Skip to Content

SAP GRC v10.1 SP19 S_Service false violation

May 06 at 04:57 AM


avatar image
Former Member


We are having the following issue during our upgrade:

S_Service role violations where the Ruleset does not even have it, but the role violating has S_Service with both fields as “ * “. That rule is not even in that risk or function.

Additionally, I have seen a lot of mentions of this phrase which is directly out of the SAP Note “adjust your Ruleset”. What is meant by that? Because our Ruleset does not contain one entry for S_Service either active or inactive.

Thanks in advance.


10 |10000 characters needed characters left characters exceeded
* Please Login or Register to Answer, Follow or Comment.

1 Answer

Ken Golden May 10 at 05:46 PM

Hi John,

Which ruleset are you utilizing?

You need to check which Logical Groups your target system is assigned to within "Maintain Mapping for Actions and Connector Groups" in SPRO. Rulesets are uploaded, or activated, for specific systems or for Logical Groups, or both.

S_SERVICE could be in a ruleset that was uploaded to one of the Logical Groups that the system belongs to, and you may just not know it.

You should use program GRAC_DOWNLOAD_RULES and download each available "System" ruleset, including all Logical Connectors rulesets, and find which one contains the S_SERVICE rules in the Function-Permission file.

You could also check table GRACFUNCPRM to see if RESOURCEID=S_SERVICE returns any results. If so, there is a rule in one of the rulesets with this activated.

Let us know if any of this helps,


10 |10000 characters needed characters left characters exceeded