Error Semi-Automatic Control

[Former Member]

Hi gurus,

When I plan the testing of a semi-automatic control in GRC 10.1, I don´t have any problem if it is based on tables. However, if it is based on ABAP reports, I got an error in the job monitor.

Any idea of what can be happening?

[Former Member · Accepted solution]

Hello John,

I have some tips for you in order to troubleshoot this scenario.

1. If you are using asynch mode, the best way to find out the issue is by going to the target system and look in SM37 for the name of the job you gave when scheduling the job. If you go to job details, there might be some information there.

2. Make sure the RFC user which collects the data from the target system, has enough permissions to execute the next step of the job in the foundation system(when executing in asynch mode)

3. You can check in SLG1 for a detailed log description.

Could you please provide us the error message?

Thank you,

Fernando

[Former Member · Accepted solution]

Hi Fernando,

Thanks for you quick response.

1. There is nothing interesting when I just look at SM37.

2. The RFC User contains all the permissions to execute the job. (Could you please give details about which are the object and values the RFC User should have?).

3.About SLG1, there is one error when creating the job but no details. (Attached you can see the error that I found).

Thankssss!!!!!

[Former Member · Accepted solution]

Hello John,

Sorry if I ask you too obvious questions but I need to understand if everything is working fine in your system. Here we go:

1. Have you checked the reports in the plug-in (/GRCPI/OVERVIEW)? Also, have you run the ABAP program to check if it is working without CCM?

2. Is there any other messages in the job log steps?

3. Are you using Synch or asynch mode?

Thanks,

Fernando

[Former Member · Accepted solution]

Thanks for your response Fernando,

Here you have the answer to your questions:

1. The report is in this table and the report is working fine. The problem I guess is on the ABAP reports option because I have tried to create more than 1 data source based on different reports and the still the same error.

2.In the job log steps I also have the message:

Communication failure with remote system GRD100-DPN100 ### ########## ## ## 1000

3.Communication mode: Asynch mode.

Any idea of what can be happening?

[Former Member · Accepted solution]

I created another Data Source, and when repeating exactly the same issue, I got the message.

Communication failure with remote system XXXXX. You dont have authorization for this transaction in.

Any idea of what can be happening?

[Former Member · Accepted solution]

John,

Throw a trace on the ID in the backend ECC system and run your test again.  Looks like the ID in the backend system does not have the required authorization to successfully execute.

Matt

[Former Member · Accepted solution]

Hi Matt,

Thanks for your reply. What do you mean with ID? the ID system?

Should I check the RFC User?

Thanks,

Kind regards,

[Former Member]

Hello John,

Glad we found an error message which says exactly what is happening in the system. As you are using Asynch mode, system will create one job in the back-end system and another one for the callback with the data analyzed.

Matt is right. You do not have enough authorizations and in this case, to create the background job (according to the first logs provided in the thread).

The authorizations required are for the RFC user. In this case, you should check the authorizations of both RFC users. You must have RFC user to call the target system, and also another RFC user who will perform the call back. Check these users in the respective ABAP connectors.

Suggestion: Provide SAP_ALL and GRFN_USER ACTVT 02 and check if the issue is gone. After it, you can trim the authorizations.

Let us know whether it works or not.

Best Regards,

Fernando

[Former Member]

Hi Fernando,

Thanks for you advise.

I guess I solved the isse deleting the connectors and setting them back again. BUT, now when I create a business rule based on an Standard abap report, the system works perfectly. Otherwise, when I create a business rule based on a customized report, it fails. No dumps neither in GRD nor in ECC system.

Attached you can see the screenshot from SLG1  in GRC(the only error I have) which says "Creating job starts".

Any idea of what can be happening?

Thank you so much!

[Former Member]

Hi John,

What happens if you execute this customized report directly in ECC?

Does it work?

Is the status of the job "in Process" or "error"?

Check whether the user who executes the plan have access to SM36. I would consider what Matt said in his previous reply. Try to execute a trace in order to catch any authorization missing.

Thank you,

Fernando

[Former Member]

Hi Fernando,

I can exactute the customized report directly in ECC. No problem with that.

When you say, the user who executes the plan have access to SM36, you mean RFC? and where? in ECC or in GRC?

Thanks,

Kind regards,

[Former Member]

Hi Fernando,

Thanks again for your message. I tried with another data source and I got the messsage

Communication failure with remote system XXXXXXXXX ½Õâ ßÞÛÝÞÜÞçØÙ ÝÐ ±µ 1000.

Why this strange symbols? What can be wrong?

Any idea?

Thanks,

Kind regards,

[Former Member]

Hello John,

That is a really strange error message. As you are using asynch, I believe the issue is when the RFC user tries to create the job in the back-end system. You must have 2 jobs scheduled in the back-end system, one for running and the other one to send the results back to the system.

Have you provided the authorizations SAP_ALL and GRFN_USER ACTVT 02 to the RFC users?

If authorizations are not the root cause, then I would consider opening an incident with us. But, first of all, check the scenario again with RFCs users containing all the authorizations above.

Thank you,

Fernando

[Former Member]

Hi Fernando,

I can not give SAP_ALL to the RFC Users, so I have to debug the error in other way.

Kind regards,

[Colleen]

Hi John

Switch a trace on the server (without filter) and then replicate the error. After that you can check for the system user or the end user to identify Authorisation issues. Also, if it is RFC related you will find ST22 in satellite system. SLG1 may assist as well

Assigning SAP_ALL (and S_RFCACL) to investigate is the quick way to check if it's PFCG authorisation related

Regards

Colleen

[Former Member]

Thanks for the info Colleen.

If I trace but the RFC does not have the permission he has to use, will it be registered in the trace?

Thanks,

Kind regards,

[Colleen]

Hi John

Yes it should be but failed RFCs also show up in ST22 and SM21

You've got nothing to lose to try running a trace but everything to learn

Regards

Colleen