Data Description

The ST06 transaction is used to display information from the OS (via the SAPHostAgent) about it’s resources including CPU, RAM, Disk & Network.

Potential Use Cases

This event could be used for the following scenarios:

Measure, monitor and alert on the following hardware resources:

  • CPU load, utilization, context switches, queue length

  • Memory used & free

  • Swap used / free

  • Network KB, packets in/out and collisions per second

  • Number of CPUs visible to the OS

Splunk Event

The event will look like this in Splunk:

SAP Navigation

List of Selected Runtime Errors

Navigate to this data by using the ST06 t-code and the information displayed when you first enter is what is captured by the ST06 extractor and sent to Splunk in this EVENT_TYPE.

The detail about specific resources like CPU and LAN (network) adaptors are contained in the EVENT_SUBTYPE(s)

  • CPU_SINGLE

  • LAN_SINGLE

CPU_SINGLE subtype contains information about specific processes in the operating system, it shows the following information per process.

Field Mapping

Field

Description

Unit of measure

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

“CPU_SINGLE”

IDLE_CPU

Measures unused CPU capacity (100-(SYS_CPU+USER_CPU))

%

INSTANCE_NAME

SAP instance that the data was collected on

String

SERIALNR

Serial number in saposcol result structure

Number

SUBTYPE

Subtype in saposcol result structure

Number

SYS_CPU

Measures Kernel/System CPU load

%

TYPE

Type in saposcol result structure

Number

USER_CPU

Measures User/applications CPU load

%

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCTIME

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -

LAN_SINGLE records the performance metrics of each LAN adaptor individually.

Field Mapping

Field

Description

Unit of measure

COLLISIONS

Number of packet collisions

Count (cumulative)

CURRENT_TIMESTAMP

The date time stamp when the information was collected

YYYYMMDDHHMMSS

EVENT_SUBTYPE

“LAN_SINGLE”

String

INSTANCE_NAME

SAP instance that the data was collected on

String

IN_ERRORS

Number of inbound packet errors (typically SAP system start up - but can be reset to 0)

Count (cumulative)

IN_PACKETS

Number of inbound packets (typically SAP system start up - but can be reset to 0)

Count (cumulative)

LANNAME

Name of the LAN adaptor

String

PACKETS

Total number of packets in / out since data collection started (typically SAP system start up - but can be reset to 0)

Count (cumulative)

OUT_ERRORS

Number of outbound packet errors (typically SAP system start up - but can be reset to 0)

Count (cumulative)

OUT_PACKETS

Number of outbound packets (typically SAP system start up - but can be reset to 0)

Count (cumulative)

SERIALNR

Serial number in saposcol result structure

Number

SUBTYPE

Subtype in saposcol result structure

Number

TYPE

Type in saposcol result structure

Number

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCTIME

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -