Category: Licenses

SAM4U: Software Asset Manager

SAP has released the SAM4U tool to manager your software licenses for SAP. This tool is especially useful in large SAP landscapes.

The SAM4U tool helps you to optimize the licenses. It does not replace the formal license submission tool SLAW2.

Benefits of SAM4U

  1. Improved SAP license cost control
    SAM4U continuously analyzes actual SAP usage and compares it with purchased license entitlements. It helps identify: over-licensed users, under-licensed users, users automatically classified into expensive license categories.
    Opportunities to reduce license costs through reclassification.
  2. Proactive audit readiness
    Instead of waiting for an SAP audit: License consumption is continuously monitored. Compliance gaps become visible early. Entitlements and usage are maintained in one place. This reduces surprises during SAP license audits.
  3. Consolidated View Across Multiple SAP Systems

Usage data from ECC, S/4HANA and other ABAP systems is consolidated. License consumption is tracked centrally. Landscape-wide reporting becomes possible.

  1. User classification optimization

SAM4U analyzes: actual usage, authorizations, assigned roles.

It highlights users who may be consuming more expensive license types than necessary and suggests optimization opportunities.

  1. Authorization analysis

The tool provides: current vs. target user classifications, detailed authorization object analysis, role and profile impact assessments.

This is useful for Basis, Security, and GRC teams performing role redesign or license optimization exercises.

  1. Transaction usage analysis

SAM4U tracks: active user behavior, transaction code usage, historical activity.

Transaction analysis can be leveraged for authorization role redesign.

  1. SAP HANA consumption insights

SAM4U includes: historical HANA memory consumption, database growth trends, HANA enterprise edition analytics. This gives visibility into HANA utilization over time.

  1. Simulation capability

According to the SAM4U user guide, the tool can simulate: changes to roles
changes to authorizations, impact on required license quantities.

This allows “what-if” analysis before implementing role changes.

  1. No data leaves the customer network

License data remains inside the customer’s environment. SAP does not receive operational usage data through SAM4U. This addresses common security and confidentiality concerns.

  1. No additional license cost. SAM4U tool is free of charge.

Time to implement the tool is not for free.

Set up of SAM4U

The setup of the SAM4U tool is clearly described on the SAP help file for SAM4U. SAP also offers help with a service to implement the tool on their SAM4U site.

Central installation

The first part is the installation of the central tool on the central system.

Choose a system with a high S4HANA version. Do not use SAP solution manager.

First make sure on the central system the bug fix notes listed in 3646933 – SAM4U Solution | Fiori Application | V2 are applied. And apply the notes for 3292019 – SAM4U Data Extractor.

Once done goto the installation and upgrade part of the SAP help file for SAM4U:

F0llow all the steps:

Hints: the first 2 steps are confusing. It tells you to start transaction /n/SAM4U/START, but that only works when step 2 is done, where you create the actual start variant.

After completing all the steps when starting transaction /n/SAM4U/START the FIORI page should launch:

Connecting the SAP systems

Per SAP system you want to connect, first apply the notes for 3292019 – SAM4U Data Extractor. The per connected system follow the steps in the SAP help file for SAM4U for the Data Extractor Guide:

Choose between RFC based or file based data extraction. Important in both cases to give the user ID’s the appropriate authorizations as described in both Required Authorizations section as in the Data Gathering section. Make sure the data extractor job runs regularly.

The data of the extractors is stored in table /SAM4U/BEXDUSE. Looking at the content of this table as basis person can also help you to get insights into how end users are using the system. You can find transaction start, but also Remote Function calls.

Administration of systems

Before usage you must administer all your systems in the solution. This part is explained in the SAP help file for SAM4U:

After setting up the proper authorizations go to the Administration section:

In the SAM4U tool add the system by clicking the + sign:

In the popup that comes select the RFC you created from the central system to the backend system. Make sure the user in your RFC has the rights to run and read the SAM4U tables, and has the rights to run the SAM4U RFC modules. If the rights are not ok, the tool will make the connection Red (without further detail). To get the details of what is missing in the target system role, run an ST01 or STAUTHTRACE in the target system for the user ID used in the RFC.

