. Can we convert Authorization field to Org, fieldA. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE orZPFCG_ORGFIELD_CREATEUse SE38 or SA38 to run the above report. • Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be postprocessed in roles. • The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level field.In addition, all affected roles are analyzed and the authorization data is adjusted. The values ofthe authorization field which is now to become the organizational level field are removed andentered into the organizational level data of the role.Note: Table for Org Element- USORGRefer to Note 323817 for more detail.Q. How many profiles can be assigned to any user master record.A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profileassignments for users). This table contains both information on the change status of a user andalso the list of the profile names that were assigned to the user.The field PROFS is used for saving the change flag (C = user was created, M = user waschanged), and the name of the profiles assigned to the user. The field is defined with a lengthof 3750 characters. Since the first two characters are intended for the change flag, 3748characters remain for the list of the profile names per user. Because of the maximum length of12 characters per profile name, this results in a maximum number of 312 profiles per user.Q. Can you add a composite role to another composite role?A. NoQ. How to reset SAP* password from oracle database.A. Logon to your database with orasid as user id and run this sqldelete from sapSID.usr02 where bname=SAP* and mandt=XXX;commit;Where mandt is the client.Now you can login to the client using sap* and password passQ. What is difference between role and profile.A. A role act as container that collect transaction and generates the associated profile. Theprofile generator (PFCG) in SAP System automatically generates the correspondingauthorization profile. Developer used to perform this step manually before PFCG was introducedbySAP. Any maintenance of the generated profile should be done using PFCG.Q. What is user buffer?A. When a user logs on to the SAP R/3 System, a user buffer is built containing allauthorizations for that user. Each user has their own individual user buffer. For example, if userSmith logs on to the system, his user buffer contains all authorizations of roleUSER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.A user would fail an authorization check if: • The authorization object does not exist in the user buffer • The values checked by the application are not assigned to the authorization object in the user buffer • The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter
auth/number_in_userbuffer.Q. SAP Security T-codesA. Frequently used security T-codesSU01 Create/ Change User SU01 Create/ Change UserPFCG Maintain RolesSU10 Mass ChangesSU01D Display UserSUIM ReportsST01 TraceSU53 Authorization analysisClick here for all Security T-codesEnd UserTransaction Code Menu Path PurposeSU3 System --> User Profile--> Own Set address/defaults/parameters DataSU53 System --> Utilities --> Display Display last authority check that Authorization Check failedSU56 Tools --> Administration --> Monitor Display user buffer --> User BufferRole AdministrationTransaction Code Menu Path PurposePFCG Tools --> Administration --> User Maintain roles using the Profile Maintenance --> Roles GeneratorPFUD <none> Compare user master in dialog. This function can also be called in the Profile Generator: Environment --> Mass compare The Job for user master comparison is: PFCG_TIME_DEPENDENCY (to Release 4.0 RHAUTUP1)SUPC Tools --> Administration --> User Mass Generation of Profiles Maintenance --> Roles --> Environment --> Mass GenerationUser Administration
Transaction Code Menu Path PurposeSU01 Tools --> Administration --> User Maintain Users Maintenance --> UsersSU01D Tools --> Administration --> User Display Users Maintenance --> Display UsersSU10 Tools --> Administration --> User User mass maintenance Maintenance --> User Mass MaintenanceSU02 Tools --> Administration --> User Manually create profiles Maintenance --> Manual Maintenance --> Edit Profiles ManuallySU03 Tools --> Administration --> User Manually create authorizations Maintenance --> Manual Maintenance --> Edit Authorizations ManuallyProfile Generator ConfigurationTransaction Code Menu Path PurposeRZ10 Tools --> CCMS --> Maintain system profile parameters. Configuration --> Profile (auth/no_check_in_some_cases= Y). MaintenanceSU25 IMG Activity: Installation Enterprise IMG --> Basis 1. Initial Customer Tables Fill Components --> System Upgrade Administration --> Users and 2a. Preparation: Compare with SAP Authorizations --> Maintain values authorizations and profiles 2b. Reconcile affected transactions using Profile Generator --> 2c. Roles to be checked Work on SAP check indicators 2d. Display changed transaction and field values codes Select: Copy SAP check ID’s and field values • Maintain Check IndicatorsSU24 Same as for SU25: Select: Change Check • Maintain Templates IndicatorsTransport
Transaction Code Menu Path PurposeSCCL Tools --> Administration --> Local client copy (within one system, Administration --> Client between different clients) Administration --> Client Copy --> Local CopySCC9 Tools --> Administration --> Remote Client Copy (between clients Administration --> Client in different systems) Data exchange Administration --> Client Copy over a network (not files). --> Remote CopySCC8 Tools --> Administration --> Client transport (between clients in Administration --> Client different systems) Data exchange Administration --> Client using a data export at operating Transport --> Client Export system level.<none> Tools --> Administration --> User Mass transport of roles Maintenance --> Roles --> Environment --> Mass Transport<none> Tools --> Administration --> User Upload/Download of Roles Maintenance --> Roles --> Role --> Upload/DownloadSU25 Point 3. Transport of Check indicatorsSTMS Tools -->Administration --> Transport Management System Transports --> Transport Management SystemSystem configurationTransaction Code Menu Path PurposeRZ10 Tools --> CCMS --> Maintain system profile parameters. Configuration --> Profile (auth/no_check_in_some_cases = Y). MaintenanceRZ11 Description of system profile parametersSM01 Tools --> Administration --> Lock transaction codes from Administration --> Transaction execution Code AdministrationAuthorization Object
Transaction Code Menu Path PurposeSU20 Tools --> ABAP Workbench --> List of authorization fields Development --> Other Tools --> Authorization Objects --> FieldsSU21 Tools --> ABAP Workbench --> List of authorization objects (Initial Development --> Other Tools --> screen lists by object class) Authorization Objects --> ObjectsAuditTransaction Code Menu Path PurposeSE84 Tools --> Administration --> User Information System for SAP R/3 Maintenance --> Information Authorizations SystemSECR* <none> Audit Information SystemTable maintenanceTransaction Code Menu Path PurposeSM30 System --> Services --> Table Create table authorization groups(Tables Maintenance --> Extended Table (V_BRG)V_BRG, Maintenance Maintain assignments to tablesV_DDAT) (V_DDAT)Table GroupTransaction Code Menu Path PurposeSE43 ABAP Workbench --> Maintain (Display) Area Menus Development --> Other Tools --> Area Menus Common Transaction Codes for Basis AdministrationAL01 SAP Alert Monitor SE14 Utilities for Dictionary SSM0 Menu Tables Maintenance and Test
AL02 Database Alert Monitor SE15 ABAB/4 Repository Info SSM1 SAP and System Company Menu administrationAL03 Operating System Alert SE30 ABAP/4 Run time ST01 System Trace Monitor AnalysisAL04 Monitor Call Distribution SE38 ABAP/4 Editor ST02 Setup/Tune BuffersAL05 Monitor Current SE54 Generate Table View ST03 Performance Workload SAP statistics, WorkloadAL06 Performance: SE61 R/3 Documentation ST04 Select Database Upload/Download ActivitiesAL07 Early Watch Report SE80 ABAP/4 Development ST05 SQL Trace WorkbenchAL08 Users Logged On SE91 Maintain Messages ST06 Operating System MonitorAL10 Download to Early SE92 Maintain System Log ST07 Application Watch Messages MonitorAL11 Directories SE93 Maintain Transaction ST08 Network Monitor CodesAL12 Display Table Buffer SH01 Online Help: F1 Help ST09 Network Alert (Exp session) Server MonitorAL13 Display Shared Memory SH03 Call Extended Help ST10 Table Call (Expert mode) StatisticsAL15 Customize SAPOSCOL SICK Installation Check ST11 Display destination Developer TracesAL18 Local File System SLDB Logical Databases ST12 Application Monitor (Tree Structure) MonitorAL19 Remote File System SLW4 Translation: Application ST14 Application Monitor Hierarchy AnalysisAL20 Early Watch Data SM01 Lock Transactions ST22 ABAP/4 Runtime Collector List Error AnalysisDB01 Analyze Exclusive Lock SM02 System Messages STAT Local Transaction Waits Statistics
DB02 Analyze Tables and SM04 User Overview STDR TADIR Indexes Consistency CheckDB03 Parameter Changes in SM12 Display and Delete STUN Performance DB Locks Monitor MenuDB11 Early Watch Profile SM13 Display Upgrade SU01 Maintain User Maintenance Records RecordsDB12 Overview of Backup SM21 System Log SU02 Maintain Logs Authorization ProfilesDB13 Database SM31 Table Maintenance SU03 Maintain Administration Calendar AuthorizationsDB14 Show DBA Action Logs SM35 Batch Input Monitoring SU10 Mass Changes to User Master RecordsPFCG Profile Generator – SM36 Background Job SU12 Mass Changes to Activity Groups Scheduler User Master RecordsRZ01 Job Scheduling Monitor SM37 Background Job SU20 Maintain Overview Authorization FieldsRZ02 Network Graphics for SM38 Queue Maintenance SU21 Maintain SAP Instances Transaction Authorization ObjectsRZ03 Presentation, Control SM39 Job Analysis SU22 Auth Objects SAP Instances Usage in TransactionsRZ04 Maintain SAP Instances SM50 Workprocess Overview SU24 Maintain Profile Generator TablesRZ06 Alert Thresholds SM51 List of SAP Servers SU25 Copy SAP to Maintenance Customer Prof Gen TablesRZ08 SAP Alert Monitor SM63 Display/Maintain SU30 Overall Operation Mode Sets Authorization ChecksRZ10 Maintenance of Profile SM64 Release of an Event SU50 Maintain User Parameters Defaults
RZ11 Profile Parameters SM65 Background Processing SU51 Maintain User Analysis Tool AddressSAR Maintain Transaction SM66 System-wide Work SU52 Maintain User Codes Process Overview ParametersSARA Archive Management SM67 Job Scheduling SU53 Analyze Authorization ErrorSCAT Computer Aided Test SM68 Job Administration SU56 Display list of Tool User AuthorizationsSCC0 Client Copy SMGW Gateway Monitor SVER ABAP/4 VerificationSCU3 Table History SMLG Logon Groups SVMC Start View Maintenance with MemorySD11 Data Modeler SMX Display Own Jobs SWT0 Configure Workflow TraceSDBE Matchcode Objects SOFF SAPoffice: Area Menu SWU8 Technical Trace (test) On/OffSE01 Transports and SP00 Spool and Related SWU9 Display Technical Correction System Areas TraceSE02 Environment Analyzer SP01 Output Controller SWUD Diagnostic ToolsSE03 Transport Utilities SP11 TemSe Directory SWUE Initiate EventSE07 Transport System SP12 TemSe Administration SWUF Workflow Monitor Status DisplaySE09 Workbench Organizer SPIT Output Controller SWUH Test MethodSE10 Customizer Organizer SPAD Spool Administration SWWD Switch on Work Item Error MonitoringSE11 ABAP/4 Dictionary SPAM SAP Patch Manager SYNT Display Syntax Maintenance Trace OutputSE12 ABAP/4 Dictionary SPAT Spool Administration - TU01 Call Statistics Display test
SE13 Maintain Technical SPDD Display Modified DDIC TU02 Active Instance Settings (Tables) objects Profile parametersQ List few security TablesClick here for security tablesQ How to create users?Execute transaction SU01 and fill in all the field. When creating a new user, you must enter aninitial password for that user on the Logon data tab. All other data is optional. Click here forturotial on creating sap user idQ What is the difference between USOBX_C and USOBT_C?The table USOBX_C defines which authorization checks are to be performed within atransaction and which not (despite authority-check command programmed ). This table alsodetermines which authorization checks are maintained in the Profile Generator.The table USOBT_C defines for each transaction and for each authorization object whichdefault values an authorization created from the authorization object should have in the ProfileGenerator.
Q What authorization are required to create and maintain user master records?The following authorization objects are required to create and maintain user master records: • S_USER_GRP: User Master Maintenance: Assign user groups • S_USER_PRO: User Master Maintenance: Assign authorization profile • S_USER_AUT: User Master Maintenance: Create and maintain authorizationsQ List R/3 User Types 1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon 2. A Service user - Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted 3. System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on. 4. A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.Q What is a derived role? • Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before. • The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either. • Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level. Follow this link for more infoQ What is a composite role? • A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles. • Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role. • Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group. • The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison. Follow the link to learn moreQ. What does the different color light mean in profile generator?A.
Q. What are the different tabs in PFCG? A. Q What does user compare do? If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on a daily.. Can we convert Authorization field to Org, fieldA. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE orZPFCG_ORGFIELD_CREATEUse SE38 or SA38 to run the above report. • Organizational level fields should only be created before you start setting up your system. If you create organizational level fields later, you might have to do an impact analysis. The authentication data may have to be postprocessed in roles. • The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational level field.In addition, all affected roles are analyzed and the authorization data is adjusted. The values of theauthorization field which is now to become the organizational level field are removed and entered intothe organizational level data of the role.Note: Table for Org Element- USORGRefer to Note 323817 for more detail.Q. How many profiles can be assigned to any user master record.A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments forusers). This table contains both information on the change status of a user and also the list of the profilenames that were assigned to the user.The field PROFS is used for saving the change flag (C = user was created, M = user was changed), andthe name of the profiles assigned to the user. The field is defined with a length of 3750 characters. Sincethe first two characters are intended for the change flag, 3748 characters remain for the list of theprofile names per user. Because of the maximum length of 12 characters per profile name, this results ina maximum number of 312 profiles per user.Q. Can you add a composite role to another composite role?A. NoQ. How to reset SAP* password from oracle database.A. Logon to your database with orasid as user id and run this sqldelete from sapSID.usr02 where bname=SAP* and mandt=XXX;commit;Where mandt is the client.Now you can login to the client using sap* and password pass
Q. What is difference between role and profile.A. A role act as container that collect transaction and generates the associated profile. The profilegenerator (PFCG) in SAP System automatically generates the corresponding authorization profile.Developer used to perform this step manually before PFCG was introduced bySAP. Any maintenance ofthe generated profile should be done using PFCG.Q. What is user buffer?A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for thatuser. Each user has their own individual user buffer. For example, if user Smith logs on to the system,his user buffer contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayedin transaction SU56.A user would fail an authorization check if: • The authorization object does not exist in the user buffer • The values checked by the application are not assigned to the authorization object in the user buffer • The user buffer contains too many entries and has overflowed. The number of entries in the user buffer can be controlled using the system profile parameter auth/number_in_userbuffer.Q. How to find out all roles with T-code SU01?A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this. Go to the Selection by Authorization Value. In Object 1 put S_TCODE and hit enter. And put SU01 in Transaction code and hit execute (clock with check) button. I use authorization object, as you can use this to test any object.You can also get this information directly from table, if you have access to SE16 or SE16N. ExecuteSE16N Table AGR_1251 Object S_TCODE VALUE (low) SU01Q. How to find out all the users who got SU01 ?A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out. Go to the Selection by Authorization Value. In Object 1 put S_TCODE and hit enter. And put SU01 in Transaction code and hit execute (clock with check) button. I use authorization object, as you can use this to test any object.Q. How to find out all the roles for one composite role or a selection of composite roles?A. Execute SE16N Table AGR_AGRS Composite roles You can put multiple composite roles using the more buttonQ. How to find out all the derived roles for one or more Master (Parent) roles?A. Execute SE16N Table AGR_DEFINEUse either agr_name field or Parent_agr field.Q. How can I check all the Organization value for any role?A. Execute SE16N Table AGR_1252
Role Type in the role here and hit execute.You can always download all the information to spreadsheet also using .Q. How do I restrict access to files through AL11?A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to restrictalias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the authorization forS_DATASET as mentioned below Activity 33 Physical file name /tmp/* Program Name with Search Help *Q. How can I add one role to many users?A. SU10. If you have less than 16 users then you can paste the userids.If you have more than 16 users – Click on Authorization data and click on next to users andupload from clipboard .Hit the change button and go to the role tab and add the roles to be assigned and hit save.Q. What are the Best practices for locking expired users?A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User group.Q. How can be the password rules enforced ?A. Password rules can be enforced using profile parameter. Follow the link to learn more about theprofile parameter.Q. How to remove duplicate roles with different start and end date from user master?A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 865841 for more info.Q. How come the users have authorization in PFCG, but user still complains with noauthorization?A. Make sure the user master is compared. May be the there is a user buffer overflow Also check the profile- Follow the instruction below. SUIM > User by complex criteria. Put the userid of user who is having issue. Execute Double click on the user id and expand the tree. Select the profile in question and see if theauthorization is correct or not. If not do the role reorg in PFCG and see if that helps.Q. How can I have a display all roles.A. Copy sap_all and open the role and change the activity to 03 and 08Q. How can I find out all actvt in sap?A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the validactivities for each authorization object can be found in table TACTZ (transaction SE16).Q. How to find all the users who got access to change and create users?You can find all users who have access to create or change users using SUIMExecute Transaction SUIMGo to - Users by Complex Selection Criteria >>Users by Complex Selection Criteria or you could runreport RSUSR002 using SA38 or SE38Fill in the screen as shown below, and execute the query. There are couple of other authorization( S_USER_AGR, S_USER_GRP and S_USER_PRO) you might want to check as well.On the other hand you could just give the user SU01D, which is display user master.
Q. What is SAP?A. SAP is the name of the company founded in 1972 under the German name (Systems, Applications,and Products in Data Processing) is the leading ERP (Enterprise Resource Planning) software package.Q. Explain the concept of “Business Content” in SAP Business Information Warehouse?A. Business Content is a pre-configured set of role and task-relevant information models based onconsistent Metadata in the SAP Business Information Warehouse. Business Content provides selectedroles within a company with the information they need to carry out their tasks. These informationmodels essentially contain roles, workbooks, queries, InfoSources, InfoCubes, key figures,characteristics, update rules and extractors for SAP R/3, mySAP.com Business Applications and otherselected applications.Q. What is IDES?A. International Demonstration and Education System. A sample application provided for faster learningand implementation.Q. What is SAP R/3?A. A third generation set of highly integrated software modules that performs common business functionbased on multinational leading practice. Takes care of any enterprise however diverse in operation,spread over the world. In R/3 system all the three servers like presentation, application server anddatabase server are located at different system.Q. What are presentation, application and database servers in SAP R/3?A. The application layer of an R/3 System is made up of the application servers and the message server.Application programs in an R/3 System are run on application servers. The application serverscommunicate with the presentation components, the database, and also with each other, using themessage server. All the data are stored in a centralized server. This server is called database server.
Q. What should be the approach for writing a BDC program?A. Convert the legacy system data to a flat file and convert flat file into internal table. Transfer the flatfile into sap system called “sap data transfer”. Call transaction(Write the program explicitly) or createsessions (sessions are created and processed ,if success data will transfer).Q. What are the major benefits of reporting with BW over R/3?Q. Would it be sufficient just to Web-enable R/3 Reports?A. Performance — Heavy reporting along with regular OLTP transactions can produce a lot of load bothon the R/3 and the database (cpu, memory, disks, etc). Just take a look at the load put on your systemduring a month end, quarter end, or year-end — now imagine that occurring even more frequently. Dataanalysis — BW uses a Data Warehouse and OLAP concepts for storing and analyzing data, where R/3was designed for transaction processing. With a lot of work you can get the same analysis out of R/3 butmost likely would be easier from a BW.Q. What is the difference between OLAP and Data Mining?A. OLAP - On line Analytical processing is a reporting tool configured to understand your databaseschema, composition facts and dimensions. By simple point-n-clicking, a user can run any number ofcanned or user-designed reports without having to know anything of SQL or the schema. Because ofthat prior configuration, the OLAP engine “builds” and executes the appropriate SQL. Mining is to buildthe application to specifically look at detailed analyses, often algorithmic; even more oftenmisappropriate called “reporting.Q. What is “Extended Star Schema” and how did it emerge?A. The Star Schema consists of the Dimension Tables and the Fact Table. The Master Data related tablesare kept in separate tables, which has reference to the characteristics in the dimension table(s). Theseseparate tables for master data is termed as the Extended Star Schema.Q. Define Meta data, Master data and Transaction dataA. Meta Data: Data that describes the structure of data or MetaObjects is called Metadata. In otherwords data about data is known as Meta Data. Master Data: Master data is data that remains unchangedover a long period of time. It contains information that is always needed in the same way.Characteristics can bear master data in BW. With master data you are dealing with attributes, texts orhierarchies. Transaction data: Data relating to the day-to-day transactions is the Transaction data.Q. What is Bex?A. Bex stands for Business Explorer. Bex enables end user to locate reports, view reports, analyzeinformation and can execute queries. The queries in workbook can be saved to there respective roles inthe Bex browser. Bex has the following components: Bex Browser, Bex analyzer, Bex Map, Bex Web.Q. What are variables?A. Variables are parameters of a query that are set in the parameter query definition and are not filledwith values until the queries are inserted into workbooks. There are different types of variables whichare used in different application: Characteristics variables, Hierarchies and hierarchy node, Texts,Formulas, Processing types, User entry/Default type, Replacement Path.Q. What is AWB?. What is its purpose?A. AWB stands for Administrator WorkBench. AWB is a tool for controlling, monitoring andmaintaining all the processes connected with data staging and processing in the business informationwarehousing.Q. What is the significance of ODS in BIW?A. An ODS Object serves to store consolidated and debugged transaction data on a document level(atomic level). It describes a consolidated dataset from one or more InfoSources. This dataset can beanalyzed with a BEx Query or InfoSet Query. The data of an ODS Object can be updated with a deltaupdate into InfoCubes and/or other ODS Objects in the same system or across systems. In contrast tomulti-dimensional data storage with InfoCubes, the data in ODS Objects is stored in transparent, flatdatabase tables.Q. What is Extractor?A. Extractors is a data retrieval mechanisms in the SAP source system. Which can fill the extractstructure of a data source with the data from the SAP source system datasets. The extractor may beable to supply data to more fields than exist in the extract structure.
Q. How do I change the name of master / parent role keeping the name of derived/child rolesame? I would like to keep the name of derived /child role same and also the profileassociated with the child roles.A. First copy the master role using PFCG to a role with new name you wish to have. Then you have togenerate the role. Now open each derived role and delete the menu. Once the menus are removed itwill let you put new inheritance. You can put the name of the new master role you created. This will helpyou keep the same derived role name and also the same profile name. Once the new roles are done youcan transport it. The transport automatically includes the Parent roles.What is the difference between C (Check) and U (Unmaintained)?A. Background:When defining authorizations using Profile Generator, the table USOBX_C defines which authorizationchecks should occur within a transaction and which authorization checks should be maintained in the PG.You determine the authorization checks that can be maintained in the PG using Check Indicators. It is aCheck Table for Table USOBT_C.In USOBX_C there are 4 Check Indicators.· CM (Check/Maintain)- An authority check is carried out against this object.- The PG creates an authorization for this object and field values are displayed for changing.- Default values for this authorization can be maintained.· C (Check)- An authority check is carried out against this object.- The PG does not create an authorization for this object, so field values are not displayed.- No default values can be maintained for this authorization.· N (No check)- The authority check against this object is disabled.- The PG does not create an authorization for this object, so field values are not displayed.- No default values can be maintained for this authorization.·U (Unmaintained)- No check indicator is set.- An authority check is always carried out against this object.- The PG does not create an authorization for this object, so field values are not displayed.- No default values can be maintained for this authorization..Q. What does user compare do?A. Comparing the user master: This is basically updating profile information into user master record. Sothat users are allowed to execute the transactions contained in the menu tree of their roles, their usermaster record must contain the profile for the corresponding roles.You can start the user compare process from within the Profile Generator (User tab and User comparepushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered intothe user master record. Never enter generated profiles directly into the user master record (usingtransaction SU01, for example)! During the automatic user compare process (with reportpfcg_time_dependency, for example), generated profiles are removed from the user masters if they donot belong to the roles that are assigned to the user.If you assign roles to users for a limited period of time only, you must perform a comparison at thebeginning and at the end of the validity period. You are recommended to schedule the background jobpfcg_time_dependency in such casesQ. Can wildcards be used in authorizations?A. Authorization values may contain wildcards; however, the system ignores everything after thewildcard. Therefore, A*B is the same as A*.Q. What does the PFCG_TIME_DEPENDENCY clean up?A. The PFCG_TIME_DEPENDENCY background report only cleans up the profiles (that is, it does notclean up the roles in the system). Alternatively, you may use transaction PFUD.
