The SM21_LOG event is used in SAP to view the system log.
Potential Use Cases
This event could be used in the following scenarios:
Alert on specific error messages displayed in the system log.
Visualize system health status by application server.
Determine error trends over time.
Correlate system errors with other occurrences in the environment such as database events.
This filter is used to select or exclude specific messages from the system log and is an optional configuration to control data volume sent to Splunk. By default, all system log messages are collected by PowerConnect. To access the filter, log into the managed system and execute the /n/bnwvs/main transaction code. Then go to Administrator → Metric Filters → More → SM21 Sys.Log Filter.
Then select the “New Entries” button and enter the desired configuration based on the configuration options defined below, and Save:
SAP Instance - This field is mandatory, and is the instance from which you would like to extract the data. To extract data from all instances, enter a wildcard value (i.e. “*”).
Clt - This field is mandatory and is the client from which you will extract the data.
User - This field is mandatory and is the user related to the system log. To extract data for all users, enter a wildcard value.
Grp - This field is mandatory and represents the system log message group. To extract data for all message groups, enter a wildcard value.
N - This field is mandatory and represents the message group sub-name. To extract data for all the message group sub-names, enter a wildcard value.
Message Text - This field is optional and represents the message text from the system log. To extract data for all messages, enter a wildcard value.
INCL/EXCL - This field is mandatory and is an exclusion or inclusion criteria. To exclude the values defined in the selection criteria enter an “E“ in the field. Similarly, to include the values defined in the selection criteria enter an “I” in the field.
Active - This field is mandatory and is a checkbox used to enable or disable the filter criteria. To activate the filter criteria, ensure the checkbox is checked. Conversely, if you would like to disable data collection ensure the checkbox is unchecked.
Here is an example of the filled-out filter:
The event will look like this in Splunk:
To access to the SM21 system log, log into the managed system and execute the SM21 transaction. You will then be brought to a user selection parameter screen. Fill out the user selection parameters as desired and select the Execute button.
You will then be brought to the system log, which matches the data that is extracted and sent to Splunk.
Unit of Measure
System Log: Group of 36 System Log Messages
System Log: Classification ID for Messages
The date time stamp when the information was collected
SysLog: File number
Icon for Priority Status
SysLog: Instance name (System & Computer & Number)
SysLog: File offset
System log: Third character of message name
System log: SAP process name
Database Error Message
System log: SAP user name
The UTC OFFSSET in HHMMSS that the data was collected in
The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in.
+ | -