Category: Basis

basis

Mass locking and end validity date of users

There are 2 good reasons for mass locking and ending validity date of user: security and licenses.

Questions that will be answered in this blog are:

  • How can I mass lock users automatically if they have not logged on for a certain time?
  • How can I mass set the validity date of the users that did not log on for a certain time?

Automatic lock of user after expired logon

In RZ11 you can set parameter login/password_max_idle_productive with an amount in days.

Password max idle initial

If the user (including yourself) did not logon to the system after this amount of days the password is still valid, but it does not allow you to logon.

If the user tries to logon after the period he will see this error message and cannot continue:

In SU01 such a user looks like this:

If you also want to automatically lock users after you give them a new password, use the parameter login/password_max_idle_initial.

Initial passwords is one of the nice ways of entering a system as hacker. Especially if the initial password used by the admin is more or less the same (like Welcome_1234!). Countermeasure: instruct your admins to use the Password Generator. This will generate long random once off password.

Mass setting of user validity date

For user measurement and security reasons you want to limit the validity period as well. Users who are locked still count for user measurement (see blog on license measurement tips & tricks). Users locked and unlocked by some method can be security threat.

Standard SAP program RSUSR_LOCK_USERS (built on top of program RSUSR200) is the tool to achieve this.

It has quite a long selection screen:

On the first block set the dates for last logon and password change to get a good selection of users.

On the second block very important to only select Dialog Users.

First run with Test Selection to get a list. If you are happy with the list, run it with Set End Of Validity Period.

OSS notes

Performance and bug notes (OSS search hints RSUSR200 and RSUSR_LOCK_USERS):

Output device NULL

For some batch jobs you want to have the execution done and don’t want to fill up your system with large spool files of this execution. This blog will explain to setup printer NULL to have a batch job suppress the output generation.

Questions that that will be answered in this blog are:

  • How do I setup printer NULL?
  • How to test the setup of printer NULL?
  • Where to find more background information on printer NULL?

Setup of printer NULL

Start transaction SPAD to define a new printer. Now create printer call NULL (with long and short name both NULL):

Select a simple windows driver. Fill the other mandatory fields. Add the message description clearly that the output will be lost.

Save the printer definition.

Testing the NULL printer

From the blog explaining the technical clean up we will take program RSWWHIDE. This program generates huge amount of output (per deleted item 3 to 10 lines). We will run the program twice in test mode: once with printer NULL and once with printer LP01 (default printer). Selection of printer NULL is same as with any printer:

Result in SM37:

The first run with printer NULL has suppressed the generation of the spool file.

Background OSS note

All background on output device NULL can be read in OSS note 181571 – Output device NULL.

Mechanics behind SAP user measurement

This blog will analyze some of the tables behind the SAP user license measurement.

Warning: the list of tables below is not complete. Do not base any assumptions on the content of these tables in your system. In updates and newer versions all content can change. The tables and the text in blog is to give you insight into the process. In any contract SAP will claim the right for inspection of actual usage of your system versus the license rights in your contract.

Questions that will be answered are:

  • How do I know which objects are measured?
  • How are objects measured?
  • How can I find actual measured objects?

The general user measurement principles are explained in the blog on USMM.

The tables behind license measurement

The best table to start with is the TUAPP table: measurement of applications.

Example is given below:

Here you can see that Advanced ATP is measured via call function module. In SE37 you can lookup the function module and see inside the code what exactly is measured:

The other entry in TUAPP we will take as example is Procurement Orders. Its application ID is 5000 and does not measure via function module.

First we get the application to unit and unit name from table TUAPP_UNT (units themselves are defined in table TUUNT):

Now we see procurement is counting Inquiry, Purchase order, Contract, Scheduling Agreement and Others.

The actual values read by the measurement for the application counters are stored in table TUCNT:

The tables behind the AC checks

The AC (anti cheating) modules use bit different tables.

Table TUL_AC_UNIT is to denote the table to count on:

Here you see the main procurement table EKKO has ID number 5018.

In table TUL_ACTTC you can lookup this value:

This data will be used in dynamic SQL statement that will list the user name (ERNAM) who did the create or change and uses AEDAT (last change or creation date) for table EKKO to count for check 5018.

License measurement tips & tricks

This blog will give you tips & tricks for the SAP license measurement.

Questions that will be answered are:

  • How to deal with license classification for background users?
  • How to deal with license classification for standard SAP users?
  • How to deal with license classification for SAP support and fire-call users?
  • How to deal with multiple logon?
  • How to deal with developer licenses?
  • What does Confusopoly mean?

