Risk Analysis result different in DEV and PROD

Hi Gurus,
I have modified few functions in development and transported the changes but after transport there is a new SOD produced at the user level and with same access in Development there is no violation when I checked the function permission there is two duplicate entries in production ruleset compared to Development. Do I need to remove the duplicate entries in production and then run risk analysis is this going to fix SOD ?
My assumption is GRC 10 doesn't have ability to transport changes for deletion in functions.
Regards,
Salman

Dear Salman,
looks that the rules have been appended so it shows twice.
I suggest to download the correct rules from DEV and upload in PROD again. You can use program GRAC_UPLOAD_RULES to upload in PROD. Please make sure you set the option to overwrite, and not append.
With GRAC_RULE_DELETE you can also delete the rules before you upload (not necessary, but possible).
Hope this helps.
Regards,
Alessandro

Similar Messages

Query Execution time is different in DEV and PROD

Hi,
Query is as follows:
SELECT DISTINCT tds.*
FROM testdev.contract_trans npq, testdev.contract_trans_group tds
WHERE npq.contract_trans_group_id = tds.id
AND tds.contract_id <> :contractid
AND tds.tradingday_date BETWEEN :fromtradingday AND :totradingday
AND tds.category_id = :categoryid
AND tds.state_id = :entitystateid
AND EXISTS
(SELECT *
FROM testdev.contract_trans npq1,
testdev.contract_trans_group tds1
WHERE npq1.contract_trans_group_id = tds1.id
AND tds1.contract_id = :contractid
AND (npq.network_point_id = npq1.network_point_id
OR (npq.network_point_id IS NULL
AND npq1.network_point_id IS NULL))
AND tds.tradingday_date = tds1.tradingday_date
AND tds.category_id = tds1.category_id
AND tds.state_id = tds1.state_id)
This query is taking 500ms of time to execute in DEV and when it is executing in Prod it is execuiting in 1.10min. I also analyze the table as well as use hint on this. But the time is not getting reduce in Prod. I compare the tables of dev and prod but data is on shink.
row execution plan for DEV :
call count cpu elapsed disk query current rows
Parse 1 0.00 0.01 0 0 0 0
Execute 1 1.62 1.57 0 0 0 0
Fetch 2 0.81 0.78 0 1208 0 364
total 4 2.43 2.37 0 1208 0 364
Misses in library cache during parse: 1
Optimizer mode: CHOOSE
Parsing user id: 5 (SYSTEM)
Rows Row Source Operation
364 HASH UNIQUE (cr=1208 pr=0 pw=0 time=783194 us)
545 FILTER (cr=1208 pr=0 pw=0 time=775342 us)
545 HASH JOIN (cr=1208 pr=0 pw=0 time=774670 us)
99432 TABLE ACCESS FULL CONTRACT_TRANS (cr=382 pr=0 pw=0 time=465 us)
18225 HASH JOIN (cr=826 pr=0 pw=0 time=359469 us)
1000 HASH JOIN (cr=445 pr=0 pw=0 time=108528 us)
46 TABLE ACCESS FULL CONTRACT_TRANS_GROUP (cr=223 pr=0 pw=0 time=48274 us)
675 TABLE ACCESS FULL CONTRACT_TRANS_GROUP (cr=222 pr=0 pw=0 time=51497 us)
99432 TABLE ACCESS FULL CONTRACT_TRANS (cr=381 pr=0 pw=0 time=182 us)
And row execution plan for PROD:
call count cpu elapsed disk query current rows
Parse 1 0.00 0.00 0 0 0 0
Execute 1 0.00 0.00 0 0 0 0
Fetch 2 80.03 78.40 219 319722 0 364
total 4 80.03 78.41 219 319722 0 364
Misses in library cache during parse: 0
Optimizer mode: CHOOSE
Parsing user id: 5 (SYSTEM)
Rows Row Source Operation
364 HASH UNIQUE (cr=319722 pr=219 pw=0 time=78406184 us)
545 FILTER (cr=319722 pr=219 pw=0 time=78385884 us)
545 HASH JOIN (cr=319722 pr=219 pw=0 time=78384017 us)
675 TABLE ACCESS FULL CONTRACT_TRANS_GROUP (cr=222 pr=219 pw=0 time=328724 us)
2380118 NESTED LOOPS (cr=319500 pr=0 pw=0 time=71521450 us)
837 HASH JOIN (cr=603 pr=0 pw=0 time=315980 us)
46 TABLE ACCESS FULL CONTRACT_TRANS_GROUP (cr=222 pr=0 pw=0 time=48647 us)
99432 TABLE ACCESS FULL CONTRACT_TRANS (cr=381 pr=0 pw=0 time=100990 us)
2380118 TABLE ACCESS FULL CONTRACT_TRANS (cr=318897 pr=0 pw=0 time=70077111 us)
Can any body help me out why this is happening?
Regards,
Saptadip

