EWA alert solutions

The SAP Early Watch Alert (EWA) report can contain valuable information on specific topics in your system that you must fix.

More information on the EWA workspace can be found in this blog.

General EWA tips and tricks can be found in this blog.

EWA alert solution finder

On the me.sap.com go to the specific page for EWA solution finder:

Action follow up is on the right hand side per alert:

You can choose:

  • Hide the alert (be very careful!)
  • Snooze the alert (see SAP blog)
  • Mail the alert

The snoozing is a very useful function. For example, you detect a red alert on HANA revision, but it will take you a month to implement (due to regression testing, process, etc), you can now snooze the alert for the implementation period:

After the implementation is done, the alert should be gone. If the implementation is delayed, you will be reminded again.

SAP Focused Run real user monitoring (RUM) overview

This blog will explain the technical activation and usage of RUM (real user monitoring) in SAP Focused Run.

Basic activation of RUM

First go to the Fiori settings tile:

If the RUM function is not active yet, activate it and Save:

Now go to the FRUN backend ABAP system and start transaction STC01 and select task list SAP_FRUN_SETUP_USECASE and variant SAP&FRUN_AUM (advanced user monitoring):

In the task list setup also select the batch jobs:

Now run the task list. This should not take longer than 1 minute. Result green is ok:

Technical activation of RUM per managed system

Per system for which you want to activate the RUM function proceed as follows:

Go to the SSI Fiori tile:

Select the system:

Now press the Configure manually button and new screen opens:

On top first select Step 2 for Execute configuration. And select the Configure Real user monitoring step. Press the Execute Selected button and wait for the log to show success:

Alternatively you can also do the SSI completely new on the first screen by selecting the Configure Automatically button.

Background: RUM is an intense function. If it is not active, the agent does not have to do anything. The re-do of the SSI is needed to tell the agent on the system to start sending RUM data once it is activated in FRUN configuration.

With this step the managed system is prepared.

Functionality activation of RUM per managed system

Now we can go to the RUM Fiori tile:

After scope selection nothing is active yet:

On top right choose the Configuration button and start with the housekeeping settings:

WARNING: RUM can use a lot of data in your database. It can also consume a lot of your Focused Run licensing. If you use too much; reduce amount of systems for which you activate RUM and reduce the retention periods in the screen above. See blog on Focused Run license measurement.

Go to the Systems section and toggle the Activation for the system to On:

Wait for the configuration and data collection to happen. Take 5 to 10 minutes patience for this step.

After the step, refresh the screen and it should look like this:

Data should appear on the left. On top, select the icon Data Quality. This shows the data collection status per host. The icon will be red at start and turn green after 30 minutes.

Using Real User Monitoring: request tool

Now the setup is done, we can start to use the tool. The main screen is the requests tool:

From the start screen you can zoom into the task type you are interested in. As example we zoom in to the task type Dialog:

Drill down all the way:

Here you can see for which user and when the action was done. Unfortunately the action description is pretty technical: action 2000 in transaction CJ8G still might leave you a bit puzzled.

Using Real User Monitoring: cards tool

The second tool is the cards tool:

Here the entry point is the task type or trend in card format.

Using Real User Monitoring: front end tool

The front end tool gives an overview of front end response times and on clients used on your system:

Using Real User Monitoring: back end tool

The back end tool gives an overview of the back end performance and distribution of the response times:

Using Real User Monitoring: hot request tool

The hot request tool gives a cross section for high usage and performance.

If a part is used more, the block size is larger. In this caser, zooming in on the less used red part might be useful. But is it also interesting to analyze the large used orange blocks, since a lot of users are impacted.

Using Real User Monitoring: 24 hour profile

The 24 hour profile tool can be used to see if there are hours of the day where performance is worse than others. Some might be expected. But also: you might want to put in extra capacity to deal with peak loads. Or schedule some intense batch jobs at different times.

Using Real User Monitoring: topology

The topology tool can help you to analyze where data flow to and from your system are running and with which performance quality:

Using Real User Monitoring: execution flow

In some cases a specific user is complaining about poor performance. You can use the execution flow tool to filter on a specific user ID. After opening the tool, press the filter button to detail the user ID:

More tools

RUM has many more tools. Just explore the menu on the left side if another tool is useful for your situation.

Creating a Custom Metric to Check SAPRouter SNC Certificate Expiry

This metric and script checks the SAPRouter SNC certificate expiry and gives an alert depending on how many days left until expiry.

Define SAProuter in Focused Run LMDB

Prerequisite: Make sure you have installed the SAP Host Agent and performed Outside Discovery on the SAPRouter host.

Go to the LMDB of you Focused Run system, then go to Single Customer Network:

Switch Namespace and go to “Technical Systems” and choose “Unspecific Standalone Application System” from the drop-down, then hit Create.

Enter:

Enter the Extended SID:

Add Software Component Version:

Search on the software, and then select the correct release, then Add. E.g.:

Save

Add Installation Path and Required LMDB Attributes. NOTE: Find out the relevant software installation path of the SAPRouter on the server.

Perform Simple System Integration.

Configure Script and Custom SAPHostCtrl Operation

Prerequisite: The script requires the SAPRouter SNC Certificate to be properly installed, and the PSE credentials in the cred_v2 file for the account that runs the SAPRouter service.

A script is scheduled to run daily as the same user that runs the SAPRouter service. The script reads the expiry date of the from the PSE and writes it to a file in JSON format so that the FRUN metric can read and interpret it. The script by default has SAPRouter home directory as /usr/sap/saprouter or <drive>:\usr\sap\saprouter, and it can be changed. This will be denoted as <SAPROUTER_HOME>. The PSE file variable can also be changed.

Linux/Unix

Create a new executable file in the SAPRouter home directory and copy the code in Appendix A. Ensure it is owned and executable by the user that runs the SAPRouter service and belongs to group sapsys. E.g.,

chown <saprouter user>:sapsys saprouter_expiry_days.sh
chmod 744 saprouter_expiry_days.sh

In the script, adjust the following variables:

  • SAPROUTER_HOME
  • SECUDIR (The SECUDIR folder is where the PSE file resides)
  • SAPROUTER_USER
  • PSE

Test the Script. Switch to the user that runs the SAPRouter service, then execute the script:

/usr/sap/saprouter/saprouter_expiry_days.sh

Look for file NUMDAYS.json. It should contain e.g.:

{type:integer, name:NumDays, value:136}

Schedule script in the root crontab as follows:

# Run SAProuter SNC Certificate expiry check
00 09 * * * su - <saprouter user> -c /usr/sap/saprouter/saprouter_expiry_days.sh

Windows

Create a batch file (*.bat) in the SAPRouter home directory. In the script, adjust the following variables:

  • SAPROUTER_HOME
  • SECUDIR (The SECUDIR folder is where the PSE file resides)
  • PSE

Test the Script. Logon as the user that runs the SAPRouter service. Right-click on the bat script and “run as Administrator”. Alternatively, if you are not logged as the SAPRouter service account, you can “run-as” the user that runs the SAPRouter service and execute the script that way.

runas /user:<domain or hostname>\<SAPRouter service user> <SAPROUTER_HOME>\saprouter_expiry_days.bat

NOTE: The SAPRouter service user requires “Allow log on locally” user rights.

Look for file NUMDAYS.json. It should contain e.g.:

{type:integer, name:NumDays, value:136}

Schedule the Script. Open a command prompt as administrator. Execute the command:

SCHTASKS /CREATE /RU <DOMAIN>\<saprouter user> /RP <password> /SC DAILY /TN "Run SAPRouter SNC Certificate expiry check" /TR "C:\Windows\System32\cmd.exe /C \"<SAPROUTER_HOME>\saprouter_expiry_days.bat\"" /ST 09:00 /RL HIGHEST

Note: The start time e.g., 09:00 is in 24 hour format. You should see:

Run the new task to test it:

SCHTASKS /RUN /TN "Run SAPRouter SNC Certificate expiry check"

You should see:

Check the timestamp of the file NUMDAYS.json.

Create Custom Operation for saphostctrl

To load these values into Focused Run, a custom operation for saphostctrl needs to be created.

Linux/Unix

As Root: Create the following custom operations conf file:

/usr/sap/hostctrl/exe/operations.d/checksnccert.conf

Enter the following into the conf file:

Command: cat /usr/sap/saprouter/NUMDAYS.json
Description: Check number of days to SNC certificate expiry
ResultConverter: flat
Platform: Unix

Test the custom operation as follows:

/usr/sap/hostctrl/exe/saphostctrl -function ExecuteOperation -name checksnccert

Result should be:

Webmethod returned successfully
Operation ID: 06C635D6863A1EEDB6BC5C819EE199D7

----- Response data ----
description=Check number of days to SNC certificate expiry
{type:integer, name:NumDays, value:169}
exitcode=0

Windows

Create the following custom operations conf file:

C:\Program Files\SAP\hostctrl\exe\operations.d\checksnccert.conf

Enter the following into the conf file:

Command: FOR /F "tokens=* delims=" %x in (<SAPROUTER_HOME>\NUMDAYS.json) DO @echo %x
Description: Check number of days to SNC certificate expiry
ResultConverter: flat
Platform: Windows

In a Command Prompt as Administrator, test the custom operation as follows:

"C:\Program Files\SAP\hostctrl\exe\saphostctrl" -function ExecuteOperation -name checksnccert

Result should be:

Webmethod returned successfully
Operation ID: 00155D657F901EEDBCF9E32BC564F964

----- Response data ----
description=Check number of days to SNC certificate expiry
{type:integer, name:NumDays, value:360}
exitcode=0

Create Custom Alert in Focused Run

Create a new monitoring template for SAPRouter here:

Enter into Expert Mode. Create a new Alert with the following settings:

NOTE: If the tick box “Do not Group Individual Occurrences” is ticked, it will alert at each data collection regardless of its previous rating, and not only at a change of rating.

Create Custom Metric In Focused Run

Create a new Metric with the following settings:

Data Collection

All parameters of the Data Collector which are fixed should have the “Configure” box unticked, and the common parameters pre-filled with the correct values.

The “Custom Operation” parameter is the saphostctrl operation “checksnccert” created earlier. The “Metric Name” parameter is the name of the metric in the JSON output file produced by the script, which is “NumDays”.

Threshold

The threshold picks up the integer as returned by the script; if it falls to below or equals 10 days, then raise a yellow alert, if below or equals 5 days, then raise a red alert. Choose whatever threshold values suit you.

Assignment

Assign the Metric to the Alert:

Activate the Alert

Apply SAPRouter Template and Check Monitoring

TIP: Initially set the collection interval to 5 minutes and apply template to see whether it is collecting data. Then you can set the collection interval back to daily.

You should see this in the Monitoring Application:

Appendix A: saprouter_expiry_days.sh

#!/bin/bash
# Outputs the expiry date of the SNC Certificate and calculates the number of days
# If the number of days falls below threshold, it sends an alert
# Written by Tony Swietochowski

SAPROUTER_USER=saprouter
SAPROUTER_HOME=/usr/sap/saprouter
SECUDIR=$SAPROUTER_HOME/sec
PSE=local.pse
HOSTNAME=$(hostname -f)

# Check  for saprouter user
[[ ! "$USER"=="$SAPROUTER_USER" ]] && echo "This script must be run using the $SAPROUTER_USER user. Exiting." && exit 1

EXPIRYDATE=$(${SAPROUTER_HOME}/sapgenpse get_my_name -p $PSE -n validity 2>&1 | grep NotAfter | awk -F\( '{print$2}' | cut -c -6)
NUMDAYS=$(echo $(( ($(echo $(date --date="$EXPIRYDATE" +%s) - $(date -d $(date +%y%m%d) +%s)) )/86400 )))
# Above method based on https://stackoverflow.com/questions/4946785/how-to-find-the-difference-in-days-between-two-dates

echo $NUMDAYS > $SAPROUTER_HOME/NUMDAYS
echo \{type:integer, name:NumDays, value:$NUMDAYS\} > $SAPROUTER_HOME/NUMDAYS.json

Appendix B: saprouter_expiry_days.bat

@echo off

REM Outputs the expiry date of the SNC Certificate and calculates the number of days
REM If the number of days falls below threshold, it sends an alert
REM Written by Tony Swietochowski

set SAPROUTER_HOME=D:\usr\sap\saprouter
set SECUDIR=%SAPROUTER_HOME%\sec
set SNC_LIB=%SECUDIR%\sapcrypto.dll
set PSE=local.pse

for /f "tokens=2 delims=\" %%i in ('whoami') do set THISUSER=%%i
FOR /F "tokens=* USEBACKQ" %%F IN (`hostname`) DO (SET HOSTNAME=%%F)

chdir /d %SAPROUTER_HOME%

for /f "tokens=2 delims=(" %%a in ('%SAPROUTER_HOME%\sapgenpse.exe get_my_name -p %PSE% -n validity ^2^>^&^1 ^| findstr /l "NotAfter"') do set DATESTRING=(%%a

set expiry_year=20%DATESTRING:~1,2%
set expiry_month=%DATESTRING:~3,2%
set expiry_day=%DATESTRING:~5,2%

set current_year=%date:~-4%
set current_month=%date:~4,2%
set current_day=%date:~7,2%

set "from=%current_month%-%current_day%-%current_year%"
set "to=%expiry_month%-%expiry_day%-%expiry_year%"
echo Wscript.Echo DateDiff("d", "%from%", "%to%") > %TEMP%\tmp.vbs

for /f %%a in ('cscript /nologo %TEMP%\tmp.vbs') do set /a "numdays=%%a"

del %TEMP%\tmp.vbs

echo Number of days to SAPRouter certificate expiry: %numdays% > %SAPROUTER_HOME%\NUMDAYS.log
echo {type:integer, name:NumDays, value:%numdays%} > %SAPROUTER_HOME%\NUMDAYS.json

<< This blog was originally posted on SAP Focused Run Guru by Tony Swietochowski (DXC). Repost done with permission. >>

Activating SAP Cloud ALM

This blog will explain the steps to activate SAP Cloud ALM.

Check the use cases of Cloud ALM on the Cloud ALM expert portal.

Organizational preparation

This might be taking the most time in larger organizations. SAP will allow 1 Cloud ALM per customer. But the customer might have multiple SAP systems managed by multiple SAP competence centers. In this case, you need to align who will call off the Cloud ALM system.

Identity provider choice

You can use Cloud ALM with integration to your own corporate identity provider or use the SAP IAS (Identity Authentication Service).

Changing can be done later on. See OSS note 3020352 – How to specify a different IAS tenant for your SAP Cloud ALM tenant. But keep in mind here that there is no migration of user and access data (so you have to redo it manually).

