Hi Experts,
- Our PRD system is using SAP ECC 6.0 EHP5 with 2 physical servers: APP and DB. We've load balancing, active log shipping and DB clustering.
- Both servers are using Windows 2008 R2 (Enterprise) with MS SQL Server 2008 R2.
- Current DB size is about 90GB with about 200 active users.
- Audit log had been activated on both servers.
FYI, we've already changed DDIC account to a non dialog type (system) and it's only being used when there is a proper authorized request and approval. The account is not locked.
So far this account has not been used, however, when we checked the system audit log using SM20, we've noticed that there are some logon activities by this account for executing a batch job program (RSBTCRTE).
-> "Terminal" and "TCode" columns are empty.
-> Program: RSBTCRTE
-> Message Text: Logon Successful (Type=B)
Here are some SM20 output on DDIC account:
Name Date Time User Terminal TCode Program Message Text
SAP-PRD 31.07.2013 11:46:46 DDIC RSBTCRTE Logon Successful (Type=B)
SAP-PRD 31.07.2013 11:46:55 DDIC RSBTCRTE Logon Successful (Type=B)
SAP-PRD 31.07.2013 11:46:55 DDIC RSBTCRTE Logon Successful (Type=B)
SAP-PRD 31.07.2013 11:46:58 DDIC RSBTCRTE Logon Successful (Type=B)
SAP-PRD 31.07.2013 11:46:58 DDIC RSBTCRTE Logon Successful (Type=B)
We've checked all over on our system and could not figured it out.
We've checked SM59 for all batch jobs and there are no any batch jobs scheduled using this account and for this particular date and time.
We know logon "Type=B" is used for background job and nobody should be able to use this account to logon and perform anything as this is a non dialog account.
We wanted to know where to check and find out why DDIC is being used to perform this activity and what is this RSBTCRTE program about?
Appreciate if anybody help out on this issue.
Thank you in advance.
- Peter
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.