Background users

According to OSS note 32326 – System measurement : Technical users all background users are free of charge. Classify them as type 91 Test users. This rule is valid for:

  • Batch users to run background jobs
  • SAP to SAP system connection users
  • Interface batch users
Be careful with the interface users. If an external system posts data into SAP system with a single background user, but it is clear that in the source system multiple real users doing the actions, SAP might want to charge you for 'indirect use'.

System dialog users

SAP standard dialog users are excluded from system license measurement. See OSS note 1402837 – Info USMM/LAW: Excluded SAP users in the measurement for a full list.

SAP support users and fire-call users

For live support of an SAP system you typically will have 2 types of support users:

  1. Users for SAP themselves to logon to your system and provide support to you
  2. Fire-call users with elevated authorizations to solve time critical incidents

Both type of users have no direct business goal, but have only support usage. You can mark them as type 91 Test user, as long as you have a clear naming convention for these users and a general rule that they are locked unless they are needed.

User deletion as regular activity

The user measurement program (both USMM and USMM2) checks for deletion of users in the last three months. To avoid discussions on user deletion it is best practice to delete monthly, or bi-monthly, all persons which have left your company.

End validity date

Users who don’t have a current validity date are not counted in the user measurement program. You might want to schedule program RSUSR_LOCK_USERS in a regular batch job to end the validity of users that did not log on for long time automatically. See this blog for more details.

Multiple logon

SAP does measure how many times a user has a double, triple, etc logon. The results are stored in table USR41_MLD. SAP might argue that the same user is used by multiple persons. You can use the contents of table USR41_MLD to prove if this was a mistake only. If the are too many multiple logons you might need to go back to the business to change their behavior.

You can also forbid the multiple logons at system level. SAP system parameter login/disable_multi_gui_login can be set in RZ11 to forbid multiple logons. For some users (like DDIC) you do want to keep multiple logons. These users must be set into system parameter login/multi_login_users=username1,username2,username3,etc.

Proper consolidation

Use the SLAW or SLAW2 tool to execute a proper consolidation of your measured users. This process will de-duplicate your counted users.

License validation program

Read this dedicated blog to know more about license vailidation program RSUVM080.

LUI License utilization information

The LUI (license utilization information) tool is an online SAP tool that has all the information on your on premise and cloud licenses information combined. For cloud the usage is automatically visible. For on premise systems you can upload the usage via the SLAW files. This can give you insights into under-consumption and over-consumption of licenses. Read more in this blog.

Check for bug fix notes in your advantage

SAP might give you a list of OSS notes to apply in your system before the measurement. These notes normally benefit SAP. You can also check for OSS notes that benefit you.

Example:

3017067 – USMM2: Korrektur Klassifizierungshilfe Anwender Prof/Ltd.Prof.

FIORI gateway usage

For FIORI gateway usage, read this dedicated blog.

Developer licenses

SAP has made the developer license measurement messy with the move to S4HANA by removing the simple DEVACCESS measurement. Read more in this blog.

Confusopoly

If you think you know all about SAP licenses, SAP will change everything again. Dilbert has a nice word for it: confusopoly:

Sometime people on sales/buying SAP joke about the SAP abbreviation being Shut-up And Pay.

EHP switches and licenses

EHP switches can deliver great new functionality. But not all of them are for free. This blog will explain, how you will know which ones are included in the standard license, and which ones not.

Questions that will be answered are:

  • How to know which switch has license impact?
  • What are best practices for EHP switches?

Relationship between EHP switches and licenses

The relationship between EHP switch activation and licenses is explained in OSS note 1524246 – Relationship of licenses and business functions.

Attached to this OSS note is the most recent version of the PDF listing which switches are part of the standard license, and which switches require an extra license.

How to read the document?

The document is sorted per business area. Best way is simply use the find button in the PDF and search for your switch.

Example of 2 switches that don’t have license impact:

The pricing comment and License (material number) column are empty. These switches are part of standard license.

Example of switch with license impact:

For this switch your company should be in possession, or acquire the license mentioned in the last column.

EHP switches best practices

Since EHP switch can have license impact the following best practices is suggested:

  • Restrict SFW5 EHP switch activation access to basis team only (display for all is ok)
  • Explain basis team the fundamentals of the licenses and EHP switches
  • Determine in your company who must approve EHP switch on and make clear to basis team only to execute the activation after this approval

If you have switched on a switch with licenses and don’t want to use it, check if it is a reversible switch. Then simply undo this. If it is not reversible, don’t use the corresponding functionality. The latter is much harder since you need to restrict authorizations to that function very carefully.

