SMMS

Data Description

The SMMS event is used in SAP to administrate the message server. Only one message server can run in each SAP system. It performs the following tasks in the SAP system:

• Central communication channel between the individual application servers (instances) of the system

• Load distribution of logons using SAP GUI and RFC with logon groups

• Information point for the Web Dispatcher and the application servers (each application server of the system firsts logs on to the message server)

When an instance is started, the dispatcher process contacts the message server so that it can announce the services it provides (DIA, BTC, SPO, UPD, and so on). If the connection setup to the message server fails, an entry is made in the system log (syslog).

If the message server stops working, it must be restarted as quickly as possible to ensure that the system continues to operate smoothly.

Potential Use Cases

This event could be used in the following scenarios:

• Alert on failures associated with the message server.

• Determine the protocol types used by the message server.

• Correlate the information regarding the message server with other SAP processes such as work processes or data from ST03.

Splunk Event

SMMS with EVENT_SUBTYPE=””

The event will look like this in Splunk:

Open

SMMS with EVENT_SUBTYPE=”PTCL”

The event will look like this in Splunk:

Open

SAP Navigation

SMMS with EVENT_SUBTYPE=””

Log into the managed system and execute the SMMS transaction. The information displayed will match the information that is extracted and sent to Splunk:

The information displayed will match the data that is extracted and sent to Splunk.

SMMS with EVENT_SUBTYPE=”PTCL”

Log into the managed system and execute the SMMS transaction. Double-click on the application server.

The information displayed will match the data that is extracted and sent to Splunk.