Functions/Risks/Rules update recommendadtion

Hello colleagues,
Recently I have started to work with RAR(CC) tightly. Some points are uncleared for me and I would very appreciated for some helps and advices.
We performed post-installation steps for RAR (uploaded SAPObjects, BP, Functions, Rules and so on). The first my question is reqarding daily support system.
1) May we upload own files with actions and permissions which made by concotenation of standard actions/permissions files with our actions/permissions files? Or we have to manage via RAR interface?
1.1 In case if we can upload own files, would it rewrite existing information or add missing information?
1.2 Why standard files(actions, permissions) content duplicated information? For example, tcode F.13 contains in action file and permission file. Would it be enough to include F.13 (tcode and auth. objects) only in permission file?
2) Regarding question #1, should we run rule generation reports every time after changing:
2.1 If we add new BP, Function
2.2 If we don't change BP, Functions, but add new transactions/permissions to Functions
3) Is it possible to perform risk analysis during run of Rule Generation job (config -> log. systems -> generate rules)?
4) How to restrict number of rules if we get message like this:
Risk: M014 has exceeded the maximum number of rules (46,655) that can be generated
Regards,
Artem Ivashkin

Artem
yes all your questions are related to rules.
request you to divide them in two part and create new thread ...
that will be very helpful
Regarding :
) May we upload own files with actions and permissions which made by concotenation of standard actions/permissions files with our actions/permissions files? Or we have to manage via RAR interface?
"yes you can upload your own files, by modifiying the standard rule file. However be very cautious, the rate of error is very high. And extra TAB or RETURN and your rules will not be generated"
1.1 In case if we can upload own files, would it rewrite existing information or add missing information?
"Yes it will overwrite existing data"
1.2 Why standard files(actions, permissions) content duplicated information? For example, tcode F.13 contains in action file and permission file. Would it be enough to include F.13 (tcode and auth. objects) only in permission file?
"that is must, the program which generate rules. First create rules at Action level and based on Action level, Persmission level rules are generated"
regards,
Surpreet

Similar Messages

Unexpected risks after rule update

I wanted to updat RAR rules in dev GRC as per Q2 2009 rule update provided by SAP.
SAP recommendation for transaction FBV0 is:
remove auth objects F_BKPF_KOA and add F_BKPF_BUK with actvt 01 or 02.
As client wants to keep KOA active, I have done following in function AP02 and GL01, to test user risk analysis result in each case
case 1. KOA and BUK both active
case 2: KOA inactive and BUK active
I tested 5 users who have acccess to FBV0.
Among those, in case of 2 test users I found some unexpected results.
In case 1, both users have less number of risks where as in case 2(inactive KOA) I got more risks in user analysis in dev grc.
I am surprised, if I make an auth obj inactive, how can the new risks be generated. The new risks are related to FBV0 and functions AP02, GL01.
Other three users have same risks in both cases.
Can you suggest me what could be the reasons behind this.

In case 2, number of conditions are less : if any user satisfies the condition of BUK active - user will show respective risk. For specific 2 users, they may have authorization for BUK only, but not for KOA. So they are not showing the risks in case1. But in case 2, they have the required authorization to satisfy the risks for BUK only. When case1 is set as risk condition(bith KOA and BUK active) those 2 users can not satisfy the conditions to show rish as they may not have authorization of both KOA and BUK.

Rule Updates - Custom Risks, Multiple Systems

We have CC 5.2 on SP8 connected to 3 ECC clients in our landscape. We also have a bunch of Custom Risks - both Conflicting and Critical action.
If we update to SP9 to include ALL Rule updates from Q2 2008 as indicated in Note: 1173980:
will the Custom risks beginning with 'Y' be wiped out?
and also will we have to update the applicability of the Risks to the particular cleints..now we have a subset of risks to Client A, a different subset applicable to client B and ALL applicable to Client C.
Any information on how the Rule Updates via SP9 impact the current setup is appreciated.
Thanks

Thanks Simon,
Will ONLY the Functions (TCodes, Object values) be updated and the expectation is to Generate the Rules again?
Will any other activities have to be performed after applying the SP for Rule Updates.
Thx

GRC CC rule update q2 2009

Having taken a look at it, I don't agree with the fact that it recommends to remove the check of f_bkpf_koa in many tcode. For tcd FB05 for example, the Tcode is in functions AP01, AR01, GL01. If we remove the permission check f_bkpf_koa, the authroization check of FB05 in these 3 functions will be exactely the same. And because GL01 conflicts against AP01 and also AR01, every users having FB05 will have conflicts. Same case for FBV0, and also much more other tcds!!!
Does any body have an idea why SAP recommend to remove f_bkpf_koa check in the q2 2009 rule update?