Q. What happens to change documents when they are transported to the production system?A. Change documents cannot be displayed in transaction SUIM after they are transported to theproduction system because we do not have the befor input method for the transport. This means that ifchanges are made, the USR10 table is filled with the current values and writes the old values to theUSH10 table beforehand. The difference between both tables is then calculated and the value for thechange documents is determined as a result. However, this does not work when change documents aretransported to the production system. The USR10 table is automatically filled with the current valuesfor the transport and there is no option for filling the USH10 table in advance (for the history) becausewe do not have a befor input method to fill the USH10 table in advance for the transport.Q. What is the difference between the table buffer and the user buffer?A. The table buffers are in the shared memory. Buffering the tables increases performance whenaccessing the data records contained in the table. Table buffers and table entries are ignored duringstartup. A user buffer is a buffer from which the data of a user master record is loaded when the userlogs on. The user buffer has different setting options with regard to the auth/new_buffering parameter.Q. What does the Profile Generator do?A. The Profile Generator creates roles. It is important that suitable user roles, and not profiles, areentered manually in transaction SU01. The system should enter the profiles for this user automatically.Q. How many authorizations fit into a profile?A. A maximum of 150 authorization fit into a profile. If the number of authorizations exceed this marker,the Profile Generator will automatically create more profiles for the role. A profile name consists oftwelve (12) characters and the first ten (10) may be changed when generated for the first time.Q. What authorization objects are needed for PFCG?SAP Transport AuthorizationTo release TaskS_TRANSPRTACTVT=43, 03, 75TTYPE=TASKOther type:CLCP Client TransportsCUST Customizing RequestsDTRA Workbench RequestsMOVE Relocation transportsPATC Preliminary Corrections and DeliveriesPIEC Piece listsTASK TasksTRAN Transport of copiesS_DATASETPROGRAM=SAPLSTRF, SAPLSLOGACTVT=34FILENAME=*To release Customizing RequestsS_TRANSPRTTTYPE=CUSTACTVT=43, 03, 75S_DATASETPROGRAM=SAPLSCTS_RELEASE, SAPLSLOG, SAPLSTRFACTVT=33, 34FILENAME=*S_RFCFC_TYPE=FUGRRFC_NAME=STPAACTVT=16;
Authorization object needed for PFCG accessS_USER_AGRACT_GROUP= * (You can restrict by role, if proper naming convention is used)ACTVT=01, 02, 03, 64 other fields below01 Create or Generate02 Change03 Display06 Delete08 Display change documents21 Transport22 Enter, Include, Assign36 Extended maintenance59 Distribute64 Generate68 Model78 Assign79 Assign Role to Composite RoleDL DownloadUL UploadS_USER_GRPCLASS=ACTVT=22; 03Other activity01 Create or Generate02 Change03 Display05 Lock06 Delete08 Display change documents22 Enter, Include, Assign24 Archive68 Model78 AssignS_USER_TCDTCD= * (Transaction in role)S_USER_PROPROFILE= *ACTVT=01, 06Other activity01 Create or Generate02 Change03 Display06 Delete07 Activate, generate08 Display change documents22 Enter, Include, Assign24 ArchiveS_TCODETCD=PFCG;What is client 000 in SAP R/3?Client 000 is defined as the SAP standard and the customer cannot change it. This client serves as acopy template for the creation of further clients.
What are the different type of work process ?The following work process in SAP R/3 • Dialog (D): each dispatcher needs at least 2 dialog work processes (not shown above) • Spool (S): at least 1 per R/3 System (more than 1 per dispatcher allowed) • Update (V): at least 1 per R/3 System (more than 1 per dispatcher allowed) • Background (B): at least 2 per R/3 System (more than 1 per dispatcher allowed) • Enqueue (E): exactly 1 per R/3 System (only 1 E work process is required and allowed)How do you start SAP R/3?To start R/3, run the shell script startsap from the home directory of user <sid>adm.startsap starts the saposcol process, which is the statistics collector for operating system resource data,if it is not yet running. • startsap calls the script startdb, which starts the database if it is not already started. • startsap then starts the central instance. • The R/3 System administrator can start additional instances and application servers. To start the instances independently of the database, use the script startsap. • startsap has the following options: • startsap r3: Checks if the database is running; if it is, only the instance is started • startsap db: Starts only the database • startsap all: Default entry; starts both the database and the R/3 instanceIn what sequence are profile parameter read?R/3 processes read the appropriate parameters from a C source in the R/3 kernel • The default profile /usr/sap/<SID>/SYS/profile/DEFAULT.PFL is read; profile values already defined in the C source are replaced with the values in the default profile • The instance profile /usr/sap/<SID>/SYS/profile/<SID>_<instance>_<hostname> is read; profile values already defined in the default profile or in the C source are replaced with the values defined in the instance profile • This procedure ensures that system parameter values reflect the instance profile and the values in the default profile and the C source.What are the step involved before stopping R/3 system?Before stopping any R/3 system following steps are basic steps to be performed. • Before the R/3 System is stopped, the R/3 System administrator should check the: • Check if any background jobs from any application server are active or have been triggered externally. Use transaction SM37 • Check if the background work process BTC is running in any application server. • Check if any update records are open when the system is stopped, the records are rolled back and set to status init. At startup, the records are processed again. • The administrator must decide whether to interrupt the jobs or wait until they are finished. • Give system users advance warning of the system shutdown. To create a system message, you can use transaction SM02. • Before shutting down the system, use transaction SM04 to check whether users are still logged on, and ask them to log off. • The R/3 System administrator and administrators of external systems should also inform one another about data transfers between their respective systems.How do you check the work process from UNIX?Use the following commands.To check all the work processes:ps -ef | grep <SID> | grep dw
To check the message server:ps -ef | grep <SID> | grep msTo check the SAP OS collector:ps -ef | grep saposHow do you display the server name?To display the server name, use transaction SM51. Information about the process types is alsodisplayed. For further information, select one of the instances and choose Processes. Alternatively, todisplay the system processes, use transaction SM66.How do you display all active users in your system?To display the overview of all active users on the instance where you are logged on, use transactionSM04. For a user overview of the whole system, call transaction AL08.. What happens to locks when the enqueue server is restarted?A. If they have not been saved to disk in the backup file, they will be lost. The locks that are inheritedby the update task when COMMIT WORK is executed after CALL FUNCTION .. IN UPDATE TASK aresaved to the disk. The locks are saved to disk when the update request becomes valid, that is, with theCOMMIT WORK. Each time the enqueue server is restarted, the lock entries saved on the disk arereloaded to the lock table. A lock is saved to disk at the point at which the backup flag is set.Q. The enqueue server is a single-point-of-failure in the SAP System. Can I guarantee highavailability for the Enqueue Server?A. To guarantee this you must use the standalone Enqueue Server with the Replication Server. This isdescribed in the documentation Standalone Enqueue Server.SAP note 524816 contains the prerequisites that must be fulfilled for using the standalone EnqueueServers with the Replication Server.Q. Where is the lock table stored?A. In the main memory (shared memory) of the enqueue server. All work processes on the enqueueserver has access to the table. External application servers execute their lock operations in the enqueueprocess on the enqueue server. Communication in this case takes place via the relevant dispatchers andthe message server.Q. Can locks exist directly after startup?A. Yes, the saved locks, which were inherited by the update task, are reloaded to the lock table duringstartup (see first question).Q. How fast are lock operations?A. In work processes on the enqueue server, a few 100 microseconds. In work processes of externalapplication servers you have to include network communications and process changes. Depending onCPU and network load this amounts to a few milliseconds.Q. What should I do first if a problem arises?A. Use the diagnosis functions:sm12 Extras ® Diagnosis and thensm12 Extras ® Diagnosis in updateIf a problem is reported, back up the trace files dev_w*, dev_disp, dev_eq* and check theSyslog.Q. The following message is displayed in the diagnosis details in SM12:Lock management operation modeInternal lock management in same processWhat does this message mean and what are the other options?A. "Internal lock management in same work process" in the diagnosis function means that you arelogged onto the enqueue server and your work process can access the lock table straight away. You donot have to delegate enqueue requests to an enqueue process on a remote enqueue server. If you arelogged onto an application server that is not an enqueue server, the diagnosis function will provide you
with the name of the enqueue server.Each SAP System has exactly one application server that functions as an enqueue server. This enqueueserver maintains the lock table, which is located in a shared memory segment. All of the work processeson the enqueue server can access the lock table. All work processes on other application serversdelegate their enqueue requests to a special enqueue work process on the enqueue server.This procedure is configured automatically. The parameter line "rdisp/enqname =<application servername>" in the default profile DEFAULT.PFL indicates which application server is currently acting as theenqueue server. When an application server detects that its name matches the name of the enqueueserver, it creates the lock table and all of its work processes process enqueue requests inline. If anapplication server detects that its name does not match the name of the enqueue server, it sends allenqueue requests to the enqueue server.Work processes of the type "enqueue" guarantee that incoming requests are processed immediately.One enqueue process is usually sufficient. In very large SAP Systems with many application servers, asecond process can be beneficial. However, it is not expedient to define more than two enqueueprocesses. If the transaction SM50 -> [CPU] shows that only the first enqueue process is being used,the bottleneck is due to something else.Q.Why is an enqueue work process required in a central system? Dont all work processeshave the same access to the shared memory and thus to the lock table?A. Although the enqueue process is not used in a central system, it does not do any harm. Since almostall customers install an application server sooner or later, problems will inevitably arise if the enqueueprocess is missing. For this reason, the enqueue diagnosis function will output an error if an enqueueprocess has not been configured.Q. Are the locks in the lock table also set at the database level? If not, database functionscould be used to process objects locked in the SAP system.A. Locks are not set on the database. The lock table is stored in the main memory of the enqueueserver.Q. Is a lock table built if an enqueue work process is not started on the enqueue server in theinstance profile?A. Yes, because the work processes on the enqueue server use the lock table directly, and not via theenqueue process. The latter is only responsible for lock requests from external application servers.Q.How can I find out who is currently holding the ungranted lock? In other words, how cancheck the program after an ENQUEUE to determine which use is currently holding the lock sothat I can let him or her know?A. When the ENQUEUE_... function module is returned, the name of the lock owner is listed in SY-MSGV1.Q. Can I use special characters in my lock argument (especially the ‘at’ sign (@))?A. The ‘at’ symbol is used as a wildcard in SAP locks (enqueues). In other words, it can stand for anyother character during collision checks. For example, the parameter value 12345@ locks the quantities123450 to 123459, 12345a to 12345z, and 12345A to 12345Z, and all other values with any specialcharacter in the 6th character position.This is described in detail in the section Lock Collisions.In order to prevent the wildcard mechanism from being activated in SAP locks when it is not required,you need to ensure when enqueue function modules are called that key value parameters do not containany wildcard characters.If key values that you want to use to lock individual entities do contain wildcard characters, you have toreplace the wildcards with different characters before the enqueue is called.Q. With a single-process system as an enqueue server, we have reached X SD Benchmarkusers. Can this number be increased by using a multiprocessor system (message server onthe same machine as the enqueue server)? Can we assume that scaling is linear (number ofCPUs * X SD users)? How many processes are advisable if message servers, dispatchers, onedialog, and two enqueue processes are to run on the system?A. A significant increase in the enqueue server throughput can be expected by using several processors.The CPU load on the enqueue server is distributed relatively evenly between message server,dispatchers, and enqueue work processes, which means that up to 3 processors can be occupiedsimultaneously. Dispatchers and message server represent the bottleneck with the enqueue. Linearscaling can be expected for up to 3 processors, even if lock requests are so frequent that message
server, dispatchers, and work processes are occupied simultaneously. Due to asynchronous systemprocesses (for example, syncer), using more processors can further enhance throughput.Q. The Syslog often contains messages such as "Enqueue: total wait time during locking:2500 seconds". How should I analyze this problem? Or is the entry not critical? (There are norecords of terminations or timeouts.)A. The message is output for information purposes only but may indicate parallel processing errors withABAP programs. The specified wait time is the time that has elapsed since startup due to the use of theWAIT parameter when the enqueue function module was called.The WAIT parameter enables a lock attempt to be repeated a number of times, for example, so that theupdate task does not have to be cancelled when a lock is set temporarily by other programs. The workprocess remains busy between the lock attempts.Q. User cannot connect to SAPA. Check SAP logon settings, ping the host, check message server, check dispatcher, etcQ. User cannot printA. See if the user has proper authoriztion. check SAP user setup, check SPAD, check spools, check unixqueue or print queue at the os level, etcQ. Why do you get "GetProcessList failed: 80004005" error while starting SAP consolemanagementA. You have selected one of the Process List nodes in the tree. Then you closed MMC and clicked "Yes" inthe dialog "Save console settings to SAPMMC?". Now when you open again the MMC and those processesare not started, you get this error.Solution: Start MMC and select SAP Systems in the tree. Then close it and choose "Yes" in the dialog"Save console settings to SAPMMC?". Now you wont get this annoying error on every start.