What is client 000 in SAP R/3?

Client 000 is defined as the SAP standard and the customer cannot change it. This client serves as a copy template for the creation of further clients.

What are the different type of work process ?

The following work process in SAP R/3

Dialog (D): each dispatcher needs at least 2 dialog work processes (not shown above)

Spool (S): at least 1 per R/3 System (more than 1 per dispatcher allowed)

Update (V): at least 1 per R/3 System (more than 1 per dispatcher allowed)

Background (B): at least 2 per R/3 System (more than 1 per dispatcher allowed)

Enqueue (E): exactly 1 per R/3 System (only 1 E work process is required and allowed)

How do you start SAP R/3?

To start R/3, run the shell script startsap from the home directory of user <sid>adm.
startsap starts the saposcol process, which is the statistics collector for operating system resource data, if it is not yet running.

startsap calls the script startdb, which starts the database if it is not already started.

startsap then starts the central instance.

The R/3 System administrator can start additional instances and application servers. To start the instances independently of the database, use the script
startsap.

startsap has the following options:

startsap r3: Checks if the database is running; if it is, only the instance is started

startsap db: Starts only the database

startsap all: Default entry; starts both the database and the R/3 instance

In what sequence are profile parameter read?

R/3 processes read the appropriate parameters from a C source in the R/3 kernel

The default profile /usr/sap/<SID>/SYS/profile/DEFAULT.PFL is read; profile values already defined in the C source are replaced with the values in the
default profile

The instance profile /usr/sap/<SID>/SYS/profile/<SID>_<instance>_<hostname> is read; profile values already defined in the default profile or in the C
source are replaced with the values defined in the instance profile

This procedure ensures that system parameter values reflect the instance profile and the values in the default profile and the C source.

What are the step involved before stopping R/3 system?

Before stopping any R/3 system following steps are basic steps to be performed.

Before the R/3 System is stopped, the R/3 System administrator should check the:

Check if any background jobs from any application server are active or have been triggered externally. Use transaction SM37

Check if the background work process BTC is running in any application server.

Check if any update records are open when the system is stopped, the records are rolled back and set to status init. At startup, the records are processed
again.

The administrator must decide whether to interrupt the jobs or wait until they are finished.

Give system users advance warning of the system shutdown. To create a system message, you can use transaction SM02.

Before shutting down the system, use transaction SM04 to check whether users are still logged on, and ask them to log off.

The R/3 System administrator and administrators of external systems should also inform one another about data transfers between their respective
systems.

How do you check the work process from UNIX?

Use the following commands.
To check all the work processes:
ps -ef | grep <SID> | grep dw
To check the message server:
ps -ef | grep <SID> | grep ms

To check the SAP OS collector:

ps -ef | grep sapos

How do you display the server name?

To display the server name, use transaction SM51. Information about the process types is also displayed. For further information, select one of the instances and choose
Processes. Alternatively, to display the system processes, use transaction SM66.

How do you display all active users in your system?

To display the overview of all active users on the instance where you are logged on, use transaction SM04. For a user overview of the whole system, call transaction AL08.

The following section contains some common questions and answers regarding the lock

Q. What happens to locks when the enqueue server is restarted?

A. If they have not been saved to disk in the backup file, they will be lost. The locks that are inherited by the update task when COMMIT WORK is executed after CALL
FUNCTION .. IN UPDATE TASK are saved to the disk. The locks are saved to disk when the update request becomes valid, that is, with the COMMIT WORK. Each time
the enqueue server is restarted, the lock entries saved on the disk are reloaded to the lock table. A lock is saved to disk at the point at which the backup flag is set.

Q. The enqueue server is a single-point-of-failure in the SAP System. Can I guarantee high availability for the Enqueue Server?
A. To guarantee this you must use the standalone Enqueue Server with the Replication Server. This is described in the documentation Standalone Enqueue Server.

SAP note 524816 contains the prerequisites that must be fulfilled for using the standalone Enqueue Servers with the Replication Server.

Q. Where is the lock table stored?

A. In the main memory (shared memory) of the enqueue server. All work processes on the enqueue server has access to the table. External application servers execute
their lock operations in the enqueue process on the enqueue server. Communication in this case takes place via the relevant dispatchers and the message server.

Q. Can locks exist directly after startup?

A. Yes, the saved locks, which were inherited by the update task, are reloaded to the lock table during startup (see first question).

Q. How fast are lock operations?

A. In work processes on the enqueue server, a few 100 microseconds. In work processes of external application servers you have to include network communications and
process changes. Depending on CPU and network load this amounts to a few milliseconds.

Q. What should I do first if a problem arises?

A. Use the diagnosis functions:
sm12 Extras Diagnosis and then
sm12 Extras Diagnosis in update
If a problem is reported, back up the trace files dev_w*, dev_disp, dev_eq* and check the Syslog.

Q. The following message is displayed in the diagnosis details in SM12:

Lock management operation mode
Internal lock management in same process
What does this message mean and what are the other options?
A. "Internal lock management in same work process" in the diagnosis function means that you are logged onto the enqueue server and your work process can access the
lock table straight away. You do not have to delegate enqueue requests to an enqueue process on a remote enqueue server. If you are logged onto an application server
that is not an enqueue server, the diagnosis function will provide you with the name of the enqueue server.
Each SAP System has exactly one application server that functions as an enqueue server. This enqueue server maintains the lock table, which is located in a shared
memory segment. All of the work processes on the enqueue server can access the lock table. All work processes on other application servers delegate their enqueue
requests to a special enqueue work process on the enqueue server.

