Using remote ATC for S4HANA readiness checks

In one of the previous blogs we explained how you can perform analysis on your system as preparation for the S4HANA upgrade. This blog will explain how to run detailed analysis on your custom code as preparation for S4HANA upgrade. Pre-condition is that you have installed 7.52 netweaver system and done the configuration for remote ATC as described in this blog.

Questions that will be answered in this blog are:

  • What do I need to do in order to set up the remote S4HANA readiness check in ATC?
  • How to run the remote S4HANA readiness check?
  • How to handle the results of the remote S4HANA readiness check?

How to set up remote ATC for S4HANA readiness check?

To run the remote ATC for S4HANA readiness check you must install a netweaver 7.52 system and configure the remote ATC. Instructions can be found in this blog.

In the central 7.52 ATC system you must then apply all the extra OSS notes needed that are listed in OSS note 2436688 – Recommended SAP Notes for using S/4HANA custom code checks in ATC.

In the SAP code inspector (for details see this blog) you can now find the S4HANA readiness variants:

SCI variants

How to run the S4HANA readiness in ATC?

To run the S4HANA readiness variant create in the ATC tool (for all details see this blog) a special S4HANA readiness run series:

ATC S4HANA readiness

In this run it is important to put your analysis system object provider into the variant!

Now start the ATC run and be patient. The run might take a few hours pending on your system size and Z code base sizing.

You can monitor the progress in the ATC run monitor:

ATC run monitor

You can also see here if any tool issues were reported. If tool issues are present, click on the underlined number and see if you can solve them. Most issues are SAP bugs and you need to apply an OSS note. Before creating new message for SAP make sure you have applied all recent notes for the S4HANA readiness check (2436688 – Recommended SAP Notes for using S/4HANA custom code checks in ATC) and all the remote ATC notes as explained in the remote ATC blog.

How to handle the results?

If the ATC run is finished you can look at the results in the central system:

S4HANA readiness check result

The results consist of a code point where a potential issue is. If you click on the code point you jump to the analyzed systems code.

There is also a note number which explains what you need to check.

Now basically 3 things can happen:

  • You can fix the issue directly: nice, the next run the issue is gone.
  • You read from the OSS note the function has changed or is no longer present in S4HANA. Read the OSS note for alternatives or check with your functional consultant on functional alternatives. Example of change is the way output and pricing is done. You know now it will be changed, but you cannot prepare in the current system. Use the list as input for project management for work estimation.
  • You read from the OSS note the potential issue and conclude it is not relevant for your situation. Example is material number length handling. If you use material numbers properly this is not relevant for you, but the tool will generate massive amounts of alerts. But maybe in some cases you need to intervene.

To distribute the results, apply OSS note 2499684. This enables you to download the ATC results into xls spread sheet. From here it is easier to follow up if action is needed for long list (like material number length) or not.

If you have done your first round of check, you want to rerun. But some notes you might have detected as not relevant and you want to exclude them.

To do this copy the SCI S4HANAREADINESS variant to your own variant. Then change the SCI variant to exclude the OSS notes you don’t want to see any more:

Exclude S4HANA OSS note




Now rerun the ATC with the new variant. The list you get will be smaller. Repeat this iterations as long as needed.

Don't change the originally SAP delivered SCI variants. New features and bug fixes by SAP will update this variant. If you have an updated SAP variant, simply copy it again to your Z variant and redo the exclusion of OSS notes.

S4HANA 1809 update

If you previously installed remote ATC for a 1709 check and want to run now for S4HANA 1809 there are a few update steps to follow.

First step is to install OSS note 2659194 – Check variant for SAP S/4HANA 1809 custom code checks and carry out the manual aftercare action. This will deliver you the SCI variant for S4HANA_READINESS_1809.

If you now run remote ATC without step 2, you get the issue described in OSS note 2532285 – ATC: Inspection was not executed because target release information cannot be processed.

Step 2 is to update the simplification content to version 1809. You have to download the content from SAP software site and upload it in your ATC 7.52 system. For this step follow the instructions from OSS note 2241080 – SAP S/4HANA: Content for checking customer specific code.

Short summary of these steps in this note: download the most up-to-date simplification database:

Simplification content

In the 7.52 central ATC system use tcode SYCM to upload this file.

Update new content procedure

Now you are good to go for the S4HANA 1809 readiness check for custom code.


Enabling ATC for remote checks

By using a Netweaver 7.52 server (or newer) you can use that server a central ATC server for running the ATC. For explanation on ATC itself, please check this blog.

Questions that will be answered in this blog are:

  • What are reasons for running remote ATC checks?
  • How to set up remote ATC checks?
  • Which limitations does remote ATC checks have?

Reasons for running remote ATC checks

There are several reasons why you might want to do this:

  • Run ATC against an old 7.00/7.01/7.02 system, where ATC is not delivered by SAP
  • Run ATC for S4HANA Readiness checks
  • Run the latest ATC checks and you want to use the new baseline function
  • Run the ATC tool centrally when you have more development systems, but still want to maintain the ruleset only once
Consider very carefully if the benefits you are looking for are worth the setup work below.

The master OSS note for the remote checks is 2375864 – ATC: Remote Checks – Developer Scenario.

Central system

First of all you need a 7.52 or higher system. This might already be big stumbling block if you don’t have this. In past blogs and notes you might find it works for 7.51 as well, but this will have severe limitations. For example the S4HANA Readiness only works properly on 7.52.

Read note 2364916 – Recommended SAP Notes for using ATC to perform remote analysis. Goto the section of the central check system for your version and see which OSS notes you need to apply so solve the known bugs.

Checked system

The master note 2375864 – ATC: Remote Checks – Developer Scenario  contains the OSS notes to be applied for the older versions. For the newer versions OSS note 2190065 – ATC/CI: Remote Code Analysis – Object Provider Stub is needed.

This looks like a simple action, but it is not. It will pull in dependent OSS notes. One of these notes is the key OSS note 2270689 – Remote Analysis (for source system).

Note 2270689 is a HUGE OSS note. It takes 15 to 20 minutes to download and will result into a time-out dump is you have standard 10 minutes set. Ask basis team to set rdisp/max_wprun_time and rdisp/scheduler/prio_high/max_runtime to 30 minutes for you to able to download this note.

Per checked system you will need an RFC connection from the central system to the checked system.

To initialize the remote check per checked system you must run program RS_ABAP_INIT_ANALYSIS:


Also run this program in the central system!

Configuring the central system

Start transaction ATC and goto the setup menu to set the system role:

System role menu

Select here the second option to make it a central system:

Set central system role

Then goto the menu for setting up the object providers:

Object providers

First create a group:

System group

The fill the RFC Object providers:

RFC object provider link to RFC connection

The vital element here is the RFC connection that you have created from the central system to the local system.

Make sure in the central system by testing in SM59: the connection is properly working. Also make sure that the user in the checked sytem has sufficient RFC rights to execute the remote ATC checks.

Setup the SCI variant for remote execution

In the central system set up the SCI variant for remote execution.

Be aware here one of the major limitations: you can only select the check which SAP has enabled for RFC based check:

Central SCI based on RFC

Remote ATC run execution

In the central sytem now define the ATC to run:

Remote ATC check definition

Important here:

  • The check variant has to be defined in the central system
  • The variant runs against the selected object provider you have just defined

After the first run you must likely will get check tool failures:

Check tool failures

Read the failures carefully and solve them one by one.

End result

The end result is the same as with the local system. By clicking on the code you will jump from central to checked system.

Keep end users out of the system during maintenance

This blog will explain an elegant new way to keep end users out of the system during maintenance.

Questions that will be answered are:

  • How does the login/server_logon_restriction parameter work?
  • How do I assign the right to logon during maintenance?

Traditional ways of keeping users out of the system during maintenance

Traditionaly ways of keeping users out of the system is by locking the users either via SU10 or custom built program.

Major setbacks of both methods:

  • Locking and unlocking takes time
  • In the user history you see constant lock and unlocks that you need to explain to auditors

New login/server_logon_restriction parameter

In more recent SAP systems (7.5 and up) there is a new parameter called login/server_logon_restriction.

RZ11 parameter login server_logon_restriction

If you set this to 1 then only people with the right privilege can log on to the system. The parameter is immeditately effective. All non-privileged users will get this error when they try to log on to the system:

Server restricted logon

After the system maintenance you can set the parameter back to normal and everybody can log on again. User history is not touched.

Be aware this is a dynamically switchable parameter. If you set the value to 1 and need to restart the system during your maintenance the value after restart is back to 0, which means everybody can log on again.

How to assign the privilige to log on to basis administrators?

First you need to create or extend the user security policy for basis admins using transaction SECPOL. Add the policy attribute SERVER_LOGON_PRIVILEGE and set it to value 1.


Now you can add this security policy to all basis team members in SU01:

Assign security policy ADMIN to user

All persons with security policy ADMIN are now still allowed to log on during the maintenance when parameter login/server_logon_restriction is set to 1 in RZ11.

Other use of security policies

Security policies can also be used to enhance security of specific user groups (like basis team). See this blog for more on this feature.


Text on logon screen before and after logon

This blog will explain how to get text on the SAP logon screen before users logon and on the screen after users logon.

If you want to load a picture after the logon screen, please see this blog.

Questions that will be answered are:

  • How to add a text to the logon screen?
  • How to include icons?
  • How to put a text after the logon screen in stead of a picture?
  • How to put a clickable URL in the text after the logon screen?

Setting text before logon

The text to be shown before logon is maintained via transaction SE61. Select General text and for the name select ZLOGIN_SCREEN_INFO.


Now press change:


Enter the text you want to show to the users.

If you want to show SAP icons in the text start transaction SE38 and run program RSTXICON. Run it as ABAP list. Look for the icon you want and lookup the code. Please it between 2 @ symbols.

End result looks like this:


Adding a text after the logon screen

After the logon screen you can either add a picture or a weburl. But no text or text with hyperlink. To achieve this we will do a small development trick. We put the text on a webdynpro page and add the webdynpro page as URL for the start screen.

First develop the webdynpro in SE80:

ZSTARTPAGE webdynpro

We will call the webdynpro ZSTARTPAGE. In our example there is a text (caption) and a LinkToUrl. The LinkToUrl has a text and a hyperlink and will show as a clickable element to the user. Save and generate the webdynpro. Test the webdynpro and note down the URL of the webdynpro.

Start transaction SM30_SSM_CUST to maintain the customizing for logon screen and other items. In the parameter SESS_URL fill out the webdynpro URL. If the parameter SESS_URL does not yet exist, just create it.

The end result will look like this:

Text after logon including hyperlink

Depending on the security settings of the system you might need to tweak the SICF node of the webdynpro to suppress a password popup.