Data Description

The SM58 event is used in SAP to view and address errors associated with the asynchronous RFC error log.

Potential Use Cases

This event could be used in the following scenarios:

  • Alert on tRFC failures.

  • Identify failures associated with specific transactions for a business process monitoring use case.

  • Correlate with RFC connection data to determine the impact of any RFC connection failures.

  • Trend tRFC errors over time.

Splunk Event

The event will look like this in Splunk:

SAP Navigation

To access the SM58 data, log into the managed system and execute the SM58 t-code. Then enter the user selection parameters, and select the execute button.

The data visible will match the data in Splunk.

Field Mapping

Field

Description

Unit of Measure

ARFCDATUM

System Date

YYYYMMDD

ARFCDEST

Logical Destination (Specified in Function Call)

String

ARFCFNAM

Name of Function Module

String

ARFCIPID

Host ID (IP ID

String

ARFCLUWCNT

Counter within a transaction (LUW)

String

ARFCMSG

Message Variable

String

ARFCPID

Process ID

String

ARFCRESERV

Horizontal Line

String

ARFCRETRYS

No. of attempts

Number (Count)

ARFCRETURN

Reply expected

String

ARFCRHOST

Application server

String

ARFCSTATE

Status of an ARFC call (RECORDED,CPICERR,MAILED,READ..)

String

ARFCTCODE

Transaction Code

String

ARFCTIDCNT

Transaction ID (LUW -> COMMIT WORK)

String

ARFCTIME

Time Stamp

String

ARFCUSER

User Name

String

ARFCUZEIT

System Time

HHMMSS

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

String

EVENT_TYPE

SM58

String

HASH

HASH for tRFC/qRFC

Integer

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -