Critical Logging Event  Red ( /sapapo/om13)

Hello,
In  /sapapo/om13--->checks, we can see critical logging event is red.
I logging section, message are
1> error in /SAPAPO/OM_REORG_DAILY (date 16.10.2007)
2> Planning version was created.(date 13.10.2007)
3> ATP time series active(date 12.10.2007)
4> error OM13 ( date 10.10.2007)
we want to turn this critical loging event to green.
Should we delete livecache application logs via /sapapo/om12  or is there any other way to turn it into green.
As far as I know, /sapapo/OM13->Logging contains last entries from logging log.(/sapapo/om13->Logging----
>Logging Log .)But Last entries means how many? any parameter to do this?(Just a query)
Can somebody please help me turning critical event log to green.
Please feel free to add  thougts.Thanks.
Regards,
Tushar
Message was edited by:
        Tushar Chavan

Hello Tushar,
You could turn critical event log to green if you will not have the Critical Logging Events for the last 5 days.
For example, OM13 could Shows the Critical Logging Event as Yellow. You could run the transaction /sapapo/om11 or /sapapo/OM13 -> tab 'logging' to review the critical logging events, which have occurred recently on your system. If , for example, the 'Old transactional simulations deleted' by the //om_ reorg_daily report or corrections of the inconsistencies in /sapapo/om17 were done on your system, the events will be listed in the 'logging' section. And the OM13 Shows Critical Logging Event (Yellow) to pay attention for you to check 'logging' for more details.                                                                               
Information to the reason of the yellow light can be found via the blue info button.                                                                     
For example on the my local system in the transaction /sapapo/om13 -Checks -> 'Critical Logging Event' shows the yellow light. Before the yellow light you will see the last Event to be checked in "Logging".             
The next info was displayed, when I was clicked blue info button:                
At least one critical logging event has occurred recently. See "Logging"         
in the Writer for more details.                                                  
And when will go to the  transaction /sapapo/om13 -> logging ( or you could use the transaction /sapapo/om11 ), you will see  "Logging" list of events for more details.    
-> In your case if you have red light for the Critical Logging Event, you need to correct the problem with the error in  "Logging"  event.
-> You should not delete the "Logging"  events on your system to get the green light
in //om13->checks, "Logging"  events needed for the further analysis of the LCA problems on your system, if you have them or will have in future.
-> If the error in /SAPAPO/OM_REORG_DAILY occurred, it has to be checked/corrected. And if the job will run without errors the problem is gone. See the SAP note 800927.
->"2> Planning version was created.(date 13.10.2007)
      3> ATP time series active(date 12.10.2007)"
    Please review the SAP note: 792286 Repairing/activating ATP time series.
    Are you running the system upgrade?
< If yes, then the note 792286 is NOT needed to be applied or pay attention.
During the upgrade the step to activate the ATP time series is before to load the master data to liveCache in the target release. And during the load master data the planning versions were loaded < created > to the liveCache from APO database. >
    What is the version of your system?
-> I recommend you to create the OSS message to the component 'BC-DB-LCA'
    to check the critical LCA events on your system.
Thank you and best regards, Natalia Khlopina

Similar Messages

  • Missing boot events on the Diagnostic performance operational log (event-id 100)

    I noticed that event (100) is not always reported or not reported at all on several machines and I would like to understand how can I force reporting it.
    In addition I would appreciate if you can explain regarding the keys under:
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Boot]
    Things I've already tested on win7:
    1. Verified that the diagnostic performance > operational log is enabled
    2. Services: ‘Diagnostic Policy Service’ (auto) and ‘Diagnostic service host’ (manual) were running
    3. Verified that GPO is not disabled for:
    - Computer Configuration\Administrative Templates\System\Troubleshooting
    - Diagnostics\Windows Boot Performance Diagnostics Computer Configuration\Administrative Templates\System\Troubleshooting and Diagnostics\Diagnostics: Configuration scenario executing level
    Thanks,

    For keys under [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Boot]
    Please take a look of discussions in this link(reply posted by David J)
    Diagnostics-Performance log Event 100 - Critical, Error, or Warning - when and why?
    http://social.technet.microsoft.com/Forums/windows/en-US/48005f5d-5f66-439a-af51-3a2ebb894e31/diagnosticsperformance-log-event-100-critical-error-or-warning-when-and-why?forum=w7itproperf
    My understanding to this issue—“event (100) is not always reported or not reported at all on several machines”
    is that : this kind event log occurs when an time parameter during the boot process reaches a threshold in the registry key, then a warning, critical or error message will appear in the event viewer. If it doesn’t reach the threshold, then there will be
    no report.
    Regards
    Yolanda
    TechNet Community Support

  • I need to start and stop logging based on a digital input event(or analog if necessary), log data for several seconds prior to the event, and have the data file close at the end of event and increment the filename for the next logging event.

    I don't know if this can be done with VI Logger or need to use Labview V7.1.

    After browsing through the VI Logger User Manual, it looks like the triggering that you are hoping to accomplish is possible. However, incrementing the filename for the next logging event is not going to be possible. VI Logger does exactly what its name tells - logs data. I don't think the automation that you are hoping to accomplish is possible.
    For help with setting up your application, if you do choose to stay with VI Logger, make sure to chek out the Getting Started with VI Logger Manual.
    Best of luck.
    Jared A

  • Retain Console System.log Events file for Usage Analysis

    I recently became interested in tracking the usage of some Apple computers. I discovered that the system.log events file in Console provides the login and logout times. So, I was able to use that to calculate how much time the computers are being used. This was very handy because there was data from October 2010 to June 2011. I went back a few days later and discovered the log files had been purged all except a few weeks of data. Is there any way to prevent them from being purged? Or, can I increase the size of the retained system.log file? What's the point of a log file tracking events if it's only going to be deleted? Alternatively there are programs designed to keep track of computer usage such as login and logout times as well as user usage by application. Would you recommend one of these?

    Thanks for bringing the typo to my attention. I've corrected that now. I'm reminded of the phenomenon by which we see and read words as groups of letters regardless of their positioning.
    I've not really had any specific system problems that cause huge log files. However, sometimes when diagnosing problems it's nice to have a long period of time to examine possible issues.
    Regarding your #3, opening .bz2 files... Have you saved these log files from Console and then tried opening them? It's just bazaar. The file opens to another file, then opens to another file, and so on. You never see the actual file contents. Others have observed the same thing.
    Regarding your #4, I created the script you mention. It's described here:
    http://www.resourcesforlife.com/docs/item4103
    However, I'd like to just go ahead and use the existing system.log events.
    Greg

  • Logging event link-status

    Is this enabled by default on Cisco IOS switch ports? What logging level will ensure I see link status in the router buffer log?

    logging event link-status global (global configuration)
    To change the default switch-wide global link-status event messaging settings, use the
    logging event link-status global command. Use the no form of this command to disable the link-status event messaging.
    logging event link-status global
    no logging event link-status global
    Syntax Description
    This command has no arguments or keywords.
    Defaults
    The global link-status messaging is disabled.
    Command Modes
    Global configuration
    Command History
    Release Modification
    12.2(25)SG
    Support for this command was introduced on the Catalyst 4500 series switch.
    Usage Guidelines
    If link-status logging event is not configured at the interface level, this global link-status setting takes effect for each interface.
    Examples
    This example shows how to globally enable link status message on each interface:
    Switch# config terminal
    Enter configuration commands, one per line. End with CNTL/Z.
    Switch(config)# logging event link-status global
    Switch(config)# end
    Switch#
    Related Commands
    logging event link-status global (global configuration)
    logging event link-status (interface configuration)
    To enable the link-status event messaging on an interface, use the logging event link-status command. Use the no form of this command to disable link-status event messaging. Use the
    logging event link-status use-global command to apply the global link-status setting.
    logging event link-status
    no logging event link-status
    logging event link-status use-global
    Defaults
    Global link-status messaging is enabled.
    Command Modes
    Interface configuration
    Command History
    Release Modification
    12.2(25)SG
    Support for this command was introduced on the Catalyst 4500 series switch.

  • REST API for audit log events

    How can I execute audit log report using REST API. If it is not possible is there any other ways to retrieve all audit log events(Upload/download/delete/share/login/logout) using REST API.

    I thought it not possible
    Ravin Singh D

  • Nexus logs events

    Hello,
    I am sending my nexus's logs to a syslog server, but I need to catch specific messages and send a alarm by email.  I am looking the catalog of all nexus logs events, could anyone help me?
    Regards,

    This is Cisco MDS 9000 Family and Nexus 7000 Series NX-OS System Messages Reference. This may vary if you have a different Nexus.
    Thanks,
    Don
    http://www.solarwinds.com/log-event-manager.aspx
    PS: Please rate and close questions if your question has been answered.

  • Server 2012 Domain Controller Logging event 2004, with error "crc check"...

    Pretty new domain, and domain controller, running server 2012 as a Hyper-V VM.
    Getting this error when it reboots.  I have done a chkdsk, thinking maybe the vhdx file is corrupt in some way.  Have also checked the system log for events talking about file corruption.  Nothing.
    The disk in question has 10+ GB free, so disk space is not an issue.  I ran dcdiag /q /a & it told me that DFSR has logged events in the last 24 hours, but nothing else.  AD seems to think everything is cool.
    Not sure what to look at next...  Thanks for any pointers/help.
    The DFS Replication service stopped replication on volume C:. This failure can occur because the disk is full, the disk is failing, or a quota limit has been reached. This can also occur if the DFS Replication service encountered errors while attempting to
    stage files for a replicated folder on this volume. 
    Additional Information: 
    Error: 23 (Data error (cyclic redundancy check).) 
    Volume: 0F55C346-589F-11E2-93EB-806E6F6E6963

    I have a series of the following Events logged, and then the 2nd event.  The 2nd event is being logged every 8 hours.
    Log Name:      DFS Replication
    Source:        DFSR
    Date:          2/15/2013 7:36:49 AM
    Event ID:      2212
    Task Category: None
    Level:         Warning
    Keywords:      Classic
    User:          N/A
    Computer:      MyDC.Domain.lan
    Description:
    The DFS Replication service has detected an unexpected shutdown on volume C:. This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. The service has automatically initiated a recovery process.
    The service will rebuild the database if it determines it cannot reliably recover. No user action is required.
    Additional Information:
    Volume: C:
    GUID: 0F55C346-589F-11E2-93EB-806E6F6E6963
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="DFSR" />
        <EventID Qualifiers="32768">2212</EventID>
        <Level>3</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-02-14T23:36:49.000000000Z" />
        <EventRecordID>196</EventRecordID>
        <Channel>DFS Replication</Channel>
        <Computer>MyDC.domain.lan</Computer>
        <Security />
      </System>
      <EventData>
        <Data>0F55C346-589F-11E2-93EB-806E6F6E6963</Data>
        <Data>C:</Data>
      </EventData>
    </Event>
    Log Name:      DFS Replication
    Source:        DFSR
    Date:          2/15/2013 7:36:49 AM
    Event ID:      2004
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      MyDC.Domain.lan
    Description:
    The DFS Replication service stopped replication on volume C:. This failure can occur because the disk is full, the disk is failing, or a quota limit has been reached. This can also occur if the DFS Replication service encountered errors while attempting to
    stage files for a replicated folder on this volume.
    Additional Information:
    Error: 23 (Data error (cyclic redundancy check).)
    Volume: 0F55C346-589F-11E2-93EB-806E6F6E6963
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="DFSR" />
        <EventID Qualifiers="49152">2004</EventID>
        <Level>2</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-02-14T23:36:49.000000000Z" />
        <EventRecordID>197</EventRecordID>
        <Channel>DFS Replication</Channel>
        <Computer>MyDC.Domain.lan</Computer>
        <Security />
      </System>
      <EventData>
        <Data>0F55C346-589F-11E2-93EB-806E6F6E6963</Data>
        <Data>C:</Data>
        <Data>23</Data>
        <Data>Data error (cyclic redundancy check).</Data>
      </EventData>
    </Event>

  • No logging event link-status on SG300

    How can I do it (no logging event link-status) on Cisco Small Business 300 Series Managed Switches (SG300)?

    no logging event link-status
    This command disables the logs generated when port(s) go down or up. 

