Remote Code Analysis in ABAP Test Cockpit (ATC) – FAQ

[OlgaDolinskaja]

This document tries to answer the most important questions about the Remote Code Analysis in ABAP Test Cockpit (ATC).

With the SAP NetWeaver AS ABAP 7.51 innovation package SAP customers and partners can perform Remote Code Analysis in ATC which allows to analyze remotely with the latest checks custom code even in older systems using only one system for ATC (SAP_BASIS >= 7.51).

For more information about Remote Code Analysis in ATC please take a look at the Remote Code Analysis in ATC – One central check system for multiple systems on various releases.

If you have common questions, which should be answered in this collection, you can propose them here, in case you are interested to discuss more specific topics please take part at the forum/discussions.

Frequently Asked Questions

General Setup

• What are the total license costs for the initial setup of ATC including the new SAP NetWeaver AS for...


• Do we really need one extra system for only running ATC? Do we need then one central ATC for all sys...


• Do I need to implement any special SAP Note in older SAP systems?

ATC and Code Vulnerability Analyzer (CVA)

• Do we need to pay separate license costs for security checks?


• What does Code Vulnerability Analysis (CVA) deliver additionally to ATC?

ATC and Solution Manager

• Can I reuse our SAP Solution Manager system for setting up the ATC central system there?


• What about the integration into the ChaRM prozess? Can I track the ATC check results in the Solution...


• Can I set the central ATC system equal to the central CCLM system?


• ChaRM: Is it possible to run ATC checks at status change to "To Be Tested" analogous to "Critical Ob...

Core Concepts

• Is it possible to check only new ABAP code during transport release in Transport Management System a...


• Can the ATC check runs be planned periodically?


• Can the ATC checks be integrated into the standard syntax check?


• Is the state of the approvals held on the ATC central check system or on the local checked system?


• How is the finding exactly referenced (code or source code line)?


• How expensive are remote ATC checks with respect to memory usage, execution time etc.?


• What about release dependent ATC checks? Various AS ABAP releases may contain different ABAP stateme...


• The ATC can be configured so, that it will run during transport release and the transport request wi...


• Can I restrict the ATC check only to my custom code (no check for SAP code)?


• Does the central ATC system need to know the release of the checked system e.g. to check differently...


• Can I extend the scope of the Remote Stubs, e.g. in order to add specific DDIC information for my ow...


• We practice "collective code ownership". Is there a way to address findings to the last user, instea...


• Can I mark already processed findings?


• During ATC remote checks run: will the ABAP Unit tests run on the local system?


• Is a check for searching pragmas or pseudo-comments are also planned? Background: Detect and approva...


• Are there ATC checks for Web Dynpro?


• What happens to my exemption when I change the coding?


• Is it possible for a customer to scan partner add-ons?


• Is it possible to run ATC checks when releasing transport tasks?


• Which BAdIs can I use to implement extension points for ATC?


• How can I view a central ATC check result in my developer system?


• How can I decide on which granularity an exemption can be applied?


• Can I run remotely ABAP Unit tests?


• How can I see which objects were included in an ATC mass run?


• I want to run local ATC checks on my central ATC check system. Is it possible?


• Can the same person request and approve an ATC exemption?


• Can the baseline be managed centrally, e.g. via permissions, so that a local developer cannot deacti...


• Our central ATC check system is on the SAP NetWeaver AS ABAP 7.52 (SAP_BASIS 7.52) release. Is it po...


• In which environments: development, test or productive SAP recommends to execute ATC runs?

ATC and ABAP Development Tools (ADT)

• Can the ATC messages be displayed automatically in Eclipse as e.g. compiler messages?

Frequently Asked Questions

General Setup

What are the total license costs for the initial setup of ATC including the new SAP NetWeaver AS for ABAP 7.51 or 7.52 system? Do we have to extend every developer license?

ABAP Test Cockpit is part of the SAP NetWeaver license. Since the ATC central check system acts only as runtime system for the ATC checks, there are no additional license costs.