First do one system to test the entire function. When you are happy, repeat for all backend systems.

Next step is to download the ruleset xls which is attached to OSS note 3113382 – Authorization-based SAP S/4HANA User Simulation / FUE Projection. Upload the downloaded xls with the Upload button:

Next step is to download License Entitlement file from me.sap.com. Instructions are given on top. Use the upload button to upload the file:

Running the tool

On the landscape tab run the tool per landscape to gather the data, by pressing the Go button:

Wait until the results are done.

Go to the Consolidation tab and create a consolidation and execute it:

Now the data sections in the Analytics and License entitlement are visible with the data:

For all the functions here, the SAP help file for SAM4U links is excellent to explain the details:

OSS notes and SAP references

If you need bug fix notes search on me.sap.com with the term SAM4U.

Link to the official SAM4U marketing. Small and simple blog on SAM4U.

Link to the YouTube explanation of SAM4U.

SAP and Oracle JRE/JDK

Oracle has started to charge companies for using Oracle JRE and JDK. Questions might come to you on the relationship and use of Oracle JRE/JDK in SAP products.

More background information can be found on for example these sites:

All statements and notes below are only generic and not legally checked in any form! It is your job to check your companies situation and contracts. The listing below is only made to help speed up your research.
This blog is also not complete. See it as hints and starting point. Use Google and Support.sap.com more full search on your specific questions in your specific situation.

Potentially relevant OSS notes and blog

General notes and blogs

FAQ

SAP GUI

Use of JRE in SAP GUI

146505 – SAP GUI for the Java environment (Platform Independent GUI)

Compatibility issues

ABAP system license verification program

SAP has a bit of a hidden program to verify licenses on an ABAP system: RSUVM080. You can use this program yourself as well to prepare for license measurement and discussion on licenses.

Questions that will be answered in this blog are:

  • How to set up the User Type validation program RSUVM080?
  • How to use it for validation of your licenses?

Installation of program RSUVM080

In very new versions program RSUVM080 is present already. For older versions implement it by applying OSS note 2339166 – Validation of the user classification.

Also check bug fixes notes:

Use of program RSUVM080

If you start program RSUVM080 you see that a file is required for the validation rules:

The file has a specific format. The picture below is an example we use here:

In XLS format:

LincensesInputDownload

The actual definition of the file content, you have to do yourself by using common sense! When having discussions with SAP, they might provide the file and ask you to run it.

Now run the tool in productive system. Output looks like this:

Explanation of the checks

In the details of the input you can see we have provided several checks:

  1. Authorization checks: first 4 lines (check for * in users management, or change or create. 4th line is check for development rights)
  2. Transaction code checks: check for VA01, SE38 and SE11

The checks are shown in the columns on top.

You can see that transaction codes VA01, SE38 and SE11 were executed by the users. When you click on the green icon in the AC check column you can see the details for the AC (anti cheating) checks (more on the AC checks in this blog):

You can see that the user did not only execute VA01, but also did updates to VBAK table. So the user did execute the transaction and created records. Therefore for this user the right license type should be assigned. If the user has rights for VA01, and started it, but never made a posting, this is off course different.

If a user has a DEVACCESS entry, it is marked in the SSCR column. If the user was involved in transports, the transport column is marked.

In the #steps column you can see what other transactions were performed by the user:

Selection of users

It is important to realize that the program only selects the user as Green if one or more of the criteria was met. This can help you focus on the discussion points you are having with SAP (for example around use of VA01 for sales order creation).

You can start with a limited set of rules, and then expand.

First you can give all users the lowest classification. Then you start. For example: start with only the rule for transaction VA01. Assign the users the correct license type. On the selection screen, don’t select the users you already classified, by excluding them in the selection. Then focus on the AC checks: learn from them and see which transactions lead to them. Add this to the rules, and again classify the users correctly. In the next run the classified users are excluded again. This you can do until no AC check box is there. Then randomly validate that the actions left, which are executed by the other users, are indeed part of the lowest license type.

Measurement of developer licenses

Every year SAP measures the licenses. The developer licenses are the most expensive licenses and also the ones which are under continuous debate with SAP.

Questions that will be answered in this blog are:

  • What is a developer and why is it so hard to measure?
  • How can I go back to the DEVACCESS measurement on my non-S4HANA systems?
  • What are the complexities on S4HANA with measuring developers?

Developer definition

Most likely the definition in your contract clearly states developer is only for creation and changing custom code (Z code). And not for applying OSS notes. The measurement should follow the definition.

Developer measurement on non-S4HANA system

On a non-S4HANA based system, the developer key concept still exists. This means a developer key needs to be called off at sap support site for keys. This mechanism is hackable, but in the end in the system table DEVACCESS is filled with everybody who has filled in the keys.

SAP has given update notes on the USSM user measurement programs that use the S4HANA logic, which is described below.

By applying OSS note 3225435 – USMM2: Development Workbench check – Restore old version, you can revert back to the original way of working that measures entries in DEVACCESS table and changes to REPOSRC.

The measurement of developers has to run on the development system. For security reasons, you should delete all entries in DEVACCESS table in all non-development systems.

When a developer is leaving, you should also delete the corresponding entry in DEVACCESS table to avoid it from being counted in the license measurement.

Read this blog on the deletions of entries in DEVACCESS table.

S4HANA logic (or better no logic)

In S4HANA SAP removed the developer key (see this blog). In the USMM measurement program SAP has put in logic to measure a developer as everybody who creates a transport entry of type Workbench. Text from the word document attached to note 3038370 – USMM2: Development Workbench Check alte Version wieder herstellen:

"In the current version of the check all users are shown that have made an entry of type K (workbench request) or S (development/correction) in the field TRFUNCTION in the table E070 within the last year."

Note 3038370 is now obsolete and replaced with OSS note 3225435 – USMM2: Development Workbench check – Restore old version.

This means also the following actions are counted as developer:

  • Basis team applying OSS note
  • Consultant making a client independent customizing
  • Many more actions that lead to entries in workbench request

This logic of SAP does not make any sense. As customer you can have big debates with SAP on this.

It is really unclear why SAP is not simply checking the REPOSRC changes on S4HANA system done on Z code last year. This will simply give list of real changes done on custom code by whom. That would be fair measurement.

SAP, if you read this, you can take over this idea.

OSS notes with or without manual instructions

Some OSS notes have manual instructions to create SAP Z programs or to alter SAP objects. To avoid discussions with SAP, it is best if you carry out these instructions by an ABAP developers, rather than a basis consultant. Not only does the ABAP developer has a better clue on what the impact is, it also makes sure that the Z coding and changes to standard SAP are registered in the system and transport on the ABAP developers name. This will avoid discussions on developer licenses.

If basis applies the automatic OSS notes, these are not core custom developments. Check if these are counted by the measurement program. Then check the definition in your contract. Most likely the definition in your contract clearly states developer is only for custom code (Z code). And not for applying OSS notes.

SSCR key listing and developer license

You can run program RSUVM080 to quickly get overview of developer SSCR keys in development system or view in table DEVACCESS. More on RSUVM080 in this blog.

Developer classification help

See OSS note 3333812 – SAP Developer User Classification Help. This note installs program SLIM_DEV_CLF_HELP and transaction SLIM_DCH:

This will read from the transports in the given timeframe the list of users who created one of the listed development objects.

The note above also links to the formal developer measurement guide. The end of the guide contains a long list of use cases.

LUI: license utilization information

The LUI (license utilization information) is a new tool provided by SAP to help you better manage the insights into your current utilization.

Questions that will be answered in this blog are:

  • How do I use the LUI tool?
  • Where do I find more information on the LUI tool?
  • Does the LUI tool work for on premise systems and cloud systems?

Use of the LUI tool

The LUI tool is part of the support pages of SAP and can be reached using this link.

Open opening the link and logging on, you start with the overview screen:

As you can see the overview is both for On Premise as well as Cloud based solution licenses.