SAP tool for measuring current indirect access

In the previous blog the new SAP license model for indirect access. The biggest challenge after reading the blog will be: how can I know the impact for my situation and my SAP system?

For this purpose SAP has developed an estimation tool.

Questions that will be answered in this blog are:

  • Which note do I need to apply to get the estimation tool?
  • How do I run the estimation tool?
  • Why is the tool estimation only?
Warning: this tool only gives estimation. The tool cannot take into account specific configurations you have done to standard SAP that influence the outcome. Also the tool cannot take into account potentially company specific agreements you have made with SAP.

Digital access report

Start transaction RSUVM_DAC for the digital access report:

Double click on the line will get you to the details.

More background on this transaction via OSS note 2837612 – Measurement report for Digital Access: RSUVM_DAC.

New estimation tool

SAP has developed new estimation tool.

S4HANA: OSS note 2957649 – Completely revised digital access estimation report for S/4H and 2999672 – Completely revised digital access estimation report 2 for S/4H.

ECC: OSS note 2957647 – Completely revised digital access estimation report for ECC and 2992090 – Completely revised digital access estimation report 2 for ECC.

Running the new estimation tool

Start program DAC_S4_COUNT_DOCTYP_ITEM for S4HANA or DAC_ECC_COUNT_DOCTYP_ITEM for ECC (new programs!):

Enter the date and user ID’s. Result:

Installation of the old estimation tool

The generic OSS note is 2738406 – Digital Access: Central Technical Guidelines.

Depending on your SAP version and support package the tool is already available, or you need to manually install it. In case of manual installation, first manually create package Digital_Access in SE80. The next OSS note to install is depending on your version (S/4HANA or ECC):

After the SNOTE actions add the text manually.

Then apply OSS note 2795775 – Digital Access: Usability Improvements Estimation Note to get extra selection criteria.

Running the old estimation tool

After the note is installed you can start program DAC_S4_COUNT_DOCUMENTTYP_ITEM (for S4HANA) or DAC_ECC_COUNT_DOCUMENTTYP_ITEM (for ECC):

Fill out the date and user ID to check.

Result is the amount of documents in the period:

Unfortunately you have to enter user ID by user ID. See OSS note 2933979 – The report DAC_ECC_COUNT_DOCUMENTTYP_ITEM does not give back any document.

How does the counting work?

The counting estimation in the ABAP is simply executing a select count for the time frame and user on the respective tables for specific document types.

Example below is the counting of purchase order line items:

Here you can see only lines from EKPO with type lc_bstyp_f (which has value ‘F’) are selected. If you have configured your system differently (for example copied F to Z and are using Z) the count program will not find and report this.

This is the reason why the program is only to give you an estimation.

Tool updates

Regularly check the tool OSS note for new updates of the note version. Other relevant notes and bug fixes:

SAP new license model for indirect access

This blog will explain about the new SAP license model for indirect access, also known as Digital Access license.

Questions that will be answered in this blog are:

  • Where to find reference material on the new SAP license model?
  • How does the new SAP license model look like?
  • What are the exact definitions inside the documents for digital access?
IMPORTANT:
The explanation in this blog is to help you understand. This is not a replacement of the official SAP site. Please always check the latest official SAP site on the latest status of licensing. The document to search for in the SAP site is called SAP licensing guide (a guide for buyers).

For measurement of digital access in your system read this blog.

References

Before starting the explanation these are important and useful references:

The new model

The new model consist of 3 components:

  1. Direct human access
  2. SAP applications (engines)
  3. Indirect access / digital access
Formal definition:

Digital Access to SAP ERP (“ERP”)

This Package grants (a) humans a license to Use ERP through Non-SAP Application(s) that is/are directly integrated to ERP without the need to be licensed as a “Named User” of ERP and (b) non-humans (e.g. bots, sensors, chips, devices, etc.) a license to Use ERP directly or through Non-SAP Application(s) that is/are directly integrated to ERP and without the need to be licensed as a “Named User” of ERP (collectively, “Digital Access of ERP”).

All Digital Access of ERP will be licensed based exclusively upon the number of Documents created annually by such Digital Access of ERP.  Documents are unique records (i.e. unique digital line-items/objects) as defined in the “Document Definitions” column of the below table.  Each Document shall count as one (1) Document, except for Material Documents and Financial Documents which shall each count as two tenths (0.2) of a Document.  However, where the automated processing in ERP of a Document from one Document Type results in the subsequent creation in ERP of one or more additional Documents of different Document Type(s), such additional Documents shall not be counted.
Where a Non-SAP Application is connected to ERP via a Connectivity App, such Non-SAP Application is still deemed directly integrated to ERP for purposes of this provision.  Any humans and/or non-humans using ERP through application(s) (e.g. Ariba, Concur, Successfactors, Hybris) that is/are integrated to a Non-SAP Application that is directly integrated to ERP do not need to be licensed as a “Named User” of ERP.

In practice this should means documents posted via generic interface user, IOT device, 3rd party application, cloud application posting data in SAP system, etc.

By simply counting documents and agreeing on a price per document, this will simplify the ever ongoing discussion on indirect access.

Document definitions

SAP starts with 9 documents. You can find the list and definition in the table below.

Document TypesDocument Definitions
Sales DocumentA Sales Document is (i) a line item record that represents the material and/or service being sold or quoted and/or (ii) a record that represents an individual order/release against a scheduling agreement which indicates the material and/or service being sold.
Purchase DocumentA Purchase Document is (i) a line item record that represents the material and/or service being ordered or requested and/or (ii) a record that represents the release against a scheduling agreement which indicates the material and/or service being procured.
Invoice DocumentAn Invoice Document is a line item record that represents the material and/or service being billed.
Manufacturing DocumentA Manufacturing Document is (i) a record which represents the production-related details associated with manufacturing a material, including: the type, quantity and color of what to produce, when to produce it, where to produce it and/or other distinguishing characteristics, and/or (ii) a record that represents a confirmation which indicates the status of the processing activities associated with manufacturing orders.
Material DocumentA Material Document is a line item record that represents a specific material being received, issued or transferred to, from or within a storage location or plant.
Quality Management DocumentA Quality Management Document is (i) a record that represents the details of a nonconformance being reported including the information required for problem solving and/or (ii) a record that represents results of an inspection.
Service & Maintenance DocumentA Service & Maintenance Document is (i) a record that represents the details of work to be performed including the information needed to plan, execute and bill for a service or maintenance request , and/or (ii) a record that represents the details of a problem being reported including the information required for problem solving and/or (iii) a record that represents the status of the processing associated with service orders and maintenance orders  and/or (iv) a record that represents a claim by a customer for repair or replacement or compensation for under-performance, pursuant to terms in a warranty document.
Financial DocumentA Financial Document is a record that represents accounting information in a financial journal.
Time Management DocumentA Time Management Document is (i) a record that represents an employee’s time worked and assigned to business related objects and/or (ii) a record that represents a confirmation (e.g., a progress update) which indicates the status of the processing activities associated with manufacturing orders.

USMM2: new user license measurement program

This blog will explain on the new USMM2 user license measurement procedure.

Questions that will be answered are:

  • When do I get the new USMM2?
  • How to technically activate the new USMM2?
  • How to run the new USSM2?

In the previous blog on USSM the user classification principles are explained. These principles are still valid for USMM2. If you want to know more about the technical working and mechanics behind the user measurement, read this blog.

Activation of USMM2

USMM2 is activated if you install a recent support package: SAP_BASIS release 7.50 (SP 11), 7.51 (SP 06) and 7.52 (SP 02). With the import of the support package the old USMM is simply replaced with the new one. Official background document from SAP: please follow this link.

The old transaction USMM is still available using transaction USMM_OLD. The only action to do is to activate the new SICF nodes:

New USMM master data

After starting USMM you reach the new start screen:

The basic options are still the same. Here you set the basic master data for the user measurement.

Newer feature is the rule-based classification:

More information from SAP on this feature: follow this link.

Executing the new system measurement

From the USMM start screen hit the system measurement button. The new web part of USMM will start.

The first part is to update the USMM tool and measurement programs.

Yes, also the user measurement programs are written by SAP and are definitely not bug free.
If the measurement program measures too much, apply the notes you find. If the measurement program measures not accurately and SAP does not inform you to apply the note, then you cannot help it that SAP makes a mistake and charge you too little. 
When SAP asks you politely to apply the OSS note best to comply to the request.

In the second step you can do the user classification check and adjust when needed:

The third step will fire the regular measurement jobs:

In the last step you can transfer the results or download the LAW file:

Further processing in SLAW2: read this blog.

Printed format

You can use transaction USSM_PDF to get a PDF format of the user measurement.

License measurement tips & tricks

For license measurement tips and tricks, read this dedicated blog.

LUI License utilization information

The LUI (license utilization information) tool is an online SAP tool that has all the information on your on premise and cloud licenses information combined. For cloud the usage is automatically visible. For on premise systems you can upload the usage via the SLAW files. This can give you insights into under-consumption and over-consumption of licenses. Read more in this blog.

Developer licenses

USMM2 runs typically on a productive system. For developer licenses the process is more tricky. Also due to the fact that SAP in S4HANA removed the simple DEVACCESS measurement. Read more in this blog.

Bug fix OSS notes

Following list contains recent bug fix OSS notes:

SLAW2: license measurement consolidation

This blog will explain about the SLAW2 tool as successor of the SLAW tool used for license measurement consolidation. For background information on SLAW tool, see this blog.

Questions that will be answered in this blog are:

  • How to technically activate SLAW2?
  • How to setup system master data in SLAW2?
  • How to consolidate user measurement data in SLAW2?
  • How to use the SLAW2.0 information system?
  • Differences between SLAW and SLAW2?

SLAW2

Depending on your system, when you start the SLAW transaction, you might be mandatory routed to SLAW2.

In this case you are forced to use SLAW2.

Basic activation of SLAW2

Before you can use SLAW2 web part you have to enable the corresponding SICF nodes:

SLAW2 system settings

If the basic activation is done, start SLAW2 by using the transaction SLAW2. This will open the SLAW2 start screen:

In the master data you start first with checking the already present systems (if you were using SLAW before) or adding a new system.

In this screen you can also go to the general SLAW2.0 settings:

Running the consolidation in SLAW2

The basic principle of SLAW2 and SLAW are the same. The buttons are in different place. SLAW2 is helping you in bit more fancy roadmap style.

If your system data is properly set up, you can select the Start new or Change Consolidation button in the start screen:

The roadmap on top shows in which part of the process you are.

You can show the results and start the Combine Users process.

Next step is the Consolidate users step:

As last step you can see the results and submit to SAP.

In contrast to the old SLAW, the consolidation is done. If you want to repeat, you have to create a new consolidation.

SLAW2 information system

On the start screen of SLAW2 you can go to the LAW2.0 information system.

From here you can create lists and filter them. The results can be exported to excel for further processing, analysis and clean up.

SLAW versus SLAW2.0

The features in SLAW2.0 and SLAW are basically the same. The positives of SLAW2.0 are the information system and roadmap support. The old SLAW is easier if you have more iterations in cleanup.

As said before, depending on your version, SAP forces you to use SLAW2.0.

License measurement tips & tricks

For license measurement tips and tricks, read this dedicated blog.

LUI License utilization information 

The LUI (license utilization information) tool is an online SAP tool that has all the information on your on premise and cloud licenses information combined. For cloud the usage is automatically visible. For on premise systems you can upload the usage via the SLAW files. This can give you insights into under-consumption and over-consumption of licenses. Read more in this blog.

Relevant OSS notes

If you are facing bugs or issues, you can check these OSS notes:

SAP user measurement consolidation for multiple systems: SLAW

This blog will explain how to consolidate multiple SAP user measurements into 1 combined measurement using the SLAW tool.

Questions that will be answered are:

  • How to use the SLAW tool?
  • Which options and help does it bring for consolidation of user measurement?
  • How to consolidate if users have different user ID’s across the systems?

SLAW2

The SLAW tool has a successor in the SLAW2 tool. See this blog to see how SLAW2 works.

Preparation of consolidation

In each of the systems where you have run USMM user measurement, you have to export the data in the LAW file format. To do this go to USMM and select menu option System Measurement and Export to LAW file:

Save as local file is the most common and easy option. Repeat this for all your systems.

LAW consolidation

You need to select one system for consolidation. This can be your main ECC productive server or for example your solution manager system.

In the consolidation system start transaction SLAW:

The consolidation process consists of 4 steps:

  1. Load all the LAW files
  2. Combine the users
  3. Consolidate
  4. Send consolidated results

First load all of your LAW files, before going to the user combination.

In the step Combine Users you have several options to combine the users:

The best option for your consolidation is dependent on the differences per system. If you user name is the same per system, then this is good option. If the username is different per system, but your email is kept consistent per system, then this is a better option. Last resort is to do by name.

After the combination you can start the consolidation. Result of the consolidation for test users on name looks as follows:

If you see cleansing opportunities, do use them. After the cleansing start USMM again, export LAW file and rerun the consolidation.

Tips & tricks for license measurement

For tips and tricks for license measurement read this dedicated blog.

Bug fix notes

Exit mobile version