smartexporter sap® components...smartexporter sap® components – manual 6 introduction...

ManuaL

Implementation and operation of the SmartExporter

SAP® components

Step by step instruction

on how to implement the

specific Smartexporter

SaP® components

SmartExporter SAP® Components

Copyright

Audicon GmbH

Documentation

Meitnerstraße 6

70563 Stuttgart

Germany

Audicon did its utmost to ensure the quality of the information supplied in this document. All information is supplied without warranty of any kind. Audicon GmbH hereby disclaims all

warranties and conditions with regard to this information whether express, implied or statutory.

The document is protected by international copyright law. Translating, printing, copying images, tables or the publishing of the whole document or parts of it requires the

written permission of Audicon GmbH.

SAP, SAP DART, R/3, ABAP/4 and the SAP logo are registered trademarks of SAP SE, Walldorf, Germany.

Microsoft Excel is a registered trademark of Microsoft Corporation.

Acrobat Reader is a registered trademark of Adobe Systems Inc.

This publication contains references to the products of SAP SE. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, Clear Enterprise, SAP BusinessObjects Explorer, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE in Germany and other countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP France in the United States and in other countries.

SAP SE is neither the author nor the publisher of this publication and is not responsible for its content. SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

SmartExporter SAP® Components – Manual 4

Contents

Introduction ........................................................................................................................... 6

SmartExporter Specification ............................................................................................... 6

System Requirements ........................................................................................................ 8

Comparison of the data extraction methods ....................................................................... 8

Installation ............................................................................................................................11

Scope of Delivery ..............................................................................................................11

Delivery Concept ..............................................................................................................12

Release Compliance .........................................................................................................12

Installation Checklist .........................................................................................................12

Update Checklist ...............................................................................................................12

Installation Procedure .......................................................................................................13

Authorization ........................................................................................................................17

Authorization Concept .......................................................................................................17

SmartExporter end user ................................................................................................18

SmartExporter SAP® components administrator ...........................................................21

Extended RFC authorization objects .............................................................................23

Administration ......................................................................................................................26

Transactions .....................................................................................................................26

File system .......................................................................................................................26

Customizing .........................................................................................................................27

Concept ............................................................................................................................27

Settings.............................................................................................................................28

Function button Logical File ...........................................................................................34

“Check Directory access” function button ......................................................................37

Plug-Ins ............................................................................................................................38

Authorization Profiles ........................................................................................................40

Creating and Maintaining Authorization Profiles ............................................................41

Import and Export of Authorization Profiles ...................................................................51

Transport SmartExporter Settings .................................................................................54

Application ............................................................................................................................56

Functions ..........................................................................................................................56

Data Privacy .....................................................................................................................56

Authorization Concept ...................................................................................................59

Data Privacy Decryption ...................................................................................................60

DDIC Download ................................................................................................................60

Request Status Overview .................................................................................................64


Export ............................................................................................................................68

Clean up data ...................................................................................................................69

Table / Archive information ...............................................................................................70


Introduction

SmartExporter Specification

SmartExporter supports the user when extracting data from an SAP® system.

SmartExporter is not just a data pump to extract any kind of data volume. It goes far beyond, as it provides substantial support for the user in selecting the required data and preparing these for further analysis purposes, particularly in combination with the tools AIS TaxAudit and SmartAnalyzer.

Auditors and other people interested in SAP® data do not have to be experienced SAP® users with a thorough knowledge of SAP® table structures anymore. SmartExporter allows the wizard based download of data from several SAP® systems depending on the authorization level of the user.

Additionally, the join definitions supported by SmartExporter enable you to extract data from several tables at once. This limits the volume of the data to be extracted and the data can be prepared for further processing.

Due to a detailed authorization concept the SAP® administrator can define a user- and group-specific authorization for tables and joining tables. Thus he can make restrictions based on field values, such as company code and fiscal year, to prevent unauthorized access.

Furthermore, the SAP® administrator can protect confidential data by anonymizing or pseudonymizing fields as part of Audicon SmartExporter Data Privacy.

SmartExporter contains a Client and a Server component and can be operated in an offline or online mode.

This manual describes installation, operation, authorization management and customizing of the SmartExporter SAP® components.

The following modes are available in SmartExporter:

Online synchronous:

The external SmartExporter Windows client is connected to the SAP® system and downloads the specified data synchronously. You can either transfer the data directly using a dynamic filter calculation method or carry out the provision and transport of data separately using a buffer table method. If you use the buffer table method, the data will be placed in a buffer table in a background job, in turn the buffer table is read by the client asynchronously. Especially, when dealing with huge data volumes with complex filters this will lead to a considerable increase in performance.

Online asynchronous:

The external SmartExporter Windows client is connected to the SAP® system and initiates an asynchronous background job processing the Data Request. As a result of this process files are generated on the SAP® application server, which are then transferred to the SmartExporter Windows client.


Offline:

Being in offline mode the SmartExporter Windows client creates and saves a Data Request which will be processed by another SmartExporter Windows client which is connected to an SAP® system and it will process the Data Request either synchronously or asynchronously as described above.

The result of the data extraction can be subject to further analysis by other auditing tools like AIS TaxAudit or SmartAnalyzer.


System Requirements

The SmartExporter SAP® components can be installed on SAP® systems with ABAP stack as of release 4.6C.

Note:

For the SAP® versions 4.6C, 4.7 and SAP® Basis 640 a separate installation is available. Please contact Audicon (by phone: +49-211-52059-430 or by e-mail: [email protected]) to request this installation.

To install the SmartExporter SAP® components you have to load the transport request suitable for your SAP® base release from the CD. Alternatively, you can install the Add-On provided on the CD. In case you are using the SAP® Add-On for SmartExporter please refer to the SAP® help for more information on the install: http://help.sap.com (section “Add-On Installation Tool“) or in the “Add-On Installation EN.pdf” guide in the SmartExporter SAP Components\Documentation folder on the SAP® Components CD. (If you have downloaded the SmartExporter version, you can find the files in the SAP Components\SmartExporter SAP Components\Documentation directory in the download package.)

If you want to use SmartExporter in online mode, you have to do so via an SAP® user. Hereinafter the term "SmartExporter end user" will always be used to refer to the SAP® user profile which is used for the SmartExporter RFC connections. To administrate SmartExporter SAP® components an administrator or a user with certain authorizations is required, hereinafter referred to as SmartExporter SAP® components administrator.

The authorizations are described below and can also be defined by uploading and deriving the SAP® role templates included in this delivery package.

Comparison of the data extraction methods

In addition to the SmartExporter SAP® components there are also two other methods of data extraction: via existing SAP® standard components (RFC_READ_TABLE RFC function module) that are already present in the SAP® system or via ZAUDICZ_RFC_READ_TABLE RFC function module. Both alternatives come with limitations of the SmartExporter functionality. To use the full scope of SmartExporter functionality the installation of the SmartExporter SAP® components is required.

http://help.sap.com/


The following table contains a comparison of the three different extraction methods:

SmartExporter SAP® components

ZAUDICZ_RFC_READ_TABLE

SAP® standard components

Also records that are not available in a sorted order can be extracted correctly.

Can result in incomplete data extractions

Supported file types: DEC (virtual or amount fields with decimal separators, thousands separators and signs), FLTP (Floating Point), INT8 (64 bit integer) and QUAN (Quantity)

May return incorrect values

No overflow of calculation or amount fields

May return incorrect values

Synchronous Data Request

Place the Data Request in the queue of the SAP® system

Joins with more than one table

Checking the size of the Data Request

Access archived data

Additional Data Sources

Maximum record length Unlimited for version 6.0.0000 or higher, 2.048 bytes for previous versions

2,048 Bytes (depending on the DATA parameter)

512 bytes

Maximum filter length 132 characters 255 characters (depending on the data type of the OPTIONS parameter)

68 characters

Installation As Add-On or transport

As source code or transport

No installation required

Authorization check using S_TABU_DIS / S_TABU_NAM and/or SmartExporter authorization profiles

S_TABU_DIS / S_TABU_NAM

S_TABU_DIS / S_TABU_NAM

Table 1: Comparison of the SmartExporter SAP® components, ZAUDICZ_RFC_READ_TABLE and SAP® standard components


Please refer to the corresponding manuals on the SAP® Components CD (or in the SAP Components folder of the download package) for further information on the two other data extraction methods:

Read the “Installing_and_configuring_ZAUDICZ_RFC_READ_TABLE.pdf” manual in the ZAUDICZ_RFC_READ_TABLE\Documentation folder for information on the installation and configuration of ZAUDICZ_RFC_READ_TABLE.

Read the “Configuring existing SAP® standard components for the use with SmartExporter.pdf” manual in the SAP Standard Components\Documentation folder for more information on the use of the SAP® standard components.


Installation

This manual describes the installation of the current SmartExporter SAP® components that are shipped together with SmartExporter 2018 R1. You can also use SmartExporter SAP® components that are older than version 6.0.0001; however, in this case it may be that the full scope of functionality of SmartExporter 2018 R1 is not available to you. SmartExporter SAP® components version 2.0.0002 or older are no longer supported.

Scope of Delivery

The software will be delivered on a data carrier or via download package. The data carrier (or the SAP Components folder in the ZIP file of the download) contains the “Readme.txt” file and the SmartExporter SAP Components directory with the following content:

Manual in PDF file format (in the Documentation folder)

SAP® user roles (templates for profiles are available in the Templates folder)

SAP® transport requests (incl. patches, if available, in the Transport folder)

Add-On (certified by SAP SE ) (in the AddOn folder)

The folder structure is shown in the following figure.

Figure 1: Folder structure

Please consider the length of the path. When importing profiles SAP® only supports a path length of 127 characters at the most.


Delivery Concept

The installation of the SmartExporter SAP® components will be performed within a reserved /AUDIC/ namespace, which is configured automatically in your SAP® system during the actual installation.

Release Compliance

The version of the SmartExporter Windows client used must be compatible with your SAP® release. SmartExporter can run in combination with the following SAP® basis releases:

SAP 46C

SAP 6xx

SAP 7xx

Installation Checklist

The following installation checklist for SmartExporter should be taken into consideration:

1. Import SmartExporter transport request or install the Add-On

2. Create/import user role(s)

3. Customizing

4. Specify export path and buffer path (optional)

5. Configure SmartExporter authorization profiles (optional)

6. Configure SmartExporter Data Privacy profiles (optional)

Note:

For version 3.0.0001 and higher the required patches will be shipped as a complete installation. Please always import the current version of the transport request.

In case you are using the Add-On please refer to the SAP® help http://help.sap.com (section “Add-On Installation Tool“) or the “Add-On Installation EN.pdf” guide in the “SmartExporter SAP Components\Documentation” folder on the SAP® Components CD for more information on the install.

Update Checklist

If a previous version of SmartExporter SAP® components is installed on your system, these components will be updated automatically. The existing authorization profiles are also working for the current version of the SmartExporter SAP® components.

When updating already installed SmartExporter SAP® components no Data Requests should be run by SmartExporter clients during the installation of the SmartExporter SAP® components, as this might lead to errors or an abortion of the program.

Note:

The optional authorization object Z_ASE3 is not supported any more.

http://help.sap.com/


The SmartExporter authorization profiles provide an extended authorization check. If possible, the settings for customizing will be taken from the existing configuration. Please consider, however, the changed configuration of the export path and the new configuration parameters described in the “Customizing" section on page 27.

The update equals a new installation. The changes made to the SmartExporter Customizing will be preserved.

Installation Procedure

The SmartExporter SAP® components are stored in a separate namespace AUDIC, which is reserved for Audicon in SAP®, in order to avoid name clashes with products from other producers and their customer objects in the first place. This namespace is created and configured automatically on your system when installing the SmartExporter SAP® components.

Note:

Below you find the description of how to install the SmartExporter SAP® components using a transport request. In case you have already installed the SmartExporter SAP® components via the Add-On, please proceed with the configuration described in the “Authorization" section on page 17.

The directory SmartExporter SAP Components/Transport/<SAP release> contains the following files (where xxxxx is the number of the transport request and AUy represents the delivery system):

K9xxxxx.AUy

R9xxxxx.AUy

The K9xxxxx.AUy file is the R3Trans command file. The R9xxxxx.AUy file is the corresponding Data file. Data and command file have to be transferred to the central transport directory of your destination system. (When using an FTP, please make sure to transfer the data in binary mode.)

Copy the K9xxxxx.AUy command file to the /sapmnt/trans/cofiles directory and the R9xxxxx.AUy data file to the /sapmnt/trans/data directory.

The specified paths for the transport directory /sapmnt/trans serve as an example and can be defined differently in your system (e.g. /usr/sap/trans) and have to be changed accordingly.

If you want to use the template for the logical export file as described in the "Function button Logical File" section on page 34, you can install the transport request K900043.AU6 from the "Transport\FILENAMECI" folder.

IMPORTANT NOTE:

File names have to remain upper case after their transfer. Please make sure that the file names are still upper case. You also have to remove the read-only attribute.


The import of the requests can be started by using the corresponding TMS functions.

1. Call the STMS transaction.

2. Select Import Overview .

3. Select the SAP® system for which you want to import the requests.

4. Select Import Queue Display .

5. In the Extras menu select the Other requests – Add function.

Figure 2: Importing transport request

6. Select the transport request which you have copied in the previous step and confirm that you want to add the transport request.

The request will be shown in the import queue.

Figure 3: Import Queue

7. Select the imported request by highlighting it and click the Select Request +/- icon.

8. Click the Import Request icon to import the request.

The transport requests are exported from client 800. In the following step enter the target client for the import to make sure that client-specific data you want to import is copied to the correct client.


Due to the small size of the request you can import it by using the time setting Immediate and the execution setting Synchronous.

In more recent versions of the SAP_BASIS component you have to set the Ignore Invalid Component Version checkbox in the Options tab because otherwise the import is not possible due to the different versions of the delivery system and your system.

Figure 4: Import transport request

9. Click Next to start the import.

10. Confirm your entries by clicking Yes.

Depending on the settings the import will now be run synchronously in the dialog or asynchronously in the background.

11. Click the Logs icon to show the transport log of the request.

You can ignore the "(4) Ended with Warning" messages for the import steps Import ABAP Dictionary Objects and ABAP Dictionary Activation.


Figure 5: Transport Logs


Authorization

Authorization Concept

To use SmartExporter specific authorizations are required. Depending on the operational mode you are using SmartExporter in you have to consider the following aspects.

If you operate SmartExporter in online mode, the user who is used by the external SmartExporter Windows client to logon to the SAP® system via RFC needs certain authorizations which are described in the “SmartExporter end user” section on page 18.

