Strange Issue with EAM logs

[Former Member]

Dear Experts,

I have been facing a strange issue with EAM GRC 10.0 on Consolidation Logs.

Background - GRC system version 10.0 , SP12.

System connected to GRC - ECC, CRM, BW, Net weaver Gateway.

Findings Made - This is not related to Time difference issue, the GRC is getting right data in Tables

Issue with System - Net weaver Gateway

Actual Issue - The Netweaver Gateway system has been integrated correctly with GRC and I am able to get all the FF logs.

In the GRC, the GRACACTUSAGE table is also getting correct data on the FF user activities.

However, when I go to NWBC and click on the Session details on FF log , it displays Blank. Even when I try to fetch from Cosolidation logs, it says No Record Found

This is quite strange as the correct data is flowing in GRC sytem but not getting displayed via NWBC consolidation logs.

Could you please share you ideas on this. Your help is highly appreced..

Wish you a very Happy New Year in Advance!

Thanks,

Mrudula

[Former Member]

Hi Mrudula,

Please check if all the basis jobs are running on the GRC server and also the Collector job is running properly on the GRC server or not.

Since we faced this issue long back for 1 of the customer and it got resolved once all the Basis  jobs and Collector job  started running properly.

Regards

Pradeep

[Former Member]

Hi Madhu & Munish,

Thank you for your quick response.

Here are the details:

Madhu - this issue is not related to the one you mentioned. Because the FF ID log is generationg for all users. However, for none of the the consolidation logs are generating.

However, as mentioned earlier, the backed end tables GRACTUSAGE is getting right data, but this is not reflecting on NWBC

Munish - The FF table is rightly getting updated. All entries are seen about when the FFID has logged in, and from GRACTUSAGE can find the T-codes the FFID has launched. The issue is, the consolidation logs are showing no record.

[Former Member]

Hi Mrudula,

I believe you have done following activities.

1)You might have already run FF log synch job or Update Consolidation log report.

2)Did you verify FF tables like GRACFFLOG?

3) Did you check authorization relevant to FF?

Share you parameter settings for all FF ?

Thanks

Mohan

[Former Member]

Hi Mohan,

1.Yes please. I have run all the sync jobs

2. GRACFFLOG tables has been updated with the FF User & log details correctly. Also, GRACACTUSAGE gives me details on what T-codes have been launced by FFID

3 The FF has all the required authorizations

Sorry, did not get what parameter setting are you asking about.

Infact when I log on to NWBC and click Firefighter log report, I get the right report. Also I get the reason code report. SLG1 shows all . No error anywhere.

Only when I click on Session details in Fire fighter log report and try directly accessing via Consolidation Log report, nothing gets populated.

[madhusap]

Hi Mrudula,

Please check Timezone settings as well as authorizations to RFC user as per below SAP note :

1775432 - Transaction logs are not getting captured by GRC 10.0

When you run FF LOG sync job, you can check the logs in SLG1, if session found or not also check if RFC user has authorizations as mentioned in note 1775432

Also can you confirm which method you are using for Firefighter approach, Centralized or De-Centralized ?

Regards,

Madhu.

[Former Member]

Hi Madhu,

We are using the centralized firefighting approach.

Both the systems, GRC and plugin are in the same time zone. Also, I assume RFC users has all authorizations, because the Transaction log is getting captured in GRC tables GRACACTUSAGEand GRACFFLOG, the issue is it does not display via NWBC consolidation logs.

Thanks,

Mrudula

[former_member193066]

its an auth issue, rfc user on backend system must have access to S_TOOL_EX.

check if he it has or not try to add this access.

You should be fine

Regards,

Prasant

[former_member193066]

its an auth issue, rfc user on backend system must have access to S_TOOL_EX.

check if he it has or not try to add this access.

You should be fine

Regards,

Prasant

[Former Member]

Hi Prasant,

The RFC used is Trusted RFC. And the current user which executes this has S_TOOLS_EX authorisation. Still the same issue

[Former Member]

Hi Prasant

Can you please tell me how you have achieved the portal role+technical role assignment using a dummy role in GRC 10?

It will be a huge help!

Thanks

Uma.

[Former Member]

Hi Mrudula,

Please try to troubleshoot it. Check SLG1 logs of the sync job. Check if there is any error.

How EAM works:

User login to FF ID: Notification email triggers to controller of the FF ID.

User logout: Another notification trigger and email goes to controller to review the FF logs.

Tcodes executed will store in STAD and Batch user fetch this transaction data from STAD.

Batch user should have authorization to fetch this data.

1. Data fetch from STAD à Store in FF tables à Workflow sync job trigger workflow.
2. If data is not stored in the FF table by Batch user .Workflow will not get trigger.

Regards

Munish kumar

[madhusap]

Hi Mrudula,

Is it happening for few Firefighter sessions where Session Logs are missing or happening for all Firefighter sessions?

We have seen this behavior recently where I logged in and logged off with Firefighter ID for 3 consecutive times and found that session logs are missing for one session where as for other two sessions I can see the session log data.

We have reported this to SAP as well. We are on GRC 10.1 SP06.

Is your issue the same?

Regards,

Madhu.