user DDIC is not authorized to start TP sapxpg on host

[Former Member]

Hello Friends,

I have a distributed system SAP ECC6, on linux 64 bit as OS on one host(svlixxca1) with oracle 11.2.0.3.0 on another  host(svlixxca2). I tried to schedule DB13 DB clean up job once in a week after a fresh installation, first I tried with a user who has SAP_ALL, and SAP_NEW authorization in 000, it got failed last weekend, then I tried with DDIC, again it got failed this weekend.

SM37 job log says:

SXPG_COMMAND_EXECUTE failed for BRCONNECT - Reason: program_start_error: For More Information, See SYS. Job cancelled after system exception ERROR_MESSAGE.

Developer trace displays below error:

**** Trace file opened at 20130310 030012 CET, by disp+work

**** Versions SAP-REL 720,0,401 RFC-VER U 3 1386868 MT-SL

======> CPIC-CALL: 'ThSAPOCMINIT' : cmRc=20 thRc=20

No storage allocation available

ABAP Programm: SAPLCRFC (Transaction: )

User: DDIC (Client: 000)

Destination: %_TCPIP_%1 (Handle: 1, DtConId: 513BC20B957E5597E10000000A6BA2FE, DtConCnt: 0, ConvId: ,)

EPP RootContextId: 005056B9592B1ED29FEAC996AC159DE9, ConnectionId: 00000000000000000000000000000000, ConnectionCnt: 0

EPP TransactionId: 513BC209957E5597E10000000A6BA2FE

Error RFCIO_ERROR_SYSERROR in abrfcpic.c : 1730

CPIC-CALL: 'ThSAPOCMINIT' : cmRc=20 thRc=20

No storage allocation available

DEST =%_TCPIP_%1

HOST =svlixxca2

PROG =sapxpg

While I checked the RFC connection for SAPXPG_DBDEST_svlixxca2 , it says ERROR: user DDIC is not authorized to start TP sapxpg on host svlixxca2. How to rectify this RFC connection?

Can anyone help to solve this issue?

Thanks in advance!

[Reagan]

Hello

Please check this note.

Note 583759 - R/3 error when you start jobs from DB13

Cheers

RB

[Former Member]

Hi Reagon,

Thanks for your reply but i don't think thos note helps as such. I am wondering why RFC is getting failed with DDIC or with the user who has all authorizations(SAP_ALL and SAP_NEW), here issue is not authorized to run TP sapxpg on host? Infact when DB13 job ran once with user id who has all auth. and once with DDIC both wrote the dev_rfc12 log in a same manner,

Destination: %_TCPIP_%1 (Handle: 1, DtConId: 51320F24A14D437DE10000000A6BA2FE, DtConCnt: 0, ConvId: ,)

EPP RootContextId: 005056B9592B1ED29FEAC996AC159DE9, ConnectionId: 00000000000000000000000000000000, ConnectionCnt: 0

EPP TransactionId: 51320F22A14D437DE10000000A6BA2FE

Error RFCIO_ERROR_SYSERROR in abrfcpic.c : 1730

CPIC-CALL: 'ThSAPOCMINIT' : cmRc=20 thRc=20

No storage allocation available

"No storage location is available" what does it mean?  I really don't understand what is the problem.

Regards - vikas

[Former Member]

Hi,

Having SAP_ALL and SAP_NEW does not mean that you can execute remote RFC's, for example.  This comes to light when you set up solman to satellite systems, the user account needs RFC auth's to be added specifically.  Now this may not be the issue you are seeing, but check that the account has the RFC rights specifically added.  It may just help.

Regards,

Graham

[Reagan]

Hello

Check this thread please. Not sure how effective it is:

http://scn.sap.com/thread/3323179

Cheers

RB

[Former Member]

Hello Guys,

My problem is still not solved, I appreciate all of your answers but i am at the same place. I have changed the paarmeter gw/acl_mode to 0, which was 1 by default after installation, still the same issue. When i run the RFC connection test, it fails, but now it is not throwing authorization error. dev_w6 log says

*  LOCATION    SAP-Gateway on host svlixxca1.org.int / sapgw00

*  ERROR       Start of TP /usr/bin/rsh failed

*

*  TIME        Wed Mar 13 14:56:22 2013

*  RELEASE     720

*  COMPONENT   SAP-Gateway

*  VERSION     2

*  RC          667

*  MODULE      gwuxrd.c

*  LINE        460

*  SYSTEM CALL execvp

*  COUNTER     3

*

*****************************************************************************

*** ERROR => GwStartProgram: exit /usr/bin/rsh [gwuxrd.c     472]

Wed Mar 13 14:56:43 2013

child (pid=12407) exited with exit code 255

where is the problem? Will someone please suggest?