Hereinafter the term "SmartExporter end user" is used to refer to the SAP® user who was assigned the role described here.

For the SmartExporter end user the corresponding sample role templates are contained in the SmartExporter SAP Components\Templates\Role Templates directory on the data carrier for the languages German and English.

Note:

The combination of the described authorizations required for the use of SmartExporter and authorizations which accrue from other roles and profiles which are applied to the SAP® user might lead to unwanted authorizations for the SAP® user. Please consider authorizations such as S_DATASET and S_TABU_DIS in particular.

Figure 6: Role template for the SmartExporter end user (Z:ASE_ENDUSER_TPL_3)

The role templates can be uploaded, copied and derived using the SAP profile generator (TA PFCG).

When importing role templates please consider that the file name including the file path must not exceed 127 characters. This is a restriction of the SAP® import tool. Please note that internally the file name will be truncated after 127 characters.

For configuration and maintenance tasks additional authorizations for a SmartExporter SAP® components administrator are required. For the SmartExporter SAP® components


administrator (see “SmartExporter SAP® components administrator” section on page 21) the corresponding sample role templates in the languages German and English are contained in the SmartExporter SAP Components\Templates\Role Templates directory on the SAP® Components CD.

Figure 7: Role template for the SmartExporter SAP® components administrator (Z:ASE_ADMIN_TPL_3)

Alternatively, an SAP® administrator with the corresponding authorizations may configure the authorization roles. In case your administrator is using the profile SAP_ALL, you can generate this profile after importing the roles and creating profiles for them.

SmartExporter end user

To call the SmartExporter RFC function modules the user requires the following authorizations.

RFC Access

Authorization check for RFC access (S_RFC)

Activity (ACTVT) 16 (Execute)

Name of RFC (RFC_NAME) to be protected

/AUDIC/SE, RFC1, SDIFRUNTIME, SYST, SCUST_SYS_INFO, SLI1, SDTX, SUSR

Type of RFC (RFC_TYPE) to be protected

FUGR (Function group)

Table 2: Authorization check for RFC access (S_RFC)

Note:

When using SAP® 4.6C you have to replace SDIFRUNTIME by SDIF.


The authorizations for the function groups SCUST_SYS_INFO and SLI1 are optional for the download of data. However, for the download of Data Dictionaries these authorizations are required.

If these authorizations are not assigned, not all information can be shown in the connection test of the SmartExporter Windows client.

Figure 8: Authorization check for RFC access (S_RFC)

System Authorizations (S_ADMI_FCD)

Process administration with the transactions SM04, SM50

PADM

Table 3: System administration function (S_ADMI_FCD)

Note:

The authorization process administration S_ADMI_FCD, activity PADM is optional. If this authorization is not assigned, not all information can be shown in the connection test and the Data Dictionary download of the SmartExporter client.

Figure 9: System administration function (S_ADMI_FCD)

Archiving (S_ARCHIVE)

Activity 03

Work area BC

Archiving Object BC_ARCHIVE, BC_BCSET, BC_DBLOGS, BC_SBAL, BC_XMB

Table 4: Archiving (S_ARCHIVE)

Note:

The listed attributes of the authorization object only serve as an example. The configuration in a customer system has to be defined for each individual case.

To allow access to archived data in an SAP® system, a separate license for the SmartExporter client is required.


Figure 10: Archiving

Batch-Processing: Batch-Jobs (S_BTCH_JOB)

Job operations RELE, SHOW,PROT

Summary of jobs *

Table 5: Batch-Processing: Batch-Jobs (S_BTCH_JOB)

Note:

Without the authorization to enable one's own batch jobs (RELE) it is not possible to run asynchronous Data Requests or to run a Data Request as a background job.

Figure 11: Batch-Processing: Batch-Jobs (S_BTCH_JOB)

Writing files to the backend file system requires the following authorizations (S_DATASET).

File access (S_DATASET)

Activity (ACTVT) Delete, Read, Write

Physical file name (FILENAME) *

ABAP-Program name (PROGRAM) /AUDIC/*

Table 6: Authorization for file access (S_DATASET)

Note:

You can further restrict the authorizations using the attributes FILENAME and PROGRAM.

The /AUDIC/* value for the PROGRAM attribute only allows programs, function modules and classes from the AUDIC namespace to access the specified path.

When using the FILENAME attribute for the restriction you have to specify the physical path in the file system of the application server(s). You cannot specify the logical file name which is configured in the SmartExporter settings.

The maximum length of the path of 59 characters may not be exceeded because otherwise no authorization check is possible.


Figure 12: Authorization for file access (S_DATASET)

Table Maintenance

Table maintenance using default tools like SM30 (S_TABU_DIS)

Activity (ACTVT) 03 (Display)

Auth. group (DICBERCLS) ZASE

Table 7: Table maintenance using default tools like SM30 (S_TABU_DIS)

Figure 13: Table maintenance using default tools like SM30 (S_TABU_DIS)

Note:

For SAP® versions of the base release 700 and higher a new authorization object S_TABU_NAM is available (see SAP® note 1481950). This object also allows to restrict the access on table level below or alongside an authorization group.

Note:

Using the SmartExporter authorization profiles you can define which tables the SmartExporter end user may access complementary to SmartExporter customized settings for the SAP® authorization check. This may be useful if you do not want to alter existing S_TABU_DIS roles but prefer to create dedicated authorizations for tables with your own authorization object.

SmartExporter SAP® components administrator

In addition to the SmartExporter end user authorizations the SmartExporter SAP® components administrator requires the following authorizations.

Cross application authorization

Checking transaction codes at transaction start (S_TCODE)

Transaction Code /AUDIC/SE_CLEAN, /AUDIC/SE_CUST, /AUDIC/SE_DDIC, /AUDIC/SE_STATUS, /AUDIC/SE_INFO

Table 8: Checking transaction codes at transaction start (S_TCODE)


Figure 14: Checking transaction codes at transaction start (S_TCODE)

Basis – Administration

Archiving (S_ARCHIVE)

Activity 03 (Display)

Work area BC (SAP NetWeaver)

Archiving Object *

Table 9: Archiving (S_ARCHIVE)

Figure 15: Archiving

Batch-Jobs (S_BTCH_JOB)

Activity PROT (Joblog)

Summary of jobs *

Table 10: Authorization for Batch-Joblogs

Figure 16: Check of authorizations for Batch-Joblogs

GUI-Activities (S_GUI)

Activity 60, 61 (Import, Export)

Table 11: Authorization for GUI activities (S_GUI)

Figure 17: Authorization for GUI activities (S_GUI)


Devices for Batch processing (S_SPO_DEV)

Device *

Table 12: Spool Device

Figure 18: Spool Device

The two roles were created or imported. Please assign one or more users to these roles.

The user who was assigned the role for SmartExporter SAP® components administrator authorizations should also be assigned the SmartExporter end user role so that he can carry out all configuration and maintenance tasks.

Extended RFC authorization objects

In the Customizing the SAP® administrator can activate the extended RFC authorization checks. This allows him to define activities in the corresponding role for the different actions, e.g. the Customizing.