Welcome to the forum.
Please edit your post and use the {noformat}{noformat} tag, so your examples will stay formatted and indented.
Put the tag before and after all text you want to stay formatted.
{noformat}..{noformat} - Displays everything between the tags as programming code.
The query on PROD is doing lots more of reads/processing much more rows then on DEV.
For example, take table CONTACT_TRANS:
- less than 100,000 rows on DEV
vs
more than 2,300,000 on PROD.
but data is on shink.What does that mean?

Different Risk Analysis Results with 10.0 and 10.1

Hello,
I do not understand why I get different results with 10.0 and 10.1. Exactly the same ruleset is applied!
Definition in 10.0 and 10.1:
Analyzed Role (which definitely contains the SOD):
Version GRC 10.0 finds the SOD S_FI14 and displays it. In 10.1 nothing is displayed...Any ideas what's the problem?
Regards
Peter

We had similar issues with 10 and 10.1.
We applied an SAP Note about logical groups and the ruleset, it did not work.
What did work:
When performing Risk Analysis, remove the Ruleset selection criteria (use the minus button).

System Properties user.timzone different between dev. and prod. system

Hi all,
I am facing the following issue:
In our development system I get in http://<server:port>/sap/monitoring/SystemProperties -> dispatcher -> system properties a Europe/Berlin for user.timezone.
In our productive system I get in http://<server:port>/sap/monitoring/SystemProperties -> dispatcher -> system properties a GMT for user.timezone.
Can anybody explain which system property is requested by the J2EE-engine when calling this property?
I ask, because I wrote a small programm requesting the user.property via java (expecting j2ee-engine would do that too) an got back an empty string (on both systems).
So, how/where can I change the parameter, so that the development system uses GMT, too?
I already checked the spro settings in sap, they are identical. System -> status showes the same for both systems, too.
I hope for your help.
Thanks and regards
Christian

Hello Chris,
I checked the system variables with TA SM51 ->goto -> server -> information -> environment.
There is nothing like the TZ variable on both systems (we use Linux).
Do you have an other idea?
How can I change the user.timezone shown in Java system properties?
Regards
Christian

Difference in risk analysis results post sp upgrade

Hi Team,
Recently we upgraded our GRC component in dev box to SP level 14. We reactivated the BC sets and ran all sync jobs.
Now the risk analysis results are very different from the non upgraded system.
Do we need to activate BC sets post SP upgrade ? Also how will be the latest rule sets released by SAP imported into the system ?
Thanks in advance.
Regards,
Anil

Hi,
Isn't ANALYZE outdated for R12?
You may still use the Analyze command in 11g Database (R12 is application version), and is not obsolete.
Please refer:
Analyzing Tables, Indexes, and Clusters
Ask Tom &quot;analyze in 11g ,not obsolete?&quot;
How would this resolve the issue?
If the optimizer is not updated with the latest statistics in database, then the COUNT(*) will not be updated and as a result the count will be showing a lower value.
I suggested you to perform an analyze or gather schema statistics in order to eliminate probable cause for the issue.
Thanks &
Best Regards,

