ST05 SQL performance tracing

Performance issue solving is an important job for ABAP and basis consultant. One of the helpful tools is ST05 SQL performance trace tool.

Questions that will be answered in this blog are:

  • How to switch on ST05 SQL trace?
  • How to read the results from the ST05 SQL trace?
  • How to use the ST05 SQL trace with multiple application servers?

The test program

First we create a small test program for our performance analysis.

REPORT zperftest.

DATA: zlt_vbak TYPE TABLE OF vbak.
DATA: zls_vbak TYPE vbak.
DATA: zlt_vbap TYPE TABLE OF vbap.
DATA: zls_vbap TYPE vbap.

SELECT * FROM vbak INTO TABLE zlt_vbak UP TO 1000 ROWS.

LOOP AT zlt_vbak INTO zls_vbak.
  SELECT * FROM vbap INTO zls_vbap.
    DO 10 TIMES.
      CALL FUNCTION 'BAPI_MATERIAL_EXISTENCECHECK'
        EXPORTING
          material = zls_vbap-matnr+0(18).
    ENDDO.
  ENDSELECT.
ENDLOOP.

Off course this program is written very badly to be really slow and making performance issues.

ST05 SQL trace

Start the ST05 SQL trace tool with transaction code ST05.

You can activate the trace for all users with the button Activate trace. But this is usually not needed and will only give you a long trace to analyze.

The usual method is to activate the trace with a filter, mostly on user name to trace a specific user action:

If the authorization team already started on ST01 authorization trace, you cannot start the SQL trace. First stop the ST01 trace. 

Now you can start the performance test program in a different session. Just wait until it is finished. It is important the user you are tracing is only doing this action and does not perform any other action, since these other actions are also recorded and will make the analysis harder to read.

When completed go back to the ST05 and click Deactivate trace.

Trace analysis based on duration

Now press the Display trace to see the results. If your trace is large you will get this screen:

This is quite common and click yes. If your result is really too big, change the 5000 on the first screen in to a good maximum, or try to record a smaller time frame.

Result now looks like this after sorting on the column duration:

You can see that the total SQL commands took 48 seconds in total. The longest SQL single command took 78 milliseconds (which is very fast, so long running SQL’s are not the issue in this example).

In your case you might find very large single SQL commands. By selecting the line and pressing the button Display ABAP call location, you can jump to the place in the coding that fired the SQL command.

Summarized trace analysis

Since we have many records and many small ones, we need to use the summary tools. In the trace analysis select menu path Trace and then Structure Identical statements. This will give the following surprisingly short overview:

In the third column you can see that there are 100 identical calls, and also a high number of redundant calls.

If you now click on the second line to the ABAP call position you jump to our badly performing program and see that the majority of the delay is coming from the do 100 times loop. The first line is coming from standard SAP in the BAPI call.

This happens in real live as well that not all calls will point you into the right program. You might have to check multiple lines to find the right program causing the issue.

Multiple application servers

Development systems normally have only 1 application server. Productive servers can have more. If you have to analyze a performance issue directly on production with ST05, you have to be aware that the performance trace is per application server. If needed, you can select in ST05 as specific server, or you can select all. The trace display is still per server.

Delete ABAP developer keys

This blog will answer the following questions:

  • How to delete old ABAP developer keys from my system?

ABAP developer keys clean up

If ABAP developers leave their key is still in your system and could potentially misused. Also when SAP comes to measure licenses they might peek in table DEVACCESS to see which developer keys are present.

Unfortunately SAP does not deliver a standard program delete an unused ABAP key. See OSS note 1710320 – How to delete SSCR Object and/or Developer Keys – SAP ONE Support Launchpad.

So you simply have to write your own customer program with a code that looks like:

DELETE FROM DEVACCESS WHERE UNAME EQ '<USERNAME>'.

Developer key hack

The developer keys are not safe, so don’t rely on them. See this blog.

Analyzing code before upgrade or support package: CDMC toolset

This blog will explain on the tools you can run analyzing your code before starting upgrade or support package.

CDMC toolset

Start transaction CNV_CDMC to goto the CDMC overview.

 

Goto ad hoc analysis:

CNV_CDMC start screen

Start SAP modification run

Determine SAP modifications run

Wait for run to finish. If done, click the Display Results.

Run ready

View results:

Run results

Setback of the modification overview: also OSS notes are marked as modifications.

Other useful runs: Syntax check and Inactive customer objects.

If you run these checks before an upgrade you can save quite some annoying issues during the upgrade itself.

DB01 Oracle Lock monitor

This blog will answer the following questions:

  • How does a deadlock look like in DB01 Oracle lock monitor?
  • How can I solve the issue?

Deadlocks

A database deadlock can occur when 2 or more processes are trying to update each other and are also waiting for each other. This process will lead to infinite waiting.

DB01 Oracle lock monitor

With the use of transaction DB01 you can get overview of Oracle locks. A deadlock is observed when the status is on HOLD and more processes are in status WAIT.

Solving the deadlock can be done by the Oracle DBA on database level.

Shared objects memory

ABAP programs (standard SAP and custom) use the shared memory objects technology.

Questions that will be answered in this blog are:

  • How to set the shared objects memory size?
  • How to monitor usage of shared objects memory?

Monitoring shared objects

Shared objects can be monitored with transaction SHMM:

In the start screen you can see the objects now loaded and how much memory they consume. In the start screen you can also delete and invalidate the shared memory objects.

The deletion can lead to short dumps. Only use this in emergency cases and when you are really sure

In the second tab you can see the total memory overview:

Setting shared memory objects memory size

In RZ11 with system parameter abap/shared_objects_size_MB you can set the shared object size in MB. A restart of the system is required to activate any change.

Older documentation says 500 or 1000 MB is sufficient. In newer systems a value of 3000 to 5000 in not uncommon.

Direct table hacking

Changing directly data on an SAP table is the IT admin and IT auditors worst nightmare. This blog will show you the ways it can be done.

Questions that will be answered in this blog are:

  • How can I directly edit tables?
  • How can I prevent direct table editing?
  • How can I detect direct table editing?

Direct table editing method 1: function module SE16N_INTERFACE

This method is available in the SAP S4HANA system. Start with transaction SE37 and key in function module SE16N_INTERFACE. Now press the test button. In this demo we will change dates for sales order table VBAK. In the SE37 test screen enter table VBAK and very important put X in the I_EDIT and I_SAPEDIT fields.

Now hit execute and voila: you are in direct edit mode:

Now we change a few values (date to the year 2027…) and press save:

Data is changed.

Detection of this method: none. In audit logging you can see the user started SE37 in test mode, but you cannot see which module was done, neither is the data change logged.

Prevention of this method: deny access to this function module.

Direct table editing method 2: debug/replace

Start transaction SE16 and show the data of the table to edit. Example in this case VBAK data:

Now select a line and put /h for debugging in the command line input. Press enter and the debug screen will open. Double click on the SY-UCOMM field:

In the variables screen now change the value ENTR (for the enter command you gave) to value AEN2 (command to change). Make sure the value is accepted. Now hit F8 to continue. And voila: edit mode:

Change the values (dates in this example) and press save:

How to detect this method: in the SAP audit log (activation of audit log is explained in this blog) show the change in debug/replace mode:

Prevention of this method: don’t hand out debug/replace rights.

STAUTHTRACE: improved authorization trace

If you are still using the old classic ST01 authorization trace, do keep on reading and you will want to switch to the new STAUTHTRACE improved authorization trace.

Questions that will be answered in this blog are:

  • How to run the new STAUTHTRACE tool?
  • What are the major improvements in STAUTHTRACE tool?

Running new STAUTHTRACE tool

To run the new tool start transaction STAUTHTRACE. If the tcode is too complex, add it as favorite to your start screen.

From the start screen you see the immediate benefits. You can start the authorization trace for:

  • All application servers in one go (this is highly useful in an authorization issue with RFC users or background users where you have no control on which application server it will run): just record on all servers
  • Specific user only, but errors only: this will reduce your logging footprint to errors only
  • Filter the results to not show duplicate entries

Results

The result screen from STAUTHTRACE is similar to ST01 trace

But the result is more comprehensive, since it can take errors only, with duplicates filtered and take data from all application servers. This make the result complete and more easy to catch authorization issues.

Background

The background and all feature of STAUTHTRACE are kept in SAP OSS note 2577291 – How to get trace of authorization checks using transaction STAUTHTRACE.

Generating substitution and validation rules

In the FICO module the consultant can define substitution and validation rules. These rules must be generated before they are active.

Questions that will be answered in this blog are:

  • How can I generate substitution and validation rules?
  • Where can I find more background on substitution and validation rules?

Substitution and validation rules generation

Goto SE38 and start program RGUGBR00:


Substitutions and validations

Simple select the correct application are indicated by the FICO consultant (this area can be FI, CO, etc). Select Generate validations and Generate Substitutions. Now execute.

Transport and system copies

You will need to run program RGUGBR00 locally on the system after the transport import is done.

Also after a system copy program RGUGBR00 must be run again.

Background on substitutions and validations

The full functional background on substitution and validation can be found this SAP wiki.

Licenses for SAP solution manager

SAP solution manager licenses have been renewed last few years by SAP.

Questions that will be answered in this blog are:

  • Do I need a user license for solution manager users?
  • If I run solution manager on HANA, do I need to pay HANA database licenses?
  • How can I get Focused Build and Focused Insights?

User licenses for SAP solution manager

Since 1.1.2018 the requirement of having named users was dropped by SAP.

HANA database licenses

If you want to run HANA database below SAP solution manager as database, you need to procure the infrastructure. The HANA database rights are included in SAP solution manager. This is the only exception SAP has. For all other use case you need to pay for HANA as database as well.

Using SAP solution manager for non-SAP components

You can use SAP solution manager to manage non-SAP components as well. Especially the ITSM service desk component can be used for this. When you use this function for non-SAP components, you will need SAP enterprise support rights for SAP solution manager in stead of the SAP standard support.

Focused Insights and Focused Build

SAP offers Focused Insights and Focused Build as extra options on top of SAP solution manager. Both are installed as add-on. Focused Insights brings extra dashboard building capabilities. With Focused Build you can get an extra grip on your solution build process.

In 2019 both solutions require SAP MaxAttention or need to be procured. As of 2020 both solutions are part of standard maintenance contract. For 2019 prices and 2020 announcement see the SAP blog.

Focused Run

Focused Run is separate solution with separate license to optimize the running of large SAP landscapes.

More background information

More information can be found on the SAP solution manager usage rights website.


Transaction SPOOL

Transaction SPOOL can be used as a central starting place for all printing and spool related settings, tools, error analysis.

Simply start transaction SPOOL:

Now switch from Standard Mode to Expert Mode to enable all tool.

Double clicking on the line will start the tool. On the right hand side are the transaction codes and the OSS note numbers for specific additional explanation.