Fire Fighter is missed in the FF log sent to controllers

Dear Experts,
We are at SP10, and using role based Fire Fighter.
We defined a FF role (e.g. FFrole001) and assigned this role to fire fighters.
We are facing the following problem:
If two fire fighters do the FF job at the same time, only one of fire fighters activity log will be sent to controllers for review.
(Please note that the activity log of both fire fighters has been captured, we can find it in the /n/virsa/vfat.)
Here is the detailed steps:
1. The FF roles were assigned to two Fire Fighter at the same time
2. Both of the Fire Fighters had performed some activities in system.
3. FF activity log report captured the activities performed by the two Fire Fighters.
4. But in the attachment in the email which was sent to FF controller, only one Fie Fighter was shown.
Much appriciate if any one can help on this.
Thanks!

Hi Tang,
Did you check the configuration settings for both the FF IDs.
Also, as a trail and error, to isolate the issue, can you check using only the 2nd FF ID for which the log was not sent. Ensure that the 1st FF ID is not used. This way you can identify whether the issue is with the FF ID or the configuration.
Regards,
Raghu

Similar Messages

  • File Extension (.TXT) is missing in the FF Log m4ils.

    Hi Experts
    I've configured FireFighter in ECC 5.0
    When FF sends m4il notifications, file extension (.TXT) is missing in the attached file. When I see the m4il in the SOST transaction, it says that the attached file is in a RAW format, but (obviously)  in my m4il client, I have to rename the file to txt to be able to read it.
    I read several SAP notes, but none has fixed my problem or no applies to my environment:
    Note 1046405 - File Extension (.TXT) is missing in the FF Log m4ils.
    Note 183465 - SAPconnect: File extension TXT instead of RAW
    Note 1330086 - Firefighter Log report attachment file type extension (.TXT)
    Note 1058612 - FF-'.TXT' extension missing while sending m4il Notification
    Could you help me, please ?
    Thanks !!
    SAP ECC 5.0
    VIRSAHR     530_640     0010
    VIRSANH     530_640     0012
    SAP_BASIS     640     0024

    Hi Experts
    I've configured FireFighter in ECC 5.0
    When FF sends m4il notifications, file extension (.TXT) is missing in the attached file. When I see the m4il in the SOST transaction, it says that the attached file is in a RAW format, but (obviously)  in my m4il client, I have to rename the file to txt to be able to read it.
    I read several SAP notes, but none has fixed my problem or no applies to my environment:
    Note 1046405 - File Extension (.TXT) is missing in the FF Log m4ils.
    Note 183465 - SAPconnect: File extension TXT instead of RAW
    Note 1330086 - Firefighter Log report attachment file type extension (.TXT)
    Note 1058612 - FF-'.TXT' extension missing while sending m4il Notification
    Could you help me, please ?
    Thanks !!
    SAP ECC 5.0
    VIRSAHR     530_640     0010
    VIRSANH     530_640     0012
    SAP_BASIS     640     0024

  • Fire Fighter Table Log

    Hi Gurus,
    I have to give the fire fighter log for the audit....When i look into the fire fighter log table
    Till the first step of firefighting Loggin in as Fire fighter is recordd on the Fire fighter id...But later all the activities has been Encrpted
    ylTCyMUOWnb     
    ylTCyMUOWnb     
    ylTCyMUOWnb     
    ylTCyMUOWnb     
    ylTCyMUOWnb     
    Firefighter                   THis is the first Step as fire fighter later the  field has been encrypted....
    Please let me know ...

    Hi Raghav,
       You can not download FF logs directly from the table as they are encrypeted. There are couple of ways to download FF logs.
    1) You can download FF logs in text format from FF. Go to
    FF -> Administration -> Archive -> Delete/Download Log.
    2) If you have implemented web functionality of FF (SPM), you can download any of the logs directly from web tool.
    Regards,
    Alpesh

  • Fetch client IP addresses from the Netlogon.log file of all domain controllers in the domain

    Hi,
    The event ID 5807 is logged in the system logs of domain controllers as a result of which the IP addresses for the missing subnets are logged in Netlogon.log under %systemroot%/debug. The end goal is to fetch the IP addresses along with rest of the respective
    attributes from the Netlogon.log for all the domain controllers in the domain. I have the following script however, it gives me a 0KB file despite the fact that the Netlogon.log on the DC contains ample entries from last two months. 
    function GetDomainControllers {
        $DCs=[system.directoryservices.activedirectory.domain]::GetCurrentDomain() | ForEach-Object {$_.DomainControllers} | ForEach-Object {$_.Name}
        return $DCs
    function GetNetLogonFile ($server) {
        $path= '\\' + $server + '\c$\windows\debug\netlogon.log'
        try {$netlogon=get-content -Path $path -ErrorAction stop}
        catch { "Can't open $path"}
        #reverse the array's order to the end of the file
        [array]::Reverse($netlogon)
        $IPs=@()
        foreach ($line in $netlogon) {
            #split the line into pieces using a space as the delimiter
            $splitline=$line.split(' ')
            #Get the date stamp which is in the mm/dd format
            $logdate=$splitline[0]
            #split the date
            $logdatesplit=($logdate.split('/'))
            [int]$logmonth=$logdatesplit[0]
    #last month and this month
            if (($logmonth -eq $thismonth) -or ($logmonth -eq $lastmonth)) {
                #only push it into an array if it matches an IP address format
                if ($splitline[5] -match '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'){
                    $objuser = new-object system.object
                    $objuser | add-member -type NoteProperty -name IPaddress -value $splitline[5]
                    $objuser | add-member -type NoteProperty -name Computername -value $splitline[4]
                    $objuser | add-member -type NoteProperty -name Server -value $server
                    $objuser | add-member -type NoteProperty -name Date -value $splitline[0]
                    $objuser | add-member -type NoteProperty -name Time -value $splitline[1]
                    $IPs+=$objuser
            } else {
                #break out of loop if the date is not this month or last month
                break
        return $IPs
    #Get last month's date
    $thismonth=(get-date).month
    $lastmonth=((get-date).addmonths(-1)).month
    #get all the domain controllers
    $DomainControllers=GetDomainControllers
    #Get the Netlogon.log from each DC
    Foreach ($DomainController in $DomainControllers) {
        $IPsFromDC=GetNetLogonFile($DomainController)
        $allIPs+=$IPsFromDC
    $allIPs | Sort-Object -Property IPaddress -Unique | Export-Csv "E:\bin\NetlogonIPs.csv"
    PLEASE HELP!!

    Hi jrv,
    Thanks a lot for your help.
    I understand you cannot keep on iterating the code for me. However, I am stuck at this error :-
    ERROR : Exception calling "Parse" with "1" argument(s): "String was not recognized as a valid DateTime."
    After the following code finishes executing, I get the following output :-
    $csv=cat c:\windows\debug\netlogon.log |
    %{'{0}|{1}' -f $_.SubString(0,14),$_.SubString(15,$_.Length-15)}|
    ConvertFrom-Csv -Delimiter '|' -header time,message
    time message
    04/14 01:18:45
    NO_CLIENT_SITE: ServerX 10.x.x.x
    04/14 01:17:45
    NO_CLIENT_SITE: ServerY 10.x.x.x
    04/14 01:17:44
    NO_CLIENT_SITE: ServerY 10.x.x.x
    04/14 01:17:43
    NO_CLIENT_SITE: ServerX 10.x.x.x
    However, I get the above mentioned error at the following line :-
    $csv|%{$_.time=[datetime]::Parse(($_.time -replace ' ','/2015 '))}
    I would later want to run the query just for logs from past day.
    Entire code is as follows :-
    function GetDomainControllers {
        $DCs=[system.directoryservices.activedirectory.domain]::GetCurrentDomain() | ForEach-Object {$_.DomainControllers} | ForEach-Object {$_.Name}
        return $DCs
    function GetNetLogonFile ($server) {
        $path= 'C:\Test\netlogon.log'
        try {$netlogon=get-content -Path $path -ErrorAction stop}
        catch { "Can't open $path"}
        #reverse the array's order to the end of the file
        [array]::Reverse($netlogon)
        foreach ($line in $netlogon) {
       $csv=  $netlogon | %{'{0}|{1}' -f $_.SubString(0,14),$_.SubString(15,$_.Length-15)}| ConvertFrom-Csv -Delimiter '|' -header time,message | Out-Gridview
       $csv|%{$_.time=[datetime]::Parse(($_.time -replace ' ','/2015 '))}
    #get all the domain controllers
    $DomainControllers=GetDomainControllers
    #Get the Netlogon.log from each DC
    Foreach ($DomainController in $DomainControllers) {
        GetNetLogonFile($DomainController)
    Please help!! Any help will be highly appreciated.