/AUDIC/AUT authorization object

(Maintain SmartExporter authorization profiles / Transaction /AUDIC/SE_CUST)

Activity (ACTVT)

01 (Add or Create) Add new authorization profiles

02 (Change) Change authorization profiles

03 (Display) Display authorization profiles

06 (Delete) Delete authorization profiles

21 (Transport) Transport authorization profiles

60 (Import) Import authorization profiles

61 (Export) Export authorization profiles

Table 13: /AUDIC/AUT authorization object


/AUDIC/CUS authorization object

(SmartExorter Customizing / Transaction /AUDIC/SE_CUST)

Activity (ACTVT)

02 (Change) Change settings

03 (Display) Display settings

21 (Transport) Transport settings

36 (Extended maintenance) This authorization is required for:

Activating and deactivating the extended RFC authorization check

Maintenance of the Plug-In settings

Table 14: /AUDIC/CUS authorization object

/AUDIC/DPD authorization object

(SmartExporter Data Privacy Decryption / Transaction /AUDIC/SE_DECRYPT)

Activity (ACTVT)

03 (Display) Display the decrypted data

32 (Save) Save the decrypted data to a file

61 (Export) Export key

Table 15: /AUDIC/DPD authorization object

/AUDIC/DPR authorization object

(Maintain SmartExporter Data Privacy profiles / Transaction /AUDIC/SE_DPRV)

Activity (ACTVT)

01 (Add or Create) Create new profiles

02 (Change) Change profiles

03 (Display) Display profiles

06 (Delete) Delete profiles

21 (Transport) Transport profiles

36 (Extended maintenance) Display key fields as unencrypted text

60 (Import) Import profiles

61 (Export) Export profiles

Table 16: /AUDIC/DPR authorization object


/AUDIC/EXT authorization object

(SmartExporter Data Request authorizations for SmartExporter Windows client)

This functionality allows the SAP® administrator to activate or deactivate specific actions in the SmartExporter Windows client. For example, if a SmartExporter end user is not supposed to run synchronous data extractions, Activity 16 (Execute) can be deactivated.

Activity (ACTVT)

03 (Display) Run preview and determine size

16 (Execute) Synchronous data extraction

39 (Check) Check Data Request

72 (Plan) Asynchronous data extraction

Table 17: /AUDIC/EXT authorization object

/AUDIC/STS authorization object

(SmartExporter request overview / Transaction /AUDIC/SE_STATUS)

Activity (ACTVT)

02 (Change) Delete the files and buffer table entries

03 (Display) Display Data Requests

06 (Delete) Not in use

Table 18: /AUDIC/STS authorization object


Administration

Transactions

Note:

The SmartExporter SAP® components are available in German and English. To make sure that the language-specific configuration details are displayed correctly the user should select one of the supported languages for the logon.

After importing the transport or the Add-On successfully into the previously configured namespace, the following functions can be used. These functions will be available as new transactions in your system:

/AUDIC/SE_CLEAN Delete request file

/AUDIC/SE_CUST Customizing

/AUDIC/SE_DDIC DDIC Download

/AUDIC/SE_DPRV Maintain Data Privacy profiles

/AUDIC/SE_STATUS Request Overview

/AUDIC/SE_INFO Table and archive information

Note:

When calling the transactions using the command line, you have to use the prefix /N before typing the actual transaction code, e.g. /N/AUDIC/SE_CUST. Otherwise the transaction is not selected.

File system

If you are also using SmartExporter in asynchronous mode, files will be created on the SAP® application server. These files will be written into the configured logical directory specified in the customizing. This logical directory is configured cross-client using the FILE transaction and optionally it is configured client-specific using the SF01 transaction (see “Customizing" section on page 27).

Please make sure that there is sufficient space in the export directory and that the authorization on operating system level is configured correctly.


Customizing

Concept

SmartExporter is configured by a set of parameters. You can access the Customizing screen by entering the transaction code /AUDIC/SE_CUST at any time.

Figure 19: Customizing

The SmartExporter SAP® components administrator can access the Customizing in the Audicon SmartExporter folder in the User Menu.

Select the Customizing entry and open it by double clicking or using the context menu (right-click) and the Execute entry.

The configuration settings are located in the Settings, Plug-Ins and Authorization Profiles folders.

Figure 20: Settings folder

You can switch between the display and change mode by opening the Settings menu and clicking Display/Change or pressing the F6 key.

As an alternative you can also click the Display/Change icon.


Settings

The following parameters are available in the Settings folder.

Figure 21: Display settings


The parameters in the Settings folder have the following functions:

Name Description Initial Value

Authorization check

no extended RFC authorization checks

Option to run an activity-related RFC authorization check for certain actions.

If this option is selected, the checks will be run as in previous versions.

You should only select this option if the corresponding RFC authorizations are configured.

See also “Extended RFC authorization objects” section on page 23.

X

Data Dictionary Download

Settings in this area only apply to the download Data Dictionary function, which can be run using the SmartExporter Windows client or the /AUDIC/SE_DDIC transaction.

SAP table-display authorization check active (S_TABU_DIS)

Option to activate the SAP® standard authorization check (SE16) in the DDIC matching (S_TABU_DIS).

X

SmartExporter authorization check active

Option to activate the SmartExporter authorization check (authorization profiles) in the DDIC matching

Transfer tables also on negative authorization check

Option, whether table descriptions should be transferred even if no authorization exists for the table. If this flag is not set, table descriptions are not transferred when the appropriate authorization does not exist.

X

Table download

The settings in this area apply to running Data Requests by the SmartExporter client.

SAP table-display authorization check active (S_TABU_DIS)

Option to activate the SAP standard authorization check for table download (authorization objects S_TABU_DIS, S_TABU_NAM)

X

SAP archive-display authorization check active (S_ARCHIVE)

Option to activate the SAP standard authorization check for archived data download (authorization object S_ARCHIVE)

X

SmartExporter authorization check active

Option to activate the SmartExporter authorization check (authorization profiles) for table download.

SmartExporter archiving object authorization check active

Option to also activate the SmartExporter authorization check for archiving objects (only available if also the general SmartExporter authorization check is active)


Performance

Package size The maximum package size is 15,000. This value determines how many records are transferred per package.

15,000

Options for package size check

Specify behavior for package size check

use Client value, Error on mismatch

use Customizing value

use Client value

Determines which value will be used for the check

use Client value, Error on mismatch

Max Memory / Package Maximum allowed memory requirement per package in megabytes. Due to the possible record width it may be advisable to restrict the package size.

200

Determine Size for complex requests

Select this check box to determine the expected number of records also with complex requests (joins with POOL or CLUSTER tables and archive access). This can lead to a long runtime and considerable stress on the system.

If you do not select this check box, only the number of records in the base table will be determined in case of joins with POOL or CLUSTER tables. In case of archive access the number of index entries will be determined.

X

Max. priority for batch jobs

This value defines the highest priority allowed.

System value (S_BTCH_ADM-BTCADMIN authorization)

A - high priority

B - middle priority

C - low priority

X - use client value

System value

Perform requests using complex Joins in FAE Plug-In

Defines if joins with fields in join conditions that are not included in the primary key will be run using the For All Entries Plug-In.


Technical Settings

Executing server Application server or server group on which the background jobs are run. (The current application server on which the dialog process is run is used as default.)

Note:

The search help of this field shows the available servers and server groups.

Logical export file Logical name of the export directory (cross-client with FILE transaction or client-specific with SF01 transaction).

Note:

If you use server groups, you have to make sure that all application servers of the server group have access to the common physical storage location.

/AUDIC/SE_EXPORT_FILE

Record delimiter Record delimiter for index.xml file. Windows systems use CRLF, Unix systems use LF or CR. Please contact your administrator.

depends on the system: Windows CRLF, Unix LF

XML DTD GDPdU DTD (XML DTD file for index.xml file).

Using the search help you can display the available DTD files.

This parameter should only be modified after contacting the SAP® administrator.

GDPDU-01-09-2004.DTD

Max. cursor lifetime Maximum length of time the database cursor will remain open to avoid database timeouts, especially in Oracle during long-running asynchronous extractions.

8 hours for Oracle databases. Otherwise 0 (i.e. no time limit).

Max. file size To avoid limitations due to the SAP® application server file system, especially under OS400, you can enter the maximum file size for parts of a file here. The size is given in megabytes. If you enter the value 0, no file members will be generated.

0


Buffer Table method of synchronous extraction

Buffer Table method (Storage method)

Defines how the data is stored temporarily when using the buffer table method.

Compressed File:

The data is stored in a compressed file on the SAP® application server.

Cluster table:

The data is stored in compressed form in the /AUDIC/SE_INDEX data cluster.

Table:

The data is stored in the /AUDIC/SE_DATA database table.

File:

The data is stored in a file on the SAP® application server.

It is recommended to use the "Cluster Table" setting because in this case the data volume stored temporarily in the database will be reduced by up to 95% by means of compression.

Using "Table" can lead to considerable stress on the database server in case of huge data volumes.

The "Compressed File" setting offers a compromise between runtime and stress on the system and it is therefore recommended to use this setting provided that the storage location defined in the “Logical file” field was configured.

In 4.6C the "Compressed File" option is not available, please select the "File" option.

Cluster table

Number of buffer packages (Package count)

Maximum number of data packages that are created by the background job before the client gets the next package.

This defines the maximum space in the file system or database used for a Data Request.

2


Logical file Logical file name for the storage location on the application server, in which the buffer files are created (only used if either the buffer table method "Compressed File" or "File" is used)

Note:

If you use server groups, all application servers of the server group must have access to the common physical storage location.

/AUDIC/SE_TEMP_FILE

Archive

Access method Method to evaluate the archive index

Sequential

The archive files are read completely to find matching records

Direct

The archive index is used to read matching records directly

Optimized

The index is used to determine if the direct access or reading the archive file sequentially is faster.

Note:

Only default SAP archive indexes which can be evaluated using the SARI transaction and PBS archives are supported. To access archived data using SmartExporter in combination with PBS archive add ons®, the statistics created by PBS Utility STATS are required.

If PBS Utility STATS is not implemented on the SAP® system, please contact the PBS Helpdesk and refer to the note number 17587.

If no archive indexes are available, the sequential mode is used automatically.

Optimized


Use archive without index

If this option is used, also archives without indexes can be read.

In this case it is highly recommended to restrict the access to archives using the SmartExporter authorization profiles. Without restrictions a long runtime and high stress on the system are to be expected as all available archive data of the archiving object are read sequentially.

Table 19: Customizing parameters

IMPORTANT NOTE:

Please check whether the options above comply with the configuration of your SAP® system and define them accordingly.

Function button Logical File

Click this button to branch in the maintenance of cross-client or client-specific file names or paths.

Note:

If you use a server group as executing server, all application servers must have access to the physical path.

Figure 22: Logical File Definition

Click the SF01 or FILE button to call the corresponding transaction.

This function requires enhanced authorizations to maintain the cross-client tables. The authorization necessary for this function is explained in the description of the required authorizations and roles for the SmartExporter SAP® components administrator. File names or paths can only be changed by an SAP® user with the required authorizations.

During installation no default entries for the cross-client definition are made.

In the SmartExporter SAP Components\Transport\FILENAMECI subfolder on the SAP® Components CD you find a release independent transport request K/R900043.AU6, which you can use to import the configuration described in the following. The installation is run in the same way as the installation of the SmartExporter SAP® components transport requests described in the “Installation Procedure” section on page 13.


Below a sample configuration for an operating system independent configuration is described.

Figure 23: Logical file path definition

Assignment of Logical Paths to Physical Path

Windows <V=/AUDIC/SE1>/<SYSID>/<CLIENT>/<FILENAME>

Unix <V=/AUDIC/SE2>/<SYSID>/<CLIENT>/<FILENAME>

Table 20: Assigning logical paths

Figure 24: Assignment of physical path to logical path


Figure 25: Assignment of physical paths to logical path in the detailed view

Cross-client logical file names

Logical file cross-client /AUDIC/SE_EXPORT_FILE

Name SmartExporter export file

Data format ASC

Logical path /AUDIC/SE_EXPORT_DIR

Table 21: Assignment of logical file names - cross-client

Figure 26: Assignment of cross-client logical file names

In more recent versions of the SAP_BASIS component you can use the DIR value for the data format. In this case the defined path will always be validated internally by calling the FILE_VALIDATE_NAME function module before file access is granted. This prevents unauthorized access to files outside the defined path.

Variables

/AUDIC/SE1 D:\Temp

/AUDIC/SE2 /usr/ase

Table 22: Variables


Figure 27: Definition of Variables

It might be sufficient to simply adjust the variables corresponding to the operating system of the application server(s). In Windows for example:

/AUDIC/SE1 = X:\SEExport

Using a SID = XXX with the 999 client the following path is used:

X:\SEExport\XXX\999

You have to make sure that this path exists and that the SAP® system has the authorization to read and write on this path. If you use a Windows operating system, the user <DOMAIN>\SAPService<SID> or the groups <DOMAIN>\SAP_LocalAdmin, <DOMAIN>\SAP_<SID>_LocalAdmin or <DOMAIN>\SAP_<SID>_GlobalAdmin must have the corresponding rights for the directory. For Unix (Linux, AIX, OS400, etc.) this user is <SID>adm or the group sapsys.

Additionally, you can use the PARAM_1 parameter when defining the physical path. In this parameter the user name of the SAP® process is transferred. You just have to make sure that the corresponding folder structure and the authorizations are available.

You can adjust this configuration client-specifically using the SF01 transaction. Configuration details depend on the environment of the SAP® system and have to be modified individually.

“Check Directory access” function button

Use this function button to check the configuration of the logical export file. The authorizations and access to the configured directory are checked.

When you click the Check Directory access button, a dialog is launched, where you have to specify for which user the S_DATASET authorizations are checked. By default the user currently logged into the SAP® system is selected. Select a user.

Figure 28: Select a user


Figure 29: Check export directory

In the check the complete path and the available storage space of the export directory are shown.

If the value "Compressed File" or "File" is configured for the buffer table method, this directory can be checked by placing the cursor in the Logical file field and clicking the Check Directory access function button.

Figure 30: Check directory access

Note:

Depending on the configuration the available disk space, e.g. of network drives, cannot be determined.

Plug-Ins

To use the join feature also for cluster and pool tables, enable access to archived data and anonymize or pseudonymize data via Data Privacy, the implementation is carried out in Plug-In classes.

During the installation process the required standard components Plug-Ins are installed.


Figure 31: Display available Plug-Ins

Important note:

If you make changes here, this could impair the functions of SmartExporter. Especially, the Plug-In ID and the Plug-In Class must not be changed.

After selecting one or several Plug-Ins you can switch to the detailed view using the Details

icon.

Figure 32: Detailed view of the FAE Plug-In

Due to performance reasons it may be necessary to change the value for the Plug-In Parameter field for the Plug-Ins with the IDs TABLE_READ_FAE and TABLE_READ_FAE_V4. High values may result in an increased need for storage space and long ABAP runtimes, whereas small values may cause long runtimes due to numerous database accesses. The optimal value depends on various factors and has to be determined individually. So far a value of 50 is preset for the installation and has proven to be practicable.


When configuring the archive plug-ins the Plug-In Parameter field defines which implemented class will be used to evaluate the archive index.

Figure 33: Detailed view of the Archive Plugin

The current version only supports the /AUDIC/CL_SE_AIS_DIRECT class for the analysis of the SAP® AIS indexes.

Authorization Profiles

In the Authorization Profiles folder you can configure the advanced SmartExporter authorization management.

Settings made in this area will only be applied if the SmartExporter authorization check active option in the Data Dictionary download settings or the SmartExporter authorization profiles active option in the table download settings was selected. These authorizations will be checked by the SmartExporter client before running a Data Request. A Data Request can only be run if the authorization check was completed successfully.

If the SmartExporter authorization profiles active option is selected and no authorization profiles are configured or assigned to the user, the users do not have the authorization to read the tables.

Figure 34: Authorization profiles overview


You can also use the User Assignment or the Role Assignment subfolders to assign specific users or groups to the authorization profile.

In the SmartExporter authorization profiles you can restrict the access to tables and the usage of tables in joins by means of the Table Usage and Table Joins subfolders. Besides, in the Table Filter subfolder you can restrict filter values for table fields, for instance company code, to the range of values allowed by the administrator.

Use the Export profile data and Import profile data buttons to import authorization profiles from a template or export authorization profiles as a template for deployment on other systems. The import and export functions are only available in the display mode to ensure the completeness and integrity of the configuration.

Creating and Maintaining Authorization Profiles

In the change mode you can edit existing authorization profiles and create new authorization profiles using the New Entries button. An authorization profile cannot be configured by several users simultaneously and therefore this is prevented by the program.

To avoid a loss of data save all changes in the change mode by clicking the Save button or select the STRG+S shortcut. If some changes are not saved yet when quitting an action, a message will be displayed so you can choose if you want to save or discard the changes.

Figure 35: Change authorization profiles

Field Description

Profile Unique name of an authorization profile

Profile description Short description of the profile.

If you need the profile description in multiple languages, you can enter the corresponding translations via the Translation entry in the Goto menu.

User group Assignment to the SAP® user group

Use the User Assignment or Role Assignment folders to either assign SAP® users directly or via role to an authorization profile.

Table 23: Fields and description


Select the New Entries button to open the form for new authorization profiles.

Add a new authorization profile as shown in the following image.

Figure 36: New authorization profile

Use the Back icon or the F3 key to return to the overview page of the authorization profiles. The newly added authorization profiles are shown here.

Figure 37: New authorization profile in the overview list

Select an authorization profile to configure table usage, table filter or table joins, archive usage and user assignment.


Figure 38: Change authorization profiles

Click the Table Usage subfolder to open the maintenance of the tables. Here you can select the tables to assign the authorization. The tables already configured will be displayed.

Figure 39: Configure table usage


Table usage

Table Name Table name of an SAP® database table or view.

The generic (*) value allows access to all tables. Except for the (*) value no other wildcard definitions such as "XY*" are allowed.

Using the search help for the field you can select tables from the SAP repository.

Table Usage Selection field containing the following values:

o unrestricted: The table can be used for all kinds as a left or right table

o base table only: The table can be used singularly or as a base table (left or primary table) of a join. Header tables, such as BKPF, must not be used as right or secondary table of a join.

o only as right join table: The table may only be used as a linked (right or secondary) table of a join. Item tables, such as BSEG, may only be used as a right table with a header table in a join.

Table 24: Configure table usage

Add new entries using the New Entries button.

Figure 40: Overview of the added table usage entries

Click the Table Filter subfolder to switch to the maintenance of the filters to be used. The filters already configured will be displayed.


Figure 41: Overview table filters

Field Description

Record ID Record ID for internal administration, display only

Table Name Table name of an SAP® database table or view.

The generic (*) value sets the filter for all tables for which the field name is defined. Except for the (*) value no other wildcard definitions such as "XY*" are allowed.

Field Name Name of a database field

Inclusive/Exclusive o Inclusive: The result restrictions defined by the following filter values are included

o Exclusive: The result restrictions defined by the following filter values are excluded

Option Filter condition:

o Equal to

o Between

o Contains Pattern

o Less Equal to

o Greater Equal to

o Less than

o Greater than

From Filter value for all conditions

To Upper limit (only valid for filter condition Between).

Object Name of authorization object

Fieldname in Object Field name in authorization project

Table 25: Configure table filters


Notes on the use of table filters

In the database view you have to enter filter values as follows:

o Date values (DATS) in the YYYYMMDD format

o Time values (TIMS) in the HHMMSS format

o Document numbers have to be entered with leading zeros

o Language keys (SPRAS) have to be entered using the single-character language key

o Language keys (LANGU), however, have to be entered using the double-character language key

o The special value INITIAL can be used for the filter value in LOW and HIGH to explicitly check the initial field values.

Note:

The table filters are used in an additive manner. An incorrectly defined table filter will have an impact on the result of the database request.

The specified table filters will be added to the filters defined in the Data Request.

Using filter values could increase the runtime significantly when performing a database request.

o Therefore you should only use filters for key fields of the tables.

o Complex criteria such as Contains Pattern or Between should be avoided in tables with a huge data volume.

If the field is used in the right table of a Left Outer Join, only the defined "Inclusive Equal to" filters will be used and specified as a join condition to avoid SQL syntax errors.

After importing an authorization profile template the filter values have to be adjusted according to requirements of the local SAP® system. Particularly empty filter values have to be considered as these might lead to an incomplete result.


Figure 42: New table filter

Instead of manually entering the filter values, filters can also be specified using authorization objects. In order to do so, please enter the corresponding object and authorization field. In that case only the table name and field name are required.

If the authorization object is defined accordingly, the existing authorizations of the user will be used automatically. If changes are necessary, the SAP® administrator can adjust the authorization object centrally instead of having to change the relevant filter values for all tables.

Figure 43: New table filter with authorization object


Use the Back icon or the F3 key to return to the overview page of the table filters. The newly added table filters are shown here.

Figure 44: New table filters in the overview

Click the Table joins subfolder to switch to the maintenance of the filters to be used.

The table joins already configured will be displayed.

Figure 45: Configure table joins

Field Description

Base Table Table name of the basetable (left or primary table respectively) of a join definition

The generic (*) value allows the use of each table as a base table in a join definition.

Join Table Table name of a subtable (right or secondary table) of a join definition

The generic (*) value allows the use of each table as a subtable in a join definition.

Table 26: Configure table joins

All table joins which should be allowed have to be defined. By using the generic values for Table Name and Join Table you can reduce the number of table joins that have to be defined.


Figure 46: Newly added table joins

Click the Archive Usage subfolder to switch to the maintenance of the filters to be used. The archiving objects already configured will be displayed.

Figure 47: Change archive usage

Field Description

Arch. Object Name of the archiving object (see transaction SARA)

The generic value (*) allows the use of any archiving object.

Using the search help attachment (F4 key) you can select the archiving objects and archiving sessions which were activated in the system.

Ssn from Unique number of an archiving session

This value defines the lower limit of an interval for archiving sessions. The value 0 allows the use of any archiving session up to the upper limit.

Ssn to Unique number of an archiving session

This value defines the upper limit of an interval for archiving sessions. If this value is 0 and also the value for "Ssn from" is 0, all archiving sessions will be authorized.


Field Description

Date from Date of an archiving session

Lower limit of a date interval in which an archiving session was run.

If this field is empty, all archiving sessions up to the date "Date to" will be authorized.

Date to Date of an archiving session

Upper limit of a date interval in which an archiving session was run.

If this field is empty, all archiving sessions since the date "Date from" will be authorized.

Table 27: Configure archive usage

Note:

If you want to cover several entries for the same archiving object, the restriction for all entries should be done using either the Ssn from and Ssn to values or the Date from and Date to values. Using a mixed definition may lead to undesirable combinations.

Click the User Assignment subfolder to switch to the maintenance of the SAP® users to be authorized.

The users already configured will be displayed.

Figure 48: Change user assignment

Within the authorization profiles in the user assignment you can configure SAP® users.

Field Description

User Name Name of an SAP® user

Table 28: Assign users


As an alternative for the user assignment you can also use roles to assign the authorization profile to relevant users. In order to do so, click the Role assignment subfolder.

Import and Export of Authorization Profiles

The import and export of authorization profiles is only possible in the display mode. Additionally, it is checked if another user is editing the authorization profiles in the change mode. If this is the case, a message will be prompted showing the user name of the user working in the change mode.

Figure 49: Change mode locked by other user

Import

Click the Import profile data button to locate the file to be imported on your computer.

Select the XML file to be imported and click the Open button.

Note:

The file name including path and extension must not exceed 127 characters. This is a restriction of the SAP® standard dialog for uploading files.

A dialog to define the import settings is displayed.


Figure 50: Import settings for the profile data

If the file to be imported contains several profiles, you can navigate between the profiles at the bottom of the dialog using the arrow keys.

In the Profile name area the source ID and the description of the previously exported profile are displayed. Specify the ID (target ID) which has to be used to save the profile here. You can also adjust the description of the profile.

In the Import scope area specify which definitions you want to import. You can specify here whether you want to include only the definition or also the values.

You can specify if group or user assignments of the profile to be imported should be included. This is only useful if the export originates from a test or QA system with identical user and group configuration.

In the Import settings area you can determine how to proceed with the import if an authorization profile with the same ID already exists. For example, you can define whether the existing profile should be replaced (in this case the existing profile values should be deleted before you import the new ones) or enhanced. If you want to complete the profile, activate the Enhance existing profile option.

Use the Save profile icon or the STRG + S shortcut to apply the selected settings. Click the Cancel icon or press the F12 key to close the dialog without saving.

After saving the profile a message is shown, indicating that the import was completed successfully.

Note:

Due to the use of the SAP® view cluster maintenance it is necessary to restart the /AUDIC/SE_CUST transaction to edit the imported profiles.


Figure 51: Message at restart after importing the profile

After restarting the /AUDIC/SE_CUST transaction the imported profile will be displayed in the list of available authorization profiles.

Figure 52: Newly imported profiles in the overview

Now the assignment to the user groups can be done.

Export

In order to export authorization profiles you have to select them in the display of the authorization profiles. You can also select several profiles to export.

Click the Export profile data button to select the settings you want to export.

In the Export Scope dialog the scope of the data to be exported is specified.


Figure 53: Define export scope

Select the corresponding options to specify the scope of the data to be exported.

Use the Export table filter values to define whether the filter values in the "From" and "To" columns should also be exported because it might not always be useful to transfer these values to other systems or clients.

Use the Export user assignment option to define whether the values of the user assignment and role assignment should also be exported, because Role it might not always be useful to transfer these values to other systems or clients.

Click the Enter icon to open a dialog where you can specify the file name and select the folder on your local computer. You can change the suggested file name according to the requirements.

When selecting the folder and the file name please consider that when you import the profile the total length of the file name including the path must not exceed 127 characters.

Click the Save button to export the data of the authorization profile to the selected file.

Transport SmartExporter Settings

You can only transport SmartExporter settings in the display mode. Additionally, it is checked if another user is editing the settings in the change mode. If this is the case, a message will be prompted showing the user name of the user working in the change mode.

Click the Transport settings button to select the settings to be transported.

In the Transport Parameters dialog you can specify the scope of the data to be transported.


Figure 54: Transport Parameters

Select the content to be transported and click OK (Enter) to start the export of the data.

Select the available transport request or create a new one by clicking the Create Request button.

Click Next to add the settings to the selected transport request.


Application

Functions

SmartExporter provides the following core functions:

Data Privacy (Transaction /AUDIC/SE_DPRV)

Data Privacy Decryption (Transaction /AUDIC/SE_DECRYPT)

Data Dictionary Download (Transaction /AUDIC/SE_DDIC)

Request overview (Transaction /AUDIC/SE_STATUS)

Delete request (Transaction /AUDIC/SE_CLEAN)

Table/archive information (Transaction /AUDIC/SE_INFO)

All transactions are described below.

Data Privacy

In order to protect confidential data, you can define Data Privacy profiles using the /AUDIC/SE_DPRV transaction and assign users or roles to those profiles. In doing so, you can specify the table fields to be anonymized or pseudonymized during extraction.

In the case of personally identifiable data, anonymization means changing those data so that they can no longer be traced back to a certain individual. Pseudonymization is the process of replacing the data with a pseudonym or an indicator to make it impossible or substantially more difficult to identify the individual in question. Pseudonymization is hereinafter also referred to as encryption.

The Data Privacy feature is not limited to personally identifiable data but can be applied to any table fields.

The data are anonymized or encrypted even prior to extraction. This ensures that the SmartExporter user can never access the original data.

The function can be run by calling the transaction /AUDIC/SE_DPRV.

Figure 55: Display Data Privacy profile


Field Description

Profile Unique name of a Data Privacy profile

Description Short description of the profile.

If you need the profile description in multiple languages, you can enter the corresponding translations via the Translation entry in the Goto menu.

Plug-In ID The way data are anonymized or encrypted is implemented in plug-ins. This means that you have to select the Data Privacy plug-in here. All Data Privacy plug-ins start with DATA_PRIVACY.

Click the SmartExporter Help icon for more information and to learn which plug-ins are currently implemented.

Type The current implementation supports field anonymization and field encryption.

Key Type If you want the data of a field to be encrypted, specify how encryption is to be done.

The current implementation only supports the key type Key.

Encryption using Please specify the means of encryption.

Click the SmartExporter Help icon for more information on the possible values.

Key value Please specify the static string to be used for encryption. This string can also be generated automatically via the

Generate passphrase icon.

Table 29: Settings for Data Privacy profiles

Note:

Some of the algorithms used for anonymization or encryption are CPU intensive and may lead to a significant decrease in runtime performance.

If you decide to use the AES Data Privacy plug-ins for the encryption, note that the SAP® kernel variants are considerably faster than the ABAP implementation.

Due to the implementation in SAP®, however, the kernel variants will generate different encryptions for the same values. This may be a problem if the encrypted values are key fields which will be used in other tools later on. For example, the data analysis tool IDEA may not be able to assign key fields correctly anymore when joining files.

