Data Description
The SMMS event is used in SAP to administrate the message server. Only one message server can run in each SAP system. It performs the following tasks in the SAP system:
Central communication channel between the individual application servers (instances) of the system
Load distribution of logons using SAP GUI and RFC with logon groups
Information point for the Web Dispatcher and the application servers (each application server of the system firsts logs on to the message server)
When an instance is started, the dispatcher process contacts the message server so that it can announce the services it provides (DIA, BTC, SPO, UPD, and so on). If the connection setup to the message server fails, an entry is made in the system log (syslog).
If the message server stops working, it must be restarted as quickly as possible to ensure that the system continues to operate smoothly.
Potential Use Cases
This event could be used in the following scenarios:
Alert on failures associated with the message server.
Determine the protocol types used by the message server.
Correlate the information regarding the message server with other SAP processes such as work processes or data from ST03.
Splunk Event
SMMS with EVENT_SUBTYPE=””
The event will look like this in Splunk:
SMMS with EVENT_SUBTYPE=”PTCL”
The event will look like this in Splunk:
SAP Navigation
SMMS with EVENT_SUBTYPE=””
Log into the managed system and execute the SMMS transaction. The information displayed will match the information that is extracted and sent to Splunk:
The information displayed will match the data that is extracted and sent to Splunk.
SMMS with EVENT_SUBTYPE=”PTCL”
Log into the managed system and execute the SMMS transaction. Double-click on the application server.
The information displayed will match the data that is extracted and sent to Splunk.
Field Mapping
SMMS with EVENT_SUBTYPE=””
Field | Description | Unit of Measure |
|---|---|---|
ADMIN_ALLOWED | Admin Allowed | Boolean |
BUFFER_LN | Buffer in | Number |
CLIENT_TYP | Client Type | String |
CONN_TIME | Connection Time | Weekday Month DD HH:MM:SS YYYY |
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
DISC_PEND | Disc pending | Number |
DOMAIN | Domain | String |
EVENT_SUBTYPE | String | |
EVENT_TYPE | SMMS | String |
FIRST_REP | First response | String |
FIRST_REQ | First request | String |
FI_KEY | FI Key | Number |
HANDLE | Handle | Number |
HOSTADR_IPV6 | IP Address | IP address |
HOSTNAME | Host Name | String |
IN | Messages in | String |
INDEX | Index | Number |
INFO | Information | Number |
KEEPALIVE | Keep alive | Number |
LAST_REQU | Last request | Weekday Month DD HH:MM:SS YYYY |
LOCAL | Local | IP Address:Port |
LOGIN_TIME | Log in time | Weekday Month DD HH:MM:SS YYYY |
MAX_QUEUE | Max queue | Number |
MSGTYPES | Message types | String |
NAME | Names | String |
NI_HANDLE | NI handle | Number |
NSERVNO | Server number | Number |
OPTIONS | Options | String |
OUT | Messages out | String |
PATCHNO | Patch number | Number |
RELEASE | Release | Number |
REMOTE | Remote | IP Address:Port |
SERVNAME | Server Name | String |
SOCKET | Socket | Number |
STAT | Stat | String |
STAT1 | Stat1 | String |
STATUS | Status | String |
SUPPORT_LEVEL | Support Level | Number |
TIME | Time | Weekday Month DD HH:MM:SS YYYY |
TYPE | Type | String |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |
VERSION | Version | Number |
WARN_QUEUE | Warn queue | Number |
SMMS with EVENT_SUBTYPE=”PTCL”
Field | Description | Unit of Measure |
|---|---|---|
CURRENT_TIMESTAMP | The date time stamp when the information was collected | YYYYMMDDHHMMSS |
DOMAIN | Domain | String |
EVENT_SUBTYPE | PTCL | String |
EVENT_TYPE | SMMS | String |
HOST | Host | String |
IP_IPV4 | IP Address | IP Address |
IP_IPV6 | IP Address | IP Address |
LOAD | Load | Number |
MISC | Miscellaneous | String |
NAME | Name | String |
PORT | Port | Number |
PROTOCOL | Protocol | String |
REQU | Requ | Number |
UTCDIFF | The UTC OFFSSET in HHMMSS that the data was collected in | HHMMSS |
UTCSIGN | The UTC positive or negative OFFSET indicator. Positive (+) means add UTCDIFF to find the time zone of the data, negative (-) means subtract the UTCDIFF to find the time zone adjusted date time the data was collected in. | + | - |
VIRTUAL_HOST | Virtual Host | Number |
WEIGHT | Weight | Number |