BATCH Job Playing havoc !

[Former Member]

Hi,

1. User called in to say that she cannot do a task that she used to do all the while.

2. She had that role ( Z-XX-_)

3. I went to role on PFCG it says "Last changed by "BATCH 19"

4. On checkign 'Batch 19' Its a batchjob

5. Why does it need to change the roles ? can roles be changed without user interaction ?

Thanks

[Former Member]

Is Batch19 used to schedule a user compare?

It is entirely possible that a program could be written that change role data and is periodically executed. More likely to be a user compare though.

What do the change docs for the role/assoc profile say?

[Former Member]

OK..it says ..changed by. batch 19, action-> profile deleted>oldvalue--. tdv450659

[jurjen_heeck]

I think Batch 19 runs PFCG_TIME_DEPENDENCY, the user compare Alex mentioned. Look for jobs around the time this change was logged in SUIM in tr SM37.

Check the user's roles and their begin- and enddate. Most probabely the profile that was deleted belongs to a role which is not valid anymore (in time) for that user.

Roles remain in place, profiles are added/deleted by this 'user comparison'.

If this is the case, it's working as designed.

Jurjen

P.S. to fix, change dates to make the role valid again for the user and save and compare user. This can be done from SU01 or PFCG.

Edited by: Jurjen Heeck on Jan 16, 2008 7:17 PM

[Former Member]

How Do I;

1. Determine which jobs these BATCH ids run?

2. How Can I control the jobs it run?

Thx

[Former Member]

>

> How Do I;

>

> 1. Determine which jobs these BATCH ids run?

> 2. How Can I control the jobs it run?

>

> Thx

Your Basis team will be able to help you with those questions. Not something you want to mess with........

[jurjen_heeck]

1

Go to SM37, set job name to , user name 'your potential culprit', select all job statuses and a 24 hour timespan to see them for a day, 724 for a week, you can do the maths.

2

Read the help on SM37

On 2: the PFCG_TIME_DEPENDENCY is your friend, don't take it off the schedule.

With a nightly user compare your authorization assignment is always in order. Use the start and end dates to control role assignments and fill the end dates with something like 31.12.2999 if you do not want to use the functionality at this moment.

[Former Member]

Folks I am working at this ..Shall keep you posted !

[Former Member]

>

> Go to SM37, set job name to , user name 'your potential culprit', select all job statuses and a 24 hour timespan to see them for a day, 724 for a week, you can do the maths.

Batch users can have the nasty habit of spawning and reorganizing their own jobs, so there is no guarantee that looking in SM37 alone will show a complete picture, but it is a good starting point.

I would also look at the authorizations of the user to get an idea which area it can be used in, and with that in mind go to the security administrator and ask for the person who is responsible for the user ID, the access which it has and the possibly the management of it's password as well.

Ideally, that person should have all use cases of the user ID nicely documented.

If that is not the fact... then you will need to use more technical means to log / trace / monitor / etc the user ID over a period to re-document the use cases. Some usefull transactions are SM20 / RZ11 / ST22 / etc. Scanning for the user ID (or parts of the name, such as 'BATCH') is also an idea worth trying.

Cheers and good luck,

Julius

[Former Member]

Well George I am alittle curious here but when you said Profile Delted did you mean the profile was deleted from the SAP system or the from the user. Did you check the change documents for the role or the user? If it is the user then I would check the role expiration date for the user you are talking about. When you run the user comparison in any role it will delete the profile from all the users whose valid to date is less than today's date. And the PFCG_TIME_DEPENDENCY job also does the same. Let me know If I am wrong.

Naveen

[Former Member]

The problem with the batch jobs is that ..where are change documents ? All it tells us is..." Last changed !"

[Former Member]

Hi George,

You can check the change documents using SUIM --> Change Documents --> For user.

Here you should find what are the changes made to this user by batch id.

-Pinkle