When choosing your own identity provider, you can end up in a weird maintenance issue, that you have to create a SAP support ID and e-mail in your own identity provider to give SAP access to your Cloud ALM system. See OSS note 3032960 – Steps for Providing an SAP Cloud ALM user for Development to Access the SAP Cloud ALM Tenant.

Technical preparation

Read and understand the usage rights of cloud ALM. Most important here is the limit of maximum 8 GB data usage.

Read and understand the “Setup and admin guide for Cloud ALM“.

Setting up multiple admins if required: 3248116 – How can the Initial user who provisioned SAP Cloud ALM setup additional SAP Cloud ALM Admins?.

Actual call off

After the preparation follow the steps in the guide for the actual call off. The process can be completed in a working day.

<< This blog was originally posted on SAP Focused Run Guru by Frank Umans. Repost done with permission. >>

SAP Cloud ALM positioning 2024

SAP Cloud ALM on the SAP Focused Run blog? Why?

SAP Cloud ALM and SAP Focused Run have a lot of overlapping capabilities.

The goal is not to push a tool, but to monitor, safeguard and secure SAP system running by customers. The tool is a means and not the goal.

What we will discuss:

  1. High level positioning of Cloud ALM, Focused Run and Solution manager
  2. Current status in 2024 for the tools
  3. Possible considerations
This positioning blog is for the year 2024. Next year when new functions and insights are available the positioning and considerations can change.

High level positioning of Cloud ALM, Focused Run and Solution manager

The below picture is the best one and is taken from the Focused Run overview presentation:

Positioning:

  • Solution manager: it works, but no new developments, supported until 31.12.2027
  • Focused Run: suitable for large customer and advanced needs
  • Cloud ALM: standardized setup

Cloud ALM vs Focused Run

Cloud ALM is a standardized SAP service. It has certain capabilities, but no extensions. Due to its standardized setup is can be made working very fast with a few clicks. The functions will work fast, but configuration options are limited to the use cases provided by SAP. Data volumes on Cloud ALM are not to be too high, since the UI’s are still designed for small and medium customers with lower amount of systems, alerts, etc.

Focused Run admins will be quick to adopt SAP Cloud ALM since there is a large similarity in concepts and UI.

Comparison table:

DimensionCloud ALMFocused Run
Technical setup complexityLowMedium for ABAP, High for non-ABAP
Technical setup timeLowLow to medium
Maintenance effortLowMedium
Upgrading to unlock new functionsNo effort, SAP takes careHigh effort to upgrade
Volume of data that can be handledLow to mediumHigh to very high
Complexity of scenario’s that can be handledLowLow, medium, high
Extension possibilitiesVery limitedPossible with API and custom code
Feature extensionsFast, bi-weeklyEvery half year major and minor features will be added
Current featuresLimited, but growing fastExtensive, don’t expect major extensions

Considerations

Currently running SAP solution manager

If you have functions running on SAP solution manager, first consideration is the move to SAP Cloud ALM. SAP solution manager hosts normally EWA, CHARM, documentation/implementation and/or monitoring functions. An SAP readiness check is available to check your move from SAP solution manager to Cloud ALM. Read this blog on the how.

Currently running SAP Focused Run

If you are currently running SAP Focused Run, you most likely will keep it the next few years. But still do keep track of the SAP Cloud ALM functions, and try them out.

SAP Cloud ALM might be a good solution to monitor less important systems with lower demand like sandboxes, development and test systems. These system typically don’t need intense monitoring, but mostly availability monitoring.

SAP Cloud ALM might be a good solution to monitor your SAP Cloud hosted and SAP BTP scenarios. Setup in Cloud ALM for these scenarios is far simpler than setting these up in SAP Focused Run.

SAP Focused Run will never be enabled for business process monitoring. That functionality is now available in SAP Solution manager and will only be available in the future in SAP Cloud ALM.

Monitoring solutions for running installations

If you have a running SAP installation and are looking for a good monitoring solution, then it is wise to check both SAP Cloud ALM and SAP Focused Run. Depending on your needs you can choose between both.

Check the road map of SAP Cloud ALM as well to see if missing gaps will be addressed in the upcoming year.

The business case for a monitoring solution is different per line of business. The main business case is roughly: “We will avoid or solve much faster Y major incidents per year. Each major incident costs is about xxx.xxx USD/EUR”.

New solutions

For new SAP solutions: first consider using SAP Cloud ALM. Only when expecting high volume and high monitoring requirements, set up SAP Focused Run.

Cloud ALM usage rights

Cloud ALM is in principle for free within the usage rights. The usage rights can be found on this link.

Important restrictions: 8 GB in size (in 2024) and only 1 Cloud ALM per customer (see OSS note 3343265 – When provisioning SAP Cloud ALM in SAP for Me your company is “Not Entitled/No Data” and SAP Cloud ALM cannot be provisioned).

Extensions can be procured: SAP blog.

Test driving Cloud ALM

You can use the SAP Cloud ALM demo system to test drive Cloud ALM and see if it would potentially meet your needs. Read more in this blog.

Cloud ALM background material

More background material on Cloud ALM can be found on:

Summary

SAP Cloud ALM functions are growing fast and are definitely worth using. SAP Cloud ALM is a highly standardized function. This makes it for SAP possible to deliver new functions fast and easy to integrate and easy to use. The highly standardized functions comes with a setback that the solution cannot be extended to any particular need you might have.

It is out-of-the-box what you get, and nothing more.

<< This blog was originally posted on SAP Focused Run Guru by Frank Umans. Repost done with permission. >>

SAP Focused Run dashboards in alert management

The SAP Focused Run Alert Management application allows us to create a custom dashboard that can help us to report on alerts as per our custom alert reporting needs.

To create a custom dashboard, in the Alert Management App, click on the +sign (Add Custom Page) on the navigation panel.

Upon clicking on Add Custom Page , a blank pane is displayed along with the setup panel to its right.

The first step in setup is to give a name to your dashboard. For this click on Rename button in the setup area Page Management.

In the pop-up provide the name for your dashboard.

You can also give a meaningful Icon to your dashboard that will be displayed in the navigation panel. For this provide the sap icon name in the Icon field. To get a list of available icons you can also look in the SAP Icons link which takes you to the Icon explorer.

The next is to specify the grid layout (Number of rows and columns)in the view management section of setup area. By default it is 1×1 which means you can add only 1 dashboard. If you want to add more dashboards, accordingly you can adjust the grid.

Then you need to select a view, based on what you want to show in the dashboard, by selecting from the list of available views. You can select a view by simply dragging and dropping in the dashboard layout.

In this example we have selected 4 views in the 2×2 grid layout.

  • Top Open Alerts affecting most no. of Managed Objects
  • Open Alerts by Monitoring Usecase
  • Open Alerts by duration
  • Open Alerts by source

By default all the dashboards in your custom dashboard will use the Global Scope, the scope inherited from the scope you selected while opening the Alert Management App. You can also select a custom scope for your dashboard. For example in this case we want to filter for all production system alerts. For this click on the setup button of the dashboard you want to specify the scope.

Then in the setup area, in the scope selection, select your custom scope from the drop down list. Note: You must have already created your custom scope in the Scope management section.

Once you have finalized your dashboard you can publish your dashboard by marking it as public so that others can also use the dashboard.

However, by default the public custom dashboard is not added in the navigation panel of all other users. To be able to view the dashboard a user has to again click on the + sign in the navigation panel, and then in setup area select the public page.

<< This blog was originally posted on SAP Focused Run Guru by Manas Tripathy (Simac). Repost done with permission. >>

Statistical records in SAP Focused Run

Focused Run has functions to fetch ST03N data from ABAP backend systems and use the data for analysis in SAP Focused Run System Analysis functions.

System analysis SSI activation

First step is to switch on the general functions for system analysis during SSI activation. Full help link from SAP can be found here.

In Focused Run start SM30 for table RCA_SSI_CONF and add entry for activation:

Repeat SSI

For the system that you want to have ST03N data collected, you need to repeat the SSI.

Check the detailed step in the SSI for the Statistical records aggregation:

Activate per system in System Analysis

Next step is to activate it per system in System Analysis:

Go to the settings per system and make sure Performance (aggregated statistical records) is activated:

Overview of all systems

In System Analysis, go to the bottom left tool section to open the Aggregation Configuration tool:

The overview page opens:

Now you can see both configuration and data collection is ok.

Using statistical records

Go to the System Analysis tile and select the scope:

On the left side menu switch to the ABAP performance view:

In the new view in the ABAP frontend workload, push expand the screen button:

Now you get a list of all transactions. To make it simple we filter on EntryID (in this case we filter on ME to search for the procurement transactions):

Top right, there is the download to xls button. This is a very useful tool! In XLS you can post process the data.

You can also filter and sort on other elements like amount of executions.

To get a trend, click on the trend graph, in this example the trend for ME23N transaction:

Raw table data

If you have a specific query that is not met with the out-of-the-box reports, you can use SE16 on the Focused Run backend for table STATDBUSERTCODE. In this table the raw data is stored.

<< This blog was originally posted on SAP Focused Run Guru by Frank Umans. Repost done with permission. >>

SAP Focused Run OCC dashboard

OCC dashboards are the most flexible form of dashboarding in SAP Focused Run. It is completely up to you to define any dashboard based on the available data.

The explanation below will give a quick introduction on how to setup a dashboard with as example a line graph with CPU for one system and amount of short dumps per hour for that system in a bar chart.

Set up new dashboard

Start the OCC dashboard Fiori tile:

Click the add a new dashboard icon on the left:

Now open on the right hand side icon the personalization. Here you can change the default 2 by 1 layout if want as well:

Now per gadget, select the personalization. First choose the type of graph, then select the query details:

Add the query by clicking the Plus sign:

Give the legend a name and press the Change query button:

First select the data source. In this example we choose system monitoring. Select next your system, and select the metric (in this case CPU). Don’t forget to save on top of the personalization!

We repeat for the other gadget, but now select short dumps per last hour as example:

Test your dashboard to see if the results are according to your expectation.

