SU01

Data Description

The SU01 event is used to give a visibility of users maintained in managed SAP system. The extractor supports extraction from multiple clients. Following information is collected: list of users with basic attributes (EVENT_SUBTYPE=””), user profiles (EVENT_SUBTYPE=”PROF”) and user roles (EVENT_SUBTYPE=”ROLE). Default interval is 24 hours.

Potential Use Cases

This event could be used in the following scenarios:

• Identify potential anomalies in the environment

• Dashboard users with certain attributes, profiles or roles.

• Lookup user profiles and roles.

Metric Filters

Metric filters are an optional configuration option for the SU01 extractor.

Extract Data From Multiple Clients

If you would like the SU01 data to reflect data from multiple clients, please follow the steps below:

• Log into the managed client where PowerConnect is installed

• Execute the /n/bnwvs/main transaction.

• Stop the PowerConnect batch jobs.

• Go to Administrator --> Setup Metric --> Metric Configuration

• In the row with SU01 in the Group Definition field and MULTICLIENT in the Parameter Key field, add an X to the Parameter Value field as seen below. Then Save.

• Start the PowerConnect batch jobs in the administrative console.

Splunk Event

SU01 with EVENT_SUBTYPE=””

The event will look like this in Splunk:

SU01 with EVENT_SUBTYPE=”ROLE”

The event will look like this in Splunk:

SU01 with EVENT_SUBTYPE=”PROF”

The event will look like this in Splunk:

SAP Navigation

Log into the managed system and execute the SU01 transaction code.