GW_ERROR_FND - SAP Gateway Frontend Error Log
Data Description
The GW_ERROR_FND event (corresponding to SAP transaction /IWFND/ERROR_LOG for hub system) is used to obtain important detailed context information about the time and location of SAP Gateway frontend errors that have occurred at run time.
Potential Use Cases
This event could be used in the following scenarios:
Alert on specific error messages displayed in the error log
Correlate Gateway Front end errors with other occurrences in the environment such as Gateway backend errors
Determine error trends over time
Identify precise time and location of errors in source code
Perform root-cause analyses
Reproduce and correct errors
Splunk Event
The event will look like this in Splunk:


SAP Navigation
Log in to the SAP system and execute the /IWFND/ERROR_LOG transaction code. The SAP Gateway error logs will be displayed if present.

The Error Log comprises two screen areas:
Overview: All the data of overview screen are available to Splunk
Error Context: The Error Context screen area includes the following functions, which can be executed by choosing the relevant pushbuttons.
Error Context(XML Format)
Display error in the context in XML format.
Call Stack
Display call stack up to the source code line in which the error occurred.
Request Data
Display request XML that was sent from external consumer. It contains the HTTP request headers and payload.
Response Data
Display response XML sent from SAP Gateway. It displayed the HTTP response headers and payload.
For Event Type GW_ERROR_FND the above fields in the Error Context section are optional and if activated (using configuration) then are sent to the Splunk system (in XML string).
The metric configuration is used to customize a metric event based on requirements. To access the configuration, log into the managed system and execute the /N/BNWVS/MAIN transaction code. Then go to Administrator → Setup Metric → Metric Configuration.

For event type GW_ERRPR_FND, the value of the ERROR_CONTEXT field is set to be extracted to send it to Splunk based on the below configuration. To extract the other 3 fields’ information, put ‘Parameter Value’ as X.

Field Mapping
Field | Description | Unit of Measure |
---|---|---|
BACKEND_ERROR | Is Backend Error | Boolean (Set as X if Error location is Remote or Local BEP) |
BALOGNO | Application log: log number | String |
CALLSTACK_XML | Call Stack | String |
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
DESTINATION | Destination | String |
ERROR_COMPONENT | ABAP Component | String |
ERROR_CONTEXT_XML | Error Context: complete overview of context in which error occurred including technical attributes such as service name, request URI, SAP Business Suite system alias, and RFC destination | String |
ERROR_COUNT | Error Count | String |
ERROR_PACKAGE | ABAP Package | String |
ERROR_TEXT | Error Text | String |
EVENT_SUBTYPE | Not Applicable for this Event Type (always blank) | String |
EVENT_TYPE | GW_ERROR_FND | String |
EXPIRY_DATE | Expiry Date | YYYYMMDD |
FIRST_DATE | Local Date of First Error | YYYYMMDD |
FIRST_TIME | Local Time of First Error | HHMMSS |
FIRST_TSTMP | UTC Time Stamp in Long Form | YYYYMMDDhhmmssmmmuuun |
GROUP_ID | OData V4 Service Group ID | String |
HTML_PAGE | HTML Page (HTTP Client only) | String |
HTTP_STATUS | HTTP Status Code | Numeric String |
ICF_NODE | CF Node | String |
LOCAL_DATE | Local Date | YYYYMMDD |
LOCAL_TIME | Local Time | YYYYMMDD |
LOCATION | Error Location | Single Character |
LOG_LEVEL | Error Log Level | Single Character |
LOG_LEVEL_C | Error Log Level Text | String |
NAMESPACE | Service Namespace | String |
NO_PAYLOAD_AUTH | XSD Truth Value: True/False [ext.] | Single Character |
OPID | Operation ID | String |
SUBNO | Entry number within an operation | Integer |
REMOTE_ADDRESS | Remote Address | String |
REQUEST_DATA_XML | Request Data | String |
REQUEST_ID | Request ID | String |
REQUEST_KIND | Payload trace - request kind | String |
REQUEST_KIND_DESCR | Payload trace - request kind Description | String |
REQUEST_URI | Request URI | String |
RESPONSE_DATA_XML | Response data | String |
SAPCLIENT | Client ID | String |
SERVICE_NAME | Service Name | String |
SERVICE_REPO | OData V4 Service Repository | String |
SERVICE_VERSION | Service Version | Numerical String |
SOURCE_INCLUDE | Source Include | String |
SOURCE_LINE | Source Line | String |
SOURCE_PROGRAM | Source Program | String |
T100_MSGID | Message Class | String |
T100_MSGNO | Message Number | Numerical String |
T100_MSGV1 | Message Variable | String |
T100_MSGV2 | Message Variable | String |
T100_MSGV3 | Message Variable | String |
T100_MSGV4 | Message Variable | String |
TRANSACTION_ID | Transaction ID | String |
USERNAME | User Name | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |