How to independently monitor xi / pi team for unapproved changes to PRD

[Former Member]

Our auditors require an independent review of the SAP environment to detect unapproved changes to production. Right now we monitor the transport logs for transport changes. Is anyone aware of tools or a process that can be used to monitor the xi / pi team for changes in the xi / pi environment?

[JoelTrinidade · Accepted solution]

Hi ,

I don't know whether you have heard of something know as CMS (Change management service) it would cater to your requirements.

PI Transports Using the Change Management Service (CMS)

http://help.sap.com/saphelp_nwpi71/helpdata/en/49/630650f75d4df6a3dc2f93d51eb864/content.htm

Regards

joel

[FrankMisch · Accepted solution]

Hi

actually the currently recommended transport system by SAP for PI transports is CTS.

CTS, which is the ABAP transport system, had been extended to support NON-ABAP content (such as PI/XI) a while ago. New development will be done in this area only. There won't be any new features in CMS but there will be in CTS.

But might be that you are already on CTS and the questions is the same for this.

I can think of two ways of finding out what had been transported into the target system.

a) But using the search transport function in the target PI system (tools->search transports -> select time period). As a result would will se all imports that took place during a given period of time.

b) By using the import queue in the CTS backend. There is a history function (stms -> Import -> History -> Time Period),

Infos about CTS: https://wiki.sdn.sap.com/wiki/display/SL/SoftwareChangeManagement

Regards

Frank

[Former Member · Accepted solution]

CTS+ is the way to go no doubt about it.

But if you have problems with Developers exporting and importing objects into Production then their access profile needs to be adjusted too to prevent it in the first place. Not only that but you are also able to restrict you can edit repository objects (you may have 2 teams and only want them to have edit access to their own gear). That should keep the auditors happy.

[FrankMisch · Accepted solution]

Hi,

now I got the point: Some of the developed stuff should be transportable to PROD. Other stuff not or at least not yet or not without agreement of some QA instance.

So this could be solved if one of the following things would be there:

a) Export:

The change list export functionality in the source system should be assigned to a certain permission. So some seniors could have a this special permission and others not. But this would be defined on system level but not on development project level. As far as I know there is no way to prevent developers from triggering export of change list if a transport request is available or can created. Yet for export via export wizard a special role is necessary (such as ORGANIZER or ADMIN).

=> So this is no solution for your problem on this level.

b) Attach to Transport Request

An export can only be triggered if a transport request had been created for the given developer beforehand. So if you switch to creation mode for transport requests to 'manual' and ensure that only for those persons and projects transport requests are created which are involved in the relevant projects then you can be sure that only the changes of those persons and projects are transport to PROD.

Currently the mapping between SWCVs and CTS project would have to be done manually as there is not yet a mapping between SWCV in PI and projects in CTS.

And as far as I know it is not directly possible to enable an automatic creation of transport requests only for a given user group.

But there SAP is currently developing a process level tool a layer above CRTS that allows you to control the transports on project level. This tool is using the CTS APIs, is related to the solution manager and the preliminary name is Quality Gate Manager. Might solve your problems on a higher level.

c) Enabling of Transports based on SWCVs and 'dispatching transports based on content*

With the previous SAP transport solution CMS it had been possible to enable CTS for a given set of SWCVs only. So if your sources are separated into different SWCVs. It would have been possible to block a given SWCV from transport and keep the user open for transport to PROD. Currently CTS can only be switched on/off on system level so that all SWCVs of a given source system will become transportable or not.

Yet there is an SAP project which has to goal to close this gap and to allow the definition of transport routes on SWCV level. In this way some SWCV could be blocked from export in the future.

d) Critical objects and other stuff

The next location where transports could be blocked is the import queue. Currently no knowledge of the content of an PI transport is used to decide whether an import should be done or not. But again there is a project on its way to provide the CTS system with the knowledge about the content of a transport. So it would be possible to use this knowledge to check against critical objects or perhaps other criteria in the future. The first part with of providing the knowledge has almost finished but I'm not sure to what degree the knowledge can be used and how the project roadmap looks like.

e) Manual

Of course a naming convention for exports and/or transport requests could be used to decide in the import queue of the PROD system whether an import should be done or not.

What of the mentioned point would be the best from your point of view?

But in generally I would expect a different setup of the development process:

- Three systems: DEV -> TEST -> PROD.

- Developers are allowed to transport from DEV to TEST on their own. Transport request are created automatically on demand and released automatically after attaching changelists to them.

- Transports from TEST to PROD:

- for single transport requests for single bug fixes: For each bug a transport request is created manually by quality manager or another dedicated person and is assigned to the group of users which have to fix the problem. The import into PROD has to be agreed und executed for each single transport reuqest by QM or dedicated person.

- for further development of multiple persons: there is a development phase and a test phase. After the tests had been successfully executed the whole SWCV is transport by the QM or the dedicated person from TEST to PROD to ensure that the whole tested SWCV is transported and nothing is missed.

Regards

Frank Misch