Technical Articles
Report ZSYSREC_NOTELIST – Show results of System Recommendation
[This is a copy of the same page on Code Exchange on SDN which shuts down end of August 2013. Therefore, I move my projects here to SCN.]
The application System Recommendation of the Solution Manager is used to identify notes which are relevant for a ABAP or Java system. It covers Security Notes, HotNews, Performance Notes, Legal-change Notes and Correction Notes.
This code-exchange project offers the report ZSYSREC_NOTELIST which can be used to produce a cross-system report.
ABAP Source Code
You find the source code on GitHub.
Support
If you need support or if you want to report an error, than keep in mind that this is a code-exchange project: I prefer to get comments here in the blog. If you open a ticket on component SV-SMG-SER, clearly describe that it’s about this report and that support is only available via Frank Buchholz.
Documentation
Selection Screen
- You can navigate to the System Recommendation application and the System Recommendation Settings application. (The links work only if the services WDC_NOTE_CENTER and WDA_NOTE_CENTER_CFG are activated in transaction SICF. If you only can these applications using the SAP Solution Manager Workcenter than you do not need to activate them explicitly.)
- The value help for systems and system types shows for which systems and system types date are available. You enable the data collection in the System Recommendation Settings application.
- The selection for the status refers to the status which you can set within the System Recommendation manually.
- The selection for the note type works as an “or”.
- If you have saved an ALV layout you can select it.
Result
- You can use the usual functions to filter, sort, export or print the data as well as to rearange the columns.
Special columns:
- EWA check: If checked, this note gets checked by the EarlyWatch Alert / report RSECNOTE as well. (This column is the reason why you see some delay and get the message “checking RFC to SapNet R/3…” once a day, because it takes some time to get the latest recommendations from SAP.)
- Note URL: Using this link you can show the note in the SAP Service Marketplace.
- SysRec Status: This is the status which you set in the application System Recommendations manually
- SP independant: If checked, this note is classified as “Support Package independant”. The note is related to a software component which is part of the system, however, it does not contain corrections instructions for the Note Assistent (transaction SNOTE), and it is not assigned to a Support Package or to a Kernel or Java patch. Therefore, you have to check by yourself if the note is relevant for the system.
- Sec Note, HotNews, etc: The note belong to this note type
Status Maintenance
After selecting some entries you can execute one of following functions in the command field (aka OK-CODE) to set the status of the note within System Recommendations (keep in mind that this is different from the status of a note within transaction SNOTE):
| Function | Description |
|---|---|
| NEW | New |
| IMP | To be implemented |
| NOR | Irrelevant |
| PSP | Postponed |
The updated status is shown in the list but not saved at once. Finally you execute function SAVE to store the changed data (to discard changes you simply can leave the program instead).
If you want to show these functions in the GUI status as well, you can copy the GUI status SALV_TABLE_STANDARD of program SAPLSALV_METADATA_STATUS to the program ZSYSREC_NOTELIST using the menu painter transaction SE41 (orSE80) and add the five functions listed above to the application toolbar. You need to remove some other unused functions from the application toolbar to get free space. Choose any short txt, long text and function key. Use iconICON_SYSTEM_SAVE für command SAVE.
Here is my proposal to define the GUI status (as you can see, I’ve removed some other functions):
Now you can easily set the SysRec status of a note for all systems within one step. For the following example, I’ve rearranged the columns and changed the sort order to “note”:
Object list and usage data (UPL)
New as of 23.07.2014
To decide about the business risk of implementing a note, it is useful to know which transport objects (programs, function groups, classes, etc.) get changed.
After selecting notes (which should have ‘automatic correction instructions’) you can execute function OBJ in the command field (aka OK-CODE) to retrieve the object list of changed objects with it’s transport objects.
Optional: Add function OBJ with short test ‘Object list with usage data’ and icon ICON_OBJECT_LIST to the GUI status (see icon right to the save-icon on picture below).
If you additional have activated Usage Procedure Logging (UPL) you will see the usage of objects, too.
The query 0SM_CCL_UPL_MONTH from infoprovider 0SM_UPL is used to retrieve UPL data. By default UPL data from the current and the previous month is loaded.
In case of functions (type = FUNC) of function groups (object type = FUGR) and methods (type = METH) of classes (object type = CLASS) you get exact counts. In case of all other objects, you get an accumulated count per transport object (see example with type = CLSD).
How-to guides about UPL:
Hello Frank,
with every program I see from you a natural question rises again and again: Is this a help tool that you like to use for your own work (and share it, which is wonderful) or is it a prototype of something that is coming with higher SP into GA?
All you programs "make sense" (I mean: people who felt the pain understand exactly why you've built it!) so I am sure I am not the only one seeing the programs as prototypes of a new functionality in standard delivery.
Cheers Otto
Hello Otto,
yes, that's my intention: Create prototypes, deliver them fast via SCN and try to get them into the standard.
With standard transaction STAUTHTRACE which now replaces report ZSHOWAUTHTRACE this already had worked and a standard function for ZRFC_STATRECS_SUMMARY is on its way as well. However, this report ZSYSREC_NOTELIST will not show up in the standard.
Kind regards
Frank
Hello,
Many thanks sharing knowledge for "the SAP SecFreshers" 😳
Thank you very much.
all the best
Erwin
Hi Frank,
this is really great work!
Actual i have the task to enhance an internal monitoring software to show patch delta for sap systems. While searching for some information i found your code here.
I'd like to ask you for help to guide me how can i retrieve this information using an rfc or other remote connection, so "result" can be shown in custom monitoring software?
Any help would be really great!
Optimal soultion would be if there is a standard report or rfc function, which can be called so no custom code has to be installed on sap server.
Thank you very much for your help
Tom
Hi Tom,
there does not exist a remote API to directly read results from application System Recommendations. I see following options:
1. Create custom RFC wrappers for functions like AGSNO_API_GET_CHKED_SYSTEMS and AGSNO_API_GET_RECOMM_NOTES. These functions are used by the BW query to read the cross-system results of System Recommendations. Keep in mind that these functions are not released as a public API, that means SAP is free to change them at any time.
2. There exist a standard remote interface for retrieving results from BW queries (I do not know more details about this). Use this interface to call BW query 0SMD_VCA2 / 0SMD_VCA2_SYS_RECOM_NOTES to get the cross-system results of System Recommendations.
Kind regards
Frank
Hi Frank,
thx a lot.
Might there be a chance mentioned RFC Function will become remote callable in future?
This would be real great!
Kind regards,
Tom
Hi Frank,
i'm going to 0SMD_VCA2_SYS_RECOM_NOTES . Unfortunatly i'm not able to find a documentation of its variables. Can you give me a hint where i can find some description?
Thx
Tom
2099728 - SysRec: Object list for ABAP notes does not show Usage Procedure Logging data (UPL)
Dear Frank Buchholz,
first I want to express, that I like this program very much 😉
But I have a Little Problem also. The Systems list does not mach the Sysrec configuration. There are Systems listed in ZSysrec_notelist which are not in my Sysrec list. Which Systems does this Report use, how can I predefine it, (besides the filters) ?
Thank you a lot,
with Regards,
Franz Lengel
Report ZSYSREC_NOTELIST simply shows existing results from SysRec. The same data is used to calculate the value help as well. Therefore you see these systems for which results exist.
The standard BW report which shows result of SysRec (see Configuration Validation -> Report Execution -> Reporting Templates -> Configuration reporting -> 0TPL_0SMD_VCA2_SYS_RECOM_NOTES) works in a similar way.
The SysRec settings show for which systems you currently produce new results. If you switch off a system here, than it's not in SysRec settings anymore, but you still can view old results using the Z-report. If you add a new system to the SysRec settings you have to wait for the background job until you can see it in the Z-report.
