GRC AC 5.3 SP13
Hi Guys,
What version of NW (Java stack only) do I need to install so that I can install GRC AC 5.3 SP13 on that?
Thanks,
Shankam
Have you tried looking into the installation guide...?
Similar Messages
-
Parallel processing of GRC AC 5.3 SP13 Batch Risk Analysis
Hello,
i have a question regarding the parallel processing of Batch Risk Analysis background jobs.
We have just implemented GRC AC 5.3 SP13 in one of our test-systems. The test-system currently has 6 Server-Nodes.
When running the initial Full Sync. Batch Risk Analysis the background job only gets executed by one of the Background Job Worker-Threads in one of the Server-Nodes. All the other ID0 Background Job Worker-Threads in the remaining Server-nodes remain idle.
Is there any special configuration in RAR needed in order to enable the parallel processing or is this dependent on the configuration of the Java-system itself ? If it's a system-configuration thing what configuration do I need to task the basis team to look into ?
Regards,
Benjamin>
S. Pados wrote:
> In RAR config - optimizaiton you have to set webservice i/o and netweaver lock to NO. These are giving issues when set to yes. It resolved it at our system. don't forget to restart the server after changing these values.
>
> Regards,
> Stefan
Hello Stefan,
we are currently on SAP GRC AC 5.3 SP13 (withouth the Patches). The changes we do in the webinterface for the two settings you have mentionened are not written to the database (execute select * from virsa_cc_config in the CC Debugger-Webinterface and look for IDs 250 and 251). This is a known bug.
For parameter "Store WebService Input/Output parameters objects in database Yes/No?" there seems to be a workaround by inserting the setting into the table directly (SNOTE 1508611). Can you confirm that the entry with CNFGPARAM-ID=251 exists in the table in your system (with value NO)?
For parameter "Use Net Weaver Logical Lock Yes/No?" there's the same issue. The workaround is described in SNOTE 1528592. Can you please confirm that theres an entry CNFGPARAM-ID=250 with value NO in your table ?
If you confirm the two settings I will have our IT guys insert those entries into the DB table.
P.S.: We are not planning to implement any Patches or SPs any time soon because we are doing the Ramp-up for SAP GRC 10.0. We want to check out the functionality in there first and not put too much effort into patching the "old" version right now.
@Chris Chapman:
I will have someone check the server logs for the errors that are described in the SNOTE you provided. Thanks for the help. -
Migrate SAP GRC AC 5.3 SP13 (System A - System B)
Hello all,
currently we have setup 2 SAP GRC AC 5.3 SP13 SAP instances (DEV / PRD) for the customer's SAP ERP system landscape. Those systems also contain some customer business functionality.
Because of business requirements the PRD Java Instance needs to be deleted and built up again from scratch with another WebAS Java Release Version (same SID, same Hardware, etc.).
Our plan is now to setup a dedicated Java instance which will contain the PRD installation of SAP GRC AC (new SID, different hardware, etc.) to avoid similar problems in the future. Therefore we have to migrate all of the RAR data from the "old" Java instance to the newly setup Java system. We especially need to migrate all of the RAR analysis data (e.g. SoD violation analyses of previous months, etc.), otherwise we would loose all of this information when the "old" installation is deleted and built up again.
I have checked all of the SAP documentation for SAP GRC AC 5.3 and only found these clues:
In document "SAP GRC AC 5.3 Configuration Guide v3.16 - Chapter Utilities -> Export Utility / Import Utility" it only says
something about exporting / importing rule sets, mititgating controls, etc. Can these tools also be used to export / import
analysis data too ?
In document "SAP GRC AC 5.3 Installation Guide v2.2 - Chapter Post-System Copy Configuration" it only says something about
steps to be executed if the SAP GRC AC installation was done via system copy. But there is no information about migrating RAR analysis data.
In document "SAP GRC AC 5.3 Operations Guide v2.1 - 7.2 Backup strategies" it says that in order to restore the system "you need to back up all tables with the following prefixes: VIRSA and VT". Can we simply do a backup of all of those tables, import
them into the database of the new system and the use the export/import utility to move all of the configuration etc. from the old system to the new one ?
Regards,
Benjamin
Edited by: Benjamin Schlotz on Jun 30, 2011 11:57 AMHello Sunny, hello Frank,
thanks for the quick replies.
I did know about the SNOTE regarding the post migration steps, but the To-Do's Frank posted had some additional info in them.
One question remains still open though:
How to actually migrate all the GRC AC RAR data (incl. old analysis data) from System A to System B
Our intended course of action would be:
1. Deploy SAP GRC AC on System B (same Version, SP-level etc. as in System A)
2. Export all VIRSA* and VT* tables from DB of System A, import them all in DB of system B
3. Export all configuration, etc. from System A, import it into System B (using the export / import functionality within RAR)
4. Do all the post-migration tasks described by you
Would you agree with that course of action / know any pitfalls, etc ? We need to have all the "old" RAR analysis data from System A in System B after the migration because System A will be shutdown and deleted.
Regards,
Benjamin -
GRC AC ARA v10 SP13 - Org Rule Org Level Missing
Hi Experts!
Testing ARA Organization Rules soon and have noticed that one of my key Org Levels, $BUKRS, is missing. I have not yet used this functionality on this system. I am already doing the following:
running the authorization sync job daily (we are in the middle of multiple project builds)
checked the target systems USORG table for Org Level $BUKRS entry.
active ruleset function has that Org Level $BUKRS entry and it appears on the Risk Analysis reports
All other Org Levels are available to use except for this one. Any ideas!
Thanks in advance.
-johnAlessandro,
Ran both sync jobs again, but it is still not (see below). Checked the logs to be sure it completed.
We do have two different ECC system connectors (One Production landscape, the other Project landscape), but both have the USORG table for Org Level $BUKRS entry.
Any other ideas? Is there a GRC ARA GRAC* table I can update or check for this?
Thanks,
-john -
GRC 10.0 Alerts not sending email
HI everyone:
We have set up our alerts. We have created a couple of custom critical action functions and risks and assigned risk owners to the critical action risk.
We have scheduled the following jobs:
GRAC_ACTION_USAGE_SYNC
GRAC_ALERT_GENERATION.
When we go into the NWBC screen to view the alerts, the alert data is being generated successfully online.
However, an "alert email notification" is not going out to the risk owner. The risk owner has their email address populated on their user master record (they receive emails for Firefighter so that is working fine). We have reviewed the config parameters and don't see anything related to alerts?
Does anyone know why we might not be receiving alert emails??
My GRC 10.0 is SP13
Thanks!Hello Cristian,
Please, check whether the below notes are applied in your system:
1888094 Alerts are not generated for critical actions
1878803 Conflicting and critical alerts report showing no d
1728869 GRC 10.0: Critical Action Alert email not being sen
Thank you,
Fernando -
Any Customers Implement GRC-AC ERM?
Hello!
We are evaluating GRC-AC v5.3 SP13.1 ERM and are encountering issues. Have any customers implemented this module? If so, what Version and SP did you implement on? Also, are you using the full functionality or just as a repository? Are you using the the CUP Workflow Approvals?
Any help on this would be really appreciated.
Regards,
JohnDear John,
We had implemented fully functional CUP and ERM alongwith RAR and SPM. At the time of go-live it was patch 8. Later we checked that ERM role generation methods were little different from PFCG and for that reason roles were not getting generated properly like Multiple Authorization Nodes were not working fine, auth data was getting merged, manul Objects were getting deleted if the corresponding tcode was deleted and likewise. So we stopped using ERM. Now we are in process to evaluate Patch 12 and 13 in which all ERM issues are supposed to be fixed.
If everything goes well in testing, we will start using ERM again. All workflows related to CUP, ERM and RAR(Mitigation and Risk) are functional and there is no issue in that.
Regards,
Sabita -
Role Certification search and notification
Hello,
I have configured role certification functionality in GRC-AC v10.0 SP13, and everything works fine.
When the role owner does the certification, by clicking on the certify button and writing some certification text, this text is saved in the Comments History field in the role. It's fine, but I have two questions:
1) Is there a way to search those certification texts easily, like a list of several roles?
2) When the role owner certifies the role, is there a way to configure some notification to anyone?
Thanks in advance for any help.
Regards,
Gabriel AquinoDear Gabriel,
reagarding your questions to role certification. I don't think that you can search for comments in the web client. Basically comments are stored in long text and hence searching is not that easy. Probably it is possible to search directly in the tables (e.g. you can create a report to search). If you are interested I can search the tables.
Basically role certification is calculated based on the period and the last certification date. After the defined days an email reminder is automatically sent to the role owner. The reminder template can be customized in SPRO. Further notifications are not possible with standard functionality. I suggest to raise an idea on the idea space: https://ideas.sap.com/SAPAccessControl
Best regards,
Alessandro -
Where can I find the bugfix list of GRC 5.3 SP13?
Is there any kind of list/document which describes the bugfixes within 5.3 SP13?
Thx.
UlrichUlrich,
The 4 notes below describe the changes made in the support packages. At the end the ones related with SP13:
1168508 Compliant User Provisioning 5.3 Support Package(VIRAE)
1168120 Risk Analysis and Remediation 5.3 Support Package (VIRCC)
1168121 Superuser Privilege Management 5.3 Support Package (VIRFF)
1168183 Enterprise Role Management 5.3 Support Package (VIRRE)
Hope it helps. Kind rgeards, -
SAP GRC RAR Rules Generation Job Error - SP13 application
Hello,
we applied SP 13 on GRC and RAR Rule Generation job is always in "error" status; below I list an example of job log:
INFO: -
Scheduling Job =>237----
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob run
INFO: --- Starting Job ID:237 (RULE_GENERATION) - generate f113
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.util.Lock lock
FINEST: Lock:1007
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob setStatus
INFO: Job ID: 237 Status: Running
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob updateJobHistory
FINEST: --- @@@@@@@@@@@ Updating the Job History -
1@@Msg is generate f113 started :threadid: 1
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.dao.BgJobHistoryDAO insert
INFO: -
Background Job History: job id=237, status=1, message=generate f113 started :threadid: 1
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.util.Lock unlock
FINEST: Unlock:1007
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob ruleGeneration
INFO: @@@--- Rule ruleGeneration Started ....237
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob run
WARNING: *** Job Exception: null
java.lang.NullPointerException
at com.virsa.cc.xsys.bg.BgJob.ruleGeneration(BgJob.java:1245)
at com.virsa.cc.xsys.bg.BgJob.runJob(BgJob.java:609)
at com.virsa.cc.xsys.bg.BgJob.run(BgJob.java:363)
at com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob.scheduleJob(AnalysisDaemonBgJob.java:375)
at com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob.start(AnalysisDaemonBgJob.java:92)
at com.virsa.cc.comp.BgJobInvokerView.wdDoModifyView(BgJobInvokerView.java:444)
at com.virsa.cc.comp.wdp.InternalBgJobInvokerView.wdDoModifyView(InternalBgJobInvokerView.java:1236)
at com.sap.tc.webdynpro.progmodel.generation.DelegatingView.doModifyView(DelegatingView.java:78)
at com.sap.tc.webdynpro.progmodel.view.View.modifyView(View.java:337)
at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.doModifyView(ClientComponent.java:481)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.doModifyView(WindowPhaseModel.java:551)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.processRequest(WindowPhaseModel.java:148)
at com.sap.tc.webdynpro.clientserver.window.WebDynproWindow.processRequest(WebDynproWindow.java:335)
at com.sap.tc.webdynpro.clientserver.cal.AbstractClient.executeTasks(AbstractClient.java:143)
at com.sap.tc.webdynpro.clientserver.session.ApplicationSession.doProcessing(ApplicationSession.java:333)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessingStandalone(ClientSession.java:741)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessing(ClientSession.java:694)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doProcessing(ClientSession.java:253)
at com.sap.tc.webdynpro.clientserver.session.RequestManager.doProcessing(RequestManager.java:149)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doContent(DispatcherServlet.java:62)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doGet(DispatcherServlet.java:46)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1060)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(Native Method)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob setStatus
INFO: Job ID: 237 Status: Error
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.BgJob updateJobHistory
FINEST: --- @@@@@@@@@@@ Updating the Job History -
2@@Msg is Error while executing the Job:null
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.bg.dao.BgJobHistoryDAO insert
INFO: -
Background Job History: job id=237, status=2, message=Error while executing the Job:null
Apr 4, 2011 1:36:12 PM com.virsa.cc.xsys.riskanalysis.AnalysisDaemonBgJob scheduleJob
INFO: -
Complted Job =>237----
Apr 4, 2011 1:36:13 PM com.virsa.cc.xsys.util.Lock lock
WARNING: It is used by the same owner: For current thread retrying to get lock : 1001
Apr 4, 2011 1:36:13 PM com.virsa.cc.xsys.util.Lock lock
FINEST: Lock:1001
Apr 4, 2011 1:36:13 PM com.virsa.cc.xsys.util.Lock unlock
FINEST: Unlock:1001
Is there someone that can help me?
I checked and it seems that "Use NetWeaver Logical Lock" in config tab has to be set to "No"...is it correct for you or have you got other tips?
Thx to allHello,
actuallt current values are:
Row CNFGPARAM| CNFGSEQ| CNFGVALUE|
35 250 0 NO
36 251 0 YES
Value for 250 is ok based on your feedback.
Value for 251 is based on SNOTE 1508611, even if SDN forum suggests "0" against the note.
Have you got any tips? -
SAP GRC 10 SP13 PC- AM scenario not available for assigning to connector
Hello Expert,
We are on GRC 10 SP 13 PC . We want to add connector to AM connector group under SPRO-GRC_Common Componenet Setting - Integration framework - Maintain Connector and Connector types - Define Connector groups.
I remember all other groups ( AC related) which are available in this area are coming because of activation of BC sets. I have activated all the BC sets related to PC but AM group is not available.
Any Suggestion?
Kind Regards
AsheeshHello Asheesh,
AM Integration scenario is available in next path in SPRO.
SPRO -->GRC --> Common Component Setting - Integration framework -->Maintain Connection Settings
Regards,
Gowrinadh -
GRC AC 10 SP13 - workflow not routing to multiple role owners
hello
We are experiencing issues in our production MSMP workflow where an access request with multiple business roles are not being routed to role owners after manager approval. The request contains four business roles. Three business roles have three different role owners. The fourth business role does not have a role owner assigned. After the manager approves the request, the business role without a role owner does not provision. The other three business roles do not route to their respective role owners. We have tested the same scenario in our development environment and it routes properly. I have validated our MSMP workflow settings in production and validated it was activated. I have also checked the instance monitor via GRFNMW_DBGMONITOR_WD and it does not give an indication why the request isn't routing.
Any ideas why we are seeing this? Below is a screen shot of the audit log.Hi Stacey
If DEV is working and PRD is not have you gone through and compared both and ensure latest MSMP configuration in PRD has been activated?
Also, is the approver COCHGG00 also the Role Owner?
Are you able to show you MSMP configuration? It's makes sense to analyse the log in the context of your configuration. E.g. does the Z_ADDTNL_ACCESS_PATH path have two stages: Manager and Role Owner of which there is a routing rule on the Manager approval to go to the NO_ROLE_OWNER path where the business role has no role owner?
Regards
Colleen -
NFe em processamento no ERP e OK no GRC mas teve erro de atualização do ERP
Boa tarde,
Tem acontecido que ao tentar atualizar a NFe, ocorre o erro de atualização (tabela /XNFE/NFE_HISTconsta 108), porém no monitor GRC a NFe está com status OK (verde).
Ao verificar a tabela /XNFE/NFE_HIST, o registro de wasstat 05 (Result Received) tem o error_erp 108, porém o último registro da tabela é o de wasstat 08 (sent to B2B) e neste o erroe_erp está em branco. Inserindo o erro 108 neste último registro, a NFe aparece agora no monitor GRC com status de erro, e o erro ERP 108, e aparece na aba de "Erro atualização status ERP", permitindo assim o uso da opção Atual. (atualizar o ERP novamante), que após acionado, atualiza o ERP corretamente e volta a NFe para OK no monitor GRC.
Já pesquisei notas e aqui no SCN e não encontrei nada relacionado.
Alguém já passou por isso.
GRC 10.0 sp13
ERP 604 sp11
Abraços
Ricardo Carneiro.Bom dia Ricardo,
Vamos por partes...
- o 05 significa resultado recebido da Sefaz, e o status 100 diz que foi tudo Ok por lá
- o 05 tenta comunicar com o ERP, e o 108 indica neste status que o ERP não pode processar seu status
- o 08 não comunica com o ERP, então nele não deve ter ERP_ERROR mesmo
Agora as questões:
- Deveria ter o processo parado no 05 já que houve um erro? Para alguns a resposta seria sim sim sim, para outros já que tá tudo OK faz o B2B
- Não deveria ter sido copiado o status 05 para 08? Talvez (pq resolveria a questão manual)
- O que fazer então?
Sobre o 108 ele é sintoma SEMPRE, algo não está bom no processamento ERP. A única coisa esperada de fato na emissão é o lock de processo no ERP, que o SAP NFE trata reenviando via job.
Na emissão muito provavelmente é algo errado seja configuração, seja código e deve estar dentro da BAdI.