Make dashboard public

If you are happy with your dashboard, you can make it public. To do so, go to the personalization options:

Set the selected page to public, select a proper icon, and rename the default user-edit to a proper name and don’t forget to Save.

Other users can now add you dashboard from their UI personalization menu by clicking the Add Public Page and add your dashboard:

ABAP short dump trend analysis

We can use SAP Focused Run OCC Dashboards to build a ABAP Dump Trend Analysis dashboard.

Using OCC Dashboard we can use the data provider for System Monitoring to pull the data of Short Dumps per day metric in to a trend chart.

In the OCC Dashboard app you can create a new dashboard page by clicking on Add Custom Page in the navigation panel.

By default your new page will be named as custom_page, you can rename your page by clicking on Rename in the settings section and then providing a new name.

In the View Management section of the settings area you can modify the grid layout. By default you have 2 columns in 1 row. In this example we will change to 1 X 1 to keep just the ABAP Dump Trend Analysis dashboard. (Note: we can add a dashboard to each grid in the layout).

Now for adding the dashboard to the pane we just created, we click on the settings button for that pane.

Then in settings area, under View Personalization –> Render we select the graph type. In this case we want to perform a trend chart so we select Line Chart.

Now we need to create a query for the chart that would provide the data for our graph. For this in the Query section we click on the + sign to add a query.

Now in the Query Section, for the newly added row you provide a name under Legend and then click on the change button to start editing the query.

In the Query Editor screen select the data provider System Monitoring.

Now we navigate to the Scope Selection tab to select the managed systems for which the dashboard should display data. In this example we selected System Type as Application Server ABAP and IT Admin role as Production to select all ABAP production systems.

Now in the Default tab , under Extended SID select any ABAP system and then under Metrics tab select the metric Number of Short Dumps (Today). Click on Apply button to activate the selection.

Now you can see the ABAP Dumps trend lines for the selected scope of managed systems in the graph.

Note: By default a graph for System Monitoring data provider will select Auto resolution of data which will show the data for today with hourly frequency.

You can change the resolution in the Time Range Section in the Settings area. For example here we set Period for last 30 days as “l30d” and Granularity for every day or daily as “d”.

Note: OCC Dashboard graphs will always average out the data as per the granularity set for the graph w.r.t actual collection frequency of the selected metric. For instance if the metric Number of Short dumps (Today) has a hourly frequency and we show the daily data in the graph, then the value shown in the graph will be average of all hourly data collected by the metric for that day, which will of course be different from the actual final daily count. Hence to ensure data shown on graph is accurate, ensure that the Number of Short Dumps (Today) metric has a daily frequency. Then the granularity of the graph and the metric data collection frequency being exactly same, both will have the exact same and accurate data.

To know more abut OCC Dashboards and all possibilities with it you can refer to SAP Documentation here.

<< This blog was originally posted on SAP Focused Run Guru by Frank Umans and Manas Tripathy (Simac). Repost done with permission. >>

Process Chain Monitoring in SAP Focused Run

Process Chain Monitoring in SAP Focused Run is possible via Job And Automation Monitoring which is available as of SAP Focused Run 3.0 FP02.

You can launch the Job & Automation Monitoring app in the Advanced Application Management section in the Focused Run launchpad.

When you launch the app you will be asked for a scope selection for which you can specify the systems for which you want to activate Process Chain Monitoring.

To start the setup of Process Chain Monitoring click on the settings button.

In the settings popup click on the pencil button under Technical Systems.

In the next popup select the system for which you want to configure process chain monitors by clicking on the area as shown below.

In the next screen , in the Monitoring tab click on the + sign to create a new filter to activate data collection.

Now provide a filter name and then in Job Type select SAP BW Process Chain and save.

After creating the filter move to Alerting tab and click on the + sign to create a new alert.

You can create the following types of alerts.

  • Critical Execution Status: The Execution Status is rated green, if a job finished successfully and red, if the job execution did not finish, i.e., aborted. It is rated yellow, if a job finished with warnings or errors without aborting.
  • Critical Application Status: The Application Status is rated green, if a job successfully processed the application data. It is rated red, if e.g., an ABAP job execution writes errors into the application log and yellow, if there are warnings, but no errors.
  • Critical Delay: The Start Delay rating is rated green, if the technical delay of a job (e.g., in case of an ABAP job the time passed until a job gets a work process assigned) did not exceed the threshold defined.
  • Critical Runtime: The Run Time is rated green, if the runtime of a job did not exceed the threshold defined.  

To create the alert first select the alert type.

Then in Alert Filters section provide the BW Process Chain name for which you want to activate alerting. Also you must provide the job type as BW Process Chain. You can optionally enter further filters like Execution User, Executable Name, ABAP Client and whether it’s a Standard Job or not.

Note: With Job & Automation monitoring you can create alerts for Standard ABAP jobs as well. The filters Executable Name and Standard Job is applicable only for ABAP Job type.

Optionally you can also set Notification Variant, Alert Severity and enable Automatic Alert Confirmation in the Alert Settings section.

