Clean up of Rsec Auth change Logs (RSEC_VAL)

[Former Member]

Analysis auth change Log table RSEC_VAL can grow very fast and if not cleaned up regularly could lead to other issues where RSECADMIN cannot be executed and it will time out.

Does anyone know of SAP Reports that can be routinely scheduled as a housekeeping job or any other suggestions to keep it clean ?

Thanks,

Farah

[Former Member]

Hi,

Can you try to delete few logs and let me know if you are getting the same dump. Please post the abap dump if you can.

Thanks

Manik

[Former Member]

I have to correct the name of the table. It is RSECVALCL_

This is a BW PRD system and I have to follow certain procedures to delete anything from any of the tables.

At this point it takes a long time even accessing the table itself using SE16 to see the number of entries.

1. OF TABLE ENTRIES = 299616630

From not seeing any responses on SDN I am sure it's a unique problem that others might not have experienced yet or may have a workaround for.

So far I have a message created with SAP and I am hoping I will have some resolution to this issue which I will share with SDN members.

I will attach the short dump if it helps.

Thanks,

Farah

Edited by: Farah Laman on Jun 29, 2009 1:04 PM

[Former Member]

Here is the short dump overview :

Information on where terminated

Termination occurred in the ABAP program "SAPLRSEC_SCREENS" - in

"GET_TIME_STMP_AUTH".

The main program was "SAPLRSEC_SCREENS ".

In the source code you have the termination point in line 603

of the (Include) program "LRSEC_SCREENSF03".

Runtime Errors TIME_OUT

Date and Time 06/24/2009 10:56:26

Line SourceCde

573 ----

---

574 FORM get_time_stmp_auth .

575 DATA: l_source TYPE string,

576 l_tstpnm TYPE xubname,

577 l_date TYPE sydatum,

578 l_time TYPE changtime,

579 * l_timestmp TYPE timestamp,

580 l_s_rsecbiau TYPE rsecbiau.

581

582 IF NOT g_mode = c_mode-create. " because then there is no timestamp yet

583

584 SELECT SINGLE * FROM rsecbiau INTO l_s_rsecbiau

585 WHERE auth = g_authname.

586 IF sy-subrc = 0.

587 g_timestmp_last = l_s_rsecbiau-tstpnm.

588

589 CONVERT TIME STAMP l_s_rsecbiau-timestmp

590 TIME ZONE sy-zonlo

591 INTO DATE g_timestmp_date

592 TIME g_timestmp_time.

593

594 RETURN.

595 ELSE.

596 **********************************************************************

597 ** this part becomes obsolete with the time as soon as all times stamp

598 * entries are in RSECBIAU

599 * val

600

601 l_source = 'RSECSESSION_CL INNER JOIN RSECVAL_CL ON RSECSESSION_CL~SESSIONID = RSECVAL

602

>>>>> SELECT MAX( crdate )

604 FROM (l_source)

605 INTO g_timestmp_date

606 WHERE rsecval_cl~tctauth = g_authname.

607

608 SELECT MAX( crtime )

609 FROM (l_source)

610 INTO g_timestmp_time

611 WHERE crdate = g_timestmp_date

612 AND rsecval_cl~tctauth = g_authname.

613

614 SELECT SINGLE rsecsession_cl_{tcttstpnm rsecsession_cl}crdate rsecsession_cl~crtime

615 FROM (l_source)

616 INTO (g_timestmp_last, g_timestmp_date, g_timestmp_time)

617 WHERE rsecval_cl~tctauth = g_authname

618 AND rsecsession_cl~crdate = g_timestmp_date

619 AND rsecsession_cl~crtime = g_timestmp_time.

620

621 *** hie

[Former Member]

I am not sure how i can attach a short dump , i didnt see any button for aatchment.

[Former Member]

Hi Farah.

Did you solve this problem? If you did, may I ask you how?

We are currently having 157,000,000 records in RSECVAL_CL.

Regards,

Lars

[Former Member]

Hi,

I did get a response back from SAP that at this time they don't have a solution for this. These logs grow because we are using the generated authorizations and all authorization changes get logged in RSECVAL_CL .

Here is what SAP's response looks like from my message :

" There is no automatic mechanism delivered that deletes old entries

and the growth in principle cannot be lowered as it is due to

actual changes. Because different customer may have different concern

regarding the changelog for security. Thus you may try to delete

old entries with own programs according to the business requirement."

I am planning ot hand this over to our BW development team so they can write some ABAP code to keep this clean on a routine basis Plus generate any alerts if it reaches certain threshold so we keep a check on it.

Good luck !!

Farah

[Former Member]

Did SAP not mention reconsidering your approach?

Cheers,

Julius

[Former Member]

SAP did not mention any other approach besides what we are doing to generate the authorizations. This is a standard process and standard programs are used to generate the authorizations loaded from different source systems.

I would think SAP should consider providing some way of deleting or atleast archiving and deleting these logs so we do not overflow the change Log tables.

We may not be the only unique customers trying to use this process and coming across this kind of an issue.

Farah

[Former Member]

Sounds like a customer-exit which is using a variable as a authorization value and the variable values have not been carefully chosen or are "triggered" on each navigation step.

Check CMOD for a customer-exit. It sounds like you are not "only" using the buffer but also generating the authorization on each (or many) authorization checks.

Just a guess...

Cheers,

Julius

ps: You cannot add attachments. This does not work because of load balancing. The easiest way is to use a "link" capability of your own and post the link in the thread here. Better is to post only the relevant parts of the dump. If all else fails, you can send it to me and I can "load" it for you.

[former_member215845]

Hi Farah,

Development is aware of this issue, however I cannot give you any further information on when/if a deletion option can be provided.

The response in the message is correct, it is ok to delete old entries from this table with your own program according to your business requirement. It is not necessary to delete the whole table, only the entries that are considered old from your side.

Best Regards,

Vincent