This procedure is configured automatically. The parameter line "rdisp/enqname =<application server name>" in the default profile DEFAULT.PFL indicates which
application server is currently acting as the enqueue server. When an application server detects that its name matches the name of the enqueue server, it creates the lock
table and all of its work processes process enqueue requests inline. If an application server detects that its name does not match the name of the enqueue server, it
sends all enqueue requests to the enqueue server.
Work processes of the type "enqueue" guarantee that incoming requests are processed immediately. One enqueue process is usually sufficient. In very large SAP Systems
with many application servers, a second process can be beneficial. However, it is not expedient to define more than two enqueue processes. If the transaction SM50 ->
[CPU] shows that only the first enqueue process is being used, the bottleneck is due to something else.

Q.Why is an enqueue work process required in a central system? Don't all work processes have the same access to the shared memory and thus to the
lock table?
A. Although the enqueue process is not used in a central system, it does not do any harm. Since almost all customers install an application server sooner or later,
problems will inevitably arise if the enqueue process is missing. For this reason, the enqueue diagnosis function will output an error if an enqueue process has not been
configured.

Q. Are the locks in the lock table also set at the database level? If not, database functions could be used to process objects locked in the SAP system.
A. Locks are not set on the database. The lock table is stored in the main memory of the enqueue server.

Q. Is a lock table built if an enqueue work process is not started on the enqueue server in the instance profile?
A. Yes, because the work processes on the enqueue server use the lock table directly, and not via the enqueue process. The latter is only responsible for lock requests
from external application servers.

Q.How can I find out who is currently holding the ungranted lock? In other words, how can check the program after an ENQUEUE to determine which use
is currently holding the lock so that I can let him or her know?
A. When the ENQUEUE_... function module is returned, the name of the lock owner is listed in SY-MSGV1.

Q. Can I use special characters in my lock argument (especially the at sign (@))?
A. The at symbol is used as a wildcard in SAP locks (enqueues). In other words, it can stand for any other character during collision checks. For example, the parameter
value 12345@ locks the quantities 123450 to 123459, 12345a to 12345z, and 12345A to 12345Z, and all other values with any special character in the 6th character
position.
This is described in detail in the section Lock Collisions.
In order to prevent the wildcard mechanism from being activated in SAP locks when it is not required, you need to ensure when enqueue function modules are called that
key value parameters do not contain any wildcard characters.
If key values that you want to use to lock individual entities do contain wildcard characters, you have to replace the wildcards with different characters before the enqueue
is called.

Q. With a single-process system as an enqueue server, we have reached X SD Benchmark users. Can this number be increased by using a multiprocessor
system (message server on the same machine as the enqueue server)? Can we assume that scaling is linear (number of CPUs * X SD users)? How many
processes are advisable if message servers, dispatchers, one dialog, and two enqueue processes are to run on the system?
A. A significant increase in the enqueue server throughput can be expected by using several processors. The CPU load on the enqueue server is distributed relatively
evenly between message server, dispatchers, and enqueue work processes, which means that up to 3 processors can be occupied simultaneously. Dispatchers and
message server represent the bottleneck with the enqueue. Linear scaling can be expected for up to 3 processors, even if lock requests are so frequent that message
server, dispatchers, and work processes are occupied simultaneously. Due to asynchronous system processes (for example, syncer), using more processors can further
enhance throughput.

Q. The Syslog often contains messages such as "Enqueue: total wait time during locking: 2500 seconds". How should I analyze this problem? Or is the
entry not critical? (There are no records of terminations or timeouts.)
A. The message is output for information purposes only but may indicate parallel processing errors with ABAP programs. The specified wait time is the time that has
elapsed since startup due to the use of the WAIT parameter when the enqueue function module was called.
The WAIT parameter enables a lock attempt to be repeated a number of times, for example, so that the update task does not have to be cancelled when a lock is set
temporarily by other programs. The work process remains busy between the lock attempts.
Q. User cannot connect to SAP
A. Check SAP logon settings, ping the host, check message server, check dispatcher, etc

Q. User cannot print

A. See if the user has proper authoriztion. check SAP user setup, check SPAD, check spools, check unix queue or print queue at the os level, etc

Q. Why do you get "GetProcessList failed: 80004005" error while starting SAP console management
A. You have selected one of the Process List nodes in the tree. Then you closed MMC and clicked "Yes" in the dialog "Save console settings to SAPMMC?". Now when you
open again the MMC and those processes are not started, you get this error.

Solution: Start MMC and select SAP Systems in the tree. Then close it and choose "Yes" in the dialog "Save console settings to SAPMMC?". Now you won't get this
annoying error on every start.

Architecture

To complete the logon process, the presentation server connects with a dispatcher.

When the user tries to run a transaction, the user's request comes from the presentation server to the dispatcher and is put into the local wait queue.

When the dispatcher recognizes that a work process is available, the user's request is taken from the wait queue and sent to the work process

When a user is dispatched to a work process, "user context" data the user's logon attributes, authorizations, and other relevant information is
transferred from the roll buffer, extended memory, or the roll file into the work process. This transfer (by copying or mapping, as appropriate) of user
context data into work process memory is the mechanism known as a "roll in". Transaction processing then begins.

If data from the database is required to support transaction processing, a request for data is sent to the database interface, which in turn sends a request
through the network to retrieve the information from the database.

