User locked every two minutes

[former_member301120]

Hello,

my user is locked within two minutes after unlocking it.

Its Netweaver PI System.

What can I do, to find out what program my user locks?

If already checked following:

- all connections in SM59

- JAVA Default Trace

- Exchange profile

Please advice

Regards Christian

[Former Member]

Hi Christian,

Have you checked if your user is setted in some CommunicationChannels in PI System Directory?

[Former Member]

Hi Christian,

Is this user a service id or an id which more than one people are using simultaneously.

You can run a trace (ST01) against your userId or can run a SM20 trace right from the time it started to happen.

The 6th column in SM20 output would name the program that the userID had used.

Warm Regards,

Kaushik

[former_member301120]

Hello,

the user is not set at any communication channel.

I don't see anything in st01 trace.

Is there a guide for sm20 trace?

[former_member301120]

Hello,

I've activated security auditlog now.

It's an RFC connection type R from the local host.

Seems to be from the JAVA stack.

[former_member301120]

it was the SAP J2EE CCMS Agent

[Former Member]

nice sleuthing. wish you could get points for posting your solution, maybe it will help someone.

[Former Member]

If you look in the RFC Security Best Practices wiki, you will find a section on "cardinality".

You are obviously suffering from cardinality issues...

You should fix them.

Cheers,

Julius

[former_member301120]

Hello Julius,

could you post a link to the wiki article?

[Former Member]

It is in the FAQ at the top of the page, in the main security page --> wikis -> best practices --> how to secure and analyze RFC connections.

Or via the [search|https://wiki.sdn.sap.com/wiki/dosearchsite.action?queryString=cardinalityANDRFC&where=conf_all&type=&lastModified=&contributor=&contributorUsername=] ...

Some (standard) scenarios do not by default support this cardinality requirement.

Cheers,

Julius