former Member]

Julius,

I just walked into as a Full time, If I was a consultant I could have.

but thank you for the concern.

Thanks

Vidyar

[Former Member]

Bernhard

Yes, all the roles that have an issue of profile not been generated, have RC=4,

they tell me the objects that were deleted.

Thank you for your input, I will be working on these roles.

will get back if I need some suggestion.

thanks again.

Vidyar.

[Bernhard_SAP]

After the upgrade atleast 10% of the roles on our P environment are showing Profiles not generated( yellow on the Auth. Tab).

Hi,

propably you did not finish SU25 after the upgrade.

b.rgds, Bernhard