Performance problems between dev and prod

I run the same query with identical data and indexes, but one system takes a 0.01 seconds to run while the production system takes 1.0 seconds to run. TKprof for dev is:
Rows Row Source Operation
1 TABLE ACCESS BY INDEX ROWID VAP_BANDVALUE
3 NESTED LOOPS
1 NESTED LOOPS
41 NESTED LOOPS
41 NESTED LOOPS
1 TABLE ACCESS BY INDEX ROWID VAP_PACKAGE
1 INDEX UNIQUE SCAN SYS_C0032600 (object id 51356)
41 TABLE ACCESS BY INDEX ROWID VAP_BANDELEMENT
41 AND-EQUAL
82 INDEX RANGE SCAN IDX_BE2 (object id 53559)
41 INDEX RANGE SCAN IDX_BE1 (object id 53558)
41 TABLE ACCESS BY INDEX ROWID VAP_BAND
41 INDEX UNIQUE SCAN SYS_C0034599 (object id 53556)
1 INDEX UNIQUE SCAN SYS_C0032549 (object id 51335)
1 INDEX RANGE SCAN IDX_BV1 (object id 53557)Tkprof for Prod is :
Rows Execution Plan
0 SELECT STATEMENT MODE: ALL_ROWS
1 TABLE ACCESS MODE: ANALYZED (BY INDEX ROWID) OF 'VAP_BANDVALUE' (TABLE)
52001 NESTED LOOPS
26000 NESTED LOOPS
26000 NESTED LOOPS
26000 NESTED LOOPS
1 TABLE ACCESS MODE: ANALYZED (BY INDEX ROWID) OF 'VAP_PACKAGE' (TABLE)
1 INDEX MODE: ANALYZED (UNIQUE SCAN) OF 'SYS_C0018725' (INDEX (UNIQUE))
26000 TABLE ACCESS MODE: ANALYZED (BY INDEX ROWID) OF 'VAP_BANDELEMENT' (TABLE)
26000 INDEX MODE: ANALYZED (RANGE SCAN) OF 'IDX_BE2' (INDEX)
26000 TABLE ACCESS MODE: ANALYZED (BY INDEX ROWID) OF 'VAP_BAND' (TABLE)
26000 INDEX MODE: ANALYZED (UNIQUE SCAN) OF 'SYS_C0030648' (INDEX (UNIQUE))
26000 INDEX MODE: ANALYZED (UNIQUE SCAN) OF 'SYS_C0018674' (INDEX (UNIQUE))
26000 INDEX MODE: ANALYZED (RANGE SCAN) OF 'IDX_BV1' (INDEX).The row count varies greatly. But it shouldn't as the data is the same.
Any ideas?

From DEV you show the Row Source Operations for the query. The column named "Rows" signifies the actual number of rows processed with each step.
From PROD you show the Execution Plan for the query; that is, tkprof was executed with the EXPLAIN option which generates the execution plan as of the time when tkprof was run. The "Rows" column in the Explain Plan output comes from the PLAN_TABLE.CARDINALITY, which represents an estimate by the CBO for the number of rows [expected to be] processed with each step.
So, if by <quote>The row count varies greatly</quote> you meant these "Rows" columns outputs then you're are comparing actuals from a database with estimates from another. Get the Row Source Operations from both.
"Identical data and indexes":
1. data may be the same, but it is not necessarily stored physically the same way.
2. Indexes being the same means their definitions are the same; again, physically they are not necessarily identical
In other words, data in PROD (the way it is stored on disk) may have evolved as a result of discrete deletes/updates/inserts ... in DEV it could be, for example, stored more compact if you took a copy of PROD and moved into DEV. So, the number of blocks for your segments will likely be different between PROD and DEV, the clustering factor for your indexes are likely different, etc ... things which could [and do] influence the CBO. The statistics may be different.
I guess what I'm saying is ... it is quite hard, if not outright impossible, to get two identical databases/instances/load ... hence, don't expect the executions to be 100% identical, even if you have "identical data and indexes". By all means compare between DEV and PROD (make sure you compare the same thing though) and use the observed differences as an indicator for further investigation ... don't chase the goal of 100% identical behavior.
Now, by all means look at that query taking 1 second in PROD ... I have only addressed <quote>The row count varies greatly. But it shouldn't as the data is the same.</quote>

Consistency between dev and prod systems!!!!

Hi All,
I wuld like to check the consistency between Dev and Prod systems for all the Data model and other objects existing. I would like to do this sanity check to see whether the two systems are in sync. Are there any tools or transaction codes within SAP framework which can guide me in this direction.
Kind Regards,
Surya Tamada.

Hi Surya ,
First build whole data flow :
1 .Create Infoarea ,Infoobjects & Masterdata ,Infoproviders ,Infoobject Catelog under Infoarea,MetaData - Characteristics MeteData - Key Figures
2 DSOs ,Infocubes ,Infosets, Multiproviders ,Views in the development system ,Datasources for BW system,Flat File Datasources,Transformations
then get data from the se11 tables as per your requirement :
like RSDVCHA ,RSDBCHATR,RSDCUBEIOBJ,RSDICMULTIIOBJ etc and built view on it as per your requirement .
then built flat file data sources and transformation .
get all data downloaded to flat file in ur PC .In the same way from other system.
make flow from PC File Datasource -> DSO -> Infocube and build queries for different objects .load the downloaded files to them and then run query .
ex : query to compare cube will take cube name and systems name as input and compare objects .
Regards,
Jaya

Multiple connections to dev and prod

Hi All,
I trying to connect multiple environments (Dev and Prod) from shared connections in Smartview.
When I right click on the existing planning I couldn't see anything (there were suggestions from other posts that by right clicking you will get an option to add new server).
Also I have differetn URL's for dev and Prod.

I think from 11.1.2.2 onwards the ability to add servers in Shared Connection is removed and an enhancement is filed to have that ability.
You can use private connection to connect to different instances
http://DEV:19000/aps/APS for Essbase
http://DEV:19000/HyperionPlanning/SmartView HyperionPlanning
If you are on 11.1.2.3 you can create an XML file and use that as your Shared Connection
Essbase Labs: Smart View News
Regards
Celvin
http://www.orahyplabs.com

SYSTEM LANDSCAPE - DEV and PROD - refresh

Hi All,
We have a situation like this.
1. Our BW Q&A is a copy of PROD
2. Our BW DEV is not either a copy of Q&A or PROD.
3. We have issue with a particular process chain in PROD and we need to correct (and follow the lanscape..that is want to do the correction in DEV and the transport to QA and then to PROD)
4. Since this particular process chain is not existing in the DEV environment, our Basis team is advising us to check the difference in DEV and PROD for as this process chain concern and then want to refresh it to DEV system so that we can carry out the change/modification.
We don't know really what exactly we need to find the differences between DEV and PROD for this PC and then to inform to Basis team...
Is it correct that since the particular process chain associated with various queries,data targets,update/transfer structures...etc will be over writen / copied / refreshed in DEV system from PROD?
Please advise..Please help..

Hi George, SAT, BWer,
Thanks for your messages.
George : Answers to your question:
1. Our Basis team want to copy all the configuration (related to the particular process chain only)and not Data's.
2. How to pack the process chain in a portable file and extract this file. then import it into DEV..and what is the way not to get error when doing so (knowing that fact that obejects will be different..) I don't know..whether to copy the objects are or not..
3.I agree with you.. Even we are ready to work with DEV to PROD..
SAT: Answers to your questions:
1. I do see some Process chains in the DEV and not related to this particular PC. Many development PC are there..and I don't know where the originally developed PC's ???!!
2. I am new to this Client..sorry..how this has been deleted...
BWer :Answers to your questions:
1. Yes..PC is Latest in the PROD.
2. We don't want to create the process chain all the way from scratch in the DEV. Yes..This is one of the process chain used in the metachain...Totally there are five chains in the PROD related to this..We need to modify only the second process chain..which we are trying to copy in the DEV and then do the changes...
Hope , you are clear about our requirement.
Please advise me what exactly we need to look into the DEV and PROD system so that required PC is copied alomg with (????) to DEV system..Please help.
Thank you very much in Advance..

CUP Risk Analysis results are not shown, continues processing request

We have several users that complain the risk analysis in CUP never finishes. Requests do not contain risks or huge amount of risks which could explain a long runtime.
With one user we checked, the user is never getting the risk analysis result on his screen. Sitting together with the user shows that the progress bar at bottom of IE is completing analysis, however the screen is not updated to show the risk analysis result and continues to show the processing circle.
On other pc's CUP risk analysis result is shown as expected, so it must be some issue in local PC Internet Explorer settings.
Environment used is Windows XP with IE 8. GRC version is 5.3.
Have any of you experienced the same? And is there a solution available that will resolve this issue, by e.g. correcting settings in IE 8?

