cancel
Showing results for 
Search instead for 
Did you mean: 

Remove debug facility (/h)

Former Member
0 Kudos

Hi

I want to remove debug facility (/h) from production server.

Please help me out regarding the same.

Regards

Souvik

Accepted Solutions (0)

Answers (2)

Answers (2)

former_member204746
Active Contributor
0 Kudos

please use the SECURITY forum.

Former Member
0 Kudos

Hi,

do following

serach authorization object S_DEVELOP in corresponding user roles which contain following

Activity

Package

Object name

Object type

Authorization group ABAP/4 program

restrict authorization for Object type: DEBUG

regards,

kaushal

Former Member
0 Kudos

Hi Kaushal

Will you please explain in detail.

abt where to search for obj s_develop.

Regards

Souvik

Former Member
0 Kudos

Hi Kaushal

This is the error message it is giving while doing the said process:

**189 field value(s) for object SDEVELOP were not entered in the profile**_

*Message no. 5@022*

Diagnosis

The role for which you want to generate the profile contains at least one authorization for object S_DEVELOP that contains too many values.

System Response

The profile generation is terminated.

Procedure

Distribute the values across multiple authorizations.

If the authorization in question contains a large number of organizational level values, you cannot solve the problem by generating additional authorizations, since the organizational level values are automatically copied to the new authorizations. In this case, you need to distribute the values across multiple roles.

Regards

Souvik

Former Member
0 Kudos

Hi,

do following

SUIM -> Roles ->By Authorization Object

authorization object -> enter S_DEVELOP

execute

this will gives you names of roles which contain this object,

if you use roles which created by you ( Z or Y roles) you need to maintain this object is all roles which contain this object, you need to mainitian this roles profile one by one,

for eg.,

PFCG -> ZROLE_TEST

click change -> authorization -> click Change Authorization Data -> now click on search enter S_DEVELOP as authorization object

and mainitain this object in profile,

i.e if object type field for this object contain * value remove it and give FUGR, PROG

do not give access for DEBUG

regards,

kaushal

Former Member
0 Kudos

Hi Kaushal

I did tht. But it is not allowing me to add all the objects.

I want to add all the objects except Debug.

the error msg which it gives is as follows.

189 field value(s) for object S_DEVELOP were not entered in the profile

Message no. 5@022

Regards

Souvik

Former Member
0 Kudos

Hi,

No need to add all the object since it is your production system

you can just add two object FUGR and PROG as object type for S_DEVELOP, if user's have missing authorization for particular object type you can identify it using SU53 and add it to profile later

in my case, ECC 6.0 have more than 500 object type but we add only this two with display only in production system

i found two sap note for Message no. 5@022

you can read it but it is for older R3 version,

103497 Error 5@022 in profile generation

77538 Profile generator: Message 5@022

regards,

kaushal

Former Member
0 Kudos

Hi Souvik,

The best solution is to create a user with SU53 permission. Ask him to type /h. He will get no authorization error. Go to SU53 and you will get the parameter required for stoping the debugging.

search in SUIM with those parameter you get in SU53, and stop the role which has these permission.

Hope you get the solution.

Regards

Prashant

markus_doehr2
Active Contributor
0 Kudos

This is a permission issue - remove the ABAP development permissions.

Markus

Former Member
0 Kudos

Hi Markus

How to do that?

Regards

Souvik

markus_doehr2
Active Contributor
0 Kudos

Check which roles contain the development permissions using SUIM, remove that permission from the roles and reassign them to the users.

Markus