Data archiving: data retrieval

When you perform data archiving, from time to time you need to give support on data retrieval issues.

This blog will explain some of the general data retrieval concepts.

Questions that will be answered in this blog are:

  • How does single record retrieval work?
  • How can I use the archive explorer?
  • How can I get a list of data from the archive?

Single record retrieval

Single record retrieval is different per archiving object.

Some objects (like FI_DOCUMNT) are nicely integrated. In FB03 the system will check first database, then look into the archive inforecords to find if the document is archived. And then it will show the document in same layout.

Most objects have archive read program which you can find in SARA:

Now run the read program:

And fill out the record(s) you need:

Now you need to select the data files:

If you didn't label your files correctly, you need to select them all, which makes data retrieval slow.

Results are shown:

Results might look ok, or very basic. This is different per archiving object.

Use of archive explorer for table level

An alternative way is the use of the archive explorer. This will give details on table level.

Start transaction SARE:

Fill out the required object and archive infostructure. In this case we used change document. In the second screen fill the object:

Now you can see list of changes:

Double click on the record to see the tables:

Double clicking on the table will give the actual table line content.

List transactions

Some transactions (especially in FICO domain) have integrated reporting with the data archive. We will use transaction FBL3N as example.

Start FBL3N:

Then click on Data Sources, include Archive, and select the needed files:

If you didn't label your files correctly, you need to select them all, which makes data retrieval slow.

How to check SE16N usage?

SE16, SE16N and SE16H are frequently used transactions. They can be used in positive way to quickly fetch data. They can also be a security risk, since it might lead to unwanted data display.

Questions that will be answered in this blog are:

  • Which users used SE16N?
  • How much data do the user pull using SE16N?
  • Which tables did the users read using SE16N?
  • How to check which changes were performed using SE16N?

Which users are using SE16?

Start transaction ST03 or ST03N, and create detailed settings for recording of SE16N:

Save the values and let the system collect the data.

Now in ST03 in the tree below Transaction Profile, the Details for SE16N are shown. Double clicking on the EXEC function will give details on the execution step:

The DB data is normally shown more to the right.

This will give you information on who used SE16N, and how much data transfer was happening.

Which tables were read using SE16N?

If you want to know which table was read during SE16N, you must first activate activity DU9 (generic table access) in the SAP audit log. Go to transaction RSAU_CONFIG and make sure this activity is on:

Now you can use audit log display the audit log with transaction RSAU_READ_LOG or RSAU_READ_LOG_ADM (this is the version without user ID and terminal):

Select DU9 only to make the report faster.

You can now see the tables accessed via SE16N:

In many analysis cases it is sufficient to see which tables are read, and how frequently.

Use RSAU_READ_LOG to see also user and terminal information.

The audit log is a powerful tool. Be aware of privacy related rules in your company.

Changes done with SE16N

On ECC or S4HANA systems, changes to SE16N are recorded in tables SE16N_CD_DATA and SE16N_CD_KEY. You can display the changes done using report RKSE16N_CD_DISPLAY:

OSS notes for RKSE16N_CD_DISPLAY:

How to check RFC usage in your ABAP system?

Security teams might request to you as basis administrator: which RFC calls are being made to and from your ABAP system? And you need to know which users and applications are calling on RFC.

Questions that will be answered in this blog are:

  • Which users and systems are calling my ABAP system using RFC?
  • Which programs and processes are using RFC?
  • How much data is transferred using RFC?

If you need to check HTTP usage in your ABAP system: read this blog.

RFC statistics in ST03

Go to transaction ST03N or ST03, and open the total for this month. Then open the analysis view for RFC statistics. First check the WEB Client Statistics:

This already gives a lot of information: function modules and amount of data. On the tabs for Transaction, User and Remote destinations, Remote servers and Local servers you can get even more details you need for RFC transaction source.

On all 6 tabs on all 4 reports you can double click to get more details:

Tab PageMeaning
Function ModuleTransactionUserWhat workload is caused by the function modules, transactions, or users (depending on the selected RFC profile, as the RFC client or the RFC server)?
Remote DestinationRemote ServerLocal ServerWhere is the RFC workload created?

Reference OSS notes

OSS notes:

How to check HTTP usage in your ABAP system?

Security teams might request to you as basis administrator: which HTTP calls are being made to and from your ABAP system? Or you might be requested to switch off HTTP (allowing only HTTPs) and you need to know which users and applications are still calling on HTTP.

Questions that will be answered in this blog are:

  • Which users and systems are calling my ABAP system on HTTP?
  • Which systems does my ABAP system call using HTTP?
  • Which programs and processes are using HTTP?

If you need to check RFC usage in your system: read this blog.

Web statistics in ST03

Go to transaction ST03N or ST03, and open the total for this month. Then open the analysis view for web statistics. First check the WEB Client Statistics:

This already gives a lot of information: host and port information, amount of calls. On the tabs for Transaction, User and URL you can get even more details you need for transaction source, user and URL’s on HTTP.

On all 4 tabs on all 4 reports you can double click to get more details. After double-click both HTTPs and HTTP are show. Be sure to filter on HTTP:

StatisticsDescription
WEB Client StatisticsWorkload due to requests for which the system acts as a Web client
WEB Client Dest. StatisticsWorkload due to requests for which the system acts as a Web client, broken down by different client destinations
WEB Server StatisticsWorkload due to requests for which the system acts as a Web server
WEB Server Dest. StatisticsWorkload due to requests for which the system acts as a Web server, broken down by different server destinations

Common cases

Common cases you might want to check for HTTP use:

End users using HTTP

Most of the calls will work on HTTPs as well as HTTP. The most common problem is that end users will have bookmarked the HTTP version in their browser. They will need to be informed the HTTPs version (with a different port number). If you switch off HTTP in this case when a lot of people are still using HTTP you will get a lot of tickets and complaints. Use the web client statistics as explained above to see which entry URL’s they are using. Then mail them to use the new HTTPs entry URL’s with the appropriate port and ask them to switch. Repeat this a few times until the amount of stubborn users is low enough to disable HTTP.

Disabling HTTP check

In transaction SMICM go to the Services icon and then check there is nothing running with an HTTP port.

If you are using SAP Focused Run, read this blog to set up a Security and Configuration validation rule to execute a landscape wide scan on use of HTTP port.