Optionally you can also provide Resolution Instructions in the Alert Resolution area.

If you select alert type Critical Delay or Critical Runtime you also have to enter the thresholds.

Finally click on the Save button to save and activate the alerting.

Note: When we activate monitoring of process chain by creating the filter in the Monitoring tab, we activate data collection for Process Chain monitoring. This will enable data collection of all process chains of that managed system. You can see status of all process chain runs for that system in the main page of the Job & Automation Monitoring app. Additionally and optionally you can create/enable alerting in the Alerting tab to alert on specific process chain failures.

Note: Since the launch of Job & Automation Monitoring in Focused Run 3.0 FP2 the old Job Monitoring feature has been renamed to Job Monitoring ABAP Only. The Job Monitoring ABAP Only functionality is completely deprecated as of release of Focused Run 4.0.

For more details on Job & Automation Monitoring you can refer to SAP documentation here.

<< This blog was originally posted on SAP Focused Run Guru by Manas Tripathy (Simac). Repost done with permission. >>

SAP Focused Run certificate expiry monitoring

SAP Focused Run can be used to monitor expiry of a lot of different type of certificates:

  • ABAP PSE certificates (read below)
  • Host agent PSE certificates (read below)
  • SSL certificates (see this blog)
  • Cloud Connector BTP certificate expiry (read below)
  • SNC certificate expiry (read below)
  • SNC expiry in SAP router

ABAP PSE certificate monitoring

In system monitoring you can monitor if ABAP system certificates are expiring or are already expired. SAP provides a standard metric for this based on configuration validation rule SAP ABAP PSE CERTIFICATES CHECK. This rule is taking all certificates that are to be expired in the next 7 days and all expired certificates.

This rule has two setbacks:

  • 7 days upfront warning might be too short
  • It reports all expired certificates that are already years expired and don’t harm the system

New rule for ABAP PSE certificate monitoring

For the improved setup we will defined 2 new rules:

  • To be expired certificates, with date selection -30 till tomorrow
  • Expired certificates, with date selection today till next 30 days.

Start with creating the policy in configuration validation (more on configuration validation in this blog):

Add a new policy Z_ABAP_PSE_TO_BE_EXP for the to be expired, and give it this syntax:

Add a new policy Z_ABAP_PSE_EXP for the expired ones:

Both are basically a copy of the standard SAP one with the changed dates.

Please note you need to change both the dates in the Compliant and Non-Compliant section.

Create custom metric

Now you can create a custom metric using the newly created rule. For full description on how to create custom metrics, read this blog. Create the custom metric in the ABAP system template:

Refer to the newly create custom CoVa (configuration validation) rule:

And set the threshold:

For the to be expired certificates, we only want warning.

We repeat the same for the expired certificates, but now we make it a red alert by setting the thresholds differently.

Make sure both are now activated for monitoring:

Trouble shooting

There might be false alerts raised for this metric. This is for both the custom and standard SAP metric. The source is usually the data collection.

SAP note 3138046 – False Alert ABAP PSE certificates expiring in Focused Run describes the checks to perform.

Go to the configuration and configuration validation FIORI tile and select the system and search for the PSE certificates data collection details:

Monitoring Host Agent PSE Certificate Expiry

You have configured SSL for enabling secure connections to SAP Host Agent. In such a case you need to regularly update or extend the validity of the SAP Host Agent PSE certificate. With Focused run System Monitoring you can create custom metric for monitoring SAP Host Agent PSE certificate expiry.

Setup Monitoring Host Agent PSE Certificate Expiry

Step1: Navigate to Host Template maintenance

SAP Host Agent resides at OS level of each host of systems that you are monitoring using Focused Run. Hence you need to monitor the PSE certificate for SAP Host Agents of each host in your customer network.

In our recent blog we have explained how you can configure URL Certificate monitoring in Health Monitoring in SAP Focused Run. However configuring certificate monitoring for each SAP Host Agent in your customer network using Health Monitoring will be very cumbersome.

An easier way will be to setup a custom metric in the host level system monitoring template which when activated will be automatically applied to all hosts for which the monitoring template is used.

For template maintenance you can navigate to System Monitoring Template Maintenance app on the Focused Run launch pad.

In the template maintenance app navigate down to the Host (Server) node and then to the respective template which you want to edit and click on Edit button.

Step2: Create Custom Metric

In order to create a custom metric you need to activate expert mode. For this click on the Expert Mode button as shown below.

After enabling expert mode you can click on Create button. Select Metric in the drop down from Create button.

In the Metric creation pane, under Overview tab enter the details as shown below.

Then in the Data Collection tab, provide the details as shown below.

For the URL field you need to mention the URL https://$SAP_ComputerSystem.FQDName$:1129/SAPHostControl/?wsdl in which the expression $SAP_ComputerSystem.FQDName$ will dynamically resolve the respective FQDN of the host picked up from LMDB. Hence it is important to select the check box under Placeholder and select LMDB under Placeholder type.

