EAM Logs not available

[Former Member]

Hi All,

I am on 10.0 SP10

I have gone through some threads on GRC portal on EAM logs non-availability and they talk mostly about following causes,

• TIME difference.

               I have following in my GRC foundation and plugin system

              

         Should last and second last time fields display same value? is this the meaning of having the synch in time.

• SM19, STAD, SM49

              I have activated SM19 (Collecting data I can see in SM20) , STAD also working fine.

But after this too there is not data in following tables after EAM synch

• GRACAUDITLOG
• GRACCHANGELOG
• GRACOSCMDLOG
• GRACSYSTEMLOG

Only table GRACFFLOG has entries which I am getting in FFID login notification.

Any advice please?

BR,

Mangesh

[alessandr0 · Accepted solution]

Dear Mangesh,

regarding the time differences. You have to make sure that the GRC box and the plugin system do have the same time zone. See also note 1595462.

As from my experience with all other questions regarding EAM and missing data while running sync job it had mostly to do with time zone.

Also there was a change in authorization which needs to be checked in the backend system. Best if you trace the batch user and check if the user has the proper authorization to gather data from the backend. Therefore run the sync job and check SLG1 in the backend if some authorization is missing.

Looking forward to hear from you.

Regards,

Alessandro

[Former Member · Accepted solution]

Dear Alessandro,

Thanks for you time

We have same settings for GRC and plugin, but the problem is,

Our GRC and PLUGIN SAP server time is CET and

GRC and PLUGIN OS server time is IST

so they are in synch in reference to CET and IST time difference which is 4.30, screenshot for your reference.

Somewhere during my search on GRC portal someone had suggested last and second last line time should be same to make it work (as per the screenshot).

Could you send me the same screenshot of your working system, if I am not violating any principles here.

WF-BATCH has SAP_ALL and SAP_NEW, so includes the object S_TOOL*'

BR,

Mangesh

[alessandr0 · Accepted solution]

I have in both system the same system time and both are in the same time zone and EAM log sync job runs perfectly.

[Former Member · Accepted solution]

you mean to say last two fields showing same time? in GRC?

[alessandr0 · Accepted solution]

yes - as I remember it is important that the grc box and the system you are gathering your logs are having the same time zone.

[Former Member · Accepted solution]

Do we need to schedule job /VIRSA/ZVFATBAK in plugin systems? I read it in WIKI, is it applicable for AC10.0?

[Colleen · Accepted solution]

Hi Mangesh

What's your link?

/VIRSA namespace is pre 10.0 (5.3)

Regards

Colleen

[Former Member · Accepted solution]

Hi Colleen,

I am on AC10.0 SP10, but as program /VIRSA/ZVFATBAK is available in plugin system thought if that can be one reason.

Or you asking for any other link to understand if I am on 5.3 or 10.0.

I need some confirmation on system timings, so I can force my basis team to implement the changes.

I have GRC and ECC application server on CET time zone and respective OS server is on IST.

In system status it shows the difference of 4hr 30 min as per screen shot I posted in this thread.

I gone through some notes and they suggest to have system zone in synch, but they do not pecify how to confirm this. As basis team said they are in synch in reference to CET and IST which is 4hrs 30 min.

BR,

Mangesh

[Colleen · Accepted solution]

Hi Mangesh

Yes I was asking which wiki post mentioned that program - do you have the URL?

Timezones (as mentioned above) are meant to be the same. I'm not sure if also the OS/DB layer needs to match as well, however, the GRC and ERP system do. I recall this being asked in SCN a while a go and suggested a customer incident be raised with SAP for guidance.

I think this is the thread:

"SAP updated theire code and realised a new SAP NOTE "1952693" after implementing this note issue got fixed."

Perhaps you can look at that note if it applies to your situation.

Regards

Colleen

[Former Member · Accepted solution]

HI Colleen,

The link is Scheduling Firefighter Background Jobs - Governance, Risk and Compliance - SCN Wiki

Thanks for thread link.