  • I've been recieving text messages on my Iphone 4s, but the phone number is not showing up on my bill under the message logs.  Anyone know why??

    I've been receiving text messages on my phone, but for some reason the phone number is not showing up on my bill under the message log.  Does anyone know why?

        donnagman,
    Thanks for the details. All numbers should show up in the message history log, unless you are communicating via iMessage. When texting the numbers that are missing in the message log are you using your normal messaging app on the device or a downloaded app? Have the numbers that are missing been shown in your message log before?
    LindseyT_VZW
    Follow us on Twitter @VZWSupport

  • Change History in Fire Fighter Log Report.

    Hi Experts,
    Changes made by fire fighters were not recorded in the fire fighter log reports.I have gone thru a thread in the forum,there was mentioned that the issue had been reported to the SAP.Please let me know, if there is any update on the issue from SAP.
    Thanks,
    Mukesh

    FF Logs can be recorded when the changes done with FF id. Without FF id no Support / IT user should be allowed.
    If you want to change the configuration it has to be done via FireFigher only. Otherwise you get the log from SM20, if its been configured.

  • Fire Fighter Logs details in /n/virsa/vfat

    Hi,
    When i see the Fire Fighter logs through the Tcode /n/virsa/vfat, i am just able to know what tcode was used by a particular user and at what time and date.
    Now if he has used SE38, i do not get the information of what report or program did he run in SE38. Similarly for SE16n I will not have the information of what table was used and modified.
    So is it possible to know the complete details of the activity that user has done throught the FIreFighter.
    Please help.
    Regards
    Anubhav

    In the case of SE16 you can see the generated selection-screen program for that table being submitted both in STAD if you are fast enough (i.e. before the aggregation takes place) and in the security audit log (SM20N - which is actually the correct tool to rely on). They will show reports from SA38 etc as well.
    However SE16N does not generate and submit report type programs so you cannot know which table was accessed. The only little "skidmark" it will leave behind is the memory id entries of the tabname selection parameter and SQL performance traces, but GRC does not access this data and it is unreasonable to assume that the history of these memory ids has been activated on the server side.
    If worst comes worse you will be able to find out the table though - latest with a thumb-screw or bamboo under the finder nails... 
    Cheers,
    Julius

  • Fire FIghter Log Issue

    Hi Gurus,
    I have an issue with Fire fighter Log Job...I have Scheduled the Job...ZFATBAK with a period One hour....
    When i tried to look at the Log in Fire Fighter tool...It has the below message...
    BACKGROUND JOB WAS NOT SCHEDULED/LOG & FILE NOT YET GENERATED.
    Please help ...

    Hi,
    Guess I try to help you here. Can you please check the following;
    1.FATBAK job ? ( Via SM37)
    2. Go to the configuration table in the FF (Logon to FF and one of the tabs--)
    Please let meknw the what you see.
    Thanks

  • "Missing component" messages in the installation logs

    I installed Oracle Application Server 10.1.3 on Windows, and I found some strange entries in the installActionsxxxxx.log files:
    "# Not all the dependencies for the component Oracle HTTP Server 10.1.3.0.0 could be found. Missing component oracle.bc4j 10.1.2.0.0.
    # Not all the dependencies for the component Oracle HTTP Server 10.1.3.0.0 could be found. Missing component oracle.bc4j.oem 10.1.2.0.0.
    # Not all the dependencies for the component Oracle HTTP Server 10.1.3.0.0 could be found. Missing component oracle.soap.srv 2.2.0.0.2a.
    # Not all the dependencies for the component Oracle HTTP Server 10.1.3.0.0 could be found. Missing component oracle.apache.ojsp 10.1.2.0.0.
    # Not all the dependencies for the component Oracle HTTP Server 10.1.3.0.0 could be found. Missing component oracle.apache.ejb 9.0.1.0.1."...
    This goes on for several pages. I still had the Oracle Application Server 10.1.2 installation packages on my computer, and I found out that several of the missing packages actually belong to 10.1.2, and several of them are earlier than 10.1.2.
    My questions: is it a problem at all that these components are missing, or shall I ignore these log entries? If this is a problem, how to fix it?
    Best Regards,
    Gabor

