• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 728
  • Last Modified:

R/3 on NT Syslog Events export

I believe that these SAP R/3 'syslog' events are held in a db, because I couldn't find a file. Is there a way to have these events written to any of these
1) flat file
2) snmp trap / real syslogd
3) email

  • 3
  • 2
1 Solution
The syslog is actually stored at the file level. However the log data is stored via error code and etc. which making reading the file directly almost impossible...

How the System Writes Log Files ::>>

Each R/3 application server maintains a single local log. System messages are logged in a single circular file on the server. When this log file reaches the maximum allowable size, the system starts overwriting the file from the beginning.

If you like, you can configure a server to write to a central log file as well as to a local log. (Central logging is not available on AS/400 and Windows NT host systems.) A central log file is maintained on a selected application server. Individual R/3 application servers (or instances) send their local messages to this single system. This system collects the messages from each instance and writes them to the central log.

A central log is written in two files: an active file and an old file. The active file contains the current log. When the active file reaches the maximum length specified in the system profile, the system performs a log switch. The system deletes the old log file, uses the active file as old file, and creates a new active log file.

You can specify the paths and file names for local and central system log files with the following system profile parameters:

Sys Profile that specified where to store the log file
 Specifies the active central log filename. The default file name is: SLOGJ
 Specifies the old central log filename. When a log switch occurs, the active log file is copied onto the old log file. The default filename is: SLOGJO
 Specifies the local log filename. The default filename is: SLOG<SAPSYSTEM number>

If you don't see these entries in the system profile.. check directory: /usr/sap/PD1/DVEBMGS$$/log (where $$ is your system number)

Then look for a file name SLOG00 .. (Note: there are other specific alert msg/log files in here)...

In any case, if you look at the content of the file it would be impossible to figure what is what (because the friendly format is not stored in this file... just the error codes)...

It would be too long for me to explain in detail of how to implement the extraction. But if you still want to pursue this... you can have a look at program SAPMSM22 via transaction se80... You can leverage codes from this program where it calls many other function modules to retrieve and decode the message...
luftzeugAuthor Commented:
Thanks for that response. So is this file readable, if I were able to extract the codes and do a look up, is there a timestamp in that file ? Since it is circular I can't key on size for new entries. It seems odd or on purpose that error logging would be made so proprietary. There is no method for alerting that is built in ?
The file is readable...

The error is based on a fixed length format... Example or three records:

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404
pE0A200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001&aBCD_OVERFLOW                                                  
lAB0200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001ab_Story                                            abmove1 2112

where there is one continuous line and there is no line break between records... Based on above if I am to put a line break in each record it would be like this:

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404
pE0A200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001&aBCD_OVERFLOW                                                  
lAB0200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001ab_Story                                            abmove1 2112

Just copy and paste onto Notepad and you see what I mean (hopes html not ruin the format and it works when pasted into notepad)
(Note: I also separate the records by using the lines... for ease of viewing).

Now I am going to take the first record

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404

m - The first character is an Error Type Possible entries are::: >>>

 A      ABAP                          
 D      R/2's D                        
 P      R/2's P                        
 T      R/2's T                        
 U      Transaction termination    old
 a      Start system log date again    
 b      daemon start up                
 c      daemon shut down              
 d      daemon problem report          
 e      OS error (modul,loc,errno)old  
 f      Error (module, location)   old
 g      Database SQL error            
 h      Database error (non SQL)      
 i      Internal buffers              
 j      OS error (errno,modul,loc)    
 k      Error (module, location)      
 l      Error (module, line)          
 m      Error (function,module,line)  
 n      Transaction termination        
 p      Parameter value                
 s      ABAP runtime error            
 u      Data Dictionary error          
 x      ABAP (continued)              

R68 - The next 3 chars are the system error code (Message Number) The first 2 character indicates the Area. The third char is the Error Subid... If you query against table TSL1T where Area = the first 2 chars and Subid = the third char. The return TXT column would give you the friendly Error message.

20030226000253 - This is the Date & Time stamp that you are looking for. Therefore you need to parse out the file then order by this information to get the most recent records.

0019029 - Task ID (Helps your to group errors into related job/transaction)

0D0 - Dialog at process 0 (I am not sure what is the leading number is for)

SAPSYS - Userid (Helps to identify whom activity is causing the issue)


SAPMSSY6 - Program the errored out

000 - Client Number

1 - Session Number

Then all string after this has variation of meanings based on the Error of the 2nd, 3rd, & 4th characters (in this case it is R68).

Hopes that is enough info to go on...
luftzeugAuthor Commented:
It sure is. I can write a program to read this I think, I wish it wasn't circular, I think I'll have to parse the whole file looking for new timestamps each time.
Thanks alot this info is golden especially since my client expects me to do this in a vacuum, is I know nothing about SAP.
Please just remember to accept my answer if you are happy with it :) ...

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now