User gets locked by an external system but which one?

[Former Member]

Hi,

In an abap system, we have changed the password of our administration user. Afterwards, this user gets locked every 5 minutes, obviously because the user and old password has been used to set up communication from another system to the abap system. An RFC connection for instance or whatever. Sure it is possible to check all the systems you can think of to see if the user has been used for such a purpose. But how can you see in the system itself where the call comes from that locks it? I have tried the gateway tracefile but without success. Any suggestions?

Regards,

GK

[Former Member]

Hi,

Thanks for the answers so far. Unfortunately, the change documents do not provide the information I need and also via STAD I cannot find an IP or server name that reveals the source server/application that locks the account. The only thing I do see (but that was already there in sm21) is that the involved program is SAPMHTTP. I searched the obvious systems that logon via http but without result. The point is, I have had this situation before and I'm sure many more people have. Where someone created an RFC destination and used the admin user and after a password change, there it starts locking. You normally find the cause by looking for it in the obvious systems but that is in fact the other way around. Sure there must be a way to see the causing system/application in the affected system itself?

Regards,

GK

[Former Member]

Hi,

If the connection is via HTTP, look at the HTTP logs from the ICM with transaction SMICM : you should get the external IP there.

Of course the HTTP logs need to have been activated...

Regards,

Olivier

[Former Member]

Hi Olivier,

In the meantime, we have found the system that was using the administation user. No http logs are available so I cannot find the cause of the lock now from out of the system itself. But I will have a go on a test system to find out how this can be found.

Regards,

GK

[Former Member]

Hi Olivier,

I have done some tests with locks caused by sapgui and http. You can find the causing system in case of gui by setting the work process trace level to 2. Via the system log you can find the work process involved. In case of http, you can find the causing system by setting the work process of icm to 2 in smicm.

Setting a higher trace level creates enormous trace files so normally this not the desired default. In this case the causing system or user can only be found if the locking repeats itself.

Regards,

GK

[Former Member]

Hello,

I would try transaction STAD.

There you should find entries of type RFC with your user.

If you double-click on the line, you get the details. Click on the RFC button.

as Client as Server

No. of targets 0 1

Click on the highlighted 1 under "as server".

You should get the needed info : the remote destination

Target TEST_DEV

User ID TESTOC

RFC Caller OCHRETIE

Local destin. bt1suk17v1_DEV_02 IP address xx.xx.xx.xx

Remote destin. bt1suk16v1_DXI_68 IP address yy.yy.yy.yy

Hope this helps

Olivier

[Former Member]

In fact, instead of clicking on the RFC button, you can also click on the "client info" button. You will get something like :

Client info

Initial system-ID: DXI

Initial systemtype: unknown

Initial servicetype: 1 (unknown/Dialog)

Initial user-ID: OCHRETIE

Initial action: SM59

Initial actiontype: 1 (unknown/Transaction)

Last caller system-ID: DXI

Regards,

Olivier

[Former Member]

hi,

go to su01 in the locked system.

select the user that locked.

1.you see a field named "last change on" you see there the user who changed your user. that should help you to realize what external system locked your user.

2.Or you can select from the menu "information"-->"change documents for users"

from there you can run verious good quries that will show all you need.

Message was edited by:

Pavel sheynkman