  • Logging event trunk-status vs link-status vs bundle-status

    Hi
    This is not really a query regarding the above interface level commands, but just looking for someone elses view on the differences regardless of however subtle they are.
    No links please, like I said I know what they are and do.
    Just your real life expereinces why you needed bundle-status for instance will do just fine.
    thanks in advance

    Three different use cases for status notifications.
    I'll give you my experience with using these commands and where they are useful.
    Logging event trunk-status--this command is particularly useful for tracking security vulnerabilities as well as trunk mismatches when you're relying on DTP for trunk negotiation.
    Say you have a trunk uplink on a switch that links to a distribution switch. This trunk carries traffic for multiple VLANs (thus the very definition of a trunk).
    Lets say the other side of the link on the distribution switch is for some reason changed from a trunking state (switchport mode trunk, or switchport mode dynamic desirable/auto) to a non-trunking state (switchport mode access). If the uplink on your access layer switch is not hard-coded for trunk-mode (switchport mode trunk and/or switchport nonegotiate), then your uplink interface can potentially be changed from a trunk port to an access port and only carry traffic for a single VLAN. This would leave other clients on the access switch VLANs stranded from the rest of the network. This logging mechanism would let you know that the switchport is no longer an operational trunk, even though the link status would still be up.  
    Of course, as a best practice, you should never rely on DTP to form trunk links, especially on uplinks.
    The second use is for security--if you have an interface that you KNOW should never become a trunk interface (i.e. an access port where clients connect), and for whatever reason the interface becomes a trunk link (due to a compromised switch or an over-reliance on DTP), you could potentially expose VLANs that users should never have access to. This logging mechanism would let you know if that happens. 
    Logging event link-status--this one is simple--it logs whether the interface is up/down or changes. One thing I find this useful for is on particularly important interfaces--uplink interfaces, routing adjacency interfaces, server interfaces, etc. Use this on any port when you want to absolutely know if it goes down.
    Logging event bundle-status--this one is fairly simple as well--it logs whether there is a change in the port-channel. This could be triggered by a member interface leaving or joining. One reason you would want to use this is for guaranteed bandwidth and configuration consistency.
    Sometimes port-channel members leave a channel-group because the configuration is changed on one member and not on the other, likely by mistake. This could catch an error like that and cue you on where to look into the issue. As for bandwidth, obviously you don't want to believe you have 20Gbps or 2Gbps on your uplink, then find out that you actually have half (or whatever portion) of that bandwidth missing because a member has left the port-channel. Both situations can be avoided by monitoring the status of your bundle (or port-channel). 

  • Exchange 2013 Critical Search event 2158 with event 1006

    Hi,
    I'm running Exchange 2013 CU1.  I've noticed in the event logs two errors that continuously keep popping up relating to searching.  Actual searching of mail seems fine and the mail databases are in a healthy state.
    Event ID 2158 Unified logging service
    Event 20 (Search) of severity 'Critical' occurred 11 more time(s) and was suppressed in the event log
    and
    Event ID 1006 General
    The FastFeeder component received a connection exception from FAST. Error details: Microsoft.Exchange.Search.Fast.FastConnectionException: Connection to the Content Submission Service has failed. ---> Microsoft.Ceres.External.ContentApi.ConnectionException:
    Recovery failed after 0 retries
       at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder.CheckRecoveryFailed()
       at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder.WaitForAvailable()
       at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder.SubmitDocument(Document document, TimeSpan timeout)
       at Microsoft.Ceres.External.ContentApi.DocumentFeeder.DocumentFeeder.SubmitDocument(Document document)
       at Microsoft.Exchange.Search.Fast.FastFeeder.SubmitDocumentInternal(Object state)
       --- End of inner exception stack trace ---

