locked service user XIAPPLUSER on XI 3.0

[Former Member]

Hello,

one of our Service user gets locked from time to time.

It is the service user XIAPPLUSER.

I already have activated the Audit on the system. But the only helpful

logs I can find in SM20 are telling me:

"13:55:13 DIA 04 889 SAPJSF

172.19.1.140 BU1 Password check failed for user XIAPPLUSER in"

The granularity on this doesnt increase when I set the filter in SM19

to display "All" events instead of display "only critical" events.

So I cannot know from where the login attemps arise.

Can anyone tell me about any other log file etc where I could dig deeper into attemps to login to the system?

Which exact purpose does this XIAPPLUSER have? from which XI Components

to which other components does he normaly interact?

Thanks and regards

Nesimi

[Former Member]

Hi,

XIAPPLUSER is usually used by XI to login to the Application systems.

Depending on the config, it may also be used by the application systems to log into XI. You can check this by checking the user configured in transactions SLDAPICUST, sxmb_adm->Integration Engine Configuration and also the sm59 destination for the Integration Server.

Hope this helps.

Cheers

Manish

[Former Member]

Hi,

XLAPPLUSER is one of the XI Service users used during <b>Runtime</b>.

It should be maintained to <b>receive messages from external systems</b>. It is also used for internal communication purposes ( Adapter engine to inegration engine).

cheers,

Siva Maranani.

[Former Member]

thank you for this helpful answer!

but what about logs in general?! Is SM20 really the only place where I can dig into failed login attemps on a R/3 system?

regards

Nesimi

[Former Member]

To check failed login attempts Transaction SUIM -> User -> With unsuccesful logons (or By logon date and Password Change).

You can list all the users in these reports.

regards

SKM

[Former Member]

> To check failed login attempts Transaction SUIM ->

> User -> With unsuccesful logons (or By logon date and

> Password Change).

sure. But what I am missing is a log where I can see the origin of the login attemps.

regards

Nesimi

[Former Member]

> To check failed login attempts Transaction SUIM ->

> User -> With unsuccesful logons (or By logon date and

> Password Change).

sure. But what I am missing is a log where I can see the origin of the login attemps.

regards

Nesimi

[Former Member]

What I was searching for is something like:

You can use the Logon Trace -> Note 495911 to trouble shoot further or

use Transaction SE16 to display the contents of table USR02.

Check the value of field UFlag for the SAPJSF user if the user is lockedit should have the entry '128' in the field.

regards

Nesimi