Data Description

The SM21_LOG event is used in SAP to view the system log.

Potential Use Cases

This event could be used in the following scenarios:

  • Alert on specific error messages displayed in the system log.

  • Visualize system health status by application server.

  • Determine error trends over time.

  • Correlate system errors with other occurrences in the environment such as database events.

Metric Filters

This filter is used to select or exclude specific messages from the system log and is an optional configuration to control data volume sent to Splunk. By default, all system log messages are collected by PowerConnect. To access the filter, log into the managed system and execute the /n/bnwvs/main transaction code. Then go to Administrator → Metric Filters → More → SM21 Sys.Log Filter.

Then select the “New Entries” button and enter the desired configuration based on the configuration options defined below, and Save:

  • SAP Instance - This field is mandatory, and is the instance from which you would like to extract the data. To extract data from all instances, enter a wildcard value (i.e. “*”).

  • Clt - This field is mandatory and is the client from which you will extract the data.

  • User - This field is mandatory and is the user related to the system log. To extract data for all users, enter a wildcard value.

  • Grp - This field is mandatory and represents the system log message group. To extract data for all message groups, enter a wildcard value.

  • N - This field is mandatory and represents the message group sub-name. To extract data for all the message group sub-names, enter a wildcard value.

  • Message Text - This field is optional and represents the message text from the system log. To extract data for all messages, enter a wildcard value.

  • INCL/EXCL - This field is mandatory and is an exclusion or inclusion criteria. To exclude the values defined in the selection criteria enter an “E“ in the field. Similarly, to include the values defined in the selection criteria enter an “I” in the field.

  • Active - This field is mandatory and is a checkbox used to enable or disable the filter criteria. To activate the filter criteria, ensure the checkbox is checked. Conversely, if you would like to disable data collection ensure the checkbox is unchecked.

Here is an example of the filled-out filter:

Splunk Event

The event will look like this in Splunk:

SAP Navigation

To access to the SM21 system log, log into the managed system and execute the SM21 transaction. You will then be brought to a user selection parameter screen. Fill out the user selection parameters as desired and select the Execute button.

You will then be brought to the system log, which matches the data that is extracted and sent to Splunk.

Field Mapping

Field

Description

Unit of Measure

AREA

System Log: Group of 36 System Log Messages

String

BEWERTUNG

Evaluation Path

String

CLASID

System Log: Classification ID for Messages

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

DATE

Date

DD.MM.YYYY

DATE_INT

CHAR08

YYYYMMDD

DEVCLASS

Package

String

EVENT_SUBTYPE

String

EVENT_TYPE

SM21_LOG

String

FILE_NO

SysLog: File number

Number

ICON

Icon for Priority Status

String

INSTID

SysLog: Instance name (System & Computer & Number)

String

MAND

TODO: Client

Number

POS

SysLog: File offset

Number

REPNA

Program Name

String

SUBID

System log: Third character of message name

String

TASK

System log: SAP process name

String

TERMINAL

Terminal name

String

TEXT

Database Error Message

String

TIME

Time

HH:MM:SS

TRANSCODE

Transaction Code

String

TSKNA

Type

String

TSKNU

Type

Number

USER

System log: SAP user name

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -