SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SAP BASIS ADMINISTRATION

Complete Study Notes & Reference Guide
12 Core Topics • All T-Codes • Step-by-Step Procedures • Troubleshooting Tips

Page 1
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 1: System Installation & Configuration

SAP system installation uses SWPM (Software Provisioning Manager) — the unified tool for all SAP
product installations and system copies.

1.1 SAP System Installation (SWPM)

What is SWPM?
SWPM (Software Provisioning Manager) is SAP's tool for installing, upgrading, and copying SAP systems. It
replaced older tools like SAPinst.

Pre-Installation Checklist
▪ Verify OS compatibility (RHEL, SLES, Windows Server)
▪ Check hardware requirements: RAM, CPU, Disk space
▪ Install prerequisite libraries (gcc, libc, etc.)
▪ Configure hostname and DNS resolution
▪ Create OS-level users: <sid>adm, SAPService<SID>
▪ Set kernel parameters (shared memory, semaphores)
▪ Prepare SAP media (DVDs / SAP Download Manager)

SWPM Installation Steps

▪ Launch SWPM: ./sapinst or run SWPM GUI
▪ Select product: SAP S/4HANA, ECC, NetWeaver, etc.
▪ Provide SID (System ID), Instance Number, Host details
▪ Input database type (HANA, Oracle, DB2, MSSQL, MaxDB)
▪ Configure central services (ASCS/SCS Instance)
▪ Install Primary Application Server (PAS)
▪ Install Additional Application Servers (AAS) if needed
▪ Validate installation using system checks

Instance Types
▪ ASCS: ABAP Central Services — Message Server + Enqueue Server (no dialog work processes)
▪ SCS: Java Central Services — for Java stack
▪ PAS: Primary Application Server — first dialog instance with all work process types
▪ AAS: Additional Application Server — added for scalability/load balancing
▪ DB: Database Instance — SAP HANA, Oracle, DB2, etc.

1.2 Kernel Installation and Upgrade

Page 2
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SAP Kernel Overview

The SAP Kernel is the executable layer — C-programs that form the technical foundation of any SAP system. It
contains disp+work (dispatcher), work process executables, ABAP runtime, and other binaries.

Key Kernel Files

▪ disp+work: Main dispatcher process — manages work process queues
▪ tp: Transport Control Program — handles transport requests
▪ R3trans: SAP transport engine — exports/imports data
▪ sapcontrol: SAP system control utility
▪ enserver / enrepserver: Enqueue server and replication server

Kernel Upgrade Steps

▪ Step 1: Download new kernel from SAP Marketplace (SAR files)
▪ Step 2: Stop SAP system: stopsap or sapcontrol -nr <NR> -function Stop
▪ Step 3: Backup old kernel: cp -r /usr/sap/<SID>/SYS/exe/run /backup/kernel_old
▪ Step 4: Unpack new kernel using SAPCAR: SAPCAR -xvf [Link]
▪ Step 5: Copy files to kernel directory
▪ Step 6: Adjust permissions: chown <sid>adm:sapsys
▪ Step 7: Start SAP system and verify kernel version: disp+work -V

TIP: Always keep a backup of the old kernel before upgrading. Never upgrade kernel and database
simultaneously.

1.3 Profile Parameter Setup

SAP Profile Types

▪ [Link]: Default profile — applies to all instances. Found in /usr/sap/<SID>/SYS/profile/
▪ START_<INSTANCE>: Start profile — controls how an instance starts
▪ Instance Profile: Instance-specific profile — e.g., <SID>_D<NN>_<HOSTNAME>

Key Profile Parameters

T-Code Description / Purpose
rdisp/ Maximum work process runtime (seconds) — default 300
max_wprun_time
ztta/ Roll memory extension per user
roll_extension
abap/ Heap memory for dialog users
heap_area_dia
rdisp/wp_no_dia Number of dialog work processes
rdisp/wp_no_btc Number of background work processes
icm/max_conn Max ICM connections

Page 3
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

login/ Failed logins before account lock

fails_to_lock
auth/ Enable/disable authorization object check
object_disabling
_active

T-Code Description / Purpose

RZ10 Maintain profile parameters (GUI-based)
RZ11 Display/change dynamic profile parameters

1.4 SAP Landscape Setup (DEV → QAS → PRD)

A standard SAP landscape consists of three systems connected via the Transport Management System (TMS):
▪ DEV (Development): Developers and configurators make all changes here. Changes are captured in
transport requests.
▪ QAS (Quality/Test): Transport requests are tested and validated. UAT (User Acceptance Testing) happens
here.
▪ PRD (Production): Live business system. Changes are only moved after QAS approval.

The transport path follows: DEV → QAS → PRD. This ensures changes are tested before going live.

Transport Route Flow

▪ Developer creates/modifies objects in DEV
▪ Objects are assigned to a transport request (Workbench/Customizing)
▪ Request is released by developer
▪ Basis team imports the transport to QAS
▪ Testing and approval by business team
▪ Basis team imports approved transport to PRD during change window

Page 4
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 2: User Administration

User administration in SAP involves managing user master records, assigning roles/profiles, setting
password policies, and troubleshooting authorization errors.

2.1 User Creation and Maintenance (SU01)

User Types in SAP

▪ Dialog User (A): Normal interactive user. Subject to password expiry and login checks.
▪ System User (B): Used for background jobs, RFC. No interactive login allowed. Password never expires.
▪ Communication User (C): For RFC/BAPI calls from external systems. No dialog login.
▪ Service User (S): Multiple users share for specific service scenarios (e.g., web access).
▪ Reference User (L): Not for login — only for additional authorizations via assignment.

SU01 — User Maintenance Tabs

T-Code Description / Purpose
Address Name, email, department, function
Logon Data User type, validity dates, alias
SNC Secure Network Communication settings
Default Logon language, decimal notation, date format, time zone
Parameters User-specific SAP memory parameters
Roles Assign single roles
Profiles Assign profiles (old method)
Groups Assign user groups for authorization
Personalization User-specific UI personalization
License Data SAP licensing classification

Common User Operations

▪ Create user: SU01 → Enter username → Create (F8)
▪ Copy user: SU01 → Enter new username → Copy from existing
▪ Lock user: SU01 → Padlock icon or mass lock via SU10
▪ Reset password: SU01 → Logon Data tab → Set initial password
▪ Unlock user: SU01 → Logon Data → Remove lock or use SU10 for mass unlock
▪ Display user list: SU01 → User → Display → Use selection criteria

Page 5
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

2.2 Role and Profile Management (PFCG)

Role Types
▪ Single Role: Contains authorization objects and menu entries. Directly assignable to users.
▪ Composite Role: Container of multiple single roles. Simplifies user role assignment.
▪ Derived Role: Inherits menu and authorization objects from parent role. Org-level values differ.

PFCG — Role Maintenance Steps

▪ Step 1: Create role — Enter role name, select Single Role
▪ Step 2: Define Menu — Add transactions, reports, web links to role menu
▪ Step 3: Generate Authorizations — System auto-proposes auth objects based on T-codes
▪ Step 4: Manually adjust authorization values (maintain field values, org levels)
▪ Step 5: Generate Profile — Click the profile generation button (Green checkmark status)
▪ Step 6: Assign Users — Go to User tab, add users, run User Comparison

Authorization Concept
SAP Authorization is based on: Authorization Objects → Authorization Fields → Field Values
▪ Authorization Object: Groups related fields (e.g., S_TCODE for transaction access)
▪ Authorization Check: System checks if user has correct field values for the object
▪ Profile: Container of authorizations — generated automatically from roles
▪ SAP_ALL: Profile granting all authorizations — NEVER assign in production

TIP: After modifying a role, always regenerate the profile and run User Comparison (PFCG → User tab →
User Comparison) to sync role changes to assigned users.

2.3 Authorization Troubleshooting

SU53 — Authorization Check Analysis

SU53 shows the last failed authorization check for the current user. After a user reports an authorization error:
▪ Ask user to reproduce the error
▪ User executes SU53 immediately after the error
▪ Basis team reviews the missing authorization object and field values
▪ Add the missing authorization to the user's role and regenerate profile

SU24 — Authorization Default Values

Maintains the check indicators and default values for authorization objects per transaction. Used when defining
which objects are checked by which T-codes.

T-Code Description / Purpose

SU01 User creation, maintenance, lock/unlock, password reset
SU10 Mass user maintenance — lock/unlock multiple users

Page 6
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SU53 Authorization check result (last failure for current user)

SU24 Authorization object check for T-codes
PFCG Role maintenance — create, edit, generate, assign roles
SUIM User Information System — reports on users, roles, authorizations
AGR_USERS Table showing user-role assignments
SU56 Authorization buffer for user

Page 7
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 3: Client Administration

A client in SAP is a self-contained business unit/organizational entity within a single SAP system. Each
client has its own data and user master records but shares the same ABAP programs and kernel.

