SAP Library - Find your answers

You can use the monitoring architecture to monitor selected jobs and to display problems as alerts (see Monitoring Jobs with the Alert Monitor). This job monitoring is deactivated by default; activation is described in Activating Monitoring of Jobs with the Alert Monitor.

After activation, the data is available in the context Background, Background Job Monitoring subtree. For the monitoring, it is useful to define your own monitor or to extend a monitor definition of your own to display the data. The monitor definition and the monitor produced from it are described here.

Prerequisites

You can define a rule-based or a static monitor to display data. For basic information about this, see Creating and Changing Monitors. For a rule-based monitor, the definition must contain a rule CCMS_GET_MTE_BY_CLASS with Job_Monitoring as the MTE class:

If you are using a static monitor, choose the context Background ® Background Job Monitoring for the desired system:

Features

With the definition above, the monitor created has the following structure. Here, the job SCHEDULED_JOB1 and all jobs whose names begin with JOB_EXAMPLE are to be monitored. A subtree is created for every name pattern for a monitored job (job chain):

The monitor contains the following monitoring tree elements (MTEs):

Customizing Alert Generation

· Runtime, Delay and Delay + Runtime

Threshold values are already assigned to these performance attributes by default, so that an alert is generated as of a defined runtime or delay. To change the threshold value, select the desired performance attribute and choose Properties (see Changing Properties and Method Assignments). Ensure that you choose Edit ® Properties ® Use for individual MTE so that you do not change the threshold values for the other monitored jobs.

· History and Log of Current Job

By default, these log attributes always have the color green. However, you can also assign a yellow or red alert to particular messages of the attribute. To do this, choose Properties and specify the class and ID of the desired message on the Filter tab page.

To determine this data for a message of the log attribute, follow the procedure below:

i. Select the desired log attribute and choose the Display Details button ().

ii. The Monitoring Attributes - Detail Data screen appears. To do this, select any row from the list of messages and choose Current Display Variant ().

iii. The Change Layout screen appears. Ensure that the fields for message class (MsgKlasse) and the message ID (MsgId) are displayed, and accept the changes.

iv. The class and ID of the message are now displayed in the list.

Using this monitor, you can monitor the status of background processing in your SAP system both for the entire system and itemized by application servers on which background work processes are configured. For a general introduction to background processing, see Background Processing: Concepts and Functions.

In addition to monitoring background processing in general, you can also monitor selected jobs using the Monitoring Architecture (see Monitoring Jobs with the Alert Monitor).

Features

The monitor contains the following monitoring tree elements (MTEs):

Activities

To start the monitor, follow the procedure below:

1. Start the Alert Monitor using transaction RZ20 or choose CCMS ® Control/Monitoring ® Alert Monitor.

2. On the CCMS Monitor Sets screen, expand the SAP CCMS Monitor Templates set.

3. Start the Background Processing monitor from the list by double-clicking it.

Procedure if an Alert Is Triggered

Utilization and SystemWideQueueLength show if there is a serious bottleneck in the capacity of the background processing. The optimal situation is that there is a high utilization of the work processes and a short wait queue length.

Background jobs are usually defined without a target server (Execution target in the Define Job initial screen of transaction SM36). This ensures an optimal distribution of the job workload. Jobs defined in this way therefore do not appear in the ServerSpecificQueueLength, but only in SystemWideQueueLength, meaning that the latter attribute is best for showing capacity problems in background processing.

If a bottleneck exists, it is often useful to divide the existing jobs between more servers. You can do this, for example, by switching dialog work processes to background work processes during the operation mode switch to night operation. Before you increase the number of background work processes, note that it does not make sense to have more than three background work processes for each CPU on a background server, as these work processes will already be fully utilizing the CPU. Set the number of these work processes using the system parameter rdisp/wp_no_btc.

For more information about this topic, see SAP Note 39412 (How many work processes to configure).

An alert for ServerSpecificQueueLength when there is a short SystemWideQueueLengthindicates that the distribution of the jobs is not optimal. You should only specify a target server when it is absolutely necessary that the job is started on this server.

Checking your job status with SM50 (processor type BTC) is more accurate then SM37. SAP updates the tables TBTCO wheneveryour background jobs status change. If SAP is shutdown, the currentjobs might not be update ontime to the table. (e.g. a background job wasshown as Active (SM37), in fact it real status should be Cancelled.

The type of work process:

• DIA - work process for executing dialog steps in user transactions
• UPD - update process for executing U1 (time-critical) database changes
• UP2 - update process for executing U2 (non-critical) database changes
• ENQ - for setting and releasing locks on SAP lock objects
• BTC - for executing background jobs
• SPO - for spool formatting processes

Can someone tell me what the difference between backgroud processing and batch processing is. Also does the access to this function be limited.