    Hi Gabor,
    You can ignor these log entries. (There is a bug logged. The installer team is looking for a good way to surpress these messages.)
    Regards,
    Mathias

  • Preventing missed calls/VMs from registering in the "messages" log

    I'm trying to figure out whether there is a way to get missed calls (and, preferably, notices of voicemail) delivered to a different place on the BB than notices of SMS/email. If I see the little person icon that indicates that there's a voicemail, I don't also need notice of that in the mailbox with the red star on it. Is there a way to make it stop?
    Thanks in advance!

    on your device :
    home screen >> green button >> open menu >> options >> call logs
    there you can choose to log nothing.
    => the phone calls you take, and the ones you miss, appear in the phone log, but no more in the messages list.
    The search box on top-right of this page is your true friend, and the public Knowledge Base too:

  • [Solved] Missing search feature in the generated logs?!

    Hi,
    Isn't there any search feature for logs generated by JDeveloper 10g? If I want to search some words in the logs I have to copy & paste the entire log into the Notepad and search my words there. Isn't there any better way? I know for example JBuilder has this simple feature.

    Hi,
    no, there is no feature like that
    Frank

  • Table Logging in Fire Fighter (Super User Privilege Management)

    Does anyone know exactly which sources does the Firefighter Log Report take into account?
    I would think that Change Documents (CDHDR CDPOS) and Workload Stats for TX (STAT) exexcution are part of it. Does anyone know whether table logging entries (DBTABLOG) are also displayed in the report?
    Thanks alot.
    Best regards,
    Alex

    Amongst other things, you can check the status of the table logging in SE13.
    Regardless of the application reporting, you can check the log via SCU3.
    Cheers,
    Julius

  • Approve multiple Fire Fighter logs in once

    Dear all,
    we had to start the program GRAC_EAM_LOG_SYNC_TIMEBASED to start the FF-Log creation and the e-mail notification for the FF-Controller.
    The result is that there are more then 400 FF-logs are to check/approve now.
    Does someone know a program to approve these log in an masse change?
    BR
    Melanie

    Hi Denis,
    sorry for the late answer. We had Connection Problems between our Company and  SCN.
    Here the steps how Í could execute the Report for FF-logs which were not created, but must be there.
    IF you will see the FF-log approval file via UI -> Access Management ->Search Request -> Switch selection criteria "Proces ID" to "Firefighter Log Report Review Log Worflow".
    Meanwhile wie have created a Job that runs every night with this program
    Hope this will help you!
    BR Melanie

  • What is FIRE FIGHTER ID

    hi folks,
    can anybody tell me what is FIRE FIGHTER ID.

    Hi,
    When a user in a production system needs help from an IT
    superuser, the application assigns a temporary ID that grants
    the superuser broad yet regulated access. The superuser simply
    logs on to the application’s main console, where a new session
    is opened under the Firefighter ID. Because the Firefighter ID is
    preassigned, the superuser never needs to wait for approval
    before solving a critical problem.
    Ideally Firefighter should be used only for superuser access. The reasoning...
    1) When the firefighter role is being used, the user cannot use his normal transactions
    2) Only one user can use a firefighter role at a time
    3) Complete log of firefighter role usage is available for review.
    Many-a-times it is suggested to use firefighter role for performing the duties of the users on holiday. However I think it is not appropriate. Such users should be assigned normal roles for these duties for the limited period
    Hope I had been able to help you. Please assign points.
    Rgds
    Manish

  • Changes History Report in Fire Fighter

    Hi,
    We have assigned FF ID to end user. By using that FF ID,user did some changes.
    Ex: End user has used SU01 transaction and he has assigned SAP_ALL to his own id and some other users via FF ID.
    When we checked the Log Reports in FF 5.3, we are able to the see only transaction details which he has used. But we are unable to find the changes which he has done by using SU01.
    Please check and advice me how me can get that change history report in Fire Fighter.
    Thanks & Regards,
    KKRao.

    Hi Harleen,
    Retrieve Change Log option is already set as YES. But we are unable to get Changes History Report.
    Please advice to me.
    Thanks & Regards,
    KKRao

Maybe you are looking for