    Hi,
    Please take your time to apply the latest CU and see whether the issue fixes.
    Regards,
    Simon Wu
    TechNet Community Support

  • System Log Event ID 4321 every 30 seconds, system name conflict for a name not in use

    -- Symptom --
    System event log shows an error with event ID 4321 every 30 seconds:
    The name "pac-1          :2d" could not be registered on the interface with IP address 172.20.51.206. The computer with the IP address 172.20.21.2 did not allow the name to be claimed by this computer.
    -- Environment --
    OS:  Windows 7 x64 Enterprise
    Network:  Enterprise domain
    DHCP:  Yes
    WINS:  via DHCP
    -- Additional information --
    This computer was set up from an image.  The image was built with the system being named 'pac-1'.  This system's name was changed to 'pac-11' before (or possibly shortly after) joining the domain and now has a completely different name, and there
    is no system on the network with the name 'pac-1' (there are 'pac-3', and other numbers, but no 'pac-1')
    I have renamed the system with no change to the frequency of the error, and I cannot find 'pac-1' in the registry anywhere except for strings located in HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LANDesk\Inventory\LogonHistory\Logons that list prior logons.
    I've done my google research and have found great information for plenty of other people's situations, just not this one.  Any helpful advice is welcome.
    Thank you!

    c0lorless wrote:
    -- Symptom --
    System event log shows an error with event ID 4321 every 30 seconds:
    The name "pac-1          :2d" could not be registered on the
    interface with IP address 172.20.51.206. The computer with the IP
    address 172.20.21.2 did not allow the name to be claimed by this
    computer.
    -- Environment -- OS:  Windows 7 x64 Enterprise
    Network:  Enterprise domain
    DHCP:  Yes
    WINS:  via DHCP
    -- Additional information -- This computer was set up from an image.  The image was built with the
    system being named 'pac-1'.  This system's name was changed to
    'pac-11' before (or possibly shortly after) joining the domain and
    now has a completely different name, and there is no system on the
    network with the name 'pac-1' (there are 'pac-3', and other numbers,
    but no 'pac-1')
    I have renamed the system with no change to the frequency of the
    error, and I cannot find 'pac-1' in the registry anywhere except for
    strings located in
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\LANDesk\Inventory\LogonHistory
    \Logons that list prior logons.
    I've done my google research and have found great information for
    plenty of other people's situations, just not this one.  Any helpful
    advice is welcome.
    Thank you!
    I'd check my WINS server's registration entries, if they contain an
    entry with that NETBIOS name. If the machine with the ip-address
    172.20.21.2 is not your WINS server you need to check, what services
    etc. are running on that machine. Also look if the domain/workgroup
    name, which is used by this machine is correct and identical to all
    other machines.
    Wolfgang

  • Log & Transfer red exclamation mark...HELP!!!

    Hey guys, I have a shoot on Monday and for some reason my system is not allowing me to import p2 data. In the log and transfer window, i can view the clips (Scroll back and forth and what not) but when i select any and 'add to queue' the ball spins for a bit. Then it just stops and gives me a red exclamation mark. Any ideas What am i doing wrong? I have imported p2 before. Thanks!
    Rhyno

    Well then, if it works on one machine, but not this one, then something on this machine is causing it not to work. What that is, I cannot tell you. It can be any NUMBER of things. Some small application or plugin can be causing this. Finding out what that is could mean reformatting the drive, installing the OS clean, installing a fresh install of FCP, and then seeing if it works. Then installing all the other plugins and applications one at a time, testing import as you go along, until you can't import anymore...then you know what the cause is.
    Shane

  • NULL SID Security Log Event ID 4625 when attempting logon to 2008 R2 Remote Desktop Session Host