When it receives the request, the database searches its shared memory buffers. If the data is found, it is sent back to the work process. If the data is not
found, it is loaded from the disk into the shared memory buffers.

After being located, the data is taken from the shared memory buffers and sent back across the network to the requesting database interface. Transaction
processing resumes.

Before accessing the database service, the database interface searches for the data in the R/3 buffers. If the data is found, it is relayed back to the work
process where processing resumes. If the data is not found, the database interface sends a request over the network to retrieve the information from the
database

If the data loaded from the database is eligible for R/3 buffering, it is placed in the R/3 buffers. Transaction processing resumes.

When transaction processing is completed, the dispatcher is notified of its completion. The results of the transaction are then sent back to the presentation
server.

After the transaction finishes and the work process is no longer required, the user context data is rolled out of the work process.

CPU time is the amount of time during which a particular work process has active control of the central processing unit (CPU).

Performance Analysis - Key transaction for Performance monitoring in R/3

Work Process SM50/SM66
Operating system monitoring ST06
Workload analysis, use the Workload Monitor (transaction ST03 or ST03N).
Database monitoring ST04
Setup and buffer ST02

Workload time statistics include:

Response time in milliseconds: Starts when a user request enters the dispatcher queue; ends when the next screen is returned to the user. The response
time does not include the time to transfer from the screen to the front end.

Wait time in milliseconds: This is the time a user request sits in the dispatcher queue. It starts when user request is entered in the dispatcher queue; and
ends when the request starts being processed.

Roll-in time in milliseconds: The amount of time needed to roll user context information into the work process.

Load time in milliseconds: The time needed to load from the database and generate objects like ABAP source code, CUA, and screen information.

Processing time: This is equivalent to response time minus the sum of wait time, database request time, load time, roll time, and enqueue time.

Database request time: Starts when a database request is put through to the database interface; ends when the database interface has delivered the
result.

CPU time in milliseconds: This is the CPU time used by the R/3 work process

If a problem is detected, the data in the Workload Monitor (Transaction ST03N) can be used as follows to identify the area of the system where the problem is located.
First check for general performance problems affecting all transactions. Good general performance is normally indicated by:

Wait time < 10% response time

Main menu (choose Transaction Profile) < 100 ms

In the Workload Monitor, the following values normally indicate good performance:

Average roll-in time < 20 ms

Average roll wait time < 200 ms

Average load (and generation) time < 10 % of response time (<50 ms)

Average database request time < 40 % of (response time - wait time)

Average CPU time < 40 % of (response time - wait time)

Average CPU time Not much less than processing time

Average response time - Depends on customer requirements there is no general rule

Large roll wait time - Communication problem with GUI

Large load time Program buffer, CUA buffer or screen buffer too small
Large DB time CPU /mem bottleneck on DB server, Expensive SQL statement, missing indexes, small buffer, missing statistics.

IF wait time >10%

High database time >40% (response time wait time) Analyze database
Processing time > CPUtime *2 Analyze hardware
Load time >50 ms Analyze R/3 memory config ( program buffer too small)
Roll in / roll out time >20 ms - Analyze R/3 mem config (extended mem or roll buffer)
 Analysis of SM50 / SM66

To display a snapshot of the current activities on the instance you are logged on to, use the Work Process Monitor. Call transaction SM50, or, from the R/3
initial screen, choose Tools >> Administration >> Monitor >> System monitoring >> Process overview.

The information displayed includes:

- Type of work process
- Name of the ABAP program running
- Operating system PID number
- Client being used
- Name of the job executing
- Current action
- Number of detected errors in the work process
- Table being utilized
- Semaphore resource being used
- CPU accumulation
- Time in process accumulation
- User holding the resource

If all work processes are being blocked by long running transactions, the above information is also available on operating system level by using program
dpmon.

In an R/3 System with more than one instance, you can access a global work process overview using transaction SM66.

Analysis work flow .

Work process in status running and Action Direct Read, Sequential read, Insert, Update, Delete, Commit. Analyze Database
Work process in status running and Action load program Program buffer too small
Work process in status running and Action rollin /rollout Extended memory or roll buffer analysis needed.
Work process in status stopped and reason priv Detail analysis for memory, issue with extended memory or roll buffer.
Work process in status stopped and reason cpic- Problem with CPIC connection. The remote systems all work process may be in use.

Analysis for ST06 (Operating System monitoring)

If the idle CPU is indicated as being less than 20 %, there is a CPU bottleneck. In an optimal configuration, more than 35 % CPU capacity is idle
If there is a CPU bottleneck:
1. If possible, redistribute load to other servers.
2. To find out which processes are using the most CPU, in the Operating System Monitor choose Detail analysis menu >> Top CPU processes. If the processes have high
CPU utilization, proceed as follows:

For R/3 work processes ("disp+work"): Using the process ID indicated in Top CPU processes, identify the corresponding program name and user name in
the Work Process Overview (transaction SM50).

For database processes: Identify corresponding long running SQL statements in the Database Process Monitor. To access this monitor, call transaction ST04
(Database Overview), and choose Detail analysis menu. Then choose, for example, Oracle Session.

For external processes, find out whether the process can be stopped or redistributed.