You can zoom into the details per license to see the trend:

This can help you to detect since when (and then you will check why) you are crossing the line of having utilized too much. This enables you to either take actions to go back, or simply procure more licenses.

For the SAP cloud products, the actual usage is automatically added by SAP. If you want to add usage data for the on premise systems, you will need to upload the LAW files.

Background information

Main LUI tool page can be found here.

LUI introduction video can be found here.

LUI FAQ can be found here.

Manual for using LUI can be found here.

Manual for preparation of measurement data for on premise systems can be found here.

Licenses for SAP solution manager

SAP solution manager licenses have been renewed last few years by SAP.

Questions that will be answered in this blog are:

  • Do I need a user license for solution manager users?
  • If I run solution manager on HANA, do I need to pay HANA database licenses?
  • How can I get Focused Build and Focused Insights?
  • What about Focused Run licenses?

User licenses for SAP solution manager

Since 1.1.2018 the requirement of having named users was dropped by SAP.

HANA database licenses

If you want to run HANA database below SAP solution manager as database, you need to procure the infrastructure. The HANA database rights are included in SAP solution manager. This is the only exception SAP has. For all other use case you need to pay for HANA as database as well.

Using SAP solution manager for non-SAP components

You can use SAP solution manager to manage non-SAP components as well. Especially the ITSM service desk component can be used for this. When you use this function for non-SAP components, you will need SAP enterprise support rights for SAP solution manager in stead of the SAP standard support.

Focused Insights and Focused Build

SAP offers Focused Insights and Focused Build as extra options on top of SAP solution manager. Both are installed as add-on. Focused Insights brings extra dashboard building capabilities. With Focused Build you can get an extra grip on your solution build process.

As of 01.01.2020 both solutions are part of standard maintenance contract. See also OSS note 2361567 – ST-OST Usage Rights and Support.

If you want to try out these solutions, you can use the available free SAP demo system. Read more about this in the following blog.

SAP Focused run now also covers the functionality of Focused Insights, but in a far superior and more performing way. Read more in this blog.

Focused Run

Focused Run is separate solution with separate license to optimize the running of large SAP landscapes. Focused run does NOT run on SAP solution manager. It runs on a separate environment and only runs on SAP HANA. You cannot combine a Focused Run and SAP solution manager on one single installation. More information on Focused Run can be found on the SAP site. And on the specialized SAP Focused Run Guru site.

For licenses of Focused Run, read this dedicated blog.

Despite the fact that Focused Run is a paid solution, it offers by far the most sophisticated and added value product.

More background information

More information can be found on the SAP solution manager usage rights website.


Mechanics behind SAP user measurement

This blog will analyze some of the tables behind the SAP user license measurement.

Warning: the list of tables below is not complete. Do not base any assumptions on the content of these tables in your system. In updates and newer versions all content can change. The tables and the text in blog is to give you insight into the process. In any contract SAP will claim the right for inspection of actual usage of your system versus the license rights in your contract.

Questions that will be answered are:

  • How do I know which objects are measured?
  • How are objects measured?
  • How can I find actual measured objects?

The general user measurement principles are explained in the blog on USMM.

The tables behind license measurement

The best table to start with is the TUAPP table: measurement of applications.

Example is given below:

Table TUAPP entries

Here you can see that Advanced ATP is measured via call function module. In SE37 you can lookup the function module and see inside the code what exactly is measured:

Function module AATP_AUDIT

The other entry in TUAPP we will take as example is Procurement Orders. Its application ID is 5000 and does not measure via function module.

First we get the application to unit and unit name from table TUAPP_UNT (units themselves are defined in table TUUNT):

TUAPP_UNT

Now we see procurement is counting Inquiry, Purchase order, Contract, Scheduling Agreement and Others.

The actual values read by the measurement for the application counters are stored in table TUCNT:

TUCNT

The tables behind the AC checks

The AC (anti cheating) modules use bit different tables.

Table TUL_AC_UNIT is to denote the table to count on:

TUL_AC_UNIT

Here you see the main procurement table EKKO has ID number 5018.

