SM21 logs "Trace transferred from remote client" --- Very urgent

[former_member190251]

Hello All,

'I am having an inquiry with regards to the sm21 logs " Trace transferred from remote client". Could you please let me know who activated this trigger (by user or running any program)

Please help me as the customer is chasing us for this log.

Regards

Subbu

[Former Member]

Hello,

look at this SAP Note 357683 - Trace adopted by remote client

As there is written in the SAP Note ("If you then switch to another computer via RFC, syslog message R1M is written") it might be that trace is turned on in another system connected to this one through RFC. Can you send the whole detail of one of these log messages?

Kind regards

[former_member190251]

Hello,

Thanks for the reply,

I am not clear. Could you please tell me in detail. Customer want to find who activated the trace but i am unable to find it. I have checked in STAT also. Please help me

You recommened the below note but i am getting the error as Trace transferred from remote client"

357683 - Trace adopted by remote client

Please find the log of dev_w0

[former_member190251]

hello

Please find the log clearly

[ ampsv04201prd -PI1:root:/usr/sap/PI1/DVEBMGS00/work:] more dev_w21.old | grep -i trace | more

*  ACTIVE TRACE LEVEL           1

*  ACTIVE TRACE COMPONENTS      all, MJ

M  TRACE FILE TRUNCATED (pid = 11076058 )

M  ***LOG R1M=> ThRqAccept, activate trace () [thxxhead.c   5561]

*  ACTIVE TRACE LEVEL           2

*  ACTIVE TRACE COMPONENTS      All

M  eppSetTraceLevel: changing trace level to 2

M  *** BEGIN USER TRACE  UID >31816< MODE >1< STEP >1< REQID >65188< TIME >063029< DATE >20140807< WP >21< WP_TYPE >DIA<  CONV_ID >71407595<

A  RFC SignOn> [1] ab_MakeTicketRcvInternal (buffer leng: 58, sum leng: 0, trace: 0)

A  RFC SignOn> [1] ab_MakeTicketRcvDBKey (buffer leng: 82, sum leng: 150, kleng: 64, trace: 0)

M  RstrSetUserTrace: remote tracing disabled by parameter

M  ThEppImport: imported trace flags 0x0/0x0

M  ThCPIC: activate trace for >71407595<

A  RFC SignOn> [2] ab_MakeTicketSndExternal (buffer leng: 82, sum leng: 150, kleng: 64, trace: 0)

A  RFC SignOn> [2] ab_MakeTicketSndInternal (buffer leng: 54, sum leng: 58, trace: 0)

M  ThISAPCMINIT: use external trace level 2

M  ThCPIC: activate trace for >71409639<

M  ThCPIC: activate trace for >71409639<

M  ThCPIC: activate trace for >71409639<

M  ThCPIC: activate trace for >71409639<

M  ThCPIC: activate trace for >71407595<

M  *** END USER TRACE NAME >ALEREMOTE   <  UID >31816< MODE >1< STEP >1< TIME >063029< DATE >20140807< WP >21< WP_TYPE >DIA<

*  ACTIVE TRACE LEVEL           1

*  ACTIVE TRACE COMPONENTS      all, MJ

M  eppSetTraceLevel: changing trace level to 1

M  ***LOG R1M=> ThRqAccept, activate trace () [thxxhead.c   5561]

*  ACTIVE TRACE LEVEL           2

*  ACTIVE TRACE COMPONENTS      All

M  eppSetTraceLevel: changing trace level to 2

M  *** BEGIN USER TRACE  UID >489< MODE >1< STEP >1< REQID >44718< TIME >074037< DATE >20140807< WP >21< WP_TYPE >DIA<  CONV_ID >75245713<

*  ACTIVE TRACE LEVEL           2

*  ACTIVE TRACE COMPONENTS      All

M  eppSetTraceLevel: changing trace level to 2

M  *** BEGIN USER TRACE NAME >ALEREMOTE   <  UID >489< MODE >1< STEP >2< REQID >45046< TIME >074040< DATE >20140807< WP >21< WP_TYPE >DIA<  CONV_ID >75245713<

M  ThSwitchSapTrace: current OFF want OFF

M  PfTraceActInterval: after roll in (is_open/num_of_int/act_index/act_depth=0/0/-1/0)

A  RFC SignOn> [3] ab_MakeTicketSndExternal (buffer leng: 82, sum leng: 150, kleng: 64, trace: 0)

A  RFC SignOn> [3] ab_MakeTicketSndInternal (buffer leng: 54, sum leng: 58, trace: 0)

M  ThISAPCMINIT: use external trace level 2

M  ThCPIC: activate trace for >75252939<

M  PfTraceActInterval: before roll out (is_open/num_of_int/act_index/act_depth=0/0/-1/0)

M  *** END USER TRACE NAME >ALEREMOTE   <  UID >489< MODE >1< STEP >2< TIME >074040< DATE >20140807< WP >21< WP_TYPE >DIA<

stdin

[Former Member]

Hello Fellows,

This message is related with Trace Level in SM50:

If you check above, someone have changed the trace level for the workprocess:

*  ACTIVE TRACE LEVEL           2

*  ACTIVE TRACE COMPONENTS      All

M  eppSetTraceLevel: changing trace level to 2

Regards,

Claudio

[isaias_freitas]

Hello,

Such syslog entries are not related to increasing the trace level through SM50.

They are related to user/RFC traces (possible enabled at a remote - client - system).

The SAP note 357683 (mentioned before, in this thread) informs that parameter you can use to make your system to not accept remote traces.

The dev_w21 log provided shows that the trace is active for the user ALEREMOTE.

Try checking the corresponding RFC trace (dev_rfc21) to see whether you can determine the source of the RFC connection. You can use the timestamp or the conversation ID.

Once the source has been identified, you need to disable the trace at the source system.

Regards,

Isaías

[Former Member]

Hello,

Check note 357683 - Trace adopted by remote client

BR,

K.