Identify batch program or SAP workflow on failed/error documents in SCOT/SOST

[behlau_carlos]

Hi,

in transaction SCOT/SOST I see failed emails that seemed to be created by SAP batch program or SAP workflow trigger.

The problem is, that all jobs are scheduled over one user and identify the batch job over SM37 is nearly impossible.

How can I track down the program or the SAP workflow that is creating these emails, so the variant or the workflow can be corrected.

Thanks for your help.

Best regards

Carlos Behlau

[paul_power]

Hi Carlos,

Could you screenshots of the errors ?

Are their any entries in the system log for that user, at the time of the error?

Could you limit the view in SM37 for only failed jobs within the timeframe of the error?

regards,

Paul

[behlau_carlos]

Hi Paul,

thanks a lot for your help.

The user that should receive the email has left the company - but the account is not deleted it is just looked.

Our SAP security team, wants it like that ...

Somewhere, either in the SAP workflow or in a variant of batch program the user is picked up.

The "Credit-Management VKM2" emails are the one in question - in this example.

It might be also hard coded - but I doubt that, I would found it over the job tables, by locking for Z-Programs etc (by looking into SM37/job tables).

When I look in the time range and I checked 1 hour up and 1 hour down, I could not find any program in SM37 using emails. I took the time to check all the batch jobs running in the time frame.

Is there a way to track the program back out from SOST/SCOT etc.

I can look into the document but there i was not able to see any workflow related documents ...

Best regards

Carlos Behlau

[paul_power]

Hi Carlos,

Its not an area I have alot of knowledge about. can the issue be reproduced in a test env or sandbox?

Maybe take a copy of this system and set it up on a spare machine so you wont affect other users.

Disable the mail sending job so that you can send only emails you want to troubleshoot.

Check the dev_icm traces in the work dir

Set the trace level of the ICM to level 3 so that you can see the exact SMTP conversation that SAPconnect is having with the mail server . SMICM -> Goto -> Trace Level -> Set 3.

Not certain if this will yield any further clues as to what job is triggering the emails.

Maybe someone else has more experience of tracing these jobs than I do.

best of luck,

Paul