In table TUL_ACTTC you can lookup this value:

TUL_ACTTC for EKKO

This data will be used in dynamic SQL statement that will list the user name (ERNAM) who did the create or change and uses AEDAT (last change or creation date) for table EKKO to count for check 5018.

License measurement tips & tricks

This blog will give you tips & tricks for the SAP license measurement.

Questions that will be answered are:

  • How to deal with license classification for background users?
  • How to deal with license classification for standard SAP users?
  • How to deal with license classification for SAP support and fire-call users?
  • How to deal with multiple logon?
  • How to deal with developer licenses?
  • What does Confusopoly mean?

Background users

According to OSS note 32326 – System measurement : Technical users all background users are free of charge. Classify them as type 91 Test users. This rule is valid for:

  • Batch users to run background jobs
  • SAP to SAP system connection users
  • Interface batch users
Be careful with the interface users. If an external system posts data into SAP system with a single background user, but it is clear that in the source system multiple real users doing the actions, SAP might want to charge you for 'indirect use'.

System dialog users

SAP standard dialog users are excluded from system license measurement. See OSS note 1402837 – Info USMM/LAW: Excluded SAP users in the measurement for a full list.

SAP support users and fire-call users

For live support of an SAP system you typically will have 2 types of support users:

  1. Users for SAP themselves to logon to your system and provide support to you
  2. Fire-call users with elevated authorizations to solve time critical incidents

Both type of users have no direct business goal, but have only support usage. You can mark them as type 91 Test user, as long as you have a clear naming convention for these users and a general rule that they are locked unless they are needed.

User deletion as regular activity

The user measurement program (both USMM and USMM2) checks for deletion of users in the last three months. To avoid discussions on user deletion it is best practice to delete monthly, or bi-monthly, all persons which have left your company.

End validity date

Users who don’t have a current validity date are not counted in the user measurement program. You might want to schedule program RSUSR_LOCK_USERS in a regular batch job to end the validity of users that did not log on for long time automatically. See this blog for more details.

Multiple logon

SAP does measure how many times a user has a double, triple, etc logon. The results are stored in table USR41_MLD. SAP might argue that the same user is used by multiple persons. You can use the contents of table USR41_MLD to prove if this was a mistake only. If the are too many multiple logons you might need to go back to the business to change their behavior.

You can also forbid the multiple logons at system level. SAP system parameter login/disable_multi_gui_login can be set in RZ11 to forbid multiple logons. For some users (like DDIC) you do want to keep multiple logons. These users must be set into system parameter login/multi_login_users=username1,username2,username3,etc.

But this parameter is limited to 80 characters only (see OSS note 3211079 – The character limit when adding massive users for the value of parameter login/multi_login_users).

Proper consolidation

Use the SLAW or SLAW2 tool to execute a proper consolidation of your measured users. This process will de-duplicate your counted users.

License validation program

Read this dedicated blog to know more about license vailidation program RSUVM080.

LUI License utilization information

The LUI (license utilization information) tool is an online SAP tool that has all the information on your on premise and cloud licenses information combined. For cloud the usage is automatically visible. For on premise systems you can upload the usage via the SLAW files. This can give you insights into under-consumption and over-consumption of licenses. Read more in this blog.

Check for bug fix notes in your advantage

SAP might give you a list of OSS notes to apply in your system before the measurement. These notes normally benefit SAP. You can also check for OSS notes that benefit you.

Example:

3017067 – USMM2: Korrektur Klassifizierungshilfe Anwender Prof/Ltd.Prof.

FIORI gateway usage

For FIORI gateway usage, read this dedicated blog.

Developer licenses

SAP has made the developer license measurement messy with the move to S4HANA by removing the simple DEVACCESS measurement. Read more in this blog.

Confusopoly

If you think you know all about SAP licenses, SAP will change everything again. Dilbert has a nice word for it: confusopoly:

Confusopoly

Sometime people on sales/buying SAP joke about the SAP abbreviation being Shut-up And Pay.

EHP switches and licenses

EHP switches can deliver great new functionality. But not all of them are for free. This blog will explain, how you will know which ones are included in the standard license, and which ones not.

Questions that will be answered are:

  • How to know which switch has license impact?
  • What are best practices for EHP switches?