The prerequisite for the additional security checks is the installation of SAP NetWeaver AS, add-on for Code Vulnerability Analysis (CVA) which is the separate fee-based product with additional license costs.

Do we really need one extra system for only running ATC? Do we need then one central ATC for all systems in the system landscape?

We recommend to setup one extra system for ATC. This system can check with ATC multiple systems in your landscape.

Do I need to implement any special SAP Note in older SAP systems?

Yes, you need to implement the SAP Note 2270689 in older SAP Systems. For the future developer scenario you will need to implement further SAP Notes, which will be provided later.

 

ATC and Code Vulnerability Analyzer (CVA)

Do we need to pay separate license costs for security checks?

Yes. SAP NetWeaver AS, add-on for Code Vulnerability Analysis (CVA) is the separate fee-based product with additional license costs.

Further information about CVA is on the SAP Community Wiki:  SAP NetWeaver Application Server, Add-On for Code Vulnerability Analysis

What does Code Vulnerability Analysis (CVA) deliver additionally to ATC?

ATC provides general check infrastructure including standard checks for functional correctness and performance. CVA delivers additional security checks, which can be integrated into ATC.

 

ATC and Solution Manager

Can I reuse our SAP Solution Manager system for setting up the ATC central system there?

We recommend a really new system as ATC central system. The Solution Manager is currently based on a low SAP NetWeaver release (SolMan 7.2 is based on SAP NetWeaver 7.4). The minimum release for the central ATC system is SAP NetWeaver AS ABAP 7.51. Besides this you would need to upgrade Solution Manager system each time you want to apply new ATC checks, that is the unnecessary effort.

What about the integration into the ChaRM prozess? Can I track the ATC check results in the Solution Manager?

Yes, the ATC is integrated into the ChaRM process. Just with the Solution Manager 7.2 the display of ATC results was improved. When the request is released by ChaRM, the results are displayed in the Solution Manager.

See also how ATC checks are integrated into the ChaRM in the Solution Manager 2.0 documentation on SAP Help Portal

Can I set the central ATC system equal to the central CCLM system?

Since the CCLM system is currently based on the Solution Manager, you cannot set the central ATC system equal to the central CCLM system.

ChaRM: Is it possible to run ATC checks at status change to "To Be Tested" analogous to "Critical Objects"?

The ATC checks run automatically only if the status is set to „Successfully Tested“(during release of original tasks). But you can also run ATC checks any time on demand (is possible starting with Solution Manager 7.2 SP3)

 

Core Concepts

Is it possible to check only new ABAP code during transport release in Transport Management System and let the old ABAP code pass?

By making use of the baseline in the ATC, findings in old ABAP code can be excluded. Only when new findings are added or if ABAP statements are changed within the old findings, these findings will be reported again. The baseline concept is available with SAP NetWeaver AS ABAP 7.51 innovation package. See also the SAP Community blog Remote Code Analysis in ATC – Working with Baseline to suppress findings in old legacy code.

Can the ATC check runs be planned periodically?

Yes, the ATC check runs can be planned periodically on the ATC central system. For more information see Scheduling Run Series in the Central System  on the SAP Help Portal.

Can the ATC checks be integrated into the standard syntax check?

No, it is currently not possible. However, we plan to integrate the ATC into the activation process so that the current ATC results are obtained after the activation of an ABAP object.

Is the state of the approvals held on the ATC central check system or on the local checked system?

On the ATC central check system.

How is the finding exactly referenced (code or source code line)?

A hash (from the code) is generated for each result. As long as it does not change, the line can also move.

How expensive are remote ATC checks with respect to memory usage, execution time etc.?

During an ATC check run, an object model is created in the checked system and transferred to the ATC central check system. The various checks are performed on this model in the ATC central check system. The object models are stored in a cache to minimize the time taken to create and transfer the model.

Memory consumption is strongly dependent on the number and complexity of the objects to be checked.

What about release dependent ATC checks? Various AS ABAP releases may contain different ABAP statements and commands, which must be checked differently.

This release dependency is taken into account in the ATC checks and explained in the checks documentation.

The ATC can be configured so, that it will run during transport release and the transport request will not be released in case of errors or warnings. Is this automatic check also planned for release of tasks and transport of copies?

It is planned to configure the automatic ATC check so that it is executed during the tasks release. Implemented with the SAP note 2495410.

Can I restrict the ATC check only to my custom code (no check for SAP code)?

You can configure which objects will be checked (e.g. all objects of a package). With AS ABAP 7.52 the coverage of checked source code was improved and the findings in SAP includes and generated code are ignored.

Does the central ATC system need to know the release of the checked system e.g. to check differently if applicable?

No.

Can I extend the scope of the Remote Stubs, e.g. in order to add specific DDIC information for my own remote checks?

An extension for your own remote checks is not yet planned.

We practice "collective code ownership". Is there a way to address findings to the last user, instead of to the person responsible for the object?

This is not currently possible. However, such a functionality is planned in the future.

Can I mark already processed findings?

This is not currently possible. However, such a functionality is planned in the future.

During ATC remote checks run: will the ABAP Unit tests run on the local system?

The ABAP Unit tests must always be executed on the local system. This task cannot be carried out by the ATC central system.

Is a check for searching pragmas or pseudo-comments are also planned? Background: Detect and approval process for unwanted pragmas (configurable)?

A check for searching pragmas or pseudo-comments is currently not planned. It is, however, possible to configure ATC check runs in such a way that the results are displayed despite pragmas / pseudo-comments.

For more information see Configuring Run Series in the Central System  on the SAP Help Portal.

Are there ATC checks for Web Dynpro?

The remote ATC checks are currently not applicable for Web Dynpro / Dynpro

What happens to my exemption when I change the coding?

If you request an exemption for a single finding, this exemption will be valid as long as you don’t change the coding or the relevant context of that finding. As long as you only change coding that does not affect the finding (for example you change something in line 20 of an include and the finding marks code in line 200), the finding will be recognized as the same and thereby also the exemption stays valid.

Is it possible for a customer to scan partner add-ons?

In case you as a customer want to scan partner add-ons in your system you have to register the namespace of the add-on via the report SATC_AC_INIT_NAMESPACE_REG.

You can check the documentation of the report for further details. In system older than SAP NetWeaver AS ABAP 7.50 you have to apply the SAP note 2215288 to enable this feature.

Is it possible to run ATC checks when releasing transport tasks?

Yes, this is possible. You have to enable this feature by applying the SAP note 2495410.

Which BAdIs can I use to implement extension points for ATC?

You can implement SATC_CONTACT_PERSON to determine contact person of a development object (default is TADIR-AUTHOR) and SATC_USER_ACCOUNT to determine email address of a user (default is from user data of transaction SU02).

How can I view a central ATC check result in my developer system?

Please refer to the blog Remote Code Analysis in ATC – Browse Central ATC Result in Developer Systems.

How can I decide on which granularity an exemption can be applied?

In transaction ATC you will find the “Admissible Exemption Request” tool to specify if you want to allow exemptions on finding, object or package level.

Can I run remotely ABAP Unit tests?

Yes, you can execute ABAP Unit Tests remotely with the ABAP Test Cockpit if you implement the SAP Note 3037465.

How can I see which objects were included in an ATC mass run?

You can use the expert options Expert->Display Object Keys in the transaction ATC under “Monitor and Control Runs”. The list of object keys will show you all the objects that were checked within an ATC run.

I want to run local ATC checks on my central ATC check system. Is it possible?

Yes, it is possible. You just need to enable local ATC checks for your central ATC check system as per SAP Note 2696969.

Can the same person request and approve an ATC exemption?

No, this is not possible. ATC forces the 4-eyes-principle here.

Can the baseline be managed centrally, e.g. via permissions, so that a local developer cannot deactivate the baseline?

Yes, there is an authorization for it. It is the same as for granting an exemption: S_Q_GOVERN

Our central ATC check system is on the SAP NetWeaver AS ABAP 7.52 (SAP_BASIS 7.52) release. Is it possible to use it to check an SAP S/4HANA system?

No, you need to upgrade it. The central ATC check system must be always on the higher release as the checked system.

In which environments: development, test or productive SAP recommends to execute ATC runs?

Local ATC runs should be executed by developers on the development systems over their individual developments. Development teams can additionally schedule periodic mass ATC runs on development systems.  Central ATC mass runs should be scheduled in the consolidation or test systems by quality experts. ATC runs should never be executed in productive environments.

ATC and ABAP Development Tools (ADT)

Can the ATC messages be displayed automatically in Eclipse as e.g. compiler messages?

No, there is currently no automatic check by the ATC.

 

[IanStubbings]

Hi Olga

We recently had an issue where RFC connections were slow connecting from the satellite to the Central ATC which resulted in transports not being able to be released (blocked for priority 1 and 2).

Rather than login to each individual satellite system to change the ATC settings and switch off the blocking, is there a way to remotely change ATC settings on the satellite systems connected to the central ATC system?

Thanks

Ian

[OlgaDolinskaja]

Hi Ian,

no, unfortunately it is not possible. Could you please clarify your request: is it about centrally caused error situations or do you just want to make administration easier ("mass maintenance" of the settings for several systems)?

Thanks!

Olga.

[IanStubbings]

Hi Olga

Thanks for the quick response.

It was in relation to error situations on the Central ATC system. I think we'll have to manage it manually then.

Regards

Ian

[IanStubbings]

Hi Axel

 

This Enhancement spot is further extended with 2 more BAdIs in 754 but these are both internal use. Can they be made available to the customer?

 

We would specifically like to have functionality to determine the variant to use based on the transport title in the satellite system.  Looking at the parameters for this interface, it looks likely that this BAdI will be a good fit.

Regards

Ian

[axel_jebens]

Hi Ian,

You are right, the BAdI would be a great fit. The BAdI has not been fully released for customers because it turned out to be very complex: By use of the BAdI, you can control the check variant, but you can also assign a check variant which does not exist. The exit allows to change data but it does not validate the changes. This can be critical because ATC checks may not return any result because of a bad implementation (this was just an example - in fact, there have been a couple of issues).

I will use your feedback to increase the priority of this enhancement. You can always decide to adjust the BAdI by a modification to change the parameter Can only be implemented at SAP. But as I have mentioned, you have to be a bit careful and avoid too complex implementations. It would probably also help to validate if the check variant exists.

Regards,

Axel

[IanStubbings]

Thanks for the quick response Axel and also the suggestion to increase the priority of making it available to customers.

As well as changing the flag via a modification, do I have to make any code changes? I notice that in the note 2670671, that a few changes to the code were also made.

 

*>>>> START OF DELETION <<<<<

    if cl_satc_permission_control=>is_sap_system( ).

      try.

          result = _evaluate_keys_by_extension(

            i_transport_infos = i_transport_infos

*>>>> END OF DELETION <<<<<<<

*>>>> START OF INSERTION <<<<

    try.

        result = _evaluate_keys_by_extension( i_transport_infos = i_transport_infos

*>>>> END OF INSERTION <<<<<<

...

            i_initial_keys = result ).

        catch cx_root ##catch_All ##no_Handler.

      endtry.

*>>>> START OF DELETION <<<<<

    endif.



*>>>> END OF DELETION <<<<<<<

 

 

Regards

Ian

[axel_jebens]

You don't.

Yes, this is somehow related but it relates to the other BAdI where we have decided to release the other BAdI within the enhancement spot. You may apply the note if it is also useful for you, however.

[IanStubbings]

Thanks for confirming Axel.  We can't apply the note in this system as it is only relevant up to 753. We have previously applied it in a 750 system and it was exactly what we were after, hence seeing if this would work for us again.

Regards

Ian

[axel_jebens]

If a note is relevant up to 753, it usually means that its changes are shipped with 754, so you don't need it which is true in this case.

Regards,

Axel

[IanStubbings]

Hi Axel

Just tried to switch off the checkbox but it is greyed out in change mode.

Can this only be switched off by debugging and switching the field to active?

Regards

Ian

 

[IanStubbings]

Hi Axel/Olga

We have now modified the BAdI accordingly and can successfully switch from one variant to another at runtime. Thank you again for your inputs.

My next question is whether 2 variants can be used, 1 after another. For example, the first variant would be a centralised one via RFC and the secondary one, local to the satellite system housing extra checks only relevant to them.

Is this possible or is there another way to achieve this?

Regards

Ian

[former_member736017]

Hello Olga,

first of all thank you for your great blogs!

At the top of the blog you write "But you can also run ATC checks any time on demand (is possible starting with Solution Manager 7.2 SP3)". Can you provide more info on this? What would you need to do if you want to trigger the ATC checks when the status changes to "To Be Tested"? Does a BAdI need to be implemented? Or is this customizing?

Thanks and best regards,
Stephan

 

[OlgaDolinskaja]

Hi Stephan,

thank you :-).

More infos: you need nothing to do on the ChaRM side. Only activate ATC in managed system and the ATC will send the messages to ChaRM transport related check framework.

Regarding triggering ATC when the status changes to "To Be Tested"? --ToC will be checked during release process. ToC check needs to be activated in ATC:

Best Regards,

Olga.

[koitka]

😞

[evgenikravets]

Hi Olga,

Thanks for the great and helpful blog! We set up Remote ATC about 3 years ago and do not want to miss it. Unfortunately, we need to move the ATC functionality to another system. Do you know if there is a way to move all existing exceptions to another system? I am actually just looking for some guidance on how to migrate the ATC functionality to another system.
Thank you very much and best regards,

/evgeni.

[OlgaDolinskaja]

Hi Evgeni,

no, unfortunately it is not possible to migrate exemptions, you would need to create them again on the new system.

Kind Regards,

Olga.

[former_member199125]

Hi Olga.

We are on ABAP 7.52 but ATC is still checking the SAP standard coding with in custom programs. Even i got a confirmation from SAP support agent, above statement is incorrect. He says that ATC will check standard code in custom program.

Thank you, Srinivas

PS: If can share support agent incident number as well, if required.

[dmitry_pavlov4]

Hi Olga,

I’ve read carefully your blog and your answer to the questions above… but i still have a question to the  topic "ATC and SolMan integration"... You write it is impossible to configure ATC centrally in SolMan, but we configure CCM in SolMan centrally and need to activate ATC... the only note which i found regarding this is "2420835 - Quality Collector Job SM_CCLM:QUAL* or Job SM_CCL:QUAL* cancels" which contains a reference on this blog.

 

the questions are:

1. in such a situation, where i have to configure the central ATC System? in my understanding it still can be QAS System in the development landscape. Correct?


2. if i'm right in the first question, how the data will come to Info Cubes in BW inside of SolMan? In other words, how the SolMan will know what the ATC central system is and where to get the data from when I’m configuring CCM in SolMan for a development system.

Thank you and best regards, dmitry

[OlgaDolinskaja]

Hi Dmitry,

yes, ATC central check system cannot be set up physically on SolMan system, because ATC needs >=NW 7.51 release, and the SolMan system is on NW 7.4. But if you use CCM in SolMan, then you can extract ATC results to the SolMan. Two scenarios are supported:

1. ATC runs on managed systems locally and all they are connected to the SolMan


2. ATC is set up and configured as a central check system (remote ATC scenario, with managed systems connected to the central ATC hub) and this central ATC hub is connected to the SolMan

It depends which scenario you want to implement. Please refer to the How to Guide: Custom Code Lifecycle Management in SAP Solution Manager 7.2 SP06. The page 45 describes the scenarios.

Kind Regards,

Olga.

 

[CreyJ]

Hi Olga,

we are doing a lot* of ATC checks on task and transport release on a quite newly installed S/4 (755 SP 00) along with Solman 7.2 and CTS and we are having some performance issues with this number of checks. Is there any way to tune this? I did a trace and saw that a lot of time is spent dispatching and waiting.

So I thought I could increase the number of tasks used in SATC_EXECUTE_PROJECT (in debugging), but that didn't help, at least if you only change it there.
(I also found enhancement spot SATC_TRANSPORT_INTEGRATION with BAdI BADI_SATC_TRANSPORT_CHECK_CTRL, which might allow me to increase the number of tasks used).

Do you have any idea how we can increase the performance?

Best regards

Jürgen

* At the moment 40 code pal, 8 performance, 5 security, 6 robust programming, 4 syntax, 4 programming conventions, unit tests, 2 user interfaces. 3 search functions, workflow and finally 3 abap open checks.

 

[OlgaDolinskaja]

Hi Jürgen,

normally you don't achieve much through higher parallelization (by increasing number of tasks) in the transport check, unless you really have high quantities of objects in your transports. It is very likely that individual checks are responsible for the fact that the whole check takes so long, especially since it also has a large number of open source checks in its variant (40 Code Pal and 3 ABAP Open Checks). You could take a look at the SATC_AC_CHS_OBJ_INFO view, where you can see how long it took for an object for each check. It might be possible to find the performance intensiv checks.

Otherwise it is difficult to make a general statement here. Our development support colleagues would need to look into the system. Just open a ticket on BC-DWB-TOO-ATF if you want our detailed help.

Best Regards,

Olga.

[robveenman]

Hello Olga,

Thank you for you very interesting blogs.

After coming across central ATC functionality, I implemented this on a sandbox 7.52 stack and gave a demo to the Abap team. The Abap team adopted ATC and further improved the ATC configurations, exceptions, checks, etc. All in all, ATC is a success and we use this to check and adapt our code for S/4 readiness.

However, ATC is still on implemented on the sandbox without support from our infra-partner. Hence I need to either:

A. do a system copy from sandbox to a supported server. The drawback is that a system copy would also copy other typical sandbox crap like outdated or no longer relevant add-ons, etc..

B. install a fresh Abap 7.52 stack on a supported server and export/import all ATC settings from the sandbox.

C. install a fresh Abap 7.52 stack on a supported server and reimplement all ATC settings.

If it is possible, option B would be my preferred option, but is there an export/import option? Or can we use R3trans to export/import certain ATC tables?

Regards, Rob Veenman

[OlgaDolinskaja]

Hi Rob,

it is not possible to export/import ATC settings, so the option B will not work.

Kind Regards,

Olga.

[former_member5334]

Hello, Olga.

We have an central ATC system with ABAP 7.53 system. I and we have I lot of generated object with error(such as incorrect naming and so on)

Are there any Badi, Exit to skip ATC checks by class name or FM name or object type?

[OlgaDolinskaja]

Hi Aleksandr,

there is only the BAdI BADI_SATC_TRANSPORT_OBJECT for transport release, it should be implemented in the development system (which will be checked with remote ATC). It could be helpful.

Here is the documentation:

Use

The BAdI can be used to change the checked objects which are checked by ATC when a transport is released.

 Activities

Create a BAdI implementation and implement the method "DETERMINE_OBJECTS_TO_CHECK". Return the list of object keys to be added (E_ADD_OBJECT_KEYS) or the list of object keys to be removed (E_REMOVE_OBJECT_KEYS) from the initial object list I_INITIAL_OBJECT_KEYS (or both lists).

Example

You can influence the transport check by evaluating special attributes which are assigned to individual requests.

Kind Regards,

Olga.

[former_member5334]

Thanks, Olga.

But my question is about scheduled runs in central ATC.  BAdI  ADI_SATC_TRANSPORT_OBJECT doesn't fit  us.

[OlgaDolinskaja]

Hi Aleksandr,

unfortunately we don't have such options for ATC mass runs.

Kind Regards,

Olga.

[former_member5334]

Ok, thanks.

IF SAP add such option/Badi in future it will be great.

[former_member781502]

Dear Olga

could you please describe the differences between the ATC checks "S4HANA_READINESS_REMOTE" and "S4HANA_READINESS_2021".

Which checks does one variant have that the other does not?

Are there specific scenarios for the usage of these checks? For example use "S4HANA_READINESS_REMOTE" when upgrading from ECC to S/4HANA, and "S4HANA_READINESS_2021" when updating from a lower S/4HANA-Version?

Thanks and kind regards

Serdar

[OlgaDolinskaja]

Hi Serdar,

see please https://blogs.sap.com/2019/06/25/custom-code-adaptation-for-sap-s4hana-faq/#_Toc470164293

Regarding your question about specific scenarios you are right: the S4HANA_READINESS_REMOTE is suitable during ERP->S/4HANA conversion and the release specific check variants, e.g. S4HANA_READINESS_2021 is suitable for upgrades within the S/4HANA product family.

Kind regards,

Olga.

 

[former_member781502]

Thank you Olga

 

for your fast response, appreciate it!

 

BR
Serdar

[amitpdutta]

Facing error when trying to create Object Provider in ATC Central System:

Problem reported by RFC Layer

System failure for RFC destination ATC_EABCLNT110_TRUSTED: Syntax error in program SAPLSCA_REMOTE_DATA_ACCESS              .

System Response

It is possible to store the configuration. Before it can be used, however, the issue has to be corrected.

Procedure for System Administration

• If function SCA_REMOTE_DATA_VERSION cannot be found, please check whether the remote stub is correctly installed in the target system

• If an authorization failure has occurred, please check if the user which is assigned to the destination, is authorized to call the respective stub functions.

• If syntax errors have occurred, please check the correct installation of the RFC stub.

Further notes

See note 2190113.

[OlgaDolinskaja]

Hi Kavita,

have you followed the instructions in the blog https://blogs.sap.com/2016/12/13/remote-code-analysis-in-atc-technical-setup-step-by-step/? All necessary SAP notes (incl. object provider SAP notes) must be installed on the checked system and the RFC destination must be defined on the central ATC hub. Your RFC user must be assigned the corresponding roles as described in SAP Note 2672703 Authorization roles for remote check scenarios If you have done everything properly and still experience this error message, please open a ticket to SAP.

Kind Regards,

Olga.

[amitpdutta]

Thanks Olga for your response.

I am checking with SAP for this issue.

 

 

 

[BaerbelWinkler]

olga.dolinskaja

Hi Olga!

We are currently running the ATC checks from a central system which is on NW7.52 SP09 and I'm in the process to duplicate the settings in a central system which is a S/4HANA system on 7.56 SP01.

We created a user called ATC_APPROVER in both systems which is connected to an email address functioning as an email-group so that a few of us are alerted about incoming exemptions. This works pretty well in the existing 7.52 system where the user can be selected when an exemption is requested from one of the remote systems.

When I try to use this user in the new 7.56 system from a sandbox for testing, I get an error message:

We already ran an authorization check but nothing was flagged and the "detailed" message for the error unfortunately doesn't provide provide much of a clue either, like a message ID and number to search for.

Is there anything specific we can check in the user settings (or elsewhere) which might be causing this?

Update: I did find two methods in class CL_SATC_CI_EXEMPTION where the code looks quite different in the two systems and there's note 3128712 - Enabling a more flexible means of assigning exemption processing responsibilities but it's difficult to see if that might be related or not.

Thanks much and cheers

Bärbel

[axel_jebens]

Hi Bärbel,

Did you change the settings to use the approval areas in ATC -> Setup -> Basic Settings?

If yes: If there is no corresponding configuration, better switch it off and test again!

Best Regards,

Axel

[BaerbelWinkler]

axel.jebens

Hi Axel,

thanks for your reply but I don't even see that setting and options in the new central system (S/4HANA 7.56 SP01). All I see related to exemptions is this:

This is mimicking the settings in the existing central system on NW 7.52 SP09.

With the system-ID entered as Master system.

Cheers

Bärbel

[BaerbelWinkler]

Never mind! Turns out that user ATC_APPROVER was still missing in the Maintain Approvers setting. After adding it there, I could select it in the satellite system as the approver.

Now I need to hunt down why no notification email was triggered even though I set periodicity to "Immediately" in the relevant setting and the user has a valid email address.

Thanks much and cheers

Bärbel

[axel_jebens]

Hi Bärbel,

Thanks for the feedback. Feel free to raise an incident on BC-DWB-TOO-ATF at any time if you need more help. It is often difficult to answer questions theoretically since there can be a variety of reasons if something does not seem to work as it should.

Cheers,

Axel

[pfasns]

Hi olga.dolinskaja

After succeding in setting up remote security checks via SAP BTP, I am struggling to find a way to set up scheduled runs in BTP.

Is there a way to set up scheduled runs in BTP or do i need to set it up via Eclipse?

 

Svend

 

 

[OlgaDolinskaja]

Hi Svend,

you can execute security checks on SAP BTP directly using the Custom Code Migration app (scheduling of runs is not yet supported) on SAP BTP for your on-premise ABAP system or your SAP BTP ABAP Environment ABAP system, or you can use ADT in Eclipse with SLIN_SEC check variant over your code in SAP BTP ABAP Environment ABAP system.

Kind Regards,

Olga.

[pfasns]

Hi Olga,

Thank you for a fast response!

I assumed as much, but thank you for the clarification, I will look into that.

Svend

[former_member875365]

Hello, Olga.

olga.dolinskaja

In our company, my team and I successfully set up ATC checks. But they could not solve one problem in any way - checks with programs using logical databases do not work correctly. The standard code of LDB programs gets into the checked code with Extended SLIN check. Suggest a solution please.

[DinoPhilips]

Hi olga.dolinskaja,

Within our company certain custom code is developed on system A (e.g. SolMan Dev) and transported to multiple other systems B (e.g. ECC), C (e.g. CRM), D (e.g. BW), ..... etc.

Currently we only have local ATC setup in each system. In order to mitigate ATC-findings on the originating system A  (e.g. SolMan Dev) we create an exemption. However, this exemption is not transported to the other systems B, C, D,....etc. and will raise an ATC-finding on the receiving systems. Sometimes a piece of custom code is transported to 15 systems, raising the same ATC findings on each system as was previously detected and mitigated by exemption on the originating system. Our developers are not particularly happy by having to apply for 15 additional exemptions on each individual system.

We have been looking into setting up remote ATC, but as we understand now this will not help us in having to apply for an exemption only once.

In short: we are looking for cross system exemptions functionality. Does it exist? If yes, how do we set this up? If not, are there any other clever ways how to deal with this specific situation?

Kind regards,

Dino

[OlgaDolinskaja]

Hi Dino,

if you set up remote ATC and the systems A, B, C, D,..., where you need to transport the code to ("object providers" in the terminology of the remote ATC), will belong to the same system group, then the exemptions created for the central ATC result of the ATC run executed for the system A will also be valid for the ATC runs executed for the systems B, C, D.... (see also Remote ATC with a central check system, chapter "Using a Central Check System for Multiple Checked Systems").

Kind Regards,

Olga.

[DinoPhilips]

Hi olga.dolinskaja

• Thanks for your swift reply. Greatly appreciated.


• Check question: Instead of creating Group 1, Group 2, Group 3, would it be possible to create 1 system group containing multiple systems: ECC, SSM, CRM,.... (as depicted below)

Kind regards

Dino

[OlgaDolinskaja]

Hi Dino,

you group systems if they relate to each other in order to align some data between these systems. It is up to you how yo group the systems and how many groups (1,2,3...) you need.

Kind Regards,

Olga.