Firefighter log report

Hi All,
I have a case where in the Access controls 5.2 version for the firefighter tool, the summary reports run in 3 pages whereas the detail report for the same report shows only 4 lines.
Can someone tell what all could be the possibilities for the same?
Thanks
Vani

Hi,
maybe an issue of being a controller for FF-ID or not.
You are only allowed (depends on parameter it FF-Config-Tab)  to see detailed reports when you are a controller of the FF-ID, for summary you won't have to be assigned as a controller.
Check this please.
Best regards,
Bianca

Similar Messages

  • Firefighter Log Report-Wrong entries being shown

    Hi all,
    using SAP FF rel. 5.2 - VIRSANH 520_620 I encountered the same issues
    described in notes n°:
    - 1064911 Firefighter Log Report-Wrong entries being shown
    - 1152284 Firefighter Log Report-Wrong entries being shown with
    dates
    The solutions described in these notes are not valid for my SAP
    release:
    VIRSANH 520_620
    Does someone know if are available the same corrections for my SAP FF Rel.?
    Thanks in advance,
    Claudio Orsi

    Hi Claudio,
    Not sure if this helps any....
    We recently upgraded FF 5.2 (520_620) to current SP levels and experienced some issues with the reporting feature
    We utilize the reports through the NetWeaver interface and were not receiving correct results; this happened after we went from SP 3 to SP 4
    We have backed out the SP4 level to get back to "what was working"; we have an issue opened with SAP and they have identified our experience as a bug and plan on a fix with the next release scheduled for end of June
    Are you experiencing report issues using the NetWeaver interface or the backend report tools? What is the SP level you are at?
    This information on our experience may or may not be helpfull but anything can be of some value as long as it is mentioned
    Jerry Synoga
    Ryerson, Inc.
    630-758-2021

  • Firefighter log report does not show programs executed under SA38/SE38

    We are on version 400_700 of Compliance Calibrator.  When executing the log report, the report name only shows "RFC".  We are testing SA38 & SE38.  I expected the report to display the program name.  Is there something set up wrong or are my expectations too high?  Thanks!

    Hi Vikki,
    I dont think you can see the programs executed under SA38/SE38.
    The functionality of Virsa Firefighter allows you to see the following log reports:
    Firefight log summary
    Reason/Activity report
    Firefight Transaction usage report
    Invalid Firefight ids/Owners/Control
    Log Report
    SOD conflicts in Firefighter
    Hope this helps.
    Thanks,
    Kiran Kandepalli.

  • Best Practices - Enforcing the review of  Firefighter Logs/Reports

    Hi,
    I am looking for some best practices as it pertains to the review of Firefighter Usage Logs.  How are companies these days reviewing, documenting, and enforcing that system generated FF logs/reports are indeed being reviewed and monitored?  Anything you can share is greatly appreciated.
    I have seached the GRC forum, Firefighter Post, and reviewed the recently released "Super User Access" article, but have only found information on the tool's functionality and technical specs.
    Regards,
    Edited by: jmsreyes on Jul 20, 2009 6:38 PM

    Hi,
      There is no standard or best practices in enforcing the review of FF logs and reports. Every client/company plan their own strategy around this.
    One of my client used to ask every controller to print out and file the printed paper with their signature on it. They were required to keep this for a year or so. Another client asked them to print it to pdf and save it to a secure location which will mean they have reviewed this log. If there is any issue, it will be the responsibility of the particular FF controller.
    Regards,
    Alpesh

  • FF 5.2 Send Log Report Execution Notification "YES"

    I received the Firefighter Log Report.txt attachment via email successfully (only once) but am no longer receiving them.  The /VIRSA/ZVFATBAK and /VIRSA/ZVFAT_LOG_REPORT jobs are running and I can even run them manually.  Everything else is functioning properly (i.e.; reports, logs and the FF login notification email) except for this one item.  What can I look for that might resolve this issue?

    SOLUTION:  SAP NOTE 1065048 - Superuser Log Not sent in Email to Controller
    1. Execute transaction SOST.
      a) Select Period, Send Status, Transmitted, Errors, Sender and execute to check emails generated for the firefighter log report.
      b) If no emails are generated with "VFAT Log Report" in the subject, then proceed to step 2 and check the settings. If emails are generated but not sent from your system, then proceed to step 3 and check the SAPCONNECT settings for the external email "Send Process".
    2. Execute transaction /n/VIRSA/VFAT.
      a) Click on the "Configuration" button and verify that configuration parameter "MAIL (Send FirefightID login notification) is set to "YES".
      b) Click on the "Controllers" button and verify that FF ID Controller has "EMAIL" as the usage flag.
      c) Execute transaction SU01 and verify that FF ID Controller has a valid "Email Address" and "Comm.Method INT".
      d) Repeat step c for the user under whose authorization background job for program /VIRSA/ZVFATBAK is scheduled. This can be checked by executing transaction SM37, selecting the job, clicking on button "Step" and noting down the ID under "User" column on the next screen. Also verify that
    Superuser Administrator role is assigned to this "User".
    3. Execute transaction SCOT.
      a) Make sure external email communication method is configured for address type INT and "Send Jobs" are scheduled and active.
      b) Check output format for SAP documents for address type internet is set, for example "TXT" for "RAW Text", "PDF" for SAPScript/SmartForms, etc.
      c) Do a routing test with Firefighter background job user as "SENDER", Recipient Address Type as "INT" and controller's email ID from SU01 as recipient.
      d) Refer to SAP Notes 183465, 171698 and 377602 for further information on setting conversion rules at the INT / SMTP node.
    NOTE: Please work with an ABAP developer / BASIS to identify the cause of the issue and apply any necessary kernel / ABAP patches if required to resolve the issue.

  • Customized Email Content for Firefighter login and Log report

    Hi Experts,
    Is it possible to customize the email content (subject as well as body) for Firefoghter login and log report notifications. This is required on GRC AC 5.3 SP10.
    Thanks
    Davinder

    No, D P. You can not customize FF emails. They are hard coded in the ABAP programs.
    Alpesh

  • SPM Reporting - Log reports display on front end

    Hi,
    We have implemented GRC 5.3 and have an issue on the SPM reporting through the front end.
    We have done config in dev and have the following jobs running in the background every 1 hour:
    1. /VIRSA/ZVFATBAK
    2. /VIRSA/ZVFAT_LOG_REPORT
    3. /VIRSA/ZVFAT_V01
    4. /VIRSA/ZVFAT_V03
    The log on the back-end displays all activity of FF user, but when going to the front end I seem not to get any reports to display.
    We have created the connectors via the config page, but when trying to drill through the selection criteria we found that the FF user does not come up as a selection variable. We see the system defined though.
    Any suggestions how to get the reporting to display on the front-end?
    Kind Regards, Melvin

    Santosh,
    You should only need the /virsa/zvfatbak job running in the background. However, if the emails are not triggered for the log reports, you may wish to schedule the /virsa/zvfat_log_report program to run after completion of /virsa/zvfatbak as that is the program which actually sends the notifications.
    Regarding the RFC user, check the authorisations held in the Firefighter Administrator role as those will not be too far away!
    Simon

  • Data not exist in FF Log Report

    Hello GRC Experts,
    I have a problem in FF log report.
    Iam using SPM Ver 5.3
    Under Tab Reports => User Reports => Reason / Activity Report => I select System Name then i mention the date, for example a month. I execute, i get all the details of users FireFighter, Login Date/Time, Reason,Activity.
    But  try to download the report  "Reason Activity Report.xls" and save it in my desktop and when i open the excel there is no data inside.It is blank
    - I tried opening without saving, still the same.
    - I saved and opened in notepad but it was like a XML report not the valid data
    Thanks in advance for the solution.
    Regards,
    Prasath

    Hello,
    Even in the backend, the excel file doesn't contains any data.
    Under the Tool Box - Reason/Activity report - I enter the from date and to date and then execute.
    I can see the log report generated , but when i save into local disk and open the excel. It is blank.
    Note: The Problem exist for all kinds of report, not only specific to Reason/Activity report.
    Thanks in advance.
    Regards,
    Selva