3.1 Client Overview and SCC4

Standard Client Numbers

▪ 000: SAP Reference Client — contains default settings, never use for business
▪ 001: SAP Template Client — used for initial customizing reference
▪ 066: SAP EarlyWatch Client — used for performance monitoring by SAP
▪ 100-999: Customer-defined clients — your business clients (DEV: 100, QAS: 200, PRD: 300 common)

Client Settings (SCC4)

SCC4 is used to create and maintain clients and define their settings:
▪ Client Role: Customizing, Production, Test, Demo, Education, Training, SAP Reference
▪ Logical System: Name used for ALE/IDoc communication (e.g., DEVCLNT100)
▪ Currency: Client-specific currency
▪ Change Options: Controls what can be changed in this client
▪ Client-independent obj. change: Restrict/allow changes to cross-client customizing

Client Protection Levels

▪ No restriction — changes allowed (typical for DEV)
▪ Changes to repository and cross-client Customizing allowed
▪ Changes to cross-client Customizing only — not to repository (typical QAS)
▪ No changes to repository objects — production protection (typical PRD)

3.2 Client Copy (SCCL, SCC9, SCC8)

T-Code Description / Purpose

SCCL Local client copy — copy within same SAP system
SCC9 Remote client copy — copy from source on different system
SCC8 Client export — export client data as transport
SCC7 Client import — import previously exported client data
SCC3 Client copy log — monitor and review copy progress/results
SCC5 Client deletion — delete entire client and its data

Page 8
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SCCL — Local Client Copy Steps

▪ Step 1: Log into TARGET client
▪ Step 2: Execute SCCL
▪ Step 3: Select copy profile (e.g., SAP_ALL, SAP_CUST, SAP_UONL)
▪ Step 4: Enter source client number
▪ Step 5: Schedule as background job (recommended for large clients)
▪ Step 6: Monitor progress via SCC3

Copy Profiles
▪ SAP_ALL: Complete client copy — all data, customizing, user data
▪ SAP_CUST: Customizing data only — no user data, no application data
▪ SAP_UONL: User master records only
▪ SAP_APPL: Application data only

WARNING: Client copy can take hours or days for large systems. Always schedule it during off-hours.
Ensure sufficient disk space before starting.

Page 9
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 4: Transport Management System (TMS)

TMS is the SAP tool for managing the movement of changes (transports) across the landscape.
Configuration changes, ABAP code, and customizing are all moved via TMS.

4.1 TMS Configuration (STMS)

Transport Domain
A Transport Domain is a group of SAP systems managed by one Transport Domain Controller (TDC). All systems
share the same transport directory.
▪ Transport Domain Controller (TDC): The main system that manages TMS config. Usually the PRD or a
dedicated system.
▪ Transport Directory: /usr/sap/trans — shared NFS mount across all systems in landscape
▪ Domain Controller Client: Always client 000 on the TDC system

TMS Setup Steps

▪ Step 1: In system that will be TDC, go to STMS → Create new domain → Enter domain name
▪ Step 2: In other systems (DEV, QAS), STMS → Connect to domain controller → Enter TDC hostname
▪ Step 3: Back in TDC → Approve waiting systems from Overview → Systems
▪ Step 4: Configure transport routes: STMS → Transport Routes → Go to graphic editor
▪ Step 5: Create Consolidation Route: DEV → QAS
▪ Step 6: Create Delivery Route: QAS → PRD
▪ Step 7: Save and distribute configuration to all systems

Transport Route Types

▪ Consolidation Route: Moves transports from development to quality (DEV → QAS)
▪ Delivery Route: Moves transports from quality to production (QAS → PRD)
▪ Transport Layer: Logical grouping that determines the consolidation route for transport requests

4.2 Import / Export Transports

Transport Request Types

▪ Workbench Request: Repository objects — ABAP programs, function modules, tables (cross-client)
▪ Customizing Request: Client-specific customizing changes
▪ Transport of Copies: Moves copies of objects without releasing original request
▪ Relocation Request: Move objects to different transport layer

Import via STMS

▪ Go to STMS → Import Overview → Select target system
▪ The import queue shows all transports waiting

Page 10
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide
▪ Select transport(s) and click Import (truck icon)
▪ Choose import options: break points, test import, ignore previous errors
▪ Monitor the import log immediately after

Return Code Analysis

▪ RC 0: Successful import — no warnings or errors
▪ RC 4: Warnings — import completed but with minor issues. Usually acceptable.
▪ RC 8: Errors — import completed but with errors. Review logs carefully. May need correction.
▪ RC 12: Serious errors — import may be incomplete. Investigate before further imports.
▪ RC 16: Fatal errors — import failed. Must be fixed before proceeding.

T-Code Description / Purpose

STMS Transport Management System — main TMS transaction
SE01 Transport Organizer (Extended)
SE09 Workbench Organizer — manage workbench transports
SE10 Customizing Organizer — manage customizing transports
tp OS-level transport program (command line)

TIP: Always check SE01/SE09/SE10 for transport request status before importing. Ensure the request is
Released (not open) before attempting import.

Page 11
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 5: Background Job Management

Background jobs run SAP programs and reports without user interaction. They are critical for automated
business processes like payroll, billing, MRP, and system housekeeping.

5.1 Job Scheduling (SM36)

Job Components
▪ Job Name: Descriptive name for the job (max 32 chars)
▪ Job Class: Priority: A (highest), B (normal), C (lowest/bulk)
▪ Start Condition: Immediate, time-based, after event, after job
▪ Step: The actual program/report to execute — ABAP program, external command, or external program
▪ Target Server: Specific application server or server group

SM36 — Define Background Job

▪ Enter Job Name → Select Job Class
▪ Click Start Condition → Set scheduling: date/time, immediate, periodic, after event
▪ For periodic jobs: Check 'Periodic' → Define period (hourly, daily, weekly, monthly, custom)
▪ Click Steps → New ABAP Step → Enter program name and variant
▪ Save the job definition

Job Start Conditions

▪ Immediately: Starts as soon as a free background work process is available
▪ Date/Time: Starts at a specific date and time
▪ After Job: Starts after successful completion of a predecessor job
▪ After Event: Starts when a specific SAP event is raised
▪ After Operation Mode Switch: Starts when system switches to a specific operation mode

5.2 Job Monitoring (SM37)

Job Status Values

▪ Scheduled: Job is planned but start condition not yet met
▪ Released: Job is ready to run, waiting for available background work process
▪ Active / Running: Job is currently executing
▪ Finished: Job completed successfully
▪ Cancelled: Job was terminated due to error or manual cancellation
▪ Ready: Job waiting for a free background work process

Page 12
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SM37 Monitoring Actions

▪ Filter by job name, user, date range, status
▪ View job log: Select job → Job Log button
▪ View spool output: Select job → Spool List button
▪ Cancel active job: Select running job → Cancel Job
▪ Restart cancelled job: Select cancelled → Repeat Scheduling
▪ Check step details: Select job → Step Details

Job Troubleshooting
▪ Job Cancelled: Check job log for ABAP dumps (SM37 → Job Log; ST22 for dump details)
▪ Job not starting: Check if background work processes are free (SM50)
▪ Job running too long: Check SM50 for work process details; may indicate performance issue
▪ Job missing: Could be due to client mismatch or job definition lost during transport

T-Code Description / Purpose

SM36 Define and schedule background jobs
SM37 Monitor background jobs — status, logs, spool
SM39 Job analysis — detailed work process info
JOBREPORT Background job reporting
RZ21 System monitoring configuration

Page 13
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 6: System Monitoring & Performance

Proactive system monitoring is a core Basis responsibility. Regular checks prevent performance
degradation and system outages.

6.1 Work Process Monitoring

Work Process Types

▪ DIA (Dialog): Handles interactive user requests — most common
▪ BTC (Background): Executes background jobs
▪ SPO (Spool): Handles print requests
▪ UPD (Update): Processes asynchronous database updates (V1 — time critical)
▪ UP2 (Update2): Processes non-time-critical updates (V2)
▪ ENQ (Enqueue): Manages SAP lock table — runs in ASCS instance
▪ ICM (Internet Communication Manager): Handles HTTP/HTTPS/SMTP connections

SM50 — Local Work Process Overview

SM50 shows all work processes on the current application server. Key fields to check:
▪ Status: Running, Waiting, Stopped, On Hold, Shutdown
▪ Reason: Reason why work process is in this status
▪ PID: OS process ID
▪ Report/Action: Current ABAP program being executed
▪ Client/User: Who is running the process
▪ Elapsed Time: How long the process has been in current status

SM66 — Global Work Process Overview

SM66 shows work processes across ALL application servers simultaneously. Essential for distributed landscapes.
▪ Use SM66 to identify runaway processes across the landscape
▪ Can cancel processes directly from SM66
▪ Filter by user, program, status for targeted analysis

6.2 Dump Analysis (ST22)

What is an ABAP Dump?

An ABAP Runtime Error (dump) occurs when an ABAP program encounters an error it cannot handle. ST22
(ABAP Dump Analysis) shows all recorded dumps.

Common Dump Types

▪ TIME_OUT: Work process exceeded maximum runtime (rdisp/max_wprun_time)

Page 14
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide
▪ DBIF_RSQL_INVALID_RSQL: Invalid SQL statement — usually a program bug
▪ SPACE_OPTION_WITHOUT_OPTION: Memory allocation issue
▪ UNCAUGHT_EXCEPTION: Unhandled exception in ABAP OO code
▪ DYNPRO_SEND_IN_BACKGROUND: Screen call attempted in background job
▪ MESSAGE_TYPE_X: Explicit program termination with X-message

ST22 Investigation Steps

▪ Go to ST22 → Select date/time range
▪ Filter by user or program if known
▪ Open dump entry → Review: Error type, ABAP program, line number
▪ Check 'What happened' and 'What can you do' sections
▪ Review the ABAP call stack to trace execution path
▪ Check 'Active Users' section to identify the affected user

TIP: ST22 retains dumps for 7 days by default. If you need longer retention, adjust the system parameter
rsts/max_days_dev.

6.3 System Log (SM21) and OS Monitoring (ST06)

SM21 — System Log

SM21 shows the SAP system log — records of system events, errors, and security-relevant activities.
▪ Filter by: Severity (Error, Warning, Info), Time range, User, Transaction
▪ Key message types: Database errors, Enqueue errors, Work process failures
▪ Logon/logoff events are also recorded here
▪ Critical messages should be reviewed daily as part of system checks

ST06 — OS Monitor
ST06 shows operating system-level metrics for the SAP host:
▪ CPU: Overall CPU utilization, load average
▪ Memory: RAM usage, swap utilization — high swap = performance problem
▪ Disk I/O: Read/write operations — critical for database servers
▪ LAN: Network packet statistics
▪ Filesystem: Disk space usage — /usr/sap, /sapmnt, database volumes

Workload Analysis (ST03N)

ST03N (Workload Monitor) provides detailed performance statistics:
▪ Average response time per transaction type
▪ Database request times — high DB time = DB performance issue
▪ CPU time and wait time breakdown
▪ User and transaction-level statistics
▪ Target Response Time: Dialog steps should ideally complete in under 1-2 seconds

T-Code Description / Purpose

Page 15
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SM50 Work process overview — current application server

SM66 Global work process overview — all servers
ST22 ABAP dump analysis
SM21 System log
ST06 OS monitor — CPU, memory, disk
ST03N Workload monitor — performance analysis
SM04 User overview — logged-in users and sessions
AL08 Global user overview — all users on all servers
SM51 SAP instance overview — all running instances
RZ20 CCMS Monitoring Tree — automated alerting

Page 16
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 7: Database Administration (Basis Level)

SAP Basis is responsible for database monitoring and coordination with dedicated DBAs. The primary tool
is DBACOCKPIT — a unified database administration interface within SAP.

7.1 DBACOCKPIT — Database Monitoring

DBACOCKPIT Key Functions

▪ Database status and health overview
▪ Tablespace/storage utilization monitoring
▪ Backup and recovery management
▪ Database performance analysis (slow SQL, missing indexes)
▪ Alert and alert history review
▪ Job scheduling for database maintenance (statistics update, reorganization)

Critical Areas to Monitor Daily

▪ Tablespace Usage: Check data volumes are not near capacity (warn at 85%, critical at 95%)
▪ Backup Status: Verify last backup completed successfully
▪ Database Connectivity: Ensure SAP instances can connect to the database
▪ Alert Log: Review DB alert log for errors
▪ Long-running SQL: Identify and address SQL statements exceeding performance thresholds

7.2 Backup and Restore Coordination

Backup Types
▪ Full Backup: Complete database backup — typically daily or weekly
▪ Incremental Backup: Only changed data blocks since last full backup
▪ Log Backup (Redo Log): Transaction logs — enables point-in-time recovery. Critical for HADR.

Backup Strategy (3-2-1 Rule)

▪ 3 copies of data
▪ 2 different storage types (e.g., disk + tape)
▪ 1 off-site copy

CRITICAL: Regularly test restore procedures! A backup that has never been restored cannot be trusted.
Schedule quarterly restore tests.

Page 17
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 8: System Refresh & Client Refresh

System refresh is the process of copying data from one SAP system/client to another, usually PRD → QAS
or PRD → DEV to refresh test environments with current data.

8.1 System Copy Types

▪ Homogeneous System Copy: Source and target have the same OS and database platform (e.g.,
Linux/HANA to Linux/HANA)
▪ Heterogeneous System Copy: Different OS or database platform (e.g., Windows/Oracle to Linux/HANA —
migration)
▪ Client Copy: Copies only specific client data within or across systems
▪ System Refresh: Overwrites complete target system with source system data

8.2 System Refresh Procedure

Pre-Refresh Activities
▪ Communicate downtime to users of target system
▪ Backup target system (safety net)
▪ Document target system-specific settings (TMS config, logical system, RFC destinations)
▪ List of jobs scheduled in target system
▪ Note client-specific settings, printers, and variants

Refresh Steps
▪ Stop target system
▪ Drop target database
▪ Restore source database backup to target
▪ Adapt the system using SWPM post-copy steps
▪ Or use SUM/HANA Studio for HANA system copies

Post-Copy Activities
▪ Change system ID if required (heterogeneous copy)
▪ Reconfigure TMS (STMS) in target system
▪ Adjust RFC destinations (SM59) to point to correct systems
▪ Change logical system name (BD54, SALE)
▪ Adjust ALE distribution model if applicable
▪ Lock all production users — deactivate prod-specific settings
▪ Adjust background jobs (cancel or modify PRD-specific schedules)
▪ Reconfigure printers for target environment
▪ Test key business transactions
▪ Perform client-specific housekeeping (delete sensitive data if required)

Page 18
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide
TIP: Maintain a detailed post-copy checklist document. Each refresh should follow the exact same
checklist to ensure consistency and prevent missed steps.

Page 19
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 9: Patch, Upgrade & Maintenance

Keeping SAP systems current with patches and upgrades is critical for security, stability, and new
functionality. SAP provides patches as Support Packages (SP), Support Package Stacks (SPS), and
kernel updates.

9.1 Support Package Stack (SPS) Updates

Support Package Types

▪ ABAP Support Package (SP): Fixes for ABAP stack — corrections to programs, function modules, tables
▪ Basis Support Package (SAPKB): Basis-level fixes — work processes, ICM, message server
▪ Language Support Package: Translations and language-specific corrections
▪ Support Package Stack (SPS): A combination of all component SPs at a defined compatibility level

SPAM — Support Package Manager

▪ Execute SPAM transaction
▪ Load support package SAR files via Upload (or auto-download from SMP)
▪ Select the queue of SPs to install
▪ Check prerequisites and generate import queue
▪ Start import — runs in background
▪ Monitor via SPAM status screen
▪ Complete phases: IMPORT_PROPER → XPRA (execution of post-import reports)

SUM — Software Update Manager

SUM is used for major upgrades and complex patch scenarios. It provides:
▪ Zero-downtime maintenance (Near-Zero Downtime — NZDT) capability
▪ Upgrade from one SAP release to another (e.g., ECC 6.0 EHP7 → S/4HANA)
▪ Support Package Stack maintenance
▪ Kernel update coordination

9.2 SAP Note Implementation (SNOTE)

SAP Notes are corrections or enhancements to specific SAP issues. They can be manual or automatic.

SNOTE — Note Assistant

▪ Execute SNOTE
▪ Enter SAP Note number from SAP Support Portal
▪ Download the note (automatic from SAP if SMP connection exists)
▪ Check prerequisites — other notes may need to be applied first
▪ Implement the note — system makes code corrections automatically where possible
▪ Manually follow any instructions in the note for steps that can't be automated

Page 20
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

T-Code Description / Purpose

SPAM Support Package Manager — apply support packages
SAINT Add-On Installation Tool — install add-ons and industry solutions
SNOTE SAP Note Assistant — implement SAP correction notes
SPDD Adjust ABAP Dictionary objects after upgrade (modifications)
SPAU Adjust Repository objects after upgrade

Page 21
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 10: Printing & Spool Administration

SAP's print architecture uses the spool system to manage all print requests. The Spool Work Process
(SPO) processes spool requests and sends them to output devices.

10.1 SPAD — Spool Administration

SPAD Key Areas

▪ Output Devices: Configure printers, fax devices, archive systems
▪ Device Types: Page description languages: HP LaserJet (HPLJ), PostScript (POST), SAP formats
▪ Spool Servers: Application servers designated to handle print requests
▪ Access Methods: How SAP sends data to printer: L (local), U (Unix lp), S (SAP system), E (external)

Adding a Printer in SPAD

▪ SPAD → Output Devices → Create
▪ Enter device name (max 4 chars), description
▪ Select device type (e.g., HPLJII for HP LaserJet)
▪ Select spool server (application server handling print)
▪ Set access method: U for Unix/Linux LP, L for local, etc.
▪ Enter host name and host printer name (OS-level printer name)
▪ Test print from SPAD

10.2 Spool Monitoring (SP01)

SP01 — Output Controller

SP01 is the central transaction for managing all spool requests and output management.
▪ View all spool requests with status (waiting, processing, completed, error)
▪ Redirect print to different printer
▪ Reprint documents
▪ Delete old or error spool entries
▪ Display spool request details and print parameters

Spool Consistency Check

Regular spool housekeeping is important to prevent spool overflow:
▪ Execute SPAD → Consistency Check — finds orphaned spool entries
▪ Delete old spool requests via SP01 with appropriate filters
▪ Check spool work process availability in SM50

T-Code Description / Purpose

Page 22
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

SPAD Spool Administration — configure printers, device types, spool servers

SP01 Output controller — view, reprint, delete spool requests
SP02 Own spool requests
SP12 TemSe administration — temporary sequential objects used by spool
SOST SAPconnect — fax and email outbound queue management

Page 23
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 11: RFC & Interface Management

RFC (Remote Function Call) is SAP's communication protocol for calling function modules on remote SAP
or non-SAP systems. It is the backbone of all system-to-system communication in SAP landscapes.

11.1 RFC Destination Setup (SM59)

RFC Connection Types

▪ Type 3 (ABAP Connection): RFC to another SAP ABAP system — most common
▪ Type H (HTTP Connection): Connection to web services, REST APIs
▪ Type G (HTTP Connection to External Server): External HTTP connection
▪ Type T (TCP/IP Connection): External programs using RFC library
▪ Type L (Logical Destination): Pointer to another RFC destination
▪ Type I (Internal): RFC call within the same SAP system

Creating an ABAP RFC (Type 3) in SM59

▪ SM59 → Create → Select Connection Type 3
▪ Enter destination name (convention: <SID>CLNT<100>)
▪ Technical Settings tab: Enter target host, system number, SAP Router string if needed
▪ Logon & Security tab: Enter client, language, user and password
▪ Test the connection: Connection Test button
▪ Remote Authorization Test verifies the user has required authorizations

RFC Troubleshooting
▪ Connection Test fails: Check network (ping, telnet to port 32<NN>), check target system up
▪ Authorization error: User in target system needs RFC authorization (S_RFC object)
▪ RFC timeout: Check rdisp/max_wprun_time, smq2 for queued RFC issues

11.2 Gateway Monitoring (SMGW)

The SAP Gateway manages all RFC connections. SMGW allows monitoring and managing gateway operations:
▪ View active RFC connections
▪ Monitor registered programs (external RFC servers)
▪ Check gateway work processes
▪ Security: Configure gateway access control lists (reginfo, secinfo files)
▪ Terminate problematic connections

ALE/IDoc Technical Support

▪ ALE (Application Link Enabling): SAP's framework for distributed applications — uses IDocs to exchange
data

Page 24
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide
▪ IDoc (Intermediate Document): SAP-specific data format for exchanging business documents between
systems
▪ Logical System: SAP name for a system in ALE — defined in BD54
▪ Distribution Model: Defines which message types flow between which systems — BD64
▪ Partner Profile: WE20 — defines IDoc processing parameters for each business partner

T-Code Description / Purpose

SM59 RFC destination configuration and testing
SMGW Gateway monitor — connections, registered programs
SMQS qRFC scheduler — monitor queued RFC status
SMQ1 qRFC outbound queue monitor
SMQ2 qRFC inbound queue monitor
WE02 IDoc list — view IDoc status and content
WE05 IDoc list (alternative view)
WE20 Partner profiles for IDoc processing
BD64 ALE distribution model maintenance
BD54 Logical systems maintenance

Page 25
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

TOPIC 12: Security & Compliance Support

SAP security is a shared responsibility between Basis, Security teams, and application teams. Basis is
primarily responsible for system-level security parameters, SNC/SSO setup, and audit support.

12.1 Security Profile Parameters

Critical Login/Password Parameters

T-Code Description / Purpose
login/ Minimum password length (recommended: 8+)
min_password_lng
login/ Max days before initial password must be changed
password_max_idl
e_initial
login/ Password validity in days (e.g., 90)
password_expirat
ion_time
login/ Failed attempts before lockout (recommended: 5)
fails_to_lock
login/ Failed attempts to lock user (vs. system lock)
fails_to_user_lo
ck
login/ Disable SAP* backdoor (set to 1 in production)
no_automatic_use
r_sapstar
login/ Require password change after SSO login
password_change_
for_SSO
login/ Control multiple simultaneous logins
multi_login_user
s

Critical System Security Parameters

T-Code Description / Purpose
auth/ If = Y, some auth checks skipped — NEVER set in production
no_check_in_some
_cases
auth/ Controls which auth objects are active/inactive
object_disabling
_active
rfc/ Reject RFC calls with expired passwords

Page 26
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

reject_expired_p
asswd
icm/HTTPS/ Enable SNI for HTTPS (SSL/TLS)
client_sni_enabl
ed
gw/acl_mode Gateway access control mode — set to 1 to enforce ACL
gw/ Control external program registration info
reg_no_conn_info

12.2 SNC and SSO Configuration

SNC (Secure Network Communications)

SNC encrypts and authenticates RFC/DIAG connections between SAP components and clients (SAP GUI, RFC).
▪ SNC Name: Unique identifier for each component: p:CN=<SID>, OU=SAP, O=Company, C=US
▪ SNC Quality of Protection: Authentication only (1), Integrity protection (2), Privacy (3 - full encryption)
▪ Profile parameters: snc/enable=1, snc/gssapi_lib=<path to SNC library>, snc/identity/as=<SNC name>

SSO (Single Sign-On) Options

▪ SAP Logon Tickets: Web-based SSO using cookies — configured via trust manager (STRUST)
▪ X.509 Certificates: Certificate-based authentication for RFC and HTTPS
▪ Kerberos (SPNEGO): Windows Active Directory SSO — users sign in once to Windows and auto-
authenticate to SAP
▪ SAML 2.0: Web SSO standard — SAP acts as service provider, IdP (Azure AD, Okta) authenticates

STRUST — Trust Manager

STRUST manages all digital certificates for the SAP system:
▪ Import CA certificates for HTTPS/SSL trust
▪ Manage SAP Logon Ticket issuing system certificates
▪ Configure SNC certificates
▪ Manage client certificates for external system authentication

12.3 Security Auditing

Security Audit Log (SM19/SM20)

▪ SM19: Configure Security Audit Log — define which events to audit (logins, RFC, T-code access)
▪ SM20: Analyze Security Audit Log — view recorded audit events
Key events to audit in production:
▪ Successful and failed logon attempts
▪ Transaction starts
▪ RFC calls — especially for privileged users
▪ Changes to user master records
▪ Changes to authorizations

Page 27
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

User Audit and Compliance Monitoring

T-Code Description / Purpose
SM20 Security Audit Log analysis
SM19 Security Audit Log configuration
SUIM User Information System — report on who has what access
SU53 Authorization check failures per user
SM04 Active user sessions
AL08 Global active users — all servers
RZ10/RZ11 Profile parameter review for security compliance
STRUST Certificate and trust management
SMLG Logon groups — manage user logon distribution

TIP: Regularly run SUIM reports to check: Who has SAP_ALL? Who has basis administration roles? Any
user with critical combinations of authorizations? This supports SOD (Segregation of Duties) compliance.

Page 28
SAP Basis Administration — Complete Study Notes | Comprehensive Reference Guide

QUICK REFERENCE — All Key T-Codes by Topic

Topic Primary T-Codes Monitoring T-Codes

Installation SWPM, RZ10, RZ11 SM51, SM21
User Admin SU01, SU10, PFCG SUIM, SM04, AL08
Client Admin SCC4, SCCL, SCC9 SCC3, SCC5
TMS Transports STMS, SE09, SE10 SE01, STMS Queues
Background Jobs SM36, SM37 SM39, SM50
System Monitor SM50, SM66, ST22 SM21, ST06, ST03N
Database DBACOCKPIT DB02, DBA Cockpit
Security SM19, STRUST, SU01 SM20, SUIM, SU53
Printing SPAD SP01, SP12
RFC/Interface SM59, SMGW SMQ1, SMQ2, WE02
Patches/Upgrade SPAM, SAINT, SNOTE SPAU, SPDD

Page 29