In that thread you have mentioned,

"I was under the impression time zones must be the same in the GRC and satellite system for the STAD collection. Also, match with OS timezone as well."

When you say GRC and Plugin systems time zones should match.

I have them same as CET for SAP Application instance, but the OS server has time zone IST.

so in system status I get system time IST and time zone setting to CET and CET time.

Also the note 1952693 is about logs not getting updated if FFID session is active, but his log collection is working otherwise.

But thanks for your advice.

Could you  please suggest any remedy in my situation.

BR,

Mangesh

[Colleen · Accepted solution]

Hi Mangesh

Yes that's what I was told back on training or when I first started. Unless SAP has issued a KB article or Note to advise otherwise quite a few of us work under that impression

I didn't look at the note but only linked as it was an example of similar symptom you had. Although, if there is a time zone difference could GRC be 'thinking' the FF session is in use or hasn't occurred

Are you able to comment on the wiki link for /VIRSA scheduling sitting under GRC 10

Regards

Colleen

[Former Member · Accepted solution]

Hi Colleen,

Could you please send me the KB article or a note which mention otherwise?

Well that is true, system may not be getting the logs to link FFID session in GRACFFLOG to link with the dtails from Plugin system. But is there a way to check if synch job getting data and could not synch it due to missing time stamp?

No, I am unable to comment on wiki link, there is no option available for me.

BR,

Mangesh

[Colleen · Accepted solution]

Hi Mangesh

I'm not sure of the article (if it was an article), it was something I was told 12+ months ago

The comment on wiki - that was poor grammar on my behalf. I was asking the author to come join this discussion and provide some feedback (as he's also Moderator and SAP Employee). Let's see if Fernando joins with some information

Regards

Colleen.

[Former Member · Accepted solution]

Hi Colleen,

No problem but thanks for your time and valuable inputs.

I will wait for the update.

Have a great day ahead

BR,

Mangesh

[Former Member · Accepted solution]

Hi Friends,

I have GRC system and Plugin system now both set to IST, but my GRACFFLOG table in GRC box  has timestamp entries like 20.140.528.074.150  (2014.05.28.07.41.50) for FF id login to the plugin system Date & Time: 28.05.2014 13:11:50.

my STAD at plugin has respective entries for FF user at 13:11:50

Does the FFLOG entries are written to OS server files where the OS server time is 2014.05.28.07.41.50?

Can anybody match there entries in GRC-GRACFFLOG  and Plugin-STAD, if they matches?

BR,

Mangesh

[Former Member · Accepted solution]

Dear Friends,

The issue is resolved, here are the details so it may help others,

I am on AC 10.0 SP10 and backend ECC6/ GRCPINW    V1000_731    0004    SAPK-10504INGRCPINW    SAP GRC NW Plug-in

• I have corrected time zones for the same,

GRC and ECC now on the same time zone and time. (INDIA)

OS servers were on time zone (INDIA) (So cannot confirm if we need SAP application as well as OS on same time zone)

• I have applied note 1893579 on backend system,

After applying note EAM synch job filled GRAC*LOG tables and after batch risk analysis I have all logs available in EAM consolidated log reports.

My analysis,

I also trying to link the entries form GRACFFLOG to check for time stamp, this table has respective time stamp in UTC time zone against FFID entries, they still have the same, so do not conclude that if GRACFFLOG stamps should be in synch, which was the mistake I commited during troubleshooting.

Hope this will help someone. Feel free to ask question if any, would be happy to help, always.

BR,

Mangesh

[Former Member · Accepted solution]

Hello Mangesh and Colleen,

Sorry I have seen this too late

Using program /VIRSA/ZVFATBAK, OS, Database and OS time zones must match. You can check through the report TZCUSTHELP. Another problem we had using this program (zvfatbak) is the user who executes the program. This user must have the time zone as the same user time zone in the system. For example:

User who executes the job has time zone set to CET. User time zone in the system must be CET as well. This information can be checked in STZAD transaction.

Hope I could help,

Regards,

Fernando