  • Invalid FF Log Report

    Hi All,
    Recently all GRC projects which are using GRC 10 and GRC 10.1 versions have a common issue called "Invalid FF Log Reports"
    I browsed through a lot of discussions in SCN and lot of SAP notes as well, but don't have correct information on
    why this is happening and how to fix this issue.
    Few things as per my understanding:
    1. If Firefighter Log synch and FF Workflow synch both are running together though parameter 4007 set as "YES"
    Apart from this are there any reasons why the workflows shows Invalid FF log report? Please suggest
    SAP Suggestions to fix this issue: I gathered these options to try but wanted advise from users who have used these options and did they work?
    1.  As per note 1781142, SAP suggest to cancel those log review workflows with "Invalid FF Log report"
    2.  Need to identify the workflow with Invalid FF log report generated for which FF session using " 2122027 - How to identify the workflow generated for a given FFID session?"
    and then Execute program "GRAC_EAM_ERROR_LOG_WORKFLOW" to clean-up all cases where Invalid FF Log Report got generated.
    This program comes as part of SAP Note "1930562 - Workflow got generated with empty logs due to inconsistency"
    3. SAP Note 1934127 -  1934127 - GRC10 EAM: EAM recovery program to retrieve missing log and to generate the missing workflows
    This program GRAC_EAM_LOG_SYNC_TIMEBASED has anyone used it?
    Actually if the program GRAC_EAM_ERROR_LOG_WORKFLOW clean-up all the workflows with Invalid FF log report then I want to run this program
    to re-send workflows to controllers again. But during execution of this program what are the options to be selected in order to run this
    program only for those workflows failed with Invalid FF log report?
    ~ Madan

    Hi Madan,
    please check thread http://scn.sap.com/thread/3583971
    At the end, there is a short handling document for GRAC_EAM_LOG_SYNC_TIMEBASED.
    BR
    Melanie

  • SPM configuration and log report email

    Hi all,
    I'm configuring the SPM in the ECC system. I follow the note 1065048 but I don't receive any email about the report log of the activity done by the firefighter, but I receive the mail about the login.
    What can I do to fix the problem?
    ps:
    the report /VIRSA/ZVFATBAK takes a long time to finish
    the report /VIRSA/ZVFAT_LOG_REPORT always dump for no space to extend an internal table
    Edited by: place87 on Oct 7, 2010 5:04 PM

    Luchinho,
    Firefighter background job picks data from STAT files and table CDHDR if FF configuration parameter 'Retrieve Change Log' is set to YES.
    STAT file is maintained my RSCOL00 job, which should run hourly in your system.
    So please schedule it first.
    Then check what is size of CDHDR table, as select query on this table takes long time if table is too big. In that case, you may have to create Index on this table. There is one SAP note for this, don't remember the number please search with 'CDHDR' under GRC.
    There are few parameter in configuration which send Log Report mails immediatly, so you need to set them to yes. This means your controllers will get Log Report mails every hour when /VIRSA/ZVFATBAK runs.
    Pls refer to SAP notes 1494107, 1430336, 1065048, .
    regards,
    Surpreet

  • Firefighter log

    Hi,
    while using a firefighter ID a log report is created which can be looked at by the controller (Log Report in /virsa/zvfat). Unfortunately the log report only shows transactions and doesn't show changes e.g. in FK02 or document numbers (FB01).
    How can I raise the detail level of the log report ?
    Thank you
    Max

    Max,
       You need to turn on 'Change log' to see this kind of details. Go to FF/SPM configuration tab and select the change log option and provide the value as 'Yes'. This should run the necessary background job and update the report with more details. Look at Note # 1064094.
    Regards,
    Alpesh

  • SUP Detail Log report missing activity

    Hello,
    We are using GRC 5.3 SP09.  Some actions are not being reported in the firefighter detail log report (the report that shows what transactions were executed, tables updates, old and new values, etc)
    SM59 and SARA are two actions that are not reported.
    We were expecting details for all actions while logged in using a firefighter id.
    Please advise if you have any ideas how to resolvie this issue.
    thanks
    Tammi

    There are some basis transactions which will not automatically have the detailed actions logged.
    The log works off tables CDPOS and CDHDR with STAT as the collector for Transaction data. If the activities are not captured here, the detailed change documents will not be available.
    Simon

  • FFLOGCRT Send Log Report with Critical Transactions Only

    Hi ,
    I have configured FF (SPM) where in Controllers are getting FF ID login notifications through Emails. Now I have a requirement to stop these notifications and send them only for critical transactions.I have configured critical transactions in table /VIRSA/ZVIRTCODE.
    In order to get notifications only for critical transactions I have updated the configuration as below.
    CHGLOG Retrieve Change Log     YES
    FFAUTH Firefighter Owner Additional Authorization     YES
    FFCNTL Firefighter Controller Additional Authorization     YES
    FFLOGCRT Send Log Report with Critical Transactions Only     YES
    FFLOGIM Send Log Report Execution Notification Immediately     NO
    FFLOGNOTI Send Log Report Execution Notification     NO
    FFNOTIM Send Firefighter Login Notification Immediately     NO
    MAIL Send FirefightId Login Notification     NO
    RFC Remote Function Call     LOCAL
    My controllers are not getting notified for critical transactions with above config. Please can you suggest where am I going wrong.
    SOST/SCOT working fine.
    ps: I have gone through the note Note 1065048 - Firefighter Log Not sent in Email to Controller.pdf
    Thanks!!
    ARD
    Edited by: Abhijeet Deshmukh on Sep 17, 2010 5:20 PM