I have a requrinment where they want everyone to have access to batch processing and just wanted to know how i should be handling this request.

Please help

Answer:
You have to get clarification from the requester. Most often Batch and background mean the same. There is a SAP useage which means Batch Data Communication ( BDC) that is sometimes refered to as Batch but most often refered to as BDC. Batch anf Background is controlles with S_BTCH_JOB and BDC is S_BDC_MONI. You need clarification fromt he requester.

Answer:
And if the user also has S_BTCH_ADM = Y and S_BTCH_NAM = DDIC (or *), then they can schedule the jobs, release, delete etc (as per S_BTCH_JOB actions permitted), but.. in the name of and with the authorizations of the other user names.

You can check with SUIM reports who can use your user account (for example) without having to know your password.

The myth that one cannot logon with a batch user is therefore true, because you don't need to logon with it...

Cheers,
Bob

Answer:
There is no myth about "loggin on to a Batch id" it does logon to run the batch job it just cannot be used in DIALOG mode. S_BTCH_NAM allows you to run a batch job using that users' access be it DDIC ( which should not have SAP_ALL) or any other id BATCH or DIALOG.

Answer:
There is no myth about "loggin on to a Batch id" it does logon to run the batch job it just cannot be used in DIALOG mode. S_BTCH_NAM allows you to run a batch job using that users' access be it DDIC ( which should not have SAP_ALL) or any other id BATCH or DIALOG.

It does logon, but unlike Communication users, the password is not critical for this login so you can change it. Like Communication users, one does not have to know what the password is... just access to see that someone once did and left it behind in the system. For Communication users one does not need to know the password either, but changing it, would make the access to the user more difficult.

What is the general practice for running Background jobs? Under the individual's user ID or one generic ID which has wide authorisations?

If it is run under the individual ID, then how is it handled when the person leaves the company?

What are the pro's and con's of running it under one generic ID?

Thank you
Jaynick
_________________
SAP Rules!!!

Answer:
We make sure that all background jobs are scheduled against a background user. This way we ensure that there is sufficient access to complete the job without having to give the individual users the same level of access. At the same time we can lock leavers and inactive users without being concerned of jobs falling over

To do this, you need to make sure that only a limited number of people can schedule batchjobs against the background ID. If not, you risk people obtaining access they should not have.

You can also ensure that the jobs won't have a negative performance impact on the system, as they will be scheduled with the right parameters.

Hope it helps

Answer:
If you currently allow users to create background jobs, checking for jobs scheduled for a particular ID should be a standard part of user decomissioning.

Answer:
Thanks Henrik! Any other input from SAP fans as to what the general practice out in the world is?

Jaynick

Answer:
I have a question about this also. I understood that a Basis admin could schedule background jobs to run under the userid of a system user, so that the system user (non dialog) could be granted broad authorizations, and not the dialog user, and also no maintenance is required if basis admin leaves the company.

I know that there are a few things that will require that the basis admin who schedules the background job to run under the auths of the system user id, also have the authorizations in his/her role also, or they will not be allowed to schedule it to run under the system id, even if the system id has the auths. Which is an understandable security measure. But these are only for a few things like os command and program execution considered critical, and not like broad business applications which the admin would not have in his admin role, and yet there is no problem scheduling jobs under the system id which does process business application jobs.

I have been told by some that they needed to create a generic dialog user like "JOBSCHEDULER" and use it to schedule jobs. I don't understand why they need to do this. Can anyone tell me why there would be a technical problem if they simply used their own id to schedule these jobs to run under the authorizations of the system id set up for this purpose?
_________________
Gary Morris
SAP Security Analyst/Developer
garymorris@sapsecurity.net

Answer:
Hi Gary,

Do you mean that the job admin is a generic account? That makes the connection between the dialog user ID and the name of the background user in which the job step is running even more obscure...

The belief that SOD conflicts between dialog users with S_BTCH_NAM = 'BATCHUSER' and the authorizations of 'BATCHUSER' itself is bad enough!

If you mean the job steps running in the name of the generic account as a dialog user, I have observed some OSS notes on a related topic which you can find with a search on 'call transaction' (I was looking for something else). Some programs may call a transaction screen which is not a parameter transaction and requires dialog interaction - at least that is what I understood the notes to be describing.

If I find an example again, I will post it.

