Appears to be an issue causing gap in FF capture and reporting

[Former Member]

We are on GRC 5.3 SP 13.

We have our FF Log Capture job (/virsa/zvfatbak) set to run every hour.

We have our FF Email Log job (/VIRSA/ZVFAT_LOG_REPORT) set to run once a night. It is also configured as a dependent of the Log Capture job.

There seems to be an inherent gap in the FF process that is causing some FF activity to not be sent out by the Email Log job.

For any given night, the Email Log will report all FF activity that has occurred from when it started running the previous night up to when the most recent hourly Log Capture job started running. However, if activity occurs between the time the Log Capture job starts and the Email Log job starts, it does not get sent out by the Email Job.

The activity that occurs after the recent Log Capture job starts cannot be reported out on the first night the Email Log job runs because it has not been captured yet. It won't be captured until the next run of the hourly Log Capture job. When the next night's run of the Email Log job runs, this activity has been captured but this run of the Email job will not report it because it occurred before the previous night's run of the Email Log job.

Has anyone else run into this?

Have you come up with a solution?

Thanks.

[Former Member]

Hi Bob,

Check the configuration and see the below options:

Send Log Report Execution Notification Immediately YES

Send Log Report Execution Notification YES

Send Firefighter Login Notification Immediately YES

Also, refer SAP Note 1152284 for more information.

Regards,

Raghu

[Former Member]

Sorry, but don't see how these changes resolve the problem with the nightly Email Log job. These changes would send the notifications out immediately. This is not what is wanted. We want to use the Email Log job function and only send out one report to the Controllers per day.

Also, not sure how the code change in note 1152284 would affect this issue either. This appears to resolve a problem with the sessions that start in one day and end in another. This appears to be a different issue. Please clarify.

Thanks.

[Former Member]

I did some testing with setting the notifications to immediate, but there is still a gap. If any activity occurs while the ZVFATBAK Log Update job is running, that activity will not get reported out.

Does anyone know a way around this?

Does anyone know of a way to monitor for these situations so you know when one has occurred?

Thanks.

[Former Member]

Hi,

You may look at the below notes:

Note 1154238 - Firefighter - /VIRSA/ZVFAT_V01 Log Report Logic

Note 1159821 - SuperUser Privilege Management - Change to Log report logic

Regards,

Raghu

[Former Member]

I had already looked at these notes earlier and they do not appear to me to be relevant to this particular issue. If you believe they are, please explain.

Thanks.

[Former Member]

Hi Bob,

Please check the Program Varient and the time delay between the Programs. If you are using Varient to execute the Program /VIRSA/ZVFATBAK then it needs to be adjusted. Normally we should not use the varient to execute this Job.

Please let us know the varient information, duration & frequency of this job.

[Former Member]

Can you provide more information on how the variant of the ZVFATBAK program can affect the time period that is reported by the nightly ZVFAT_LOG_REPORT program?

From looking at the programs I can see where the ZVFAT_LOG_REPORT programs reads the /VIRSA/ZFFNOTIF table to get the start date/time for it's reporting period. However, I don't see any reference to this table in the ZVFATBAK program so don't see how this would affect the reports.

Just trying to make sure we don't go off in a tangent from the main issue.

Thanks.

[Former Member]

SAP Support has verified that a reporting 'gap' period does exist if you run the email reporting job (ZVFAT_LOG_REPORT) as a separate job. This is by setting the "FFLOGIM-Send Log Report Execution Notification Immediately" flag to NO.

Their work-around is to set the flag to YES so that the emails go out when the log update job (ZVFATBAK) runs.

Supposedly the are working on a solution for the separate email job.

Thanks.