The GW_ERROR_FND event (corresponding to SAP transaction /IWFND/ERROR_LOG for hub system) is used to obtain important detailed context information about the time and location of SAP Gateway frontend errors that have occurred at run time.
Potential Use Cases
This event could be used in the following scenarios:
Alert on specific error messages displayed in the error log
Correlate Gateway Front end errors with other occurrences in the environment such as Gateway backend errors
Determine error trends over time
Identify precise time and location of errors in source code
Perform root-cause analyses
Reproduce and correct errors
The event will look like this in Splunk:
Log in to the SAP system and execute the /IWFND/ERROR_LOG transaction code. The SAP Gateway error logs will be displayed if present.
The Error Log comprises two screen areas:
Overview: All the data of overview screen are available to Splunk
Error Context: The Error Context screen area includes the following functions, which can be executed by choosing the relevant pushbuttons.
Error Context(XML Format)
Display error in the context in XML format.
Display call stack up to the source code line in which the error occurred.
Display request XML that was sent from external consumer. It contains the HTTP request headers and payload.
Display response XML sent from SAP Gateway. It displayed the HTTP response headers and payload.
For Event Type GW_ERROR_FND the above fields in the Error Context section are optional and if activated (using configuration) then are sent to the Splunk system (in XML string).
The metric configuration is used to customize a metric event based on requirements. To access the configuration, log into the managed system and execute the /N/BNWVS/MAIN transaction code. Then go to Administrator → Setup Metric → Metric Configuration.
For event type GW_ERRPR_FND, the value of the ERROR_CONTEXT field is set to be extracted to send it to Splunk based on the below configuration. To extract the other 3 fields’ information, put ‘Parameter Value’ as X.