SM21_LOG

Data Description

The SM21_LOG event is used in SAP to view the system log.

Potential Use Cases

This event could be used in the following scenarios:

• Alert on specific error messages displayed in the system log.

• Visualize system health status by application server.

• Determine error trends over time.

• Correlate system errors with other occurrences in the environment such as database events.

Metric Filters

This filter is used to select or exclude specific messages from the system log and is an optional configuration to control data volume sent to Splunk. By default, all system log messages are collected by PowerConnect. To access the filter, log into the managed system and execute the /n/bnwvs/main transaction code. Then go to Administrator → Metric Filters → More → SM21 Sys.Log Filter.

Then select the “New Entries” button and enter the desired configuration based on the configuration options defined below, and Save:

• SAP Instance - This field is mandatory, and is the instance from which you would like to extract the data. To extract data from all instances, enter a wildcard value (i.e. “*”).

• Clt - This field is mandatory and is the client from which you will extract the data.

• User - This field is mandatory and is the user related to the system log. To extract data for all users, enter a wildcard value.

• Grp - This field is mandatory and represents the system log message group. To extract data for all message groups, enter a wildcard value.

• N - This field is mandatory and represents the message group sub-name. To extract data for all the message group sub-names, enter a wildcard value.

• Message Text - This field is optional and represents the message text from the system log. To extract data for all messages, enter a wildcard value.

• INCL/EXCL - This field is mandatory and is an exclusion or inclusion criteria. To exclude the values defined in the selection criteria enter an “E“ in the field. Similarly, to include the values defined in the selection criteria enter an “I” in the field.

• Active - This field is mandatory and is a checkbox used to enable or disable the filter criteria. To activate the filter criteria, ensure the checkbox is checked. Conversely, if you would like to disable data collection ensure the checkbox is unchecked.

Here is an example of the filled-out filter:

Splunk Event

The event will look like this in Splunk:

SAP Navigation

To access to the SM21 system log, log into the managed system and execute the SM21 transaction. You will then be brought to a user selection parameter screen. Fill out the user selection parameters as desired and select the Execute button.

You will then be brought to the system log, which matches the data that is extracted and sent to Splunk.

Field Mapping