    This is a new deployment of Server 2008 R2 in a newly created 08 R2 active directory on a newlyt installed 08 R2 RDSH server.
    A new generic user is created in AD. That user can log on to the terminal server on the console just fine. But that user cannot logon via RDP. Furthermore, the domain admin credentials also cannot logon via RDP.
    When either set of credentials is used, the logon attempt registered in the Windows Security Even Log as a denied attempt with Event ID 4625 reporting a NULL SID.
    Troubleshooting: The RDSH has already been disjoined and rejoined to the domain. Also, curious note, there are three ways to save the user account on the RDSH server as a valid user account which has permissions to logon. The one Microsoft recommends is to open computer management and edit the remote desktop users group. When I the accounts here and click apply, they immediately dissapear. Secondly, I can open the computer properties and go to the remote tab. There I find the user accounts added using the previous method are enumerated but not displaying correctly. They show up with the RDSH server name and a question mark. The last way, is to open the Remote Desktop Session Configuration tool and edit the properties of the rdp connection and go to the security tab. This was the only place I could get a user to ‘stick’ but the logon attempts still show a NULL SID and access is denied.
    I have scoured every bit of RDS documenation I can find with no luck.
    Thanks,
    Chris

    I am also experiencing this issue. 
    2008 servers, 2007 exchange on server 2008. 
    These are fresh servers, fresh AD. Users can log onto domain normally, RDP not working for admin accounts, generating same errors as posted above.
    The bigger issue, is that we have a cisco messaging service account that is generating this error on the DC's and the Exchange server as well. The service basically emails users voicemails to their inbox. The user we've created for the cisco service is unable
    to authenticate to the exchange server, in turn generating the same errors posted above as well. We can log on to the domain with this account just fine. 
    Any ideas on this? We have not tried re-adding the servers to the domain. 
    Log Name:      Security
    Source:        Microsoft-Windows-Security-Auditing
    Date:          5/5/2010 9:01:13 AM
    Event ID:      4625
    Task Category: Logon
    Level:         Information
    Keywords:      Audit Failure
    User:          N/A
    Computer:      xx.corp
    Description:
    An account failed to log on.
    Subject:
    Security ID:                         NULL SID
                    Account Name:                 -
                    Account Domain:                             -
                    Logon ID:                             0x0
    Logon Type:                                       3
    Account For Which Logon Failed:
                    Security ID:                         NULL SID
                    Account Name:                
    xxxx
                    Account Domain:                            
    xxxx
    Failure Information:
                    Failure Reason:                 Domain sid inconsistent.
                    Status:                                  0xc000006d
                    Sub Status:                         0xc000019b
    Process Information:
                    Caller Process ID:             0x0
                    Caller Process Name:     -
    Network Information:
                    Workstation Name:        laptop
                    Source Network Address:            -
                    Source Port:                       -
    Detailed Authentication Information:
                    Logon Process:                  NtLmSsp 
                    Authentication Package:               NTLM
                    Transited Services:          -
                    Package Name (NTLM only):       -
                    Key Length:                        0

  • Log changes in /SAPAPO/MAT1 - Product

    Hello,
    anyone knows if there is a modification log for product master data in SCM for changes done in /SAPAPO/MAT1 - Product ?
    We have CIF to create and update product master data from R3 to scm but we have field Forward Consumption Periodo changed and it is ok in R3 so It must have been changed directy in SCM.
    Is there any way to see changes in this system?
    Tkanks,
    Teresa Lopes

    Teresa,
    It is possible - if change document logging is turned on.  In SCM, the system is delivered with the logging turned off.  You must explicitly turn it on in order to be able to review changes.
    Product master changes can be reviewed in transaction /SAPAPO/PROD_CD_READ.  Do not leave product or location blank, use asterisk instead for 'wild card'.
    If nothing is found, then logging is not turned on.  You can confirm by looking at table CDHDR, where the change data is stored.
    To turn change recording 'on', IMG > APO > Master Data > Product > Activate change documents.
    Best Regards,
    DB49

Maybe you are looking for