Noddy

Answer:
There are two types of background jobs:
1. Repetative Production scheduled jobs to support a business process.
2. Adhoc reporting in background to keep the dialog processes free for "real" work. ( transaction processing)

The repetative Production jobs should be formalized with a standard naming convention for the job name and scheduled by the Batch administrator at the appropriate time, generally on a basis person's id not a generic one as there is no accountability on a geeric ID. The batch admin will need sufficient access to create the job, not run the report if internal authorization is needed to run the report (generally S_BATCH_NAM and S_PROGRAM, plus the S_BTCH_ADM access is sufficient. This allows scheduling the jobs in ANY class to limit their run to a specific batch processes controled by basis), and the STEPS should be run under an ID setup as a batch ID for the specific module ( not a user and not the batch admin person), like BATCH_FIAR , BATCH_HR, BATCH_MM, BATCH_SEC, etc. the batch Ids (setting in SU01) should have broad functional module access, not all access.

Adhoc reporting SHOULD be encouraged to keep the dialog processes free to enter the data into the system that SAP was purchased for, entering sales orders, getting money, and paying bills, ALL more important tha a poorly defined batch job report.

The user should have access to schedule jobs but NOT S_BTCH_ADM, this then forces all the job into class C which allows basis to manage when and where batch jobs are run. Since the user is running a report in backgroung that they could run in foreground, the report SHOULD be part of their role and the report tied to the role menu and the access in the report granted. The job is then scheduled on the user' s ID and run under the user's ID.

Answer:
Thanks John, That is exactly what I have told others, but for some reason I did not understand, they were saying they had some kind of technical problem when using system admin IDs, instead of this generic one. I will try and narrow done exactly what it was. They understand that the job will not fail if the admin leaves if it is scheduled under a batch-id but they still want to use a generic dialog user to schedule all of the jobs under one batch id.

Will they encounter a technical problem if they schedule too many jobs under the same user? Will there ever be any difference in the performance of the background processing with the same user such as maybe some kind of wait time when the same system id is logging in for multiple jobs, whereas if the user ids were different it would not have waited? Or rfc trace files getting wierd error messages because the background user is trying to authenticate when it is not necessary such as wrong classification of the user id causes the kernel to handle the login in a way that it would not if the classification of the user type trying to connect was set to cpic instead of system etc..

To delete a job:
Go to Transaction SM37. Select a job (or jobs) from the Select Background Jobs screen. In the Job Overview, mark the job or jobs you want to delete by checking the box to the left of the job name. Choose Job --> Delete.


Deleting Jobs That Have Dependent Jobs:

If you delete a job that must be processed before another job can be started, the dependent job can no longer be started. The system will inform you of any such existing dependent, or successor, jobs. You'll then need to either reschedule or delete the dependent job.
If you try to release a job whose predecessor job was deleted, the system sets the status of the job to Planned. To start this job, you must release it and specify the start conditions.

We have a job which runs OK in foreground but when defined in background.
It failed and the log said it is an authorization problem. Unlike a
foreground job which we can always run SU53 after the execution to get
which auth is needed, the log of the background job didn't tell more
detail other than "it is an auth problem". Pls help us with this. is
there a way to find out what is the exactly reason after a background job
failed because of authorization?

thanks.

Answer:
Several solutions:
1) Copy the batch user to a dialogue user, then logon and run the job. You will then have your error online and maybe the SU53 you are looking for.
2) Check S_PROGRAM value for the batch user. Maje sure the batch user has activity BTCSUBMIT for the program auth group. Have you checked the job log in SM37?? You can usually drill-down to see some type of error. Common errors are S_PROGRAM and S_DATASET authotizations' missing.

Answer:
You can also run an authorization trace from ST01 for the "job step executor" (the background user) -- not the batch job scheduler, unless if they're run by the same people.

Also -- make sure you run ST01 on the exact application server the batch job is running to capture the trace.

Answer:
Tried to run the job online, it went through w/o problem.

Tried it in background again, failed with same authorization problem.

Does this make sense for you guys? Should running online and running in background have the same authorization check?

A job step can be any one of the following.
ABAP program
External command
External program

The start conditions of a job can be time based or event based.
Time based:
Immediate
At date/time On a chosen workday (defined as a certain workday per month)

All time-based start conditions can be periodic. That is, a job can be performed at regular, defined time intervals. Days that are not workdays can be treated as exceptions.

Event based:
After event (optional parameters can be used to further specify events) These can be periodic. That is, the job can be triggered every time the event occurs.
After job (this can depend on the status of the previous job)
At change of operation mode (for example, between day and night)

Go to transaction code rz04 then button Operation Modes / Instances. Then select the Operation mode and double click on it. Then you will see a window with no of Background work process. In the field named Class A increase the no to 1 (use the + button to increase that). Default value is zero. Then click on the save button to save the configuration

I need some opinions about following issue:

We have some jobs who have to be done every day. So, these jobs are planned every morning. The jobs are backgroundjobs and [b]one[/b] system user runs [b]all the jobs[/b]. Therefore, this system user has a SAP_ALL.
A system user can't login on a normal basis but I don't feel well with the SAP_ALL.

I have the idea to split this user in several system users, with a big profile of the module which need some background jobs. (HR-user for HR-backgroundjobs, FI-user for FI-backgroundjobs,...)

Is this realistic or is there an other solution? Maybe our situation at this moment isn't so bad as I think???
Can someone help me?

Thanks in advance!
Bart

Answer:
It's perfectly feasible to split them by function or module.

For non-sensitive stuff I generally have a user e.g. FIBATCH with auths to cover what's needed. It takes a bit more work to set up but helps keep things arranged in an orderly manner.

Answer:
I’ve been through audits in the past where they have been satisfied with the background user having SAP_ALL as long as you have tightly controlled who can actually schedule jobs etc against that ID.

Answer:
I’ve been through audits in the past where they have been satisfied with the background user having SAP_ALL as long as you have tightly controlled who can actually schedule jobs etc against that ID.

Its all about risk. System users can also be used as communications users and there are some tricks that could allow someone to abuse a systems user in an RFC call. (They involve a kind of password hack). If you restrict the authority of the systems user you can diminish the opportunity for abuse.

You also have to be very restrictive about authority for S_BTCH_NAM.
_________________
bwSecurity

Answer:
I’ve been through audits in the past where they have been satisfied with the background user having SAP_ALL as long as you have tightly controlled who can actually schedule jobs etc against that ID.
When I perform audits I prefer not to see the ID with SAP_ALL - as there are plenty of ways it can be misused if the required restrictions are not in place.

If you do want to use one user, at least use a chopped down version of SAP_ALL with some of the more sensitive auths removed or very tightly controlled to grant what specifically is used.

Keyword: BASIS
Title : Introduction to Background Jobs

Keyword: BASIS
Title : Defining Background Jobs

Keyword: BASIS
Title : Creating Background Jobs - Job Steps

We cannot stop the active background job, however we can pause the active jobs. Goto SA38 and run the report "BTCTRNS1" to suspend/deschedule all the scheduled jobs,ie Move Jobs with Status "Rescheduled due to Upgrade",use program BTCTRNS2 Release jobs with status "Descheduled due to upgrade".

Symptom

Corrective action

Symptom

Corrective action

Increase the swap space or decrease the R/3 Extended Memory.

If necessary, increase the roll area.

Check if the maximum process size (operating system parameter) is sufficient.

See: Swap Space Bottleneck During R/3 Operation

Go to transaction code RZ04 then button Operation Modes / Instances. Then select the Operation mode and double click on it. Then you will see a window with no of Background work process. In the field named Class A increase the no to 1 (use the + button to increase that). Default value is zero. Then click on the save button to save the configuration

Background Jobs:

Background processing is used to: Reduce the load on the dialog processor, as the dialog wp duration is limited.

You can define and schedule background jobs in two ways from the Job Overview:

• Directly from Transaction SM36.
  
• The Job Wizard : To use the Job Wizard, start from Transaction SM36, there you'll find Job Wizard

1. Call Transaction SM36.
2. Assign a job name. Decide on a name for the job you are defining and enter it in the Job Name field.
3. Set the job’s Priority or Job Class

• High priority: Class A
  
• Medium Priority: Class B
  
• Low priority: Class C

• For the system to use system load balancing to automatically select the most efficient application server to use at the moment, leave this field empty.
• To use a particular application server to run the job, enter a specific target server.

4. If spool requests generated by this job are to be sent to someone as email, specify the email address. Choose the Spool list recipient button.
5. Define when the job is to start by choosing Start Condition and completing the appropriate selections. If the job is to repeat, or be periodic, check the box at the bottom of this screen.
6. Define the by choosing Step, then specify the ABAP program,external command or external programe to be used for each step.
7. Save the fully defined job to submit it to the background processing system.

There are 6 status for background jobs


Scheduled - The job has been created, but it has not yet been assigned a starting time.
Released - The job has been created and it has been assigned a starting time.
Ready - The job is ready to be processed.
Active - The job is being processed.
Finished - The job has finished successfully.
Cancelled - The job did not finish successfully.

To check one's own Background Job's go to the TCode "SMX"