Você não postou o que encontrou na RSRFCTRC. Poste por favor.
Com o foco em solução te indicaria investigar o que está errado no ERP, e a questão ERP_ERROR não estar visível no 08 vai ficar menor. De qualquer forma pode ser motivo de chamado para o desenvolvimento avaliar opções, mas é um remédio para sanar sintoma não para curar a doença.
* Se fosse um processo de cancelamento ou skip bem mais coisas poderiam acontecer como fonte de um erro de processamento ERP.
Atenciosamente, Fernando Da Rós -
GRC 10.0 Mass Role removal
Hello all,
we are using GRC AC 10.0 (SP14). Today I found out that the access removal for multiple user is not working. The role removal for one User is working fine. But for multiple user who all have the same role it is not possible to select this existing role. Is it a standard in GRC AC or did I miss some config parameters?
The button "ADD" (yellow) is not working, and there is no button "Existing assignements". Please let me know, whether this settings are standard or not.
Many thanks,
regards
SabrinaSabrina,
Multi user requests have been quite problematic. I encourage you to search for corrections; we had to implement numerous corrections for multi-user requests. Right now, though, multi user requests for role removal using the "Existing Assignment" function are working for us (SP12 with a lot of corrections from SP13 and SP14).
I should mention that our Provisioning Log in the closure notification only lists the first user, but all three accounts in my test request just now had the role removed as requested. We have treated that as a training issue with our request submitters for the time being. We implemented Note 1727135 to correct that issue and it made matters worse, so we had to revert.
Good luck!
Gretchen -
Identified Bug in GRC AC SP 12
Dear Experts,
My client configuration : SAP GRC AC SP 12
When I run the User Sync job there are no violations seen in the Management Report. I have checked the log and it shows that the users are being pulled from the backend system but they are not populated in RAR tables.
SAP in its latest list of resolved issues for RAR has confirmed that its a bug in SP 12 and is fixed in SP 13. I had also logged an OSS message and SAP has come up with a reply saying it wants to look into the system.
I am waiting for Dylan's reply as he has SP 12 installed.Hi,
We did have the same issue in SP12 with user syncs.
SAP confirmed us to upgrade into SP13.
We are running tests now on SP13.
I would say you should go to SP13 but waiont for the SAP response.
Good luck!!
Imanol -
Difference between various Service Packs in GRC 10.0?
Hi,
Can anyone please let me know that what are the various Service pack available for GRC 10.0 (only for AC) , we are currently on SP 10 and no idea about the higher versions.
Please let me know the higher versions and the differences , pros and cons for the same.
Please share is someone have Any URL or Document with the required information.You can check the sap notes and support packages.
Each support package includes corrections, new functions, developments, etc.
It depends on your requirement if it makes sense to update or not. I am on SP13 and at the moment it does fullfil all my needs. So whether I update or not depends on the requirements I have from business. It is always possible to implement notes if you have errors.
Personally I recommend not to be first with a new support package as it always contains errors.
You can check the latest support package in PAM: http://service.sap.com/pam
Here an overview of the latest SP's for Access Control 10.0:
Regards,
Alessandro
Maybe you are looking for
-
Mac Pro Kernel Panic w/Ethernet
I have a Mac Pro hooked up to "Linksys 10/100 5 Port Workgroup Switch". Hooked up to this is a Macbook (off and on, I only connect the Macbook when transferring large files to get the 100base-T speed) and an Apple Airport Express set up as a WDS remo
-
Concurrent program Do not Insert Data Into Interface Tables!
Hi there: I am facing a problem with my concurrent program whenever I execute my stored procedure in SQL/PLUS it's work fine data load into the AP_INTERFACE/LINES. Whenever I try to load data through my concurrent programs it doesn't load into AP_INT
-
Which is the best structure for start/stop data logging?
Hi everybody, hope I can explain my problem good enough that anyone can help me: I have a VI which continuely shows on a graph the voltage of a Analog Input of a DAQ device. Now I want to allow the user to start/stop with a click on a button data log
-
I am connected to the computer with my phone and it says there are 0 photos to import, however I have over 200 on my phone to import. I am trying to figure out how to get itunes to recognize the photos on my phone. This has never happened before.
-
HFM11.1.1.3 in workspace communication error
hi, i have multiple hfm applications in server.But i created new appplication and when i try to access t from workspace i get communication error. All other applications are still working fine. I cannot see that application in register and delete opt