    Hi Simon,
    I am not using risk analysis and remediation's critical transactions table. My FF (SPM) specific crtitcal transactions are in table
    /VIRSA/ZVIRTCODE.
    CTRAN Critical Transaction Table from Compliance Calibrator(VRAT)     NO.
    I am under impression that table /VIRSA/ZVIRTCODE is used by FF for critical transactions.
    Thanks!!
    ARD

  • Firefighter logs coming up incomplete

    When running the log report I am getting inconsistent results, sometimes there is no file or some of the transactions used are not listed or I get accurate results.
    I have looked through the SAP notes listed in previous posts but nothing appears to be relevant. The data is appearing in STAD but it does not look like it is being collected by the batch job.
    All the config settings in FF are correct, I have created two jobs to make sure nothing is missed and the jobs are running.
    Any help or new ideas would be appreciated.
    Thanks,
    Roger

    Hello Roger,
      Here are the things you can look at:
    1. First check and make sure that you have followed the SAP Note 1039144. Please refer to the second section of this Note (excluding the section for index creation). Make sure that you have scheduled the job on hourly basis with default variant. Please do not run multiple jobs. If you have multiple jobs running, please cancel alll and schedule a fresh job which is running on hourly basis with default variant. Make sure that the job class in SM36 is A.
    2. Please run transaction SE37 and give the name of function module as TH_SERVER_LIST. Click on Execute button and hit execute again on the subsequent screen. At the output screen of the function module, click the icon with a number (at the bottom of the screen) to see the output of this function module. Here you should see the list of application servers that you have in your system and entry for each one of them. Please check the entries in the SERV column. The entries in this column should begin with sapdp.. for eg. sapdp00, sapdp01 etc... if there is anything else for any of the app. server then you need to make an entry in the service file of your system to correct the same. The working of FireFighter background job in highly dependent on these correct entries. If you will search the OSS for any SAP Notes, you can find SAP Notes related to it if you search based on criteria TH_SERVER_LIST. Check the ones in the GRC component.
    3. Check in SM37 if any of the FireFighter jobs are getting delayed or getting cancelled. Check SM37 for STATcollector job as well to see if that is getting delayed or cancelled. If this is the case with any of the jobs, then correct the same.
    4. Make sure that there is no timezone difference in your system where the time zone of the batch user with which you have scheduled the FireFighter background job is different from the system time zone. To check if you have any time delay problem please do the following:
      -> Check the system time from Menu -> Status.
      -> Log in via a FFid and do any transaction and immediately log off. Note the system time on which you did this.
      -> execute transaction STAD and look for the time shown of the activities that you performed above in step 2.
      -> In a correct system, the time should match, however, if in your case it does not then as your BASIS team to correct the same.
    5. Make sure that you are on latest support pacakge.
    6. Make sure that you have the configuration to log change data set to yes.
    6. If none of the above help you, then log a message with GRC-SAC-SFF support and they would be able to help you.
    Regards, Varun

  • FVAT log report having invalid characters

    Hello ,
    The FireFighter VFAT log report which received through email contains invalid characters. And the log report received as TXT file. I could not able to paste the invalid characters here as its not able to show up in this page. But it looks like a square box where ever we suppose have blanks in the log report it comes with this square box characters.
    Please help me to find any solution to avoid these invalid character.
    here is the Virsa release details
    VIRSA     400_640     0008
    FireFighter 3.0 release
    Thanks
    Sridhar

    Hi,
    I suspect that the issue is with the language settings.
    - Check the default language of the system
    - Check the user parameters in SU01 for the GRC VFAT user ID (Parameters shuch as CDG will force the language).
    - Check the SCOT settings. (Your basis team can help)
    This should resolve the issue.
    Regards,
    Raghu

Maybe you are looking for