Relationship between EHP switches and licenses

The relationship between EHP switch activation and licenses is explained in OSS note 1524246 – Relationship of licenses and business functions.

Attached to this OSS note is the most recent version of the PDF listing which switches are part of the standard license, and which switches require an extra license.

How to read the document?

The document is sorted per business area. Best way is simply use the find button in the PDF and search for your switch.

Example of 2 switches that don’t have license impact:

EHP no license

The pricing comment and License (material number) column are empty. These switches are part of standard license.

Example of switch with license impact:

EHP with license

For this switch your company should be in possession, or acquire the license mentioned in the last column.

EHP switches best practices

Since EHP switch can have license impact the following best practices is suggested:

  • Restrict SFW5 EHP switch activation access to basis team only (display for all is ok)
  • Explain basis team the fundamentals of the licenses and EHP switches
  • Determine in your company who must approve EHP switch on and make clear to basis team only to execute the activation after this approval

If you have switched on a switch with licenses and don’t want to use it, check if it is a reversible switch. Then simply undo this. If it is not reversible, don’t use the corresponding functionality. The latter is much harder since you need to restrict authorizations to that function very carefully.

SAP tool for measuring current indirect access

In the previous blog the new SAP license model for indirect access. The biggest challenge after reading the blog will be: how can I know the impact for my situation and my SAP system?

For this purpose SAP has developed an estimation tool.

Questions that will be answered in this blog are:

  • Which note do I need to apply to get the estimation tool?
  • How do I run the estimation tool?
  • Why is the tool estimation only?
Warning: this tool only gives estimation. The tool cannot take into account specific configurations you have done to standard SAP that influence the outcome. Also the tool cannot take into account potentially company specific agreements you have made with SAP.

Digital access report

Start transaction RSUVM_DAC for the digital access report:

Double click on the line will get you to the details.

More background on this transaction via OSS note 2837612 – Measurement report for Digital Access: RSUVM_DAC.

New estimation tool

SAP has developed new estimation tool.

S4HANA: OSS note 2957649 – Completely revised digital access estimation report for S/4H and 2999672 – Completely revised digital access estimation report 2 for S/4H.

ECC: OSS note 2957647 – Completely revised digital access estimation report for ECC and 2992090 – Completely revised digital access estimation report 2 for ECC.

Running the new estimation tool

Start program DAC_S4_COUNT_DOCTYP_ITEM for S4HANA or DAC_ECC_COUNT_DOCTYP_ITEM for ECC (new programs!):

New digital access entry screen

Enter the date and user ID’s. Result:

New digital access results

Installation of the old estimation tool

The generic OSS note is 2738406 – Digital Access: Central Technical Guidelines.

Depending on your SAP version and support package the tool is already available, or you need to manually install it. In case of manual installation, first manually create package Digital_Access in SE80. The next OSS note to install is depending on your version (S/4HANA or ECC):

After the SNOTE actions add the text manually.

Then apply OSS note 2795775 – Digital Access: Usability Improvements Estimation Note to get extra selection criteria.

Running the old estimation tool

After the note is installed you can start program DAC_S4_COUNT_DOCUMENTTYP_ITEM (for S4HANA) or DAC_ECC_COUNT_DOCUMENTTYP_ITEM (for ECC):

Fill out the date and user ID to check.

Result is the amount of documents in the period:

Digital access check tool result

Unfortunately you have to enter user ID by user ID. See OSS note 2933979 – The report DAC_ECC_COUNT_DOCUMENTTYP_ITEM does not give back any document.

How does the counting work?

The counting estimation in the ABAP is simply executing a select count for the time frame and user on the respective tables for specific document types.

Example below is the counting of purchase order line items:

Check tool count statement

Here you can see only lines from EKPO with type lc_bstyp_f (which has value ‘F’) are selected. If you have configured your system differently (for example copied F to Z and are using Z) the count program will not find and report this.

This is the reason why the program is only to give you an estimation.

Tool updates

Regularly check the tool OSS note for new updates of the note version. Other relevant notes and bug fixes: