Data Description
The RZ10 event is used in SAP to change profile parameters. The system automatically generates or updates the profile files at operating system level after an installation, upgrade, or the addition of a new application server instance. The installation program does not save profile files directly in the database. These profiles must be manually imported into the database. Changes are made to profiles at database level using transaction RZ10 (edit profiles).
Potential Use Cases
This event could be used for the following scenarios:
Monitor to determine if critical profile parameters are being changed.
Use to correlate with other metrics within the SAP ecosystem to determine if parameters are being exceeded.
Determine which parameters have been customized.
Splunk Event
The event will look like this in Splunk:
SAP Navigation
Navigate to this data by using the RZ10 t-code. Enter the desired profile name in the “Profile Name” field, and the profile version in the “Version” field, select Extended Maintenance under the “Edit Profile” option, and select the “Display” button.
Highlight the desired parameter that you would like to view and select the “Display” button.
The data from the RZ10 event will then display.
Field Mapping
The field mapping between the data from SAP and values in Splunk can be seen in the table below:
Field | Description | Unit of Measure |
|---|---|---|
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
EVENT_SUBTYPE |
| String |
EVENT_TYPE | RZ10 | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |
DESCR | Description | String |
PAR_DEFAULT_WERT1 | Unsubstituted standard value | String |
PAR_DEFAULT_WERT2 | Substituted standard value | String |
PAR_NAME | Profile parameter name | String |
PAR_USER_WERT | Parameter value | String |
GROUPNAME | Parameter group | String |