[Reagan]

Hello

Please check this note:

Note 446172 - SXPG_COMMAND_EXECUTE (program_start_error) in DB13

Cheers

RB

[Reagan]

Hello

Also check this note:

Note 34219 - DB13: CPIC error CM_RESOURCE_FAILURE_RETRY

According to the note

3.) For all platforms as of SAP Release 4.5:
--------------------------------------------
As of SAP Release 4.5, the SAPXPG program can be started via SAP gateway which must be set up on the standalone database server. For this, activate the so-called "Gateway options" of the RFC destination SAPXPG_DBDSET_<DBHOST_NAME> using Transaction SM59: SM59 -> TCP/IP  connections -> SAPXPG_DBDEST_<DBHOST_NAME> -> Destination -> Gateway  options: Set Gateway host and Gateway service -> OK

Try to set it and see whether it helps.

Good Luck

Cheers

RB

[Former Member]

Hi Reagan,

I am appreciating your advice, buit i am not thinking about standalone gateway. Here the point is why the standard procedure is not working.

I have tested few more things like the parameter gw/remsh which was pointing towards /usr/bin/rsh then at CI host i called up the command rsh <target host> -1 <sidadm> sapxpg to test whether it can execute SAPXPG as external program on db host or not guess what it says rsh is not a recognized command. I searched for remote shell at my CI and db host, it is not installed at all. I found from Linux team, for remote communication, we use secure shell SSH, therefore i called SAPXPG program at CI host with SSH, and it works fine.

ssh <target host> -1 <sidadm> sapxpg it shown desired result.

Therefore i have changed the parameter gw/remsh pointing towards /usr/bin/ssh, now i checked RFC test, it takes some time to process but again failed with time out error. I checked dev traces, rfc trace etc., all says same error "time out" except dev_rd trace which is pointing a little different as below

Wed Mar 13 16:52:39 2013

GwDpInit: attached to gw_adm at 7f26c9d5e650

child (pid=27824) exited with exit code 255

Permission denied, please try again.#

Permission denied, please try again.#

Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).#

Will you please advice what would be the cause? Why permissions are not denied, when i was testing it at OS level of CI host towards target host (db server), why RFC is failing for sapxpg in SAP itself?

Thanks for your help.

[Reagan]

Morning Kalra

Note 10403 - Starting external programs

Note 446172 - SXPG_COMMAND_EXECUTE (program_start_error) in DB13

Note 34219 - DB13: CPIC error CM_RESOURCE_FAILURE_RETRY

The above SAP Notes says that "rsh" is normally used. If the systems are not set up with that then have them set it and check whether it helps.

Both rsh and ssh provide remote connection, but ssh is secure.

From the Gateway trace you have provided it appears to me that the ssh parameter is expecting a password.

I am not sure whether the parameter gw/remsh can be functional when the value is ssh.

One tip I can give you is this :

Check whether the PasswordAuthentication is set to "no" or "yes" in the /etc/ssh/sshd_config

If it is yes then change it to no and restart the sshd service. Not sure whether it will help but it is worth trying.

Now check this note:

Note 980266 - RFC destination SAPXPG_DBDEST_<DB-HOST> does not work

The note says that the Gateway options should be used as remote shell is considered not secure and not used due to security reasons.

Please go through the note and see whether it helps you.

Will you please advice what would be the cause? Why permissions are not denied, when i was testing it at OS level of CI host towards target host (db server), why RFC is failing for sapxpg in SAP itself?

Not sure.

Maybe it will work after a restart of the SAP system. (just guessing)

Cheers

RB

[Former Member]

Hello Reagon,

Thanks for your support. I solved the issue.

Here is the background of problem:
Since we have a distributed system where SAP central instance is installed on one server and DB instance is installed on another server so we need to do certain tasks at DB level but through SAP appliction itself for example db cleanup log, which should be done through background job which runs every Sunday to cleanup the old logs, since last couple of weeks it was failing. I wanted to troubleshoot it and as per analysis, the background job schedules at SAP application level which actually calls SAPXPG program .

When the job was failing, there was an issue, so checked the RFC connection, (which points towards db server where the external program should execute) which installed during SAP installation, which says perform such tasks either with remote shell command or through gateway. We haven't installed standalone gateway on db servers so only option would be remote shell command.

I pointed the SAP profile parameter gw/remsh=/usr/bin/ssh, and then checked the RFC connection, it was keep failing with error connection timed out, check partner availability. DB server was pinging and up.

