Firefighter log

Hi,
while using a firefighter ID a log report is created which can be looked at by the controller (Log Report in /virsa/zvfat). Unfortunately the log report only shows transactions and doesn't show changes e.g. in FK02 or document numbers (FB01).
How can I raise the detail level of the log report ?
Thank you
Max

Max,
   You need to turn on 'Change log' to see this kind of details. Go to FF/SPM configuration tab and select the change log option and provide the value as 'Yes'. This should run the necessary background job and update the report with more details. Look at Note # 1064094.
Regards,
Alpesh

Similar Messages

  • Firefighter Logs storage location and size in GRC AC 5.3

    Hello Gurus,
    We are working on Firefighter configuration and are totally confused with following questions, appreciate if someone can show the light here :
    Where does the Firefighter logs stored - in backend or frontend or both? Can we check the size of existing Firefighter logs.
    Is there any mechanism to find out the approximate space requirement for Firefighter usage (based on number of firefighter id and number of transactions executed per day).
    Thanks
    Davinder

    D P,
      The logs are stored in the backend SAP system. I have not seen any space requirement for FF. You can take a look at the sizing guide for AC 5.3 and you may find some useful information.
    Regards,
    Alpesh

  • Firefighter log report does not show programs executed under SA38/SE38

    We are on version 400_700 of Compliance Calibrator.  When executing the log report, the report name only shows "RFC".  We are testing SA38 & SE38.  I expected the report to display the program name.  Is there something set up wrong or are my expectations too high?  Thanks!

    Hi Vikki,
    I dont think you can see the programs executed under SA38/SE38.
    The functionality of Virsa Firefighter allows you to see the following log reports:
    Firefight log summary
    Reason/Activity report
    Firefight Transaction usage report
    Invalid Firefight ids/Owners/Control
    Log Report
    SOD conflicts in Firefighter
    Hope this helps.
    Thanks,
    Kiran Kandepalli.

  • How do you generate Historical Firefighter Logs?

    We have implemented SAP GRC Firefighter 5.1 application and between security issues and other things, the firefighter usage logs had not been generated for each day since inception.  I understand when I click on the "Update Firefighter Log" that the "/VIRSA/ZVFATBAK" batch job is kicked off, however, this only updates entries within the current day's range.  I have tested running the batch job via SE38 and in the foreground see a screen to select another day / time for this program to run against.  However, when I provide a historical day / time I still do not receive any information for these missing day's activities.  Any suggestions, we are considering modifying the existing FF code to allow for a variant for such an event, but this seems crazy that SAP has not already considered this issue.  Any ideas would be greatly appreciated.

    We had to not only schedule the hourly background job "/VIRSA/ZVFATBAK". We also had to schedule a second "/VIRSA/ZVFATBAK" job running once every 8 hours with a variant to make it read 8hrs back. There is a problem where the hourly job does not always log everything. This second job will catch what the first job missed
    Dave Wood

  • Firefighter Log File Archiving - Leading Practice

    Hi All,
    I am wondering if there is any leading practice by SAP or other on how often to archive data from Firefighter Logs. How big do these get? I know it depends on how much FF IDs get used, but is this a weekly, monthly, yearly type activity?
    Thanks so much,
    Grace Rae

    Hi,
    SAP recommends to keep at least one year data in the system for firefighter logs. You can check SAP note 1041912.
    Thanks
    Sunny

  • Firefighter log Job termination.

    Hi,
    Firefighter log job termintes with short dump " EXPORT_TOO_MUCH_DATA "
    Job log overview for job:    BCXXXXFIREFIGHTERLOG
    =======================================================
    Date       Time     Message text                                                             Message class Message no. Message type
    21.11.2011 11:30:47 Job started                                                                   00           516          S
    21.11.2011 11:30:47 Step 001 started (program /VIRSA/ZVFATBAK, variant DAILY, user ID BATCH)      00           550          S
    21.11.2011 11:50:16 ABAP/4 processor: EXPORT_TOO_MUCH_DATA                                        00           671          A
    21.11.2011 11:50:16 Job cancelled                                                                 00           518          A
    Short Dump details:
    ===============
    Error analysis
        The dataset stored under an EXPORT/IMPORT ID is restricted
        by
        1. The maximum possible size of 2 GB
        2. The length of a data record and the capacity of the
        sequence counter. This error occurs only if the capacity of the
        sequence counter does not go beyond 255.
    It executes the program /VIRSA/ZVFATBAK. Please advise.

    Hi,
    You should run this job hourly because it happens due to large amount of data in CDHDR table. You can refer SAP note 1049512 for more information.
    Thanks
    Sunny

  • Firefighter Log Report-Wrong entries being shown

    Hi all,
    using SAP FF rel. 5.2 - VIRSANH 520_620 I encountered the same issues
    described in notes n°:
    - 1064911 Firefighter Log Report-Wrong entries being shown
    - 1152284 Firefighter Log Report-Wrong entries being shown with
    dates
    The solutions described in these notes are not valid for my SAP
    release:
    VIRSANH 520_620
    Does someone know if are available the same corrections for my SAP FF Rel.?
    Thanks in advance,
    Claudio Orsi

    Hi Claudio,
    Not sure if this helps any....
    We recently upgraded FF 5.2 (520_620) to current SP levels and experienced some issues with the reporting feature
    We utilize the reports through the NetWeaver interface and were not receiving correct results; this happened after we went from SP 3 to SP 4
    We have backed out the SP4 level to get back to "what was working"; we have an issue opened with SAP and they have identified our experience as a bug and plan on a fix with the next release scheduled for end of June
    Are you experiencing report issues using the NetWeaver interface or the backend report tools? What is the SP level you are at?
    This information on our experience may or may not be helpfull but anything can be of some value as long as it is mentioned
    Jerry Synoga
    Ryerson, Inc.
    630-758-2021

  • Runtime Error Firefighter log in GRC 10.0

    When logging into the AC system with a firefighter user the system generates the following runtime error:
    Runtime Errors         OBJECTS_OBJREF_NOT_ASSIGNED_NO
    Except.                CX_SY_REF_IS_INITIAL
    ABAP Program           CL_GRAC_AD_ACCESS_MGMT========CP
    Error analysis
         An exception occurred that is explained in detail below.
         The exception, which is assigned to class 'CX_SY_REF_IS_INITIAL', was not
          caught in
         procedure "RESET_USR_PWD" "(METHOD)", nor was it propagated by a RAISING
          clause.
         Since the caller of the procedure could not have anticipated that the
         exception would occur, the current program is terminated.
         The reason for the exception is:
         You attempted to use a 'NULL' object reference (points to 'nothing')
         access a component.
         An object reference must point to an object (an instance of a class)
         before it can be used to access components.
         Either the reference was never set or it was set to 'NULL' using the
         CLEAR statement.
    This problem should be solved with SAP Note 1591209 or with SP5. We are currently on SP5 and are using:
    GRCPINV - V1000_800 (SAP-10305INGRCPINW) & GRCFND_A - V1000 (SAPK-V1005INGRCFNDA).
    In these software packages the error messages should be resolved, but unfortunately the error remains.
    I have checked the (RFC) users / RFC connection and repository synch. already.
    Does anyone know what more needs to be done here?
    Us
    Thanx in advance.

    Simon,
    Thanx for the quick reply!
    All the configuration has been done according to the manuals and using same functionality/method as in vs. 5.3.
    I configured the following elements:
    - RFC users with the correct RFC role from the new security guide.
    - RFC connections from AC system to back end and back end to AC system. Used the ealier created GRC RFC users with creating the RFC connections.
    - Configured and tested (with success) the SMTP settings in the AC system.
    - Created the Controller (and also owner) user in the AC system and configured the user master data with an emailadress.
    - Connected the controller / owner to the firefighter and firefighter ID with Tx NWBC.
    - Configuration settings for the the SUPMG module have been done with Tx SPRO.
    - Walked through all the settings in SPRO concerning 'connectors' and checked and confirmed that the connector is pointing at the back end system.
    Did I forget anything?

  • Best Practices - Enforcing the review of  Firefighter Logs/Reports

    Hi,
    I am looking for some best practices as it pertains to the review of Firefighter Usage Logs.  How are companies these days reviewing, documenting, and enforcing that system generated FF logs/reports are indeed being reviewed and monitored?  Anything you can share is greatly appreciated.
    I have seached the GRC forum, Firefighter Post, and reviewed the recently released "Super User Access" article, but have only found information on the tool's functionality and technical specs.
    Regards,
    Edited by: jmsreyes on Jul 20, 2009 6:38 PM

    Hi,
      There is no standard or best practices in enforcing the review of FF logs and reports. Every client/company plan their own strategy around this.
    One of my client used to ask every controller to print out and file the printed paper with their signature on it. They were required to keep this for a year or so. Another client asked them to print it to pdf and save it to a secure location which will mean they have reviewed this log. If there is any issue, it will be the responsibility of the particular FF controller.
    Regards,
    Alpesh

  • Firefighter Log in Error

    Hi Experts...
    I have configured a FFUserid, assigned to a firefighter and the Owner and the Controller.
    When the Firefighter try to log on, a message of "The FFUser Does not exist. message /VIRSA/VFAT621.
    Could anybody help me, please?

    Hi Lizeth,
    the solution to your problem might be SAPNote <a href="https://service.sap.com/sap/support/notes/1007554">1007554</a>.
    In its vanilla version FireFighter 5.2 doesn't support case sensitive passwords and throws the error: Invalid Password maintained for Firefight ID <xxxx..>
    When the FFUID gets locked, probably your error message may appear. If your FFUID is locked, try to unlock it and check the error message.
    Compare The specified item was not found.
    Kind regards,
    Martin

  • Firefighter logs coming up incomplete

    When running the log report I am getting inconsistent results, sometimes there is no file or some of the transactions used are not listed or I get accurate results.
    I have looked through the SAP notes listed in previous posts but nothing appears to be relevant. The data is appearing in STAD but it does not look like it is being collected by the batch job.
    All the config settings in FF are correct, I have created two jobs to make sure nothing is missed and the jobs are running.
    Any help or new ideas would be appreciated.
    Thanks,
    Roger

    Hello Roger,
      Here are the things you can look at:
    1. First check and make sure that you have followed the SAP Note 1039144. Please refer to the second section of this Note (excluding the section for index creation). Make sure that you have scheduled the job on hourly basis with default variant. Please do not run multiple jobs. If you have multiple jobs running, please cancel alll and schedule a fresh job which is running on hourly basis with default variant. Make sure that the job class in SM36 is A.
    2. Please run transaction SE37 and give the name of function module as TH_SERVER_LIST. Click on Execute button and hit execute again on the subsequent screen. At the output screen of the function module, click the icon with a number (at the bottom of the screen) to see the output of this function module. Here you should see the list of application servers that you have in your system and entry for each one of them. Please check the entries in the SERV column. The entries in this column should begin with sapdp.. for eg. sapdp00, sapdp01 etc... if there is anything else for any of the app. server then you need to make an entry in the service file of your system to correct the same. The working of FireFighter background job in highly dependent on these correct entries. If you will search the OSS for any SAP Notes, you can find SAP Notes related to it if you search based on criteria TH_SERVER_LIST. Check the ones in the GRC component.
    3. Check in SM37 if any of the FireFighter jobs are getting delayed or getting cancelled. Check SM37 for STATcollector job as well to see if that is getting delayed or cancelled. If this is the case with any of the jobs, then correct the same.
    4. Make sure that there is no timezone difference in your system where the time zone of the batch user with which you have scheduled the FireFighter background job is different from the system time zone. To check if you have any time delay problem please do the following:
      -> Check the system time from Menu -> Status.
      -> Log in via a FFid and do any transaction and immediately log off. Note the system time on which you did this.
      -> execute transaction STAD and look for the time shown of the activities that you performed above in step 2.
      -> In a correct system, the time should match, however, if in your case it does not then as your BASIS team to correct the same.
    5. Make sure that you are on latest support pacakge.
    6. Make sure that you have the configuration to log change data set to yes.
    6. If none of the above help you, then log a message with GRC-SAC-SFF support and they would be able to help you.
    Regards, Varun

  • Problem with  Firefighter logs after upgrade to 5.3 from 5.2

    Hello Gurus ,
    just for 2 weeks we are running GRC 5.3 , which we updated from the 5.2 version .
    Unfortunately i could not make all the possible tests in one day and after i didnt check the FF reports .
    So after 10 days..after solving some issues from the upgrade i realized that in SPM (Superuser Priviliege Management ) we have a problem as well .
    We cant perform anymore reason / activity reports because the data are empty.By empty i mean all the entries users made dissapeard. I searched the two tables that normally should have the data (/virsa/zffcdhdr and the  STXH ) but with no luck .
    The other problem is..that after the upgrade to 5.3 from 5.2 the grcservice user that is responsible for the job  /VIRSA/ZVFATBAK didnt had enough authorization to complete the job , thing that before worked fine .
    So for 10 days the job didnt run and when i run the log report i see for every FFID the message "BACKGROUND JOB WAS NOT SCHEDULED/LOG & FILE NOT YET GENERATED"
    When i look directly in the tables CDHDR and CDPOS   i can see the data that the log  needs.
    But how can i reconstruct the FF log with this data ? Because when the auditor comes i would like to have the complete logs.
    thank you all for the support
    Cheerz ,
    david

    Hi David,
    Please go through the SAP Note [1143639|https://service.sap.com/sap/support/notes/1143639] (and subsequent Notes). I hope it is of help, at least partially.
    Best regatds,
    Feri
    Edited by: Ferenc Orosz on Apr 2, 2009 2:43 PM

  • Error in FireFighter Log Review approval workflow (SWF_RUN646)

    The MSMP workflow SAP_GRAC_FIREFIGHT_LOG_REPORT has been configured in the AC System with transaction SPRO.
    The automatic customizing has been done, number ranges have been created. Back ground jobs are running and the customizing concerning FF id's, Controllers and Owners has been done.
    The log in notification mail is sent to the controller correctly and also the notification about a new work item. The error message appears when the Controller tries to execute / open the data from the log file in the SAP Business workplace with transaction SBWP.
    This is the error message:
    Exit CL_GRAC_SPM_AUDIT_REVIEW triggered exeception for event STATE_CHG and (target) status READY->SELECTED: UI signature (ID:'') not MSMP - action for WorkIte
    Message no. SWF_RUN646
    Can anyone help?

    Hi Nagesh,
    You need to maintain an MSMP workflow for the SAP_GRAC_FIREFIGHT_LOG_REPORT  process id and activate it.Kindly run the sync jobs inorder to trigger it
    Best Regards,
    Nandita.

  • Firefighter log report

    Hi All,
    I have a case where in the Access controls 5.2 version for the firefighter tool, the summary reports run in 3 pages whereas the detail report for the same report shows only 4 lines.
    Can someone tell what all could be the possibilities for the same?
    Thanks
    Vani

    Hi,
    maybe an issue of being a controller for FF-ID or not.
    You are only allowed (depends on parameter it FF-Config-Tab)  to see detailed reports when you are a controller of the FF-ID, for summary you won't have to be assigned as a controller.
    Check this please.
    Best regards,
    Bianca

  • GRC AC 10 EAM - Is it possible to send FF logs to controller in an email as attachment ?

    Hello,
    I am new to GRC AC 10 and wanted to check if In GRC AC 10 it is possible to send the Firefighter logs to Controller in an email as an attachment like we were doing in 5.3 or the controller has to login to GRC (via link in the email or direct login to GRC) to view ?
    Mark

    Hello Colleen,
    Thanks for your reply.
    I am using most of these parameters for my FF set up and it is working as expected however I am not able to get the logs in an email as an attachment like we used to get in AC 5.3 .
    In NWBC as well we have 3 options for controller-
    Email       - Controller receives the email with link to GRC action logs - No "Submit " button to approve
    Workflow - Controller receives the email with link to GRC action logs - Gets "Submit" button to approve
    Log Display - No email , Need to manually generate the logs.
    Do you know specific parameter settings or any other way to achieve this.
    Regards
    Ritu Rawat

Maybe you are looking for