Amount of memory indicated beside Physical memory available. Compare this figure with the paging rate. To obtain the paging rate, double-click Pages in/s. The paging
rates for the last 24 hours are displayed in the columns Paged in [Kb/h] and Paged out [Kb/h]. If 20% of the total amount of physical memory is greater than the
amounts indicated in these columns, you can normally be sure there is no memory bottleneck.

If there is a memory bottleneck:

1. If possible, redistribute load to other servers.

2. Check the size of the file system cache See SAP Note 78498 in SAPNet. If necessary, reduce file system cache to < 10% of the total physical memory.
3. To identify users and their programs with a high memory consumption, call the Mode List for the extended memory. To do this, in the Setups/Tune Buffers monitor
(transaction ST02), choose Detail analysis menu >> SAP memory >> Mode List.

The following section contains some common questions and answers regarding the lock

Q. What happens to locks when the enqueue server is restarted?

A. If they have not been saved to disk in the backup file, they will be lost. The locks that are inherited by the
update task when COMMIT WORK is executed after CALL FUNCTION .. IN UPDATE TASK are saved to the
disk. The locks are saved to disk when the update request becomes valid, that is, with the COMMIT WORK. Each
time the enqueue server is restarted, the lock entries saved on the disk are reloaded to the lock table. A lock is
saved to disk at the point at which the backup flag is set.

Q. The enqueue server is a single-point-of-failure in the SAP System. Can I guarantee high availability
for the Enqueue Server?
A. To guarantee this you must use the standalone Enqueue Server with the Replication Server. This is described
in the documentation Standalone Enqueue Server.

SAP note 524816 contains the prerequisites that must be fulfilled for using the standalone Enqueue Servers with
the Replication Server.
Q. Where is the lock table stored?
A. In the main memory (shared memory) of the enqueue server. All work processes on the enqueue server has
access to the table. External application servers execute their lock operations in the enqueue process on the
enqueue server. Communication in this case takes place via the relevant dispatchers and the message server.

Q. Can locks exist directly after startup?

A. Yes, the saved locks, which were inherited by the update task, are reloaded to the lock table during startup
(see first question).

Q. How fast are lock operations?

A. In work processes on the enqueue server, a few 100 microseconds. In work processes of external application
servers you have to include network communications and process changes. Depending on CPU and network load
this amounts to a few milliseconds.

Q. What should I do first if a problem arises?

A. Use the diagnosis functions:
sm12 Extras Diagnosis and then
sm12 Extras Diagnosis in update
If a problem is reported, back up the trace files dev_w*, dev_disp, dev_eq* and check the Syslog.

Q. The following message is displayed in the diagnosis details in SM12:

Lock management operation mode
Internal lock management in same process
What does this message mean and what are the other options?
A. "Internal lock management in same work process" in the diagnosis function means that you are logged onto
the enqueue server and your work process can access the lock table straight away. You do not have to delegate
enqueue requests to an enqueue process on a remote enqueue server. If you are logged onto an application
server that is not an enqueue server, the diagnosis function will provide you with the name of the enqueue
server.
Each SAP System has exactly one application server that functions as an enqueue server. This enqueue server
maintains the lock table, which is located in a shared memory segment. All of the work processes on the enqueue
server can access the lock table. All work processes on other application servers delegate their enqueue requests
to a special enqueue work process on the enqueue server.

This procedure is configured automatically. The parameter line "rdisp/enqname =<application server name>" in
the default profile DEFAULT.PFL indicates which application server is currently acting as the enqueue server.
When an application server detects that its name matches the name of the enqueue server, it creates the lock
table and all of its work processes process enqueue requests inline. If an application server detects that its name
does not match the name of the enqueue server, it sends all enqueue requests to the enqueue server.
Work processes of the type "enqueue" guarantee that incoming requests are processed immediately. One
enqueue process is usually sufficient. In very large SAP Systems with many application servers, a second process
can be beneficial. However, it is not expedient to define more than two enqueue processes. If the transaction
SM50 -> [CPU] shows that only the first enqueue process is being used, the bottleneck is due to something else.

Q.Why is an enqueue work process required in a central system? Don't all work processes have the
same access to the shared memory and thus to the lock table?
A. Although the enqueue process is not used in a central system, it does not do any harm. Since almost all
customers install an application server sooner or later, problems will inevitably arise if the enqueue process is
missing. For this reason, the enqueue diagnosis function will output an error if an enqueue process has not been
configured.

Q. Are the locks in the lock table also set at the database level? If not, database functions could be
used to process objects locked in the SAP system.
A. Locks are not set on the database. The lock table is stored in the main memory of the enqueue
server.

Q. Is a lock table built if an enqueue work process is not started on the enqueue server in the
instance profile?
A. Yes, because the work processes on the enqueue server use the lock table directly, and not via the enqueue
process. The latter is only responsible for lock requests from external application servers.

Q.How can I find out who is currently holding the ungranted lock? In other words, how can check the
program after an ENQUEUE to determine which use is currently holding the lock so that I can let him
or her know?
A. When the ENQUEUE_... function module is returned, the name of the lock owner is listed in SY-MSGV1.
Q. Can I use special characters in my lock argument (especially the at sign (@))?
A. The at symbol is used as a wildcard in SAP locks (enqueues). In other words, it can stand for any other
character during collision checks. For example, the parameter value 12345@ locks the quantities 123450 to
123459, 12345a to 12345z, and 12345A to 12345Z, and all other values with any special character in the 6th
character position.
This is described in detail in the section Lock Collisions.
In order to prevent the wildcard mechanism from being activated in SAP locks when it is not required, you need
to ensure when enqueue function modules are called that key value parameters do not contain any wildcard
characters.
If key values that you want to use to lock individual entities do contain wildcard characters, you have to replace
the wildcards with different characters before the enqueue is called.

Q. With a single-process system as an enqueue server, we have reached X SD Benchmark users. Can
this number be increased by using a multiprocessor system (message server on the same machine as
the enqueue server)? Can we assume that scaling is linear (number of CPUs * X SD users)? How
many processes are advisable if message servers, dispatchers, one dialog, and two enqueue
processes are to run on the system?
A. A significant increase in the enqueue server throughput can be expected by using several processors. The CPU
load on the enqueue server is distributed relatively evenly between message server, dispatchers, and enqueue
work processes, which means that up to 3 processors can be occupied simultaneously. Dispatchers and message
server represent the bottleneck with the enqueue. Linear scaling can be expected for up to 3 processors, even if
lock requests are so frequent that message server, dispatchers, and work processes are occupied simultaneously.
Due to asynchronous system processes (for example, syncer), using more processors can further enhance
throughput.

Q. The Syslog often contains messages such as "Enqueue: total wait time during locking: 2500
seconds". How should I analyze this problem? Or is the entry not critical? (There are no records of
terminations or timeouts.)
A. The message is output for information purposes only but may indicate parallel processing errors with ABAP
programs. The specified wait time is the time that has elapsed since startup due to the use of the WAIT
parameter when the enqueue function module was called.
The WAIT parameter enables a lock attempt to be repeated a number of times, for example, so that the update
task does not have to be cancelled when a lock is set temporarily by other programs. The work process remains
busy between the lock attempts.

Q. User cannot connect to SAP

A. Check SAP logon settings, ping the host, check message server, check dispatcher, etc

Q. User cannot print

A. See if the user has proper authoriztion. check SAP user setup, check SPAD, check spools, check unix queue or
print queue at the os level, etc

Q. Why do you get "GetProcessList failed: 80004005" error while starting SAP console management
A. You have selected one of the Process List nodes in the tree. Then you closed MMC and clicked "Yes" in the
dialog "Save console settings to SAPMMC?". Now when you open again the MMC and those processes are not
started, you get this error.

Solution: Start MMC and select SAP Systems in the tree. Then close it and choose "Yes" in the dialog "Save
console settings to SAPMMC?". Now you won't get this annoying error on every start.

SAP Security Interview Questions

Q. SAP Security T-codes

A. Frequently used security T-codes

SU01 Create/ Change User SU01 Create/ Change User

PFCG Maintain Roles
SU10 Mass Changes
SU01D Display User
SUIM Reports
ST01 Trace
SU53 Authorization analysis
Click here for all Security T-codes
Q List few security Tables
Click here for security tables

Q How to create users?

Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password
for that user on the Logon data tab. All other data is optional. Click here for turotial on creating sap user id

Q What is the difference between USOBX_C and USOBT_C?

The table USOBX_C defines which authorization checks are to be performed within a transaction and which not
(despite authority-check command programmed ). This table also determines which authorization checks are
maintained in the Profile Generator.

The table USOBT_C defines for each transaction and for each authorization object which default values an
authorization created from the authorization object should have in the Profile Generator.

Q What authorization are required to create and maintain user master records?
The following authorization objects are required to create and maintain user master records:

S_USER_GRP: User Master Maintenance: Assign user groups

S_USER_PRO: User Master Maintenance: Assign authorization profile
S_USER_AUT: User Master Maintenance: Create and maintain authorizations

Q List R/3 User Types

1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your
own password. Check for multiple dialog logon
2. A Service user - Only user administrators can change the password. No check for expired/initial
passwords. Multiple logon permitted
3. System users are not capable of interaction and are used to perform certain system activities, such as
background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System user, a general, non-personally related, user. Additional
authorizations can be assigned within the system using a reference user. A reference user for additional
rights can be assigned for every user in the Roles tab.

Q What is a derived role?

Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the
functions included (transactions, reports, Web links, and so on) from the role referenced. A role can
only inherit menus and functions if no transaction codes have been assigned to it before.
The higher-level role passes on its authorizations to the derived role as default values which can be
changed afterwards. Organizational level definitions are not passed on. They must be created anew in
the inheriting role. User assignments are not passed on either.
Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical
menus and identical transactions) but have different characteristics with regard to the organizational
level. Follow this link for more info

Q What is a composite role?

A composite role is a container which can collect several different roles. For reasons of clarity, it does
not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles
are also called roles.
Composite roles do not contain authorization data. If you want to change the authorizations (that are
represented by a composite role), you must maintain the data for each role of the composite role.
Creating composite roles makes sense if some of your employees need authorizations from several
roles. Instead of adding each user separately to each role required, you can set up a composite role and
assign the users to that group.
The users assigned to a composite role are automatically assigned to the corresponding (elementary)
roles during comparison. Follow the link to learn more
Q. What does the different color light mean in profile generator?
A.

Q. What are the different tabs in PFCG?

A.

Q What does user compare do?

If you are also using the role to generate authorization profiles, then you should note that the generated profile is
not entered in the user master record until the user master records have been compared. You can automate this
by scheduling report FCG_TIME_DEPENDENCY on a daily.

Can we convert Authorization field to Org, field

A. Authorization field can be changed to Organization field using PFCG_ORGFIELD_CREATE or
ZPFCG_ORGFIELD_CREATE
Use SE38 or SA38 to run the above report.

Organizational level fields should only be created before you start setting up your system. If you create
organizational level fields later, you might have to do an impact analysis. The authentication data may
have to be postprocessed in roles.

The fields "Activity", "ACTVT" and "Transaction code", "TCD" cannot be converted into an organizational
level field.

In addition, all affected roles are analyzed and the authorization data is adjusted. The values of the authorization
field which is now to become the organizational level field are removed and entered into the organizational level
data of the role.
Note: Table for Org Element- USORG
Refer to Note 323817 for more detail.

Q. How many profiles can be assigned to any user master record.

A. Maximum Profiles that can be assigned to any user is ~ 312. Table USR04 (Profile assignments for users). This
table contains both information on the change status of a user and also the list of the profile names that were
assigned to the user.
The field PROFS is used for saving the change flag (C = user was created, M = user was changed), and the name
of the profiles assigned to the user. The field is defined with a length of 3750 characters. Since the first two
characters are intended for the change flag, 3748 characters remain for the list of the profile names per user.
Because of the maximum length of 12 characters per profile name, this results in a maximum number of 312
profiles per user.

Q. Can you add a composite role to another composite role?

A. No

Q. How to reset SAP* password from oracle database.

A. Logon to your database with orasid as user id and run this sql
delete from sapSID.usr02 where bname='SAP*' and mandt='XXX';
commit;

Where mandt is the client.

Now you can login to the client using sap* and password pass

Q. What is difference between role and profile.

A. A role act as container that collect transaction and generates the associated profile. The profile generator
(PFCG) in SAP System automatically generates the corresponding authorization profile. Developer used to
perform this step manually before PFCG was introduced bySAP. Any maintenance of the generated profile should
be done using PFCG.

Q. What is user buffer?

A. When a user logs on to the SAP R/3 System, a user buffer is built containing all authorizations for that user.
Each user has their own individual user buffer. For example, if user Smith logs on to the system, his user buffer
contains all authorizations of role USER_SMITH_ROLE. The user buffer can be displayed in transaction SU56.

A user would fail an authorization check if:

The authorization object does not exist in the user buffer

The values checked by the application are not assigned to the authorization object in the user buffer
The user buffer contains too many entries and has overflowed. The number of entries in the user buffer
can be controlled using the system profile parameter auth/number_in_userbuffer

How to find out all roles with T-code SU01?

A. You can use SUIM > Roles by complex criteria or RSUSR070 to find out this.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.

You can also get this information directly from table, if you have access to SE16 or SE16N. Execute
SE16N

Table AGR_1251
Object S_TCODE
VALUE (low) SU01

Q. How to find out all the users who got SU01 ?

A. You can use SUIM >User by complex criteria or (RSUSR002) to find this out.
Go to the Selection by Authorization Value.
In Object 1 put S_TCODE and hit enter.
And put SU01 in Transaction code and hit execute (clock with check) button.
I use authorization object, as you can use this to test any object.

Q. How to find out all the roles for one composite role or a selection of composite roles?
A. Execute SE16N
Table AGR_AGRS

Composite roles You can put multiple composite roles using the more button

Q. How to find out all the derived roles for one or more Master (Parent) roles?
A. Execute SE16N
Table AGR_DEFINE
Use either agr_name field or Parent_agr field.

Q. How can I check all the Organization value for any role?
A. Execute SE16N
Table AGR_1252
Role Type in the role here and hit execute.

You can always download all the information to spreadsheet also using .

Q. How do I restrict access to files through AL11?

A. First create an alias. Go to t-code AL11 > configure > create alias. Let say we are trying to
restrict alias DIR_TEMP which is /tmp. Open PFCG and assign t-code AL11, and change the
authorization for S_DATASET as mentioned below
Activity 33
Physical file name /tmp/*
Program Name with Search Help *

Q. How can I add one role to many users?

A. SU10. If you have less than 16 users then you can paste the userids.

If you have more than 16 users Click on Authorization data and click on next to users and

upload from clipboard .

Hit the change button and go to the role tab and add the roles to be assigned and hit save.

Q. What are the Best practices for locking expired users?

A. Lock the user. Remove all the roles and profiles assigned to the user. Move them to TERM User
group.

Q. How can be the password rules enforced ?

A. Password rules can be enforced using profile parameter. Follow the link to learn more about the
profile parameter.

Q. How to remove duplicate roles with different start and end date from user master?
A. You can use PRGN_COMPRESS_TIMES to do this. Please refer to note 865841 for more info.

Q. How come the users have authorization in PFCG, but user still complains with no
authorization?
A. Make sure the user master is compared. May be the there is a user buffer overflow
Also check the profile- Follow the instruction below.
SUIM > User by complex criteria.
Put the userid of user who is having issue.
Execute
Double click on the user id and expand the tree. Select the profile in question and see if
the authorization is correct or not. If not do the role reorg in PFCG and see if that helps.

Q. How can I have a display all roles.

A. Copy sap_all and open the role and change the activity to 03 and 08

Q. How can I find out all actvt in sap?

A. All possible activities (ACTVT) are stored in table TACT (transaction SM30), and also the valid
activities for each authorization object can be found in table TACTZ (transaction SE16).

