Extracting the list of tcodes consumed by SAP-System

[former_member211709]

Dear Experts,

We are on the process to revamp the authorization process. for which we have to find out the list of tcodes and roles exactly used in our system,( Eg-There may be a list of 1,00,000 tcodes which SAP delivered in the system. we must have consumed only 20,000 or so)..

Quiries

1) Is there any way to find out the exact list of tcodes consumed ?

2) If yes.., how can we find the list of roles against these tcodes or list of tcodes against roles ?

Pls help us with possible inputs.

Thanks in Advance !!!

Regards

Krishna

[JonathanM]

Hi,

This is possible as the user activities are logged in SAP.

You can use the transaction STAD to get the list for each user. Also check the user profiles from transaction ST03N.

You could create your own program using the function module SAPWL_WORKLOAD_GET_STATISTIC and compare with the user's roles.

Pay attention that the log is kept for the 3 last months (depending of the system config). Sometimes there are transaction used once a year...

Best regards,

Jonathan

[Former Member]

Hi Krishna,

1. Tcodes consumed Use ST03 > Expert Mode> Select the last month. in the Analysis Views> expand the Transaction Profile > Standard. here we can see the list of Tcodes executed in the entire month. i think 1 month data will be sufficient for you.

2. Roles against these Tcodes: This may not be possible, because one Tcode may present in several roles.

Thanks

Kishore Cherukumalla

[Former Member]

kish ch wrote:
 1. Tcodes consumed Use ST03 > Expert Mode> Select the last month. in the Analysis Views> expand the Transaction Profile > Standard. here we can see the list of Tcodes executed in the entire month. i think 1 month data will be sufficient for you.

Hi Kishore, I generally recommend a minimum of 6 months (covering a year end) to get a good view of transactions used.  1 month often doesn't cover quarter or year end where some important closing & reconciliation activities take place.

Cheers

[Frank_Buchholz]

In addition to use transaction ST03N directly you can use following new program from SCN:

How to use Workload Statistic to optimize Authorizations for SAP ABAP

Here you find my old report ZRFC_STATRECS_SUMMARY to analyze RFC calls and the new report ZTCODE_STATRECS_SUMMARY to analyze transaction calls. (Stay tuned, as I'm currently extending this report).

Kind regards

Frank

Links corrected

[Former Member]

Hi Frank, I get an error for the link you posted but this one appears to work:

https://cw.sdn.sap.com/cw/groups/how-to-use-workload-statistic-to-optimize-authorizations-for-sap-ab...

Krishna - if you have the security audit log running then you could also look at using that.  As with ST03N it's usefulness for your requirements is dependent on the period of time that is logged.

[Former Member]

I can't seem to open this link: How to use Workload Statistic to optimize Authorizations for SAP ABAP Is the document still available?

Krishna,

As mentioned before you could use ST03(N) to get insight in the transactions that are used.

Via SUIM you could find which transactions are part of a role. You could then restrict the role to not include transactions that haven't been used for a specific time. It's a tedious job, but if you want to stay close to the principle of least privilege a good one to perform on regular basis

Hope this helps.

Kind regards

Maaike

[Frank_Buchholz]

Links corrected, please try again.