Data Description

The GW_ERROR_FND event (corresponding to SAP transaction /IWFND/ERROR_LOG for hub system) is used to obtain important detailed context information about the time and location of SAP Gateway frontend errors that have occurred at run time.

Potential Use Cases

This event could be used in the following scenarios:

  • Alert on specific error messages displayed in the error log

  • Correlate Gateway Front end errors with other occurrences in the environment such as Gateway backend errors

  • Determine error trends over time

  • Identify precise time and location of errors in source code

  • Perform root-cause analyses

  • Reproduce and correct errors

Splunk Event

The event will look like this in Splunk:

SAP Navigation

Log in to the SAP system and execute the /IWFND/ERROR_LOG transaction code. The SAP Gateway error logs will be displayed if present.

The Error Log comprises two screen areas:

  • Overview: All the data of overview screen are available to Splunk

  • Error Context: The Error Context screen area includes the following functions, which can be executed by choosing the relevant pushbuttons.

    • Error Context(XML Format)

      • Display error in the context in XML format.

    • Call Stack

      • Display call stack up to the source code line in which the error occurred.

    • Request Data

      • Display request XML that was sent from external consumer. It contains the HTTP request headers and payload.

    • Response Data

      • Display response XML sent from SAP Gateway. It displayed the HTTP response headers and payload.

For Event Type GW_ERROR_FND the above fields in the Error Context section are optional and if activated (using configuration) then are sent to the Splunk system (in XML string).

The metric configuration is used to customize a metric event based on requirements. To access the configuration, log into the managed system and execute the /N/BNWVS/MAIN transaction code. Then go to Administrator → Setup Metric → Metric Configuration.

For event type GW_ERRPR_FND, the value of the ERROR_CONTEXT field is set to be extracted to send it to Splunk based on the below configuration. To extract the other 3 fields’ information, put ‘Parameter Value’ as X.

Field Mapping

Field

Description

Unit of Measure

BACKEND_ERROR

Is Backend Error

Boolean (Set as X if Error location is Remote or Local BEP)

BALOGNO

Application log: log number

String

CALLSTACK_XML

Call Stack

String

CURRENT_TIMESTAMP

The date time stamp when the information was collected

 YYYYMMDDHHMMSS

DESTINATION

Destination

String

ERROR_COMPONENT

ABAP Component

String

ERROR_CONTEXT_XML

Error Context:  complete overview of context in which error occurred including technical attributes such as service name, request URI, SAP Business Suite system alias, and RFC destination

String

ERROR_COUNT

Error Count

String

ERROR_PACKAGE

ABAP Package

String

ERROR_TEXT

Error Text

 String

EVENT_SUBTYPE

 Not Applicable for this Event Type (always blank)

String

EVENT_TYPE

GW_ERROR_FND

String

EXPIRY_DATE

Expiry Date

YYYYMMDD

FIRST_DATE

Local Date of First Error

YYYYMMDD

FIRST_TIME

Local Time of First Error

HHMMSS

FIRST_TSTMP

UTC Time Stamp in Long Form

 YYYYMMDDhhmmssmmmuuun

GROUP_ID

OData V4 Service Group ID

String

HTML_PAGE

HTML Page (HTTP Client only)

String

HTTP_STATUS

HTTP Status Code

Numeric String

ICF_NODE

CF Node

String

LOCAL_DATE

Local Date

YYYYMMDD

LOCAL_TIME

Local Time

YYYYMMDD

LOCATION

Error Location

Single Character

LOG_LEVEL

Error Log Level

Single Character

LOG_LEVEL_C

Error Log Level Text

String

NAMESPACE

Service Namespace

String

NO_PAYLOAD_AUTH

XSD Truth Value: True/False [ext.]

Single Character

OPID

Operation ID

String

SUBNO

Entry number within an operation

Integer

REMOTE_ADDRESS

Remote Address

String

REQUEST_DATA_XML

Request Data

String

REQUEST_ID

Request ID

String

REQUEST_KIND

Payload trace - request kind

String

REQUEST_KIND_DESCR

Payload trace - request kind Description

String

REQUEST_URI

Request URI

String

RESPONSE_DATA_XML

Response data

String

SAPCLIENT

Client ID

String

SERVICE_NAME

Service Name

String

SERVICE_REPO

OData V4 Service Repository

String

SERVICE_VERSION

Service Version

Numerical String

SOURCE_INCLUDE

Source Include

String

SOURCE_LINE

Source Line

String

SOURCE_PROGRAM

Source Program

String

T100_MSGID

Message Class

String

T100_MSGNO

Message Number

Numerical String

T100_MSGV1

Message Variable

String

T100_MSGV2

Message Variable

String

T100_MSGV3

Message Variable

String

T100_MSGV4

Message Variable

String

TRANSACTION_ID

Transaction ID

String

USERNAME

User Name

String

UTCDIFF

The UTC OFFSSET in HHMMSS that the data was collected in

HHMMSS

UTCSIGN

The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.

+ | -