RAR logical system

If I've only one R/3 backend system, can I still define it in a logical sytem in RAR?
Thank you,
Partha

Yes. You can. You will see advantage of using logical system function if you have more than one physical system. Please see below.
Physical - This is a specific physical system and is comparable to a connector in Risk Analysis and Remediation. You can only maintain one connector for each physical system. For example, the Production ERP system for Europe is a physical system.
Logical - It is possible from Compliance Calibrator 5.2 forward to group physical systems into Logical system groupings. The purpose of Logical systems is to aid in the maintenance of Functions. As an example, say you have Function AP01 - AP Payments and you want to add transaction code F-04 to this function. If you have 4 Physical systems that all have AP Payment as a function, you would have to add the transaction to the function 4 times, once for each physical system.
Ref: Note 1178372 - Risk Analysis and Remediation - Cross and Logical systems
Thanks,
Himadama

Similar Messages

RAR Logical Systems

Hi,
I am implementing RAR and connecting it to ECC6.0 and SRM. They will be sharing the same ruleset, so can I create 1 logical system for these 2 physical systems?
Thanks,
Niamh

What is the scope of your risk function? Is it cross-system or single system?
Please also have a look at the following SAP Note:
SAP Note 1178372 - Risk Analysis and Remediation - Cross and Logical systems
Thanks
Himadama

RAR - Logical system - SU24 upload

Hi people,
We use different logical system to include several ECC production systems. To have actual data, I need to upload the SU24 data from the backend system to the RAR (Upload objects)
There I have only the possiblity to load the SU24 data against a physical system, not for a logical system.
What happens now, if I am going to create a new function for a logical system and in this logical system are different ECC system referenced and each of them have another maintained SU24 data for standard transactions? Which data will be lead and relevant (pultruded) for the new function? Is it only the last loaded SU24 file?
Thanks for your feedbacks.
Regards,
Martin

Hi Martin,
You can upload SU24 data against individual connected physical systems only and last loaded data only will reflect. Logical system is work as basket for all added physical systems and provides flexibility for future usage.
If you want to create a new function for logical system - While adding Action (Transaction) in new Function you can choose/specify the available systems or ALL.
Thanks,
Ramesh K

Use of Logical Systems - RAR 5.3

Hi,
i have created 2 physical systems (QA and Production systems) with the necessary connectors and assigned it to a single logical system.
Subsequently i have generated the rules for that logical system. However when i run a risk analysis i do not see tha tlogical system as an option for the dropdown box labelled "system". How is the logical system set of rules supposed to be used?
The config guide states that it allows maintenance of a single ruleset across several systems, can this theory be applied for risk terminator as well?
Thanks,
Edwin

Hi Edwin,
Subsequently i have generated the rules for that logical system. However when i run a risk analysis i do not see tha tlogical system as an option for the dropdown box labelled "system". How is the logical system set of rules supposed to be used?
You wont see the logical system in the dropdown list. If you set up the logical system and generate the rules correctly it will automatically call the logical ruleset whether you choose QA or PRD.
The config guide states that it allows maintenance of a single ruleset across several systems, can this theory be applied for risk terminator as well?
RT's is configured in the backends for every system with transaction /N/VIRSA/ZRTCNFG
Kind Regards,
Vit

RAR 5.3 - Logical system

I've uploaded Function Authorization files directly against system
connector and completed the configuration and generated the rules. Now I want to connect another R/3 system to the same GRC box. In this scenario is it possible to make use of logical system.

Thanks Amol. Going into more details.
Initially we connected DRC (this is the GRC development box) to sand box (DXI) and uploaded the function authorization files against the physical system DXI. Now we are moving into landscape(3 backend r/3 systems DEV TST and PRD) and DFI is no longer connected to DRC. Now I will connect R/3 systems DEV and TST to DRC.
What should be the approach?
1. Create JCO connectors to DEV and TST
2. Create logical sytem and assign the system connectors created for DEV and TST
3. Upload static text file, SU24 authorization data, for DEV and TST into DRC
4. Upload function authorization file (function action and function permission) against logical system
5. Generate rules for logical system
6. Run full sysnc background jobs
Please let me know if I have to upload the rule files again because they were already uploaded when DXI was connected. Also please suggest if the approach is fine.

Logical System is not appearing in Informer tab to check SOD's

Hi GRC Experts,
I have an issue with logical system to run risk analysis.
I created logical system by following the Config guide, added physical system and generated rules (RAR Configuration>>Logical Systems>>Generate Rule) for that logical system.
I haven't generated rules for the physical system (RAR Config>>Rule Upload>>Generate Rules) since I dont want more rules to be displayed in the reports.
However I do not see logical system as an option in Risk Analysis (informer Tab) and Config>>Schedule background job for BAtch Risk Analysis>> under system as well.
It would be great if any one advice me on this.
Regards,

Thanks Chinmaya,
Yes you are right, I confirmed with a friend (my ex-GRC colleague) of mine as well.
can't execute sod checks on a logical system - logical systems are only intended to eliminate the need to add the same rule set over and over for the same types of systems
Regards,
Ramesh K

Logical Systems vs Cross Systems

Dear all,
I have two physical SAP ERP systems grouped under one logical system.
Now I want to connect to a third SAP ERP system in order to execute Cross System analysis between the systems under the logical system and the new third system.
I understand that I cannot do a Cross System RA on systems of the same logical system so that´s the reason why I need to set up the third system as a single new ERP system.
Anyhow the new ERP system should use the same rule set than the two systems of the logical system.
So I´d just like to set up the new system connector for the GRC 5.3 but I do not want to load the same rules again for the new ERP system, etc.
Is this possible? I tried to create a new logical system containing the new ERP system and regenerate the rules for the logical systems. But after that no simple RA is possible for the new ERP system.
Thanks for any advice and regards,
Markus Richter

Hello Markus,
Yes, you are right that you can not include the third system in the same logical group if you wish to use it for cross-system analysis. If you choose to have this as a stand alone system in RAR then first you will have to upload the rules for this stand alone system in RAR. The rules loaded for logical system will not work for this system as it is not part of the logical system group.
Regards, Varun

Use of Logical System

Hi GRC Experts:
I am currently defining my RAR landscape strategy. In the past, I have used logical systems for the same "type" of system. For example, we had 3 ECC environments so I created a logical system for the 3 ECC systems.
Now we have 1 ECC, 1 APO and 1 SRM system. Are there any benefits of setting up a logical system within this landscape? I would imagine there are some benefits with creating a logical system and assigning the BASIS risks to that system because the risks exist across the different environments. But are there any others?
Thank you,
Grace Rae

Hi Grace, Logical Systems would be an optimal design if you need to add more systems in the future to the GRC landscape to perform Risk analysis.
Logical System 1: ECC Logical System
All the ECC Physical Systems (PR1, PR2, etcu2026)
Function Authorizations to be uploaded are r3_function_actions and r3_function_permissions files which excludes the Basis Functions
Logical System 2: SRM Logical System
All the SRM physical Systems (PS1, PS2, etc...)
Function Authorizations to be uploaded are srm_function_actions and srm_function_permissions
Logical System 3: APO Logical System
All the APO physical Systems (PA1, PA2, etc...)
Function Authorizations to be uploaded are apo_function_actions and apo_function_permissions
Logical System 4: ALL Systems
All the physical systems (PR1, PR2, PS1, PS2, PA1, PA2....)
Function Authorizations to be uploaded are just the Basis Function Actions and permissions
Bugesh

BW / SolMan Logical System Change

Hello all, I am having a BW related issue and would really appreciate some advice. I realize some of this is for the solMan forums and will cross post (I normally dont)
ENVIRONMENT
New installation of Solution Manager EhP1 (19). System name is ED0. We are running Windows / MS SQL
System is only for Solution Manager ops (client 001), and CUA master (client 950).
BACKGROUND
We want to use full SolMan capabilities. This seems to include some limited BW interaction. We do not use BW in the landscape, so will rely on the "internal" BW in SolMan.
During installation, our person made a new client (000 > 400), set it as default (login/system_client), then ran tc:RSA1 and activated the content. (This sets the client)
Client 400 HAS NOT BEEN USED FOR ANYTHING other than the initial installation, and subsequent activation of BW. It has no connections to other systems, no data, cubes, or anything
PROBLEM
We were NOT AWARE that he had ran RSA1 and activated content, and began using client ED0_001 as our PRODUCTION SolMan client.
We are now unable to run RSA1 in anything but client 400.
We are unable to change the client 001 logical system name because Solution Manager has been built around it.
TROUBLESHOOTING
We changed table RSADMINA / field BWMANDT to 001 from 400. This changed the error from "You can only run in client 400" to "The logical system name has changed" (exit only)
In sandbox I duplicated this problem, then deleted the 400 client (with T000 entry). Changed the login/system_client to 001, RSDAMINA to 001, and ran function module RS_MANDT_UNIQUE_SET (set i_mandt to 001). After restart, RSA1 gives same error, logical system name changed"
On same sandbox after #2 above I attempted tc: BDLS to see if it would let me assign an exisiting logical system. It did not
QUESTIONS
Will it have any impact on Solution Manager operations to have the "BW Client" on ED0_400 while Solution Manager production is on ED0_001?
Is it possible to change the BW operating client to 001 from 400? (said another way, can I change the current logical systems BW is keyed with to a different, but existing, logical system)
Assuming the answer to Q1 is yes, and the answer to Q2 is no, what steps need to be performed to make BW fulfill the SolMan requirements?

Updated Information - Answer to Question #1.
I am embarrased I missed this section in the master guide the first time around. I will leave the question unanswered in case someone has an easy rememdy to changing the BI client logical system, as I would like to have it in my productive client if possible. However I am relieved I have the option of running it separately in case that can't be done.
There are three major options to consider when planning your system landscape in regards to BI.
BI in the Productive SAP Solution Manager Client
In this scenario, BI is used in the same productive client as SAP Solution Manager. This option allowsfor simpler configuration, and isolates the BI activities conducted for solution life cycle management from the data on a production BI instance. This is SAPu2019s recommendation.
BI in a Separate Client on SAP Solution Manager
In this scenario, BI activities are conducted in a separate client on the SAP Solution Manager system. This scenario provides increased security, as user access is more restricted. However, you must maintain users separately and this increased your administration effort. There is no technical benefit.
BI in a Separate, Non-Productive BI System
In this scenario, the BI activities are conducted in a separate, nonproductive BI system in the landscape. Data is sent to this system from the SAP Solution Manager system via RFC. This is only needed in rare cases for sizing purposes.

SolMan / BW Logical System Issue

Hello all, I am having a SolMan/BW related issue and would really appreciate some advice. I realize some of this is for the BW forums and will cross post (I normally dont)
ENVIRONMENT
New installation of Solution Manager EhP1 (19). System name is ED0. We are running Windows / MS SQL
System is only for Solution Manager ops (client 001), and CUA master (client 950).
BACKGROUND
We want to use full SolMan capabilities. This seems to include some limited BW interaction. We do not use BW in the landscape, so will rely on the "internal" BW in SolMan.
During installation, our person made a new client (000 > 400), set it as default (login/system_client), then ran tc:RSA1 and activated the content. (This sets the client)
Client 400 HAS NOT BEEN USED FOR ANYTHING other than the initial installation, and subsequent activation of BW. It has no connections to other systems, no data, cubes, or anything
PROBLEM
We were NOT AWARE that he had ran RSA1 and activated content, and began using client ED0_001 as our PRODUCTION SolMan client.
We are now unable to run RSA1 in anything but client 400.
We are unable to change the client 001 logical system name because Solution Manager has been built around it.
TROUBLESHOOTING
We changed table RSADMINA / field BWMANDT to 001 from 400. This changed the error from "You can only run in client 400" to "The logical system name has changed" (exit only)
In sandbox I duplicated this problem, then deleted the 400 client (with T000 entry). Changed the login/system_client to 001, RSDAMINA to 001, and ran function module RS_MANDT_UNIQUE_SET (set i_mandt to 001). After restart, RSA1 gives same error, logical system name changed"
On same sandbox after #2 above I attempted tc: BDLS to see if it would let me assign an exisiting logical system. It did not
QUESTIONS
Will it have any impact on Solution Manager operations to have the "BW Client" on ED0_400 while Solution Manager production is on ED0_001?
Is it possible to change the BW operating client to 001 from 400? (said another way, can I change the current logical systems BW is keyed with to a different, but existing, logical system)
Assuming the answer to Q1 is yes, and the answer to Q2 is no, what steps need to be performed to make BW fulfill the SolMan requirements?

Updated Information - Answer to Question #1
I am embarrased I missed this section in the master guide the first time around.
There are three major options to consider when planning your system landscape in regards to BI.
BI in the Productive SAP Solution Manager Client
In this scenario, BI is used in the same productive client as SAP Solution Manager. This option allowsfor simpler configuration, and isolates the BI activities conducted for solution life cycle management from the data on a production BI instance. This is SAPu2019s recommendation.
BI in a Separate Client on SAP Solution Manager
In this scenario, BI activities are conducted in a separate client on the SAP Solution Manager system. This scenario provides increased security, as user access is more restricted. However, you must maintain users separately and this increased your administration effort. There is no technical benefit.
BI in a Separate, Non-Productive BI System
In this scenario, the BI activities are conducted in a separate, nonproductive BI system in the landscape. Data is sent to this system from the SAP Solution Manager system via RFC. This is only needed in rare cases for sizing purposes.
I will leave the question unanswered in case someone has an easy rememdy to changing the BI client logical system, as I would like to have it in my productive client if possible. However I am relieved I have the option of running it separately in case that can't be done.

Export / import with logical system

Re: AC 5.3 - RAR - SP17
I have DEV and QA connected to GRC DEV\QA and am defining my ruleset here. The ruleset is defined against a logical system.
I have PRD connected to GRC PRD and want to import the ruleset that I have developed in GRC DEV\QA. I have exported the ruleset using utilies \ export and then try to import using the utilies \ import function I get an error message and cannot import the rules into the GRC PRD system. When exporting I have selected the ruleset to export against the logical system. When importing I am selecting the physical system. Will that work ? What am I missing ?
Edited by: Jan Chan on Jul 8, 2011 5:02 PM

I determined that there was some corrupt data in the ruleset connected to the logical system that I was exporting. Attempted to correct it by removing the entries and regenerating the rules under the logical system area. All attempts to correct the data have not worked - even removing the "Action" completely from the ruleset but the data still contains the corrupt data associated with the logical system. May need to use "manage deletion" to completely remove it but my entire ruleset is defined for this logical system.
I don't think there's a simple way to just change the "system" on each functions "action" - mass function maintenance does not appear to work for this.

Add third physical system to logical system

Hi ,
We are using GRC AC 5.3 SP12 ( Back end ECC6 HR ) , we have connected our GRC DEV system to DEV 100 and DEV 200 clients , now i have connected QAS 100 client to the same system ( GRC DEV) , we have already created a logical system ERP( with Both DEV 100,DEV 200 ), now when i add QAS 100 to this logical system, I am not getting any risks/Violations for the newly attached system Could you please help me out , If i am missing something here.
So far i have done following tasks
1)     Created a JCO connector for QAS 100 in Webdynpro
2)     Created a connector here in SAP RAR ( This is 3rd Connector , We are using SAP HR connectors )
3)     Add new system(QAS 100) to logical system ERP
4)     Generated Ruleset against Logical system
5)     Full Sync for newly created system to GRC ( after this job, I can see uploaded Users,Roles)
6)    Now its not showing any risk violation results in RAR
Looking forward for your response
Thanks & Regards
Uma Shankar T
SAP GRC Consultant