I think this is because a vendor accoutant, restricted on account type K (vendor) for object f_bkpf_koa is automatically authorized to post on S (GL) account type. This is mandatory to balance the post. Yet it makes him possible to post frrom GL account to GL account, even if he does not have S (GL) in his authorizations.
Same thing for a customer accountant who is restricted on D (customer) in his authorizations: he can post on GL accounts too.
Only GL accountant is really restrictied on GL account type if he has only S for object f_bkpf_koa in his authorizations.
So according to me, the rules should be:
AP01 => K
AR01 => D
GL01 => K, D, S, A, M
...which effectively create risks for every user who has FB05, FBV0...

Creation of function module for updating the ztable

Hi,
I am sending the requirement for ceation of function module for updating the ztable.
Requirement----
Table Updation rule (New record)
While creating a new record the calling function will export the following to the table handling function.
Table field     Probable Values
ZORDERNO------->     Sales Delivery no in case of sales orderShipment no in case of transfer order
UNAME----
>     User ID
ZORDTYPE----
>     SALEOR in case of sales orderTRANSF in case of transfer order
ZREFDOCNO----
>Sales Order no in case of sales orderPurchase Order no in case of transfer order
ZREFDOCNO1----
>Delivery no in case of transfer order
The table handling function will calculate the following fields
Table field     Probable Values
ZREQNO----
>Running serial number (incremented by 1 for each new record)
ZREQDAT     -
>System date
ZREQTIME----
>     System time
ZSTATUS----
>OPEN (for all new records)
Before inserting a new record the table handling function will always check if a previous record exists for the same order / shipment no. if record exists the function will not insert a new record.
Table Updation rule (Status Update)
While updating a record the calling function will export the following to the table handling function.
Table field     Probable Values
ZORDERNO----
>Sales order no in case of sales orderShipment no in case of transfer order
ZSTATUS----
>CANCEL if cancellation successfulERROR if cancellation not possible (order already processed)
The table handling function will calculate the following fields
Table field     Probable Values
ZSTATDAT----
>System date
ZSTATTIME----
>     System time

Do you have to create/update new record in Ztable through Function Module ?
or you need to write FM only for validation?
Any how, you need to create a Program with Input values for the fields of Ztable, and for rest of fields the Value can be calculated based on input as per your requirement.
Let me know clearly what exactly u need ?
Regards,
Kiran

Append Existing Ruleset with HR Risks & Rules

Our current ruleset does not contain HR risks and rules as it was not part of first implementation. Now we will add HR functionality in ECC and need to add it to our ruleset.
Can I do it like this?
1. Export our current ruleset in Configuration - Utilities - Export
2. Somehow add HR risks & rules that I can download from SAP's original files on SAP Service - Support Portal (as in the installation guide) to the file
3. Import the appended ruleset again in Configuration - Utilitiy - Import
After checking the GRC Configuration Guide and other docs it is still not clear to me. Is there a specific document that can answer my question?
Thanks.
Joe

Hi Joe,
If you have imported standard rule set text files into GRC during first implementation then as part of R/3 function_action, function permission etc., HR related functions and risks also will get uploaded into RAR System and hence you need not change the rule set again. Just check whether those functions and risks are enabled or not.
If you have fully customized rule set then the steps you have mentioned are correct. After uploading the changed files it is better to do a full synch for user, role and permission and run one full Synch batch risk analysis for the entire rule set.
Before making the changes of the rule set, keep a copy as a back up for the rules. Ensure to open the text file in word pad or edit plus and make changes accordingly. Because even a space variation in text file might not result in generation of the new rules.
You can refer to the Import/Export options of utilities in the configuration guide
Thanks and Best Regards,
Srihari.K

Function module with UPDATE TASK

All,
Have a look at the below code. While debugging the control is not going inside the function module called using call function ...... in update task statement.
I believe the function module is not executed immediately, but is scheduled for execution in a special work process (update work process). For this purpose, the name of the function module including the passed actual parameters is stored as a log record in the database table VBLOG. If the statement is executed during the update task, the addition IN UPDATE TASK is ignored.
The actual execution is triggered by the statement COMMIT WORK which is not happening in this case. The formal parameters of the function module receive the values of the actual parameters from table VBLOG. How can I read the entries in VBLOG? Why the function module is not executed? Please suggest.
PERFORM bte_publish ON COMMIT LEVEL 9.
* syncron update
 COMMIT WORK AND WAIT.
* Publish business transaction events. The function module have
* to call as last update module!
FORM bte_publish.
IF NOT gvt_nodes IS INITIAL.
 CALL FUNCTION 'CUSTOMER_HIERARCHY_THROW_BTE' IN UPDATE TASK
 EXPORTING
 ffi_valid_on = knvh-datab
 fti_event_list = gvt_nodes
 fti_event_listx = gvt_nodesx.
ENDIF.
ENDFORM. " BTE_PUBLISH
Thanks,

Right Naren. But I need to check inside the update function module, whether it is calling the BTE function module I had configured and the code which I had put in it. Any ideas?
The COMMIT WORK is returning 4 and hence I believe it is not popping up another debuggin session in which the update FM runs.
Thanks,
Message was edited by: Somen

CRM function module to update the attribute in the classification TAB of BP

Hi All,
Can any body let me know if there is any functionmodule to update the CRM function module to update the attribute in the classification TAB of BP tcode.
I have searched a lot i get FM to update the marketing attribute and not the attributes in the classification tab.
Thanks in Advance
Edited by: Sharath Kumar on Dec 2, 2010 4:48 PM

For material bom: CSAP_MAT_BOM_CREATE
and CSAP_ORD_BOM_CREATE for Order BOM.
Regards,
Ravi

HR-ABAP Any BAPI or Function module to update infotypes 167 & 170

Hi,
Can anyone let me know is there any BAPI or Function module to update infotypes 167(Health Plans) & 170(Flexible Spending Accounts).
Thanks,
Sandeep

Hi,
U can use HR_BEN_CREATE_PLANS internally it calls HR infotype operation as specified by suresh.
Suresh : If there are approximately 3000 records to be updated on regular basis do u think is it better to use BAPI's or BDC
regards
Vick

How to debug function module in update task ?

Hi ,
          i have following code :
CALL FUNCTION 'ZSD_t_UPDATE' IN UPDATE TASK
             TABLES
                              it_xvbkd = xvbkd.
Inside this function module i have some code to debug . How can i debug it ?
I put the breakpoint in it but its not working .
It is triggered on save of a tcode .
Thanks and Regards .

My home-grown method:
Set your breakpoint in the FM.
In your transaction, just before you press save, enter hobble mode in your command box with '/h'.
press save.
In your first debug screen, toggle settings>system debugging ON (NetWeaver Drop-down menu) or see previous notes for earlier WebAS versions.
Select continue (F8).
The program should then stop at your break-point in the FM.

Difference between Function module in Update task

Hi folks,
What is the difference between
1. A function module calling in 'update task'( if attributes not set for update mode).
2.A function module's attributes set to update mode, but while calling not specified 'Update task'.
Please clarify this doubt.
Thanks in advance.
Bhavani

CALL FUNCTION func IN UPDATE TASK.
Additions:
1. ... EXPORTING p1 = f1 ... pn = fn
2. ... TABLES p1 = itab1 ... pn = itabn
Effect
Flags the function module func for execution in the update task. It is not executed at once, but the data passed with EXPORTING or TABLES is placed in a database table and a subsequent COMMIT WORK then causes the function module to be executed by the update task. Update function modules must be flagged as such in the Function Builder
The return value is not set.
Addition 1
... EXPORTING p1 = f1 ... pn = fn
Effect
Values of fields and field strings specified under EXPORTING are passed from the calling program to the function module. In the function module, the formal parameters are defined as import parameters. In the interface definition, default values must be assigned to all import parameters of the update function module.
Addition 2
... TABLES p1 = itab1 ... pn = itabn
Effect
TABLES passes references to internal tables. All table parameters of the function module must have values.
Note
With update function modules, both import parameters and exceptions are ignored when the call is made.
Administration transaction
Related
COMMIT WORK, SET UPDATE TASK LOCAL
regards,
kartikey.

Function module In Update Task is called more than once

Hi experts!!
I had a requirement to Create a Customer ( i will call it B) when another Customer (A) is created (ON SAVE).
I used a Badi to implement the requirement, and inside my Badi i have 2 Function Calls in Update Task.
The first one to create Customer B and the second one to send Customer's B data to another System.
Even though the second function call is inside an IF-ENDIF condition ( so that only Customer's B data are sent) the function is called twice sending the same data. My guess is that since the First Function saves the Customer to the database, that is the reason why the second Function is called twice.
Is there any way i can control how many times a Function In Update Task is called????
Please help!!
Thank you in advance!!

Hi BreakPoint & thank you for your reply!!
I tried your suggestion but even if i fill the flag during the first call the function is called twice. Looks like during the second database commit the function is called with the correct conditions met but twice.
Also while debugging it looks like it is only called once. It s very strange!
Any other ideas???

Function modules in Update task

Hi Folks,
What is the difference between
1.If a function module contains in attributes 'Update mode ' and run( without 'update task - keyword).
2.call function ' fun2' in update task.
In this case, do we need to set the attributes must be 'Update task'?
Please help me.
Thanks in advance
Bhavani

From F1 Help...

This statement registers the update function module specified in update_function. update_function must be a character-type field, which during execution of the statement contains the name of an update function module in uppercase letters.
An update function module is a function module, for which in the Function Builder the property update module is marked. The registration of an update function module is an essential part of the update task.
The function module is not executed immediately, but is scheduled for execution in a special work process (update work process). For this purpose, the name of the function module including the passed actual parameters is stored as a log record in the database table VBLOG. If the statement is executed during the update task, the addition IN UPDATE TASK is ignored.

Regards,
Rich Heilman

Calling Function Module in Update Task

Hello Experts,
Can anyone let me know about
Calling Function Module in Update Task.
Why do we use this " In Update Task " ??
How do we Use ??
What is the Use... ??
Kindly let me know....
Thanks and Regards
Pramod

hi,
Why do we use this " In Update Task " ??
The main update technique for bundling database changes in a single database LUW is to use CALL FUNCTION... IN UPDATE TASK.
How do we Use ??
A typical R/3 installation contains dialog work processes and at least one update work process. The update work processes are responsible for updating the database. When an ABAP program reaches a COMMIT WORK statement, any function modules from CALL FUNCTION... IN UPDATE TASK statements are released for processing in an update work process. The dialog process does not wait for the update to finish. This kind of update is called asynchronous update.
What is the Use... ??
Asynchronous update is useful when response time from the transaction is critical, and the database updates themselves are so complex that they justify the extra system load
Real time scenario.
Suppose a user wants to change an entry in a database table, or add a new one. He or she enters the necessary data, and then starts the update process by choosing Save. This starts the following procedure in the ABAP program:
Firstly, the program locks the database entry against other users, using the enqueue work process (or the message server in the case of a distributed system). This generates an entry in the lock table. The user is informed whether the update was successful, or whether the lock could not be set because of other users.
If the lock is set, the program reads the entry that is to be changed and modifies it. If the user has created a new entry, the program checks whether a record with the same key values already exists.
In the current dialog work process, the program calls a function module using CALL FUNCTION... IN UPDATE TASK, and this writes the change details as an entry in table VBLOG.
When the program is finished (maybe after further dialog steps), a COMMIT WORK statement starts the final part of the SAP LUW. The work process that is processing the current dialog step starts an update work process.
Based on the information passed to it from the dialog work process, the update work process reads the log entries belonging to the SAP LUW from table VBLOG.
The update work process passes this data to the database for updating, and analyzes the return message from the database. If the update was successful, the update work process triggers a database commit after the last database change and deletes the log entries from table VBLOG.
If an error occurred, the update work process triggers a database rollback, leaves the log entries in table VBLOG, flags them as containing errors, and sends a SAPoffice message to the user, who should then inform the system administrator.
The corresponding entries in the lock table are reset by the update work process.
Hope this is helpful, Do reward.

Regarding function module in update task

Hi,
I have a function module(Zxxx) which is update type. i have called the fun.module in my program (Zyyy) using the syntax CALL FUNCTION ZXXX IN UPDATE TASK. As I suppose to debug the function module, I activated the update debugging in the debugging screen. But the controll still not goen into the function module. Please let me know solution.
Thanks & regards,
Suresh

>
sureshkumar vaniyasekar wrote:
> I activated the update debugging in the debugging screen. But the controll still not goen into the function module.
Hello Suresh,
What do you mean by not going?
If you are trying to do an F5 at the function call, the debugger is not "enter" into the FM. This is because at this point the function call is registered but the FM is not executed.
Update FM calls registered in a particular LUW are executed(in a special "UPD" workprocess) when there is a COMMIT encountered(may be explicit or implicit).
Did you read the online help on [Update Debugging|http://help.sap.com/saphelp_NW70EHP1core/helpdata/en/c6/617d0ce68c11d2b2ab080009b43351/content.htm] & [Breakpoint behaviour during Update Debugging|http://help.sap.com/saphelp_NW70EHP1core/helpdata/en/c6/617cbee68c11d2b2ab080009b43351/content.htm]?
BR,
Suhas

Functions/Risks/Rules update recommendadtion

Similar Messages

Maybe you are looking for