Setup for SAP S/4HANA and SAP Business Suite

This page explains how to connect SAP S/4HANA and SAP Business Suite on-
premise systems to SAP Cloud ALM.
Currently the following monitoring application are supported for SAP ABAP systems:

 Business Process Monitoring

 Integration & Exception Monitoring
 Real User Monitoring
 Job & Automation Monitoring
 Configuration & Security Analysis
 Health Monitoring
 Transport Management

Prerequisites

Technical Prerequisites for the ABAP system (setup is done in transaction /SDF/ALM_SETUP):

 SAP_BASIS Release:
o Either 7.40 SP16 or higher (accordingly 7.50 SP05)
o Or 7.40 SP09 - SP15 (7.50 SP00 - 7.50 SP04) with SAP Note 2283880 - Logon
Username not used in RFC API
 SAP_UI Version:
o Either SAP_UI 740 SP15 or higher
 Install the latest available support package for ST-PI 7.40 and the collective corrections
suited for your ST-PI support package from the required SAP notes mentioned below to
make sure that all use cases are fully supported.
 Check that profile parameter icm/HTTPS/client_sni_enabled is set to TRUE (see
also SAP Note 510007 - Additional considerations for setting up SSL on Application
Server ABAP)
 Check that profile parameter ssl/client_ciphersuites is set as described in section 7
of SAP Note 510007 - Additional considerations for setting up SSL on Application Server
ABAP.
 Check that DigiCert Global Root CA is imported in STRUST under SSL Client
(Anonymous) and SSL Client (Standard).
 Check that DigiCert Global Root G2 is imported in STRUST under SSL Client
(Anonymous) and SSL Client (Standard).
 Check that DigiCert RSA4096 Root G5 is imported in STRUST under SSL Client
(Anonymous) and SSL Client (Standard).

Required NOTES:
  3310406 - Collective corrections as of ST-PI 7.40 SP22 for SAP Cloud ALM (including
SP23)
 3240966 - Collective corrections as of ST-PI 7.40 SP20 for SAP Cloud ALM (including
SP21)
 3196078 - Collective corrections as of ST-PI 7.40 SP18 for SAP Cloud ALM (including
SP19)
 3133333 - Collective corrections as of ST-PI 7.40 SP17 for SAP Cloud ALM
 3104662 - Collective corrections as of ST-PI 7.40 SP16 for Cloud ALM
 3102288 - Job & Automation Monitoring: ST-PI (SP16 – SP20) fixes for on-premise jobs
(ABAP jobs and BW process chains)
 3281776 - Job & Automation Monitoring: ST-PI 740 SP21+ fixes for on-premise jobs
(ABAP jobs and BW process chains)

Required ST-PI VERSION

To make sure that all available metrics can be collected and that all use cases are available for
your SAP ABAP system, we recommend that you always install the latest version of ST-PI.
However, if you are using an older ST-PI version, please check the table below for the use case
availability. Please also make sure that you implement all SAP notes listed in the tray above.

Configure the PUSH Data Provider

Monitoring for SAP S/4HANA and SAP Business Suite uses a PUSH mechanism to push
monitoring data to SAP Cloud ALM.

1. Log on to the relevant client

o Transport Management: The setup must always be performed in client 000
o All other use-cases: The setup must be performed in the client, for which you
want to collect monitoring data (e.g. the production client). You can perform the
setup in more than one client.
 2. Call transaction /n/SDF/ALM_SETUP
3. Enter "Target ALM Description"
o To create a new ALM Destination, enter a name (e.g. CALM) and press the
"Enter" key
o To change an existing ALM destination, select one from the F4 input help and
press the "Enter" key
o After pressing the "Enter" key the subsequent fields will be filled.
4. Maintain HTTP Destination

o Click "Update destination"

o You can copy&paste the content from the JSON file created during the
enablement of the SAP Cloud ALM APIs by clicking "Paste Service Keys"
o Or you can enter the required fields for connecting Cloud ALM manually:
1. Token Endpoint: SAP Cloud ALM service key parameter "url"
+ /oauth/token
2. Client ID: SAP Cloud ALM service key parameter "clientid"
3. Client Secret: SAP Cloud ALM service key parameter "clientsecret"
4. Proxy User (if required by your network infrastructure)
5. Proxy Password (if required by your network infrastructure)
6. Proxy Host (if required by your network infrastructure)
 if your system is hosted by SAP please enter the value proxy
7. Proxy Port (if required by your network infrastructure)
 if your system is hosted by SAP please enter the value 3128
8. Root URL: Enter the SAP Cloud ALM service key parameter "Api"
without /api, e.g. https://eu10.alm.cloud.sap
o Click "Ok" to close the pop-up.
o To delete a destination click on "Delete destination"
5. Enter background user and register system
o Enter the background user you created to perform the data collection

 Make sure that it has the authorizations as described on tab "Required

Authorizations" under "Prerequisites"

o Click on "Register" to call SAP Cloud ALM and register the system. If it is
successful, a LMS ID is retrieved and is displayed.
o To unregister a system, click the "Unregister" button. Caution: This stops all data
collection and heartbeat measurements
6. Select the use cases you want to collect and push data for
After the successful setup the SAP S/4HANA or SAP Business Suite system will show up as
"Registered" service in the Landscape Management application of your SAP Cloud ALM tenant.
The data collection for the selected use-cases will be activated automatically. In general it is
recommended to use the standard collection interval. Only for specific requirements, you are
able to change the “Collection interval” for the different use cases. Please be aware that
Business Process Monitoring is using a separate scheduler, therefore, this specific value cannot
be changed.
After setting up the monitoring PUSH to SAP Cloud ALM in the managed service, the data
collection will be activated automatically with default monitoring configurations.
You can adjust the monitoring setup within the monitoring application. Find more information on
the configuration on the "Setup & Configuration" pages for the application.

After you connected your SAP ABAP system to SAP Cloud ALM, the ABAP system will keep
sending data to the monitoring applications. To which ABAP system in LMS the monitoring data
is assigned, will be determined by the LMS Id. If you perform a system refresh of your ABAP
system, by overwriting it with a copy from another ABAP system, this assignment will be broken.
To avoid that the metrics will be assigned to the source of the copy rather than the actual ABAP
system, you need to save and restore the tables containing monitoring setup information for SAP
Cloud ALM.

/SDF/DCOBQHDR

/SDF/DCRUNNING

/SDF/DCCCONFIG

/SDF/DCCLOGDET

/SDF/DCCLOGHDR

/SDF/DCKPICFG

/SDF/DCOBQDATA

/SDF/DCPARAMCFG

/SDF/AJM_JOBS

/SDF/AJM_SCHEDUL

/SDF/AJM_SYNC_PT

/SDF/AJM_JOBS_P

/SDF/AJM_GRP_JOB

/SDF/AJMF_JOBS

/SDF/AJMF_GR_JOB

/SDF/AJMF_JOBS_P
/SDF/AJMF_SCHEDU

/SDF/AJM_PJOBS

/SDF/KPICINTRVL

/SDF/CALM_CDMI

/SDF/CDM_IMPORTS

/SDF/CDM_CRT_TR

/SDF/CALM_SCHED

/SDF/CATEGORY

/SDF/IM_PUSH_ERR

/SDF/CALM_ID

/SDF/CALM_CONFIG

/SDF/CALM_INST

/SDF/CALM_QGROUP

/SDF/EXM_EXT_IDS

Troubleshooting for ABAP Systems

This page gives you some hints when you get an error or run into a problem during the SAP
Cloud ALM monitoring setup of ABAP on-premise systems.
The troubleshooting on the page can be used for the products:

 SAP NetWeaver Application Server for ABAP (7.40 or higher)

 SAP S/4HANA
 SAP Business Suite
 SAP S/4HANA cloud, private edition
 SAP SuccessFactors Employee Central Payroll


Which RFC destination(s) created during the connection setup?

When executing /SDF/ALM_SETUP at least one HTTP destination is created. You can display
them in SM59 (type G) with the prefix ZSDF_<your destination name>.
When you need proxy access with authentication a second destination ZSDE_ <your destination
name> is created.

Don't manipulate the Path Prefix in SM59!

My connection check result in SM59 returns HTTP 400.

A connection check in transaction SM59 with HTTP status code 400 is normal. Everything else
e.g. 401 (wrong credentials), 403 (forbidden), and 500 (error) is not normal.

Error: "Cannot save HTTP Destination : Password Too long"

In case the client credentials are longer than 64 characters you might get the following error
when saving the destination:

Cannot save HTTP Destination: Password Too long

In that case, you need to apply SAP_BASIS 7.40 SP2 (7.50 SP19) or note 2909503 - Use max
Password length Destination API Type G

I get an error message during the registration with SAP Cloud ALM.
When clicking on "Register" a synchronous call to SAP Cloud ALM is executed. If no LMS-Id is
retrieved and displayed the registration was not successful.

There might be several reasons:

1. Cannot create HTTP Client: Operation successfully executed

Your setup user probably doesn't have enough authorizations or the SAP_BASIS version
is too low.
2. Direct connect to ... failed NIECONN_REFUSED(-10)
Your system cannot reach the target directly and a proxy is required.
3. IcmConnInitClientSSL: Proxy connection to https://....:443 via proxy:3128 failed (proxy
returned 403 Forbidden)
In case you need a proxy to reach the target this must be allowed in the proxy. In the
ECS environment, this should be ensured.
4. IcmConnInitClientSSL: Proxy connection to https://....:443 via proxy:3128 failed (proxy
returned 407 Proxy Authentication Required)
In case the proxy requires authentication you should check in SM59 if both destinations
ZSDF_<your_name> and ZSDE_<your_name> exist and if proxy credentials are
available. If this is not the case delete the destination from /SDF/ALM_SETUP and create
a new destination.
5. ERROR => SSL handshake with ..hana.ondemand.com:443 failed:
SSSLERR_ALERT_PROTOCOL_VERSION ... Server aborted TLS handshake with fatal
TLS
Check the dev_icm ( in SMICM) for details. It indicates a wrong configuration of
ssl/client_ciphersuites (Check SAP Note 51007 section 7)

6. ERROR during secussl_read() from SSL_read()==SSL_ERROR_SSL... secussl_read:

SSL_read() failed => "Failed to verify peer certificate. Peer not trusted."
It seems the DigiCert Global Root CA is not installed. Check this setup step in STRUST.
7. 'Oauth access_token not found from Destination' 401
The password length for the service key was recently increased. Please apply the latest
 ST-PI support package (at least SP22) or SAP note 3240966 to address this. The already
created destination cannot be used. Please delete it and re-enter the API service key or
update the client secret.

Use Case cannot be activated in /SDF/ALM_SETUP.

You click on the "Activate Usecases" button and select a use case. However, when you save
your changes the selection is not saved.

During the initial setup, you can specify in each client which data should be collected. However,
SAP Cloud ALM is the leading instance. If the use case is deactivated after the initial activation in
SAP Cloud ALM or in /SDF/ALM_SETUP, it can only be reactivated in the use case in SAP
Cloud ALM.

The deactivation of the data collection from the ABAP system is always possible.

How can I troubleshoot the data collection in the ABAP system?

Data collection is triggered periodically by the scheduled job "CALM Scheduler <Setup name
in /SDF/ALM_SETUP>" (Report /SDF/CALM_SCHEDULER) as tasks via asynchronous RFCs.

1. Check the scheduler (Report /SDF/CALM_SCHEDULER) is running in the correct client.

2. Check the job logs of the scheduler.
In case there are not enough resources probably not all tasks were executed.
3. The result of the last execution is persisted in table /SDF/CALM_SCHED, for instance-
specific collectors in table /SDF/CALM_INST
4. Each application can write more logging information in the application log (SLG1) for
object /SDF/CALM.
Additionally, the job "CALM Heartbeat <Setup name in /SDF/ALM_SETUP>" (Report
/SDF/CALM_HEARTBEAT) is scheduled.

Data collection for Business Process Monitoring is triggered periodically by the jobs:

 CRBPA:DC_CONTROLLER(<Setup name in /SDF/ALM_SETUP>)(Report

/SDF/CRBPA_DC_CONTROLLER)
 CRBPA:AUTODISCOVERY(<Setup name in /SDF/ALM_SETUP>)(Report
/SDF/CRBPA_AUTODISCOVERY)