GRC 10 Firefighter Log Report Review not sent out to controller

[Former Member]

We are on GRCFND_A-SAPK-V1017INGRCFNDA    GRC Foundation ABAP and Plugin system in on basis release 640 with GRC plugin GRCPINW-V1000_640-SP12. We have configured Centralized Emergency Access Management (EAM). All configurations are completed, tested and working fine for all plugin system. Then all of sudden it stopped sending ‘Firefighter Log Reports Review’ to controller when user firefight in plugin system at Basis release 640 and 620. I checked with basis team nothing has been changed from system prospective. I can find the data in GRACACTUSAGE and GRACFFLOG table. Also ‘Firefighter Log Summary Report’ is showing for connector at Basis release 640 and 620. But ‘Consolidated Log Report’ is empty.There is nothing in ABAP dump or SLG1 log. I have given SAP_ALL to just rule out authorization issue. EAM Log sync job has been running in the GRC system successfully. Plugin system time and OS time are in sync. 

I have Applied notes:

0001941542 - CALL_FUNCTION_NOT_FOUNDdumps on running EAM Sync job

0002062450 - EAM function modules are missing in 640 and 620 releases

Please advise if any of you got into such issue and how you solved it. I would deeply appreciate your thought.

[Former Member · Accepted solution]

I would like to thank all of you for suggestions and comments. I changed
firefighter log sync job from every 1 hour to every 6 hours. Since then system
is sending ‘Firefighter Log Reports Review’ to controller without any miss. My
issue seems to be resolved.

Arvind

[former_member674995 · Accepted solution]

I have a similar issue where the job runs every 3 hours but not all the FF activities are triggered to controllers , There is a miss of few FF review Items

[former_member191076]

Hi Arvind,

is your workflow process(SAP_GRAC_FIREFIGHT_LOG_REPORT) configured properly?

Regards,

Charan

[Former Member]

Hi Charan,

Configuration is correct. Controlers are getting firefighter log review email notification for
all other plugins and also randomly for plugin where I have issue. I believe it is issue with basis release 640 because I have one plugin on basis 620 and we donot have any issue.

Thank you for looking into it.

Arvind

[Former Member]

Hello Arvind,

did you find a solution to the problem?

I am facing a similar issue where GRACFFLOG has multiple entries for the flag WORKFLOW_SENT != 'X' and so they do not appear in the 'Search Requests' section of Access Management work center.

But the FF checkout instances are showing up in 'FF Log summary report' and you don't find the corresponding instances in 'Search Requests'.

Thanks,

Pawan.

[Former Member]

We have a message open with SAP since one month, We are going back and forth. My situation is bit strange. I do get email notification for firefighter log review but it is random.

Did you check your plugin system and server time? It should be same.

[Former Member]

In my case, MSMP workflow is not started for the FF Log instance, as the action usage job was running into missing permissions in the plugin system to pull transaction usage log, I found a SAP note that talks about this behavior so I am hoping once the auth.error for communication user is fixed, the workflow would resume.

Pawan.

[former_member193066]

Hello,

Could you please confirm you are using workflow or just email ?

Regards,

Prasant

[Former Member]

Hi Prasant,

I am using workflow.

[Former Member]

Dear Arvind,

Could you check the below

- '4007 and 4009 is set as YES

- 'Workflow' is set for Controller, in Notofication type

- schedule grac_spm_log_sync_update as a periodic(hourly/daily) background job

In Consolidated log report, execute Update Firefighter Log button, to see the report

regards

plaban

[Former Member]

Hi Plaban,

4007 and 4009 are set to YES, Workflow have Controller in Notification Type, and job is scheduled hourlly. Please find the screen shot.

It has been working and then stoped. please advise