R/3 on NT Syslog Events export

Posted on 2003-02-19
Medium Priority
Last Modified: 2013-12-08
I believe that these SAP R/3 'syslog' events are held in a db, because I couldn't find a file. Is there a way to have these events written to any of these
1) flat file
2) snmp trap / real syslogd
3) email

Question by:luftzeug
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2

Accepted Solution

knowledge_now earned 400 total points
ID: 8022166
The syslog is actually stored at the file level. However the log data is stored via error code and etc. which making reading the file directly almost impossible...

How the System Writes Log Files ::>>

Each R/3 application server maintains a single local log. System messages are logged in a single circular file on the server. When this log file reaches the maximum allowable size, the system starts overwriting the file from the beginning.

If you like, you can configure a server to write to a central log file as well as to a local log. (Central logging is not available on AS/400 and Windows NT host systems.) A central log file is maintained on a selected application server. Individual R/3 application servers (or instances) send their local messages to this single system. This system collects the messages from each instance and writes them to the central log.

A central log is written in two files: an active file and an old file. The active file contains the current log. When the active file reaches the maximum length specified in the system profile, the system performs a log switch. The system deletes the old log file, uses the active file as old file, and creates a new active log file.

You can specify the paths and file names for local and central system log files with the following system profile parameters:

Sys Profile that specified where to store the log file
 Specifies the active central log filename. The default file name is: SLOGJ
 Specifies the old central log filename. When a log switch occurs, the active log file is copied onto the old log file. The default filename is: SLOGJO
 Specifies the local log filename. The default filename is: SLOG<SAPSYSTEM number>

If you don't see these entries in the system profile.. check directory: /usr/sap/PD1/DVEBMGS$$/log (where $$ is your system number)

Then look for a file name SLOG00 .. (Note: there are other specific alert msg/log files in here)...

In any case, if you look at the content of the file it would be impossible to figure what is what (because the friendly format is not stored in this file... just the error codes)...

It would be too long for me to explain in detail of how to implement the extraction. But if you still want to pursue this... you can have a look at program SAPMSM22 via transaction se80... You can leverage codes from this program where it calls many other function modules to retrieve and decode the message...

Author Comment

ID: 8025981
Thanks for that response. So is this file readable, if I were able to extract the codes and do a look up, is there a timestamp in that file ? Since it is circular I can't key on size for new entries. It seems odd or on purpose that error logging would be made so proprietary. There is no method for alerting that is built in ?

Expert Comment

ID: 8028631
The file is readable...

The error is based on a fixed length format... Example or three records:

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404
pE0A200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001&aBCD_OVERFLOW                                                  
lAB0200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001ab_Story                                            abmove1 2112

where there is one continuous line and there is no line break between records... Based on above if I am to put a line break in each record it would be like this:

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404
pE0A200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001&aBCD_OVERFLOW                                                  
lAB0200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001ab_Story                                            abmove1 2112

Just copy and paste onto Notepad and you see what I mean (hopes html not ruin the format and it works when pasted into notepad)
(Note: I also separate the records by using the lines... for ease of viewing).

Now I am going to take the first record

mR68200302260002530019029    0D0        SAPSYS      SESSION_MANAGER     SAPMSSY6                                0001                                      ThIRollroll bathxxhead9404

m - The first character is an Error Type Possible entries are::: >>>

 A      ABAP                          
 D      R/2's D                        
 P      R/2's P                        
 T      R/2's T                        
 U      Transaction termination    old
 a      Start system log date again    
 b      daemon start up                
 c      daemon shut down              
 d      daemon problem report          
 e      OS error (modul,loc,errno)old  
 f      Error (module, location)   old
 g      Database SQL error            
 h      Database error (non SQL)      
 i      Internal buffers              
 j      OS error (errno,modul,loc)    
 k      Error (module, location)      
 l      Error (module, line)          
 m      Error (function,module,line)  
 n      Transaction termination        
 p      Parameter value                
 s      ABAP runtime error            
 u      Data Dictionary error          
 x      ABAP (continued)              

R68 - The next 3 chars are the system error code (Message Number) The first 2 character indicates the Area. The third char is the Error Subid... If you query against table TSL1T where Area = the first 2 chars and Subid = the third char. The return TXT column would give you the friendly Error message.

20030226000253 - This is the Date & Time stamp that you are looking for. Therefore you need to parse out the file then order by this information to get the most recent records.

0019029 - Task ID (Helps your to group errors into related job/transaction)

0D0 - Dialog at process 0 (I am not sure what is the leading number is for)

SAPSYS - Userid (Helps to identify whom activity is causing the issue)


SAPMSSY6 - Program the errored out

000 - Client Number

1 - Session Number

Then all string after this has variation of meanings based on the Error of the 2nd, 3rd, & 4th characters (in this case it is R68).

Hopes that is enough info to go on...

Author Comment

ID: 8029407
It sure is. I can write a program to read this I think, I wish it wasn't circular, I think I'll have to parse the whole file looking for new timestamps each time.
Thanks alot this info is golden especially since my client expects me to do this in a vacuum, is I know nothing about SAP.

Expert Comment

ID: 8030713
Please just remember to accept my answer if you are happy with it :) ...

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Note: You must have administrative privileges in order to create/edit Roles. Salesforce.com (http://www.salesforce.com/) (SFDC) is a cloud-based customer relationship management (CRM) system. It is a database most commonly used by sales and marke…
For cloud, the “train has left the station” and in the Microsoft ERP & CRM world, that means the next generation of enterprise software from Microsoft is here: Dynamics 365 is Microsoft’s new integrated business solution that unifies CRM and ERP fun…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
In this video, Percona Solution Engineer Rick Golba discuss how (and why) you implement high availability in a database environment. To discuss how Percona Consulting can help with your design and architecture needs for your database and infrastr…
Suggested Courses
Course of the Month11 days, 16 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question