SAP User Monitor
Monitors the number of users depending on type and state and checks if the special user SAP* is present and configured correctly. Additionally it checks different aspects of user and password security.
General
| Executable | SAP_User_Monitor.exe |
| Connection method | RFC |
| Ports |
|
| Lookup files |
|
Default parameters
| Parameter name | Possible values | Default | Description |
|---|---|---|---|
| Host | <ip> | <hostname> | <fqdn> | empty | Hostname or IP of the target system. If you use a virtual hostname on your SAP servers, please use also the virtual host to connect. |
| SAPSID | string (3) | XXX | empty | SID of the SAP system |
| SAPInstance | number (2) | 00 - 99 | empty | Instance number of the SAP system |
| SAPClient | number (3) | 000 - 999 | empty | SAP Client (CLNT/MANDT) |
| SAPUsername | string | empty | SAP user |
| SAPPassword | string | empty | Password of the SAP user |
Sensor-specific parameters
| Parameter name | Possible values | Default | Description |
|---|---|---|---|
| DefaultUsers | <user1>,<user2>,... | DDIC,SAP*,SAPSUPPORT | Users which should be treated as default users for channels Default users with SNC name, Job steps planned with default users, Job steps planned with non-SYSTEM users, RFC connections with default users, RFC connections with non-SYSTEM users. |
| ExcludedUsers | <user1>,<user2>,... | empty | Users which should be excluded from the checks. |
| UsersForLoginCheck | <user1>,<user2>,... | DDIC,SAP*,SAPSUPPORT | Users for which the last login should be checked in channel Days since last login. |
Channels
| Channel name | Description | Lookup file |
|---|---|---|
| Users total | Number of users of the client where the sensor is running | |
| Users Type Dialog (A) | Number of users with type "Dialog" | |
| Users Type System (B) | Number of users with type "System" | |
| Users Type Communication (C) | Number of users with type "Communication" | |
| Users Type Reference (L) | Number of users with type "Reference" | |
| Users Type Service (S) | Number of users with type "Service" | |
| Users Not Locked | Number of users with no lock | |
| Users Locked By CUA | Number of users with lock set by CUA (Central User Administration) | |
| Users Locked By Admin | Number of users with lock set by administrator | |
| Users Locked After Failed Logon | Number of users with lock set because of failed logins | |
| Users Locked Combined Reason | Number of users with lock set because of multiple reasons | |
| Users Valid | Number of users which are valid depending on validity dates | |
| Users InValid | Number of users which are invalid depending on validity dates | |
| Users with Initial PW | Number of users with an initial password | |
| Users With Locked PW | Number of users with a locked password | |
| Users With Legacy PW Hash | Number of users with legacy password hash. (See SAP Note 2845609) | |
| Users With Empty User Group | Number of users which have no user group assigned. | |
| User SAP* | Shows if the user SAP* exists or not. (If you want to avoid the warning if SAP* doesn�t exist, you can use the lookup file itesys.sapusermonitor.sapstaruser.nowarning.ovl) |
|
| User SAP* Parameter login/no_automatic_user_sapstar | Shows if the parameter login/no_automatic_user_sapstar is set correctly depending on SAP Note 2383 | itesys.sapusermonitor.sapstarparameter.ovl |
| User SAP* Class | Shows if the user class for the user SAP* is set correctly depending on SAP Note 2383
| itesys.sapusermonitor.sapstaruserclass.ovl |
| Days since last login | Number of days since a standard user specified in parameter DefaultUsers last logged in. | |
| Default users with SNC name | Number of default users specified in parameter DefaultUsers which have a SNC name. | |
| Job steps planned with default users | Number of job steps which are running under a default user specified in parameter DefaultUsers. | |
| Job steps planned with non-SYSTEM users | Number of job steps which are running with a user other than type SYSTEM (B). | |
| RFC connections with default users | Number of RFC connections which are running under a default user specified in parameter DefaultUsers. | |
| RFC connections with non-SYSTEM users | Number of RFC connections which are running with a user other than type SYSTEM (B). | |
| Password Blacklist Maintained | Shows wether the password blacklist (table USR40) is maintained or empty. | itesys.sapusermonitor.passwordblacklistmaintained.ovl |
Lookup values
Values, states and texts defined in the lookup files of this sensor.
Lookup file: itesys.sapusermonitor.passwordblacklistmaintained.ovl
| Value | State | Description |
|---|---|---|
0 | OK | Table USR40 has > 20 entries |
1 | Warning | Table USR40 has < 20 entries |
2 | Warning | Table USR40 has no entries |
Lookup file: itesys.sapusermonitor.sapstarparameter.ovl
| Value | State | Description |
|---|---|---|
0 | Warning | Set Incorrectly (See Note 2383) |
1 | OK | Set Correctly |
Lookup file: itesys.sapusermonitor.sapstaruser.nowarning.ovl
| Value | State | Description |
|---|---|---|
0 | OK | Exists |
1 | OK | Not Exists (See Note 2383) |
Lookup file: itesys.sapusermonitor.sapstaruser.ovl
| Value | State | Description |
|---|---|---|
0 | OK | Exists |
1 | Warning | Not Exists (See Note 2383) |
Lookup file: itesys.sapusermonitor.sapstaruserclass.ovl
| Value | State | Description |
|---|---|---|
0 | OK | SUPER (Set Correctly) |
1 | Warning | Set Incorrectly (See Note 2383) |
Important notes
warning
Please check the limits if they fit for your alerting.
Troubleshooting
| Error Code | Error Message | Possible Solution |
|---|---|---|
[SCN-092-000] | The following parameters has not been provided: <parameters> Please read the sensor documentation for further information! | Specify the listed parameters in the profile or in the sensor-specific parameters. |
[SCN-092-100] | RFC Connection error: <message> | Check the SAP connection parameters (Host, SAPInstance, SAPSID, SAPClient, SAPUsername, SAPPassword) and that the SAP system is reachable from the PRTG probe. The message from SAP tells you the cause (e.g. wrong password, locked user, missing authorization for RFC). |
Changelog
| Version | Changes |
|---|---|
| 2025.06 |
|
| 2024.10 |
|
| 2024.04 | Fixed read of parameters when having multiple application servers |
| 2023.06 | Wrong lookup value for SAP* has been corrected |
| 2022.08 | First stable release |