In the application SysRec you first select a solution (which means you have to know which solution contains a specific system), then a system (for which SysRec has to be activated), and finally a technical system to view results.
Thank you for the reply.
How can we remove old Systems from the Report, which are no longer in the solution ?
Thanks & Regards
There is no official function available to delete outdated data about old systems.
Here are some proposals:
- Report ZSYSREC_NOTELIST offers a function "Show configuration status" which shows the current settings of the background job and the current status / age of the data
- Use a report variant for ZSYSREC_NOTELIST which only shows only current systems
- Use a custom program to delete corresponding data from tables AGSNOTE_HEAD and AGSNOTE_BUFFER
Kind regards
Frank
Thanks for the helpful Information,
deletion of data from the tables did work.
Is there a variant of zsysrec_notelist which shows only current Systems ?
Thanks with best regards,
Franz
I have another question regarding the SWF active column. If the Switch is not active, the security is not endangered, right ?
Regards, Franz
If a switched component is not active then you (any any potential attacker) most likely cannot execute any of it's coding because most likely the required dictionary objects do not exist. The syntax check and the ABAP generation would fail.
However, this is not a guaranteed rule (e.g. there could be a very small function which does not use any of the missing dictionary objects) but balancing the remaining potential security risk with the existing implementation risk we came to the conclusion to recommended omitting notes for inactive components.
Nowadays SysRec omit such notes anyway (see note 2025144). (You may have observed that you rarly find an inactive icon in the column 'SWF status' of the Z-report.)
Kind regards
Frank
Hi Frank,
is it possible 0SMD_VCA2_SYS_RECOM_NOTES has changed since solution manager 7.2?
Did params change or is there a new Report like mentioned in your FAQ "The SAP Solution Manager 7.2 shows a cross-system view on relevant Security Notes."
Do you have any hint where to get information about that without access to a solution manager 7.2 ?
Thx
Tom
Hi Tom,
in SolMan 7.2 the BW report 0TPL_0SMD_VCA2_SYS_RECOM_NOTES is still used to show cross-system view of results of System Recommendation.
See Configuration Validation -> Report Execution -> Configuration reporting -> 0TPL_0SMD_VCA2_SYS_RECOM_NOTES
There does not exist an ABAP report like ZSYSREC_NOTELIST for SolMan 7.2 (yet).
The new Fiori App System Recommentations already shows a cross-system view on required security notes and it offers to save filter settings as Fiori tiles. Therefore you may not need the BW report or an ABAP report anymore.
You find information about System Recommendations on SolMan 7.2 at
https://support.sap.com/sysrec
or in our master presentation at:
https://support.sap.com/sos
-> AGS Security Services – Security Patch Process
Kind regards
Frank
Hallo Herr Buchholz,
wir haben immer diesen Report vor dem Solution Manager Standard bevorzugt.
Gibt es eine Möglichkeit diesen auch noch unter Solution Manager 7.2 zu nutzen ?
Mit besten Grüßen
Silke
I believe that a report like ZSYSREC_NOTELIST is not necessary in SolMan 7.2 anymore as the new version of application System Recommendations has a much stronger user interface:
Please give it a try in SolMan 7.2 system.
Of course you can tell me how you would use a report compared with the new SysRec app.
Mit freundlichen Grüßen / Kind regards
Frank Buchholz
SAP CoE Security Services
You find the current version of the Z-report ZSYSREC_NOTELIST_72_SP08 here: https://wiki.scn.sap.com/wiki/display/Snippets/SAP+CoE+Security+Services+-+Tools
(I cannot update this old blog anymore to correct the links.)
Hi Frank,
How will this work when SOLMAN OnPrem runs out and we need a Cloud Tool or our own to compare the current SAP release and SP and implemented notes with the available security notes? Will it also support non-ABAP systems from SAP's products and offer APIs for reporting / monitoring?
Cheers,
Julius