Then navigate to the Threshold tab and provide the threshold as shown below. In this example the threshold is Yellow if certificate is expiring in 30 days and Red if its expiring in 15 days.

Then click on Next button to navigate to the Assignment tab where we assign this metric to an existing alert. In this step just click on the Finish button to save the metric. In this step we don’t assign to any alerts yet as we are yet to create a custom alert for this custom metric.

Step3: Create custom Alert and assign to custom Metric

In the expert mode maintenance go to the Create button and then from the drop down select Alert.

Enter the details as shown below and click on Next button.

Then in the Assignments tab you will see the custom metric you just created. Select the check box for this metric and click on Finish to save the alert.

Now your custom metric is ready together with alerting active.

To activate this template update on all hosts navigate to Managed Objects tab for the template and click on Apply and Activate button.

Upon activation the new metric will be available in system monitoring as shown below.

For more details on how to setup SSL for SAP Host Agent you can refer to the SAP documentation here.

SNC certificate expiry monitoring

SNC Certificate expiry is very critical for ABAP systems where SNC logon is used. As soon as the certificate expires users will no more be able to login to system.

In System Monitoring for ABAP systems SAP provides a standard metric called Expiring PSE Certificates which monitors all PSE certificates that includes SNC certificates. When this metric turns red it will tell how many certificates are expiring/expired but not which one. Hence its beneficial to monitor separately the status of SNC Certificates.

This monitoring can be achieved by using Configuration Validation.

You can create a custom policy with the below XML code that checks the PSE_CERT store to check on status of SNC Certificate.

<?xml version="1.0" encoding="utf-8"?>
<targetsystem desc="SNC Certificate about to expire" id="ASML_SNCERT_TOBE_EXP" multisql="Yes" version="0000">
<configstore name="PSE_CERT" system_type="ABAP">
<checkitem desc="Valid in range" id="1" operator="">
<compliant>APPLICATION like '%SNCS%' and CONTEXT like '%' and TYPE like '%' and SUBJECT like '%sapci%' and ISSUER like '%' and SERIALNO like '%' and VALID_FROM like '%' and ( ( ( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) &gt; to_number(replace(add_days(current_date, 30), '-', '')||replace(current_time, ':', '') ))
or (( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) &lt; to_number(replace(add_days(current_date, 0), '-', '')||replace(current_time, ':', '') )) )</compliant>
<noncompliant>APPLICATION like '%SNCS%' and CONTEXT like '%' and TYPE like '%' and SUBJECT like '%sapci%' and ISSUER like '%' and SERIALNO like '%' and VALID_FROM like '%' and not ( ( ( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) &gt; to_number(replace(add_days(current_date, 30), '-', '')||replace(current_time, ':', '') ))
or (( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) &lt; to_number(replace(add_days(current_date, 0), '-', '')||replace(current_time, ':', '') )) )</noncompliant>
</checkitem>
</configstore>
</targetsystem>

Note: In the above XML code, SUBJECT like ‘%sapci%’, you have to replace sapci with a hostname pattern that you use for all your SAP ABAP system hostnames.

Once you have created the policy, you can directly activate alerting on the policy.

For that go to the Configuration and Security Analytics app in the Advanced Configuration Monitoring area.

In the app navigate to Configuration Validation Alert Management under the the Related links tab.

In the Alert Management app click on Create button to create the alerting for the policy you just created.

In the next popup, enter details as shown below and then click on Select policy to select the policy for which you want to activate the alert.

In the next popup select the policy by clicking on the policy name.

Now click on Save to activate the alerting.

Additionally you can also activate email notification on the alert. For this in the Alert Management main screen, select the alert and then click on Notification/Outbound.

In the next popup select the notification variant and save.

Cloud Connector BTP certificate expiry

With SAP Focused Run 3.0 FP 2 SAP has delivered a configuration validation policy using which you can monitor Cloud Connector BTP Certificate expiry.

Note: For using this functionality you just have to ensure that you have registered your cloud connector managed system to your Focused Run System and have performed SSI for the cloud connector managed system.

You can do the monitoring via the Configuration & Security Analytics app in the Advanced Configuration Monitoring area of Focused Run Launchpad.

In the app click on the select button to select the policy to monitor Cloud Connector BTP Certificates.

In the pop-up you can search for SCC and then select the policy SAP_SCC_PSE_CERT. This is the standard policy delivered by SAP that performs configuration validation on Cloud Connector BTP Certificate expiry.

This policy monitors if a BTP certificate in cloud connector system is going to expire in less than 30 days or is already expired.

The first view upon selecting the policy is the Systems view. In this view all SAP Cloud Connector systems registered in Focused Run system are listed. A systems is marked as non compliant if it has any certificate which is going to expire in less than 30 days or has any expired certificates. This view also tells how many certificates are there in the system and how many are non compliant.

You can click on the row to see the details of the certificates which are expiring or expired.

To know more about Configuration and Security Analytics you can refer here.

Also you can find more detail at SAP documentation here.

<< This blog was originally posted on SAP Focused Run Guru by Manas Tripathy (Simac) and Frank Umans. Repost done with permission. >>