Q. How to find all the users who got access to change and create users?
A. Click here

You can find all users who have access to create or change users using SUIM
Execute Transaction SUIM
Go to - Users by Complex Selection Criteria >>Users by Complex Selection Criteria or you could run report
RSUSR002 using SA38 or SE38

Fill in the screen as shown below, and execute the query. There are couple of other authorization ( S_USER_AGR,
S_USER_GRP and S_USER_PRO) you might want to check as well.

On the other hand you could just give the user SU01D, which is display user master.

Q. What is SAP?
A. SAP is the name of the company founded in 1972 under the German name (Systems, Applications, and
Products in Data Processing) is the leading ERP (Enterprise Resource Planning) software package.

Q. Explain the concept of Business Content in SAP Business Information Warehouse?

A. Business Content is a pre-configured set of role and task-relevant information models based on consistent
Metadata in the SAP Business Information Warehouse. Business Content provides selected roles within a
company with the information they need to carry out their tasks. These information models essentially contain
roles, workbooks, queries, InfoSources, InfoCubes, key figures, characteristics, update rules and extractors for
SAP R/3, mySAP.com Business Applications and other selected applications.

Q. What is IDES?
A. International Demonstration and Education System. A sample application provided for faster learning and
implementation.

Q. What is SAP R/3?

A. A third generation set of highly integrated software modules that performs common business function based
on multinational leading practice. Takes care of any enterprise however diverse in operation, spread over the
world. In R/3 system all the three servers like presentation, application server and database server are located at
different system.

Q. What are presentation, application and database servers in SAP R/3?

A. The application layer of an R/3 System is made up of the application servers and the message server.
Application programs in an R/3 System are run on application servers. The application servers communicate with
the presentation components, the database, and also with each other, using the message server. All the data are
stored in a centralized server. This server is called database server.

Q. What should be the approach for writing a BDC program?

A. Convert the legacy system data to a flat file and convert flat file into internal table. Transfer the flat file into
sap system called sap data transfer. Call transaction(Write the program explicitly) or create sessions (sessions
are created and processed ,if success data will transfer).

Q. What are the major benefits of reporting with BW over R/3?

Q. Would it be sufficient just to Web-enable R/3 Reports?
A. Performance Heavy reporting along with regular OLTP transactions can produce a lot of load both on the R/3
and the database (cpu, memory, disks, etc). Just take a look at the load put on your system during a month end,
quarter end, or year-end now imagine that occurring even more frequently. Data analysis BW uses a Data
Warehouse and OLAP concepts for storing and analyzing data, where R/3 was designed for transaction
processing. With a lot of work you can get the same analysis out of R/3 but most likely would be easier from a
BW.

Q. What is the difference between OLAP and Data Mining?

A. OLAP - On line Analytical processing is a reporting tool configured to understand your database schema,
composition facts and dimensions. By simple point-n-clicking, a user can run any number of canned or user-
designed reports without having to know anything of SQL or the schema. Because of that prior configuration, the
OLAP engine builds and executes the appropriate SQL. Mining is to build the application to specifically look at
detailed analyses, often algorithmic; even more often misappropriate called reporting.

Q. What is Extended Star Schema and how did it emerge?

A. The Star Schema consists of the Dimension Tables and the Fact Table. The Master Data related tables are kept
in separate tables, which has reference to the characteristics in the dimension table(s). These separate tables for
master data is termed as the Extended Star Schema.

Q. Define Meta data, Master data and Transaction data

A. Meta Data: Data that describes the structure of data or MetaObjects is called Metadata. In other words data
about data is known as Meta Data. Master Data: Master data is data that remains unchanged over a long period
of time. It contains information that is always needed in the same way. Characteristics can bear master data in
BW. With master data you are dealing with attributes, texts or hierarchies. Transaction data: Data relating to the
day-to-day transactions is the Transaction data.

Q. What is Bex?
A. Bex stands for Business Explorer. Bex enables end user to locate reports, view reports, analyze information
and can execute queries. The queries in workbook can be saved to there respective roles in the Bex browser. Bex
has the following components: Bex Browser, Bex analyzer, Bex Map, Bex Web.

Q. What are variables?

A. Variables are parameters of a query that are set in the parameter query definition and are not filled with
values until the queries are inserted into workbooks. There are different types of variables which are used in
different application: Characteristics variables, Hierarchies and hierarchy node, Texts, Formulas, Processing
types, User entry/Default type, Replacement Path.

Q. What is AWB?. What is its purpose?

A. AWB stands for Administrator WorkBench. AWB is a tool for controlling, monitoring and maintaining all the
processes connected with data staging and processing in the business information warehousing.

Q. What is the significance of ODS in BIW?

A. An ODS Object serves to store consolidated and debugged transaction data on a document level (atomic
level). It describes a consolidated dataset from one or more InfoSources. This dataset can be analyzed with a
BEx Query or InfoSet Query. The data of an ODS Object can be updated with a delta update into InfoCubes
and/or other ODS Objects in the same system or across systems. In contrast to multi-dimensional data storage
with InfoCubes, the data in ODS Objects is stored in transparent, flat database tables.

Q. What is Extractor?
A. Extractors is a data retrieval mechanisms in the SAP source system. Which can fill the extract structure of a
data source with the data from the SAP source system datasets. The extractor may be able to supply data to
more fields than exist in the extract structure.

Q. How do I change the name of master / parent role keeping the name of derived/child role same? I
would like to keep the name of derived /child role same and also the profile associated with the
child roles.
A. First copy the master role using PFCG to a role with new name you wish to have. Then you have to generate
the role. Now open each derived role and delete the menu. Once the menus are removed it will let you put new
inheritance. You can put the name of the new master role you created. This will help you keep the same derived
role name and also the same profile name. Once the new roles are done you can transport it. The transport
automatically includes the Parent roles.