Actual issues is , our basis team deleted some old Jco connectors and give this new connector in back-end system when they created a new connector , But we could see 4 connectors from the GRC side configuration--> Connectors
We have restarted the JAVA server and done the full sync again , Surprisingly problem got resolved now . Looks like a small issue but we got the solution after spending 2 to 3 days and tried different options finally restarting the JAVA server resolved our issue .
Thanks & Regards
Uma Shankar T
SAP GRC Consultant

Logical system & connecters

Dear Experts,
I am implementing GRC AC RAR 5.3, i need to connect my grc dev system to two back end systems(ecc6 dev, ecc qa)
how i need to create connectors.
should i use local system or do i need to create connecters seperately..
which one is the best approach.

Use of a Logical System can be helpful even if you have a mix of ECC, BW, SRM, CRM specifically in the area of the BASIS rules. I would imagine that in most cases, the basis rules for all ABAP systems should be the same. In this case, you can have a Logical System for your BASIS rules only and attach all of the systems. You can then either connect NON BASIS rules to a physical system, or if there is a possibility of additional systems that would use the same rules, you can create a logical system for the NON BASIS rules and attach the physical system. Then when the next system is brought into scope, you would build the connector and add the system to the existing logical system. This will eliminate the need to upload rules for the new system as it will be part of the logical system. This in effect allows for scalability.
One very important point to note would be any rule where you would have Cross-System rules as there is a limitation that you cannot have a Cross System rule between systems in the same Logical System.
Edited by: Kevin Tucholke on Aug 10, 2010 12:50 PM

Logical Systems in Business Services

Hi
In Business Service creation, for Adapter Specific Identifiers, the parameter for the Logical System. It is only possible to assign one logical system to one Business Service ?.
i.e. to do
MyBusServ1, Z_LS_1
MyBusServ2, Z_LS_1
is not possible ?
When trying to assign Z_LS_1 to MyBusServ2 I get the error that Z_LS_1 is already assigned. Is there a way to circumvent ?, I do not want to create two logical systems in R/3 as the IDOCS types submitted by the Business Services are the same.
Thanks
Damien

Thanks for the replies
Sarvesh - The Business service is the sender of the information \ IDOC. If I remove the Adapter specific config then how will XI know what Logical system to apply to the IDOC ?.
Jaishankar - I am creating two IDOC's in SAP. MATMAS and PORDCR. The input file are coming from two different source systems. lets say sys1 and sys2. Both of thse for clarity are created in my scenario as Business Services. sys 1 creates MATMAS and PORDCR IDOC's int he syatem, sys2 creates PORDCR IDOC's in the system. As sys1 and sys2 are related in that they created the IDOC's as part od the same project then I would like to collect in the same partner profile in SAP e.g. Partner Profile ZPP_IDOC with IDOC types MATMAS PORDCR that serve as input for both systems. Logically I would assume that I can assing the logical system ZPP_IDOC to both the adapter specific parameter in both sys1 and sys2.
Thanks
Damien

Logical System in IDOC-XI scenario

Hi,
I need help to understand few things in IDOC-XI scenario, could any one help me in this regard.
we use Adapter specific identifiers to map services, we have following type of identifiers 1) Sys.ID & Client No. 2) Logical System.
my questions are
a) Are we use Logical System in B to B scenario ?
b) Are we use LS in reference to the SAP system or Non SAP system ? if a non SAP system....how a non SAP system send an IDOC and why a non SAP system receive an IDOC ( conversion is possible in XI ) ?
Thanks and Regards
Mahesh.

Hay Kumar,
Logical systems can also be used for SAp sytems wich are not installed yet as a virtuall placeholder.
a) yes. if on of your business is a non sap system or a propritery system that you developed yuo'll ue LS.
b) non SAP system can send and recieve IDOCs. so it's possiable to get an IDOC from a system and turn it into an RFC for SAP or get an IDOC from an SAP system and then turn it into something else for another system.
Have a Good One,
Uri Lifshitz.

RAR logical system

Similar Messages

Maybe you are looking for