Purpose

The purpose of this paper is to explain about the SAP syslog concept.

Overview

The main topic of this wiki is to explain about the syslog structure for every ABAP application server.

1. Syslog memory area

Every SAP application server has a shared memory segment called Shared Common System Area (SCSA) to store the main syslog configuration like the write pointer for the syslog file.

A SAP Application Server running in an UNIX Operating System family (HP-UX, AIX, Linux, etc) create the SCSA area with the external tool called sapmscsa during the start up. For Windows Operating System that area is created by the kernel itself during the start up.

It is possible to check this area with the showipc (for UNIX systems) or sappfpar command line as below.

> showipc 01 | grep SCSA
OsKey: 58900101 0x0382be85 SCSA Shared Memory Key: 58900000 Size:      4096        0.0 MB  Att: 21  Owner: <SID>adm  Perms: 640

> sappfpar check pf=<instance profile> | grep SCSA
 Key: 58900101  Size:        4096 (   0.0 MB) SCSA area

For Windows OS, it is possible to check this area from SAPGUI with the report RSTUNSHM.

If the Application Server, or any other program that wants to create syslog messages, cannot attach the SCSA shared memory area, it may not be able to work with the SAP syslog structure.
This area is needed to allow the creation of logs into the syslog structure. The SAP note 12715 could help to understand this memory area troubleshooting in such cases.

12715  Collective note: problems with SCSA

2. Syslog format

Length of syslog format depends of the system:

As of release 7.02 a new length is defined:

For further information about this size, check note 1118986.

1118986  Syslog: Record size increased to 320 places

3. How to check the syslog messages

a) SM21

The syslog messages are created by the kernel and stored at Operating System file configured in the parameter rslg/local/file (SLOGXX where the XX is the instance number). The size of this file is limited by rslg/max_diskspace_local
For further information about these files, check the notes 862 and 45580.

862  Reduce size of system log file

45580  How are syslog files deleted?

It is possible to check the system logs stored in these files via transaction SM21 from SAPGUI connection.

The syslog also has option in the menu bar:

The Local system log shows the logs for the connected application server.

b. Operating System level

The Web Services method also enables an option to analyse the syslog from Operating System level with the sapcontrol toll:

sapcontrol --nr <instance number> -function ABAPReadSyslog

c. Alert Monitor

Another way to analyse these system log messages is via transaction RZ20.

-> SAP CCMS Monitor Templates
-> Syslog

For further information check the SAP documentation

Syslog Monitor

4. Creating syslog messages

It is possible to create syslog messages with the ABAP Function Module RSLG_WRITE_SYSLOG_ENTRY. Calling this Function Module from transaction SM37 and provide with the needed data to be recorded in the syslog. The minimum information to the Function be executed with success are: DATA_WORD1, SL_MESSAGE_AREA and SL_MESSAGE_SUBID.

In this example, the DATA_WORD1 is the text that will be displayed in the syslog messages. SL_MESSAGE_AREA and SL_MESSAGE_SUBID came from Syslog Message Maintenance transaction. Below a example of code to use the Function Module RSLG_WRITE_SYSLOG_ENTRY:

 call function 'RSLG_WRITE_SYSLOG_ENTRY'
   exporting sl_message_area  = 'AU'
             sl_message_subid =   '3'
             data_word1       = 'my program with RSLG_WRITE_SYSLOG_ENTRY'.

Below is the output in syslog of this call:

Another way to create syslog messages is with the kernel function C_WRITE_SYSLOG_ENTRY. The syntax is quite similar and the input also the same. Below an example:

 CALL 'C_WRITE_SYSLOG_ENTRY' ID 'TYP' FIELD ' '
   ID 'KEY'  FIELD 'AU3'
   ID 'DATA' FIELD 'my program with C_WRITE_SYSLOG_ENTRY'.

For reference:
5462  Writing SysLog entries from within ABAP/4 programs

Related Content

Related Documents

Syslog Monitor

Related Notes

12715 Collective note: problems with SCSA

17108 Shared memory still present, startup fails

1118986 Syslog: Record size increased to 320 places

862 Reduce size of system log file

45580 How are syslog files deleted?

1041390 SM21: Central system log via HTTP or HTTPS

1578411 Syslog: Changes as of Basis Release 7.02

5462 Writing SysLog entries from within ABAP/4 programs