What is the difference between C (Check) and U (Unmaintained)?

A. Background:
When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks
should occur within a transaction and which authorization checks should be maintained in the PG. You determine
the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table
USOBT_C.

In USOBX_C there are 4 Check Indicators.

CM (Check/Maintain)
- An authority check is carried out against this object.
- The PG creates an authorization for this object and field values are displayed for changing.
- Default values for this authorization can be maintained.

C (Check)
- An authority check is carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.

N (No check)
- The authority check against this object is disabled.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization.

U (Unmaintained)
- No check indicator is set.
- An authority check is always carried out against this object.
- The PG does not create an authorization for this object, so field values are not displayed.
- No default values can be maintained for this authorization..

Q. What does user compare do?

A. Comparing the user master: This is basically updating profile information into user master record. So that
users are allowed to execute the transactions contained in the menu tree of their roles, their user master record
must contain the profile for the corresponding roles.

You can start the user compare process from within the Profile Generator (User tab and User compare
pushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered into the user
master record. Never enter generated profiles directly into the user master record (using transaction SU01, for
example)! During the automatic user compare process (with report pfcg_time_dependency, for example),
generated profiles are removed from the user masters if they do not belong to the roles that are assigned to the
user.

If you assign roles to users for a limited period of time only, you must perform a comparison at the beginning
and at the end of the validity period. You are recommended to schedule the background job
pfcg_time_dependency in such cases

Q. Can wildcards be used in authorizations?

A. Authorization values may contain wildcards; however, the system ignores everything after the wildcard.
Therefore, A*B is the same as A*.

Q. What does the PFCG_TIME_DEPENDENCY clean up?

A. The 'PFCG_TIME_DEPENDENCY' background report only cleans up the profiles (that is, it does not clean up the
roles in the system). Alternatively, you may use transaction 'PFUD'.
Q. What happens to change documents when they are transported to the production system?
A. Change documents cannot be displayed in transaction 'SUIM' after they are transported to the production
system because we do not have the 'befor input' method for the transport. This means that if changes are made,
the 'USR10' table is filled with the current values and writes the old values to the 'USH10' table beforehand. The
difference between both tables is then calculated and the value for the change documents is determined as a
result. However, this does not work when change documents are transported to the production system. The
'USR10' table is automatically filled with the current values for the transport and there is no option for filling the
'USH10' table in advance (for the history) because we do not have a 'befor input' method to fill the 'USH10' table
in advance for the transport.

Q. What is the difference between the table buffer and the user buffer?
A. The table buffers are in the shared memory. Buffering the tables increases performance when accessing the
data records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a
buffer from which the data of a user master record is loaded when the user logs on. The user buffer has different
setting options with regard to the 'auth/new_buffering' parameter.

Q. What does the Profile Generator do?

A. The Profile Generator creates roles. It is important that suitable user roles, and not profiles, are entered
manually in transaction 'SU01'. The system should enter the profiles for this user automatically.

Q. How many authorizations fit into a profile?

A. A maximum of 150 authorization fit into a profile. If the number of authorizations exceed this marker, the
Profile Generator will automatically create more profiles for the role. A profile name consists of twelve (12)
characters and the first ten (10) may be changed when generated for the first time.

Q. What authorization objects are needed for PFCG?

A. Click here

SAP Transport Authorization

To release Task

S_TRANSPRT
ACTVT=43, 03, 75
TTYPE=TASK
Other type:CLCP Client Transports
CUST Customizing Requests
DTRA Workbench Requests
MOVE Relocation transports
PATC Preliminary Corrections and Deliveries
PIEC Piece lists
TASK Tasks
TRAN Transport of copies

S_DATASET
PROGRAM=SAPLSTRF, SAPLSLOG
ACTVT=34
FILENAME=*

To release Customizing Requests

S_TRANSPRT
TTYPE=CUST
ACTVT=43, 03, 75
S_DATASET
PROGRAM=SAPLSCTS_RELEASE, SAPLSLOG, SAPLSTRF
ACTVT=33, 34
FILENAME=*
S_RFC
FC_TYPE=FUGR
RFC_NAME=STPA
ACTVT=16;
Authorization object needed for PFCG access

S_USER_AGR
ACT_GROUP= * (You can restrict by role, if proper naming convention is used)
ACTVT=01, 02, 03, 64 other fields below
01 Create or Generate
02 Change
03 Display
06 Delete
08 Display change documents
21 Transport
22 Enter, Include, Assign
36 Extended maintenance
59 Distribute
64 Generate
68 Model
78 Assign
79 Assign Role to Composite Role
DL Download
UL Upload

S_USER_GRP
CLASS=
ACTVT=22; 03
Other activity
01 Create or Generate
02 Change
03 Display
05 Lock
06 Delete
08 Display change documents
22 Enter, Include, Assign
24 Archive
68 Model
78 Assign

S_USER_TCD
TCD= * (Transaction in role)

S_USER_PRO
PROFILE= *
ACTVT=01, 06
Other activity
01 Create or Generate
02 Change
03 Display
06 Delete
07 Activate, generate
08 Display change documents
22 Enter, Include, Assign
24 Archive

S_TCODE
TCD=PFCG;