Hello!
If you want to successfully use GRC 5.3 with IE8, you have two options:
1) Change a parameter in the server
2) use the compatibility mode.
3) Update NW
refer to [Note 1347768 - Web Dynpro and Microsoft Internet Explorer Version 8.0|https://service.sap.com/sap/support/notes/1347768]
I dismiss option 2, because it requires to change in every end user computer, so I've been working with option 1 without problems. Bear in mind that NW 7.01 is supported: [Note 1433940 - Access Control compatibility on Netweaver Java server 7.01|https://service.sap.com/sap/support/notes/1433940]
Cheers!
Diego.

Cost Analysis result different from the cost estimate quantity structure re

Hi
Cost Analysis result different from the cost estimate quantity structure result in the same costing
run why this happen like this. ( in CK40N costing run result -- Cost analysis -- double click on costing result it shows cost estimate quantity structure result values different from cost analysis value )
Pls advice....
Regards
Kesharika

It depends on your costing variant. For sample, if you take the price in the 1° price estimated on the material view and this data has changed, you can have a difference between the first and the second estimate.
Perhaps also, it's just a definition of layout.
And 3rd hypothesis : you are looking on component in the ck40n and the variant don't take in account your cost component and just the material price.
Christophe

File adapter sender/reciever - in different systems - DEV/QA/PROD

Hi all,
does any one has an idea about how to make the source directory parameter dynamic in terms of different environment (DEV, QA, PROD)?
so I want have to change manully the path?
Thanks,
Naama

hi,
>different environment (DEV, QA, PROD)?
>so I want have to change manully the path?
first of all you will have to put it manully anyway
as if you transport every communication channel
you need to fill the data on every landsapce (QA, PRD)
as it's gone when you import it
Regards,
Michal Krawczyk

免 Chaines Char not accepted in QA system, working fine in Dev and PROD

Hi Experts,
I am stuck withchines char e.g. 免
BW QA is not accepting it, I can see the PSA data 免 converted to #, where as same records show proper 免 in BW DEV and PROD.
I checked the data in source system (RSA3) properly showing 免.
I rechecked the SM59 RFC setting in QA and compare with DEV.
All system are unicode supported.
Please help to resolve.
Thank-You.
Regards,
VB

I crated a new flat file text datasource and tried to load data (chines char) and that to work in QA.
Don't understand what's issue with 0CUST_SALES_ATTR extractor. ?
Any help/experience is welcome.
Thank-You.
Regards,
VB

FB60 screen change layout different between DEV and PRD

Hi,
I'm having problem with transaction FB60. When i try to change the layout in PRD, in screen Edit System Setting, some of the field showing 0 length. For example in WBS element field, in DEV show length 24 but PRD show length 0. I try to compare the version but it is same (program & table structure - ACGL_ITEM). When I debug the program, found out that it will get the structure from sap internal c program call 'AB_GET_CX_DATA'. So, maybe this program version are different between DEV and PRD.
Anybody knows what is the cause of this problem? Or maybe somebody can tell me how to check sap internal c program.
Thank you very much.

Yes. FB60 is Enter Vendor Invoice. In this screen you can see a table with column such as GL Acct, Debit/Credit, Amount in DC, Cost Center and others. You can add or remove some of the field using Table Setting and create Screen Variant. My problem is, the length of WBS Element and Profit Center field is 0. How to change the length.
I already searched in forum but I only found how to create screen variant.
Thanks.

Different Risk Analysis Results with the same user from 2 different RAR

Hi..
I've loaded the same Risks, Rules, etc, into 2 GRC RAR environments (Sandbox and Quality systems); both of them are connected with the same SAP ECC system. But when I do a User Risk analysis (authorization level), the result from Sandbox is different from Quality system. I donu2019t have users or roles mitigated yet, users are synchronized, rules are exactly the same and I donu2019t know what happen??... Please, help me.
Thanks...

Hi...
If I do a Full Sync of users to the same ECC system from both RAR boxes, I got different number of users loaded (i.e. 18757 vs. 18141), similar case with the full sync of roles. (13100 vs. 13150).
If I load exactly the same set of functions to both RAR systems and I generate the rules, I got the same problem, different number of rules is generated.
I've verified both RAR configuration and they are the same (excluded users, roles mitigated, etc.)
Is it a normal behavior? What could be wrong?
Thanks in advance!!

Risk Analysis result different in DEV and PROD

Similar Messages

Maybe you are looking for