Another error, i found in another SAP log that permission denied so i doubted there must be something needs to improvise at OS, it must be asking password thats why connection got refused.

I checked SSH svlixxca2 -l rd1adm sapxpg to check whether, at OS, it works or not. It asked password for rd1adm at svlixxca2 as doubted, correct. another issue noticed that after entering to svlixxca2, it says sapxpg command is not found so, this means it is not getting path.

Changes made to correct the errors:
1. Secure copied the .user_bash_profile of sidadm at svlixxca1 to svlixxca2 under /home/sidadm, which solved the issue, that command got the program SAPXPG at svlixxca2.
2. To omit the password prompting during communication at SSH level, generated public and private keys using ssh-key-gen at svlixxca1 and copied  ssh-copy-id to svlixxca2, which allowed sidadm to login on svlixxca2 without entering password.

Now everything looks fine, and db13 jobs are running fine. Thanks everyone who tried to help me.

Regards.

[sunny_pahuja2]

Hi,

Have you tested this RFC with user other than DDIC? Could you please also paste error log of JOB or SM21 log?

Thanks

Sunny

[Former Member]

Hi Sunny,

I haev tested the RFC with the user who has all authorizations and it says same not authorized to start TP sapxpg on host svlixxca2.

Job log says

10.03.2013 03:00:12 Job started                                                                                                 00           516          S

10.03.2013 03:00:12 Step 001 started (program RSDBAJOB, variant &0000000000000, user ID DDIC)                                   00           550          S

10.03.2013 03:00:12 No application server found on database host - rsh/gateway will be used                                     Q2           305          I

10.03.2013 03:00:12 Execute logical command BRCONNECT On host svlixxca2                                                          Q2           233          S

10.03.2013 03:00:12 Parameters: -jid CLNUP20130303030000 -u / -c -f cleanup                                                     Q2           233          S

10.03.2013 03:00:12 SXPG_STEP_XPG_START: is_local_host: rc = 403                                                                00           001          S

10.03.2013 03:00:12 SXPG_STEP_XPG_START: host = svlixxca2                                                                        00           001          S

10.03.2013 03:00:12 SXPG_STEP_XPG_START: is_local_r3_host: rc = 802                                                             00           001          S

10.03.2013 03:00:12 SXPG_STEP_XPG_START: RFC_TCPIP_CONNECTION_OPEN: rc = 1003                                                   00           001          S

10.03.2013 03:00:12 SXPG_STEP_COMMAND_START: SXPG_STEP_XPG_START returned: 1.003                                                BT           351          S

10.03.2013 03:00:12 SXPG_COMMAND_EXECUTE(LONG)                                                                                  BT           645          S

10.03.2013 03:00:12 <timestamp> = 20130310030012                                                                                BT           645          S

10.03.2013 03:00:12 COMMANDNAME = BRCONNECT                                                                                     BT           645          S

10.03.2013 03:00:12 ADDITIONAL_PARAMETERS = -jid CLNUP20130303030000 -u / -c -f cleanup                                         BT           645          S

10.03.2013 03:00:12 LONG_PARAMS                                                                                                 BT           645          S

10.03.2013 03:00:12 OPERATINGSYSTEM = ANYOS                                                                                     BT           645          S

10.03.2013 03:00:12 TARGETSYSTEM = svlixxca2                                                                                     BT           645          S

10.03.2013 03:00:12 DESTINATION                                                                                                 BT           645          S

10.03.2013 03:00:12 SY-SUBRC = 1003                                                                                             BT           645          S

10.03.2013 03:00:12 SXPG_COMMAND_EXECUTE failed for BRCONNECT - Reason: program_start_error: For More Information, See SYS      Q2           233          E

10.03.2013 03:00:12 Job cancelled after system exception ERROR_MESSAGE                                                          00           564          A

------------------------------------------------------------------------------------------------------------------------

but in sm21 there is a line of log and nothing is there

03:00:12 BTC  012 000 DDIC                  LC  2 Error 1003 when executing external command brconnect on (xpgid=0,convid=.)

-----------------------------------------------------------------------------------------------------------------------

Please help.

Thanks

[sunny_pahuja2]

Hi,

Check SAP note 446172.

Thanks

Sunny

[Former Member]

Hi Sunny,

This Note i have already checked, it doesn't say anything about RFC, i am surprised why RFC connection is not working, in fact if i call br tools at OS level with my ora<sid> user, it works fine.

Do you shed some light on it?

Regards, - vikas