Decrypting the data, however, will still be possible without any restrictions despite the different encrypted data values.

Click the Field definitions subfolder to switch to the maintenance of the table fields to be anonymized or encrypted. The fields already configured will be displayed.


Figure 56: Display field definitions for Data Privacy profile

Field Description

Table Name Name of an SAP® database table or view.

Generic values like those used for specifying authorization profile table filters, e.g. "*", are not allowed here.

Field Name Name of a database field

Method Please specify what kind of anonymization is to be used or whether the data of the table field are to be encrypted in accordance with the selected plug-in.

Parameter for constant and masking

When using a constant or masking for encryption, enter the required parameters here. Click the SmartExporter

Help icon for more information on the parameters.

Table 30: Field definitions for Data Privacy profiles

Note:

If there are several Data Privacy profiles for one user that contain different field definitions for the same table field, the SmartExporter SAP® components will use the field definition with the anonymization method that is more secure, in the following order: encryption with plug-in, masking, assigning a value. If the same anonymization method is used in these Data Privacy profiles, the SmartExporter SAP® components will use only the field definition of the first profile, i.e. the profile that comes first in the list of profiles.

Click the User assignment subfolder to switch to the maintenance of the SAP® users to whom the profile shall be assigned. The users already assigned will be displayed.


Figure 57: Assign Data Privacy profiles to users

Here you can configure the SAP® users to whom the SmartExporter Data Privacy profile is assigned.

As an alternative to user assignment, you can also use roles to assign the Data Privacy profile to the relevant users. In order to do so, click the Role assignment subfolder.

Figure 58: Assign Data Privacy profiles to roles

Authorization Concept

To prevent unauthorized users from manipulating the Data Privacy profiles, the Z:ASE_DPRV_DISP role for displaying and the Z:ASE_DPRV_CHNG role for maintenance are shipped.

These roles are included in the SAP® Components CD in the SmartExporter SAP Components\Templates\Role Templates directory and can be uploaded, derived and copied in the SAP profile generator (TA PFCG).

When importing role templates please consider that the file name including the file path must not exceed 127 characters. This is a restriction of the SAP® import tool. Please note that internally, the file name will be truncated after 127 characters.


Data Privacy Decryption

You can use the /AUDIC/SE_DECRYPT transaction code to decrypt data that was encrypted using the SmartExporter Data Privacy functionality.

The decryption can either be run completely in SAP® or in combination with the SmartExporter Data Privacy Decrypt Windows tool. The latter option may be the preferred choice if the decryption is supposed to be run by a person that does not have access to an SAP® system or does not have the required authorizations.

For more information on the Data Privacy Decryption please refer to the help: https://docu.audicon.net/SmartExporter/2018R1/Components/en/Content/Decryption/DataPrivacyDecrypt_SAP.htm

You can also open the help by calling the /AUDIC/SE_DECRYPT transaction and then

clicking the SmartExporter Help icon.

DDIC Download

This program creates an offline download of SAP® Data Dictionary components. According to the settings up to 3 files will be written into the target directory. These files contain information about tables, fields, company codes, application components of the SAP® system.

The following 3 files are generated (where SYSID = SAP system ID, INSTALLID = SAP installation number, TIMESTAMP = timestamp in the YYYYMMDDHHMMSS and LANGU = SAP language):

1. Tables; File <SYSID>_<INSTALLID>_<TIMESTAMP>_TABLES_<LANGU>.CSV

2. Optional Field Data; File <SYSID>_<INSTALLID>_<TIMESTAMP>_FIELDS_<LANGU>.CSV

3. System data; File <SYSID>_<INSTALLID>_<TIMESTAMP>_SYSDATA_<LANGU>.CSV

The file names contain the 3-digit SAP system ID (SYSID) and the SAP installation number (INSTALLID) for identification purposes.

The files are created using a CSV format. Columns are delimited by ASCII hex09 (htab).

The function can be run by calling the transaction /AUDIC/SE_DDIC.

The following selection screen is displayed:

https://docu.audicon.net/SmartExporter/2018R1/Components/en/Content/Decryption/DataPrivacyDecrypt_SAP.htm

https://docu.audicon.net/SmartExporter/2018R1/Components/en/Content/Decryption/DataPrivacyDecrypt_SAP.htm


Figure 59: Selection Screen /AUDIC/SE_DDIC

The parameters have the following function:

Download Settings

Download to frontend Download to frontend: Files will be written to the local SAP® client machine (only applicable with small data volumes).

Download to backend Download to backend: Files will be written to the logical directory of the SAP® application server file system.

Additional Settings

Table Name Using the Table Name option you can make restrictions to certain tables.


Table category Using the Table category option you can limit the tables to be considered for the download.

TRANSP transparent table

INTTAB structure

CLUSTER cluster table

POOL pool table

VIEW gen. view-structure

APPEND append-structure

If no types are specified, transparent tables, pool tables, cluster tables and views will be selected. Downloading structures and append data is of no actual use as no data can be loaded from these types of tables.

Language Determines the selection of language-dependent description texts.

Package size Controls the packaged reading to prevent memory overflows. It is recommended to choose a package size between 500 and 20,000 records depending on the system performance.

Data Scope

Read field information Determines if a file is written containing table field data.

Read customer tables Determines if customer-tables are selected (Z- and Y-Tables).

Read prefix tables Determines if prefix-tables are selected (/prefix/table name).

Read Additional Data Sources

The flag determines if Additional Data Sources that are created by SmartExporter using its own definition files will be read.

The Additional Data Sources are defined by means of further installations that, for example, enable access to HR clusters.

Read component information

This option determines if additional information on the SAP® application components will be read.

Compatibility

Version If you want to read the Data Dictionary information for SmartExporter 2016 R1 or previous versions, enter the value 5. For version 2018 R1 or higher enter the value 6. The preset value is 6.

The reason why it is necessary to differentiate the SmartExporter versions is the native support of the INT8 SAP® data type in the Windows client. In the SmartExporter 2016 R1 version with the SmartExporter SAP® components 5.0.0001 SP2 or previous versions this new data type had not been considered yet.

Table 31: Parameters of /AUDIC/SE_DDIC

Downloading a Data Dictionary may take several minutes depending on the selection of parameters and the system load.


Downloads to backend can be processed as a background task. With this option enabled information about generated files and records will be written to the job log. If the download is directed to the frontend or backend (please consider timeouts!), a log list will be created (see figure 60 below).

Figure 60: Protocol DDIC Download Frontend

Figure 61: Joblog background task

After scheduling a job you can monitor it directly via the transaction SM37 or the function Request Overview.


Request Status Overview

This function provides an overview of all requests.

You can call this function via the /AUDIC/SE_STATUS transaction.


Figure 62: Selection Screen of /AUDIC/SE_STATUS

The parameters have the following function:

Selections

Request ID Request ID of the Data Request, matchcode search possible

Requested by SmartExporter Windows client user who created the request

SAP User User who initiated the request

Created on Creation date of the request

Time created Creation time of the request

Comment Text, which was passed on along with the request

Mode Mode in which the request was run

S = synchronous

A = asynchronous

B = buffer table method

C = count mode (table size)

Maximum No. of Hits Maximum number of records to be displayed

Table 32: Parameters of /AUDIC/SE_STATUS


The report list displays all logged Data Requests. For each Data Request further detail information is available, which you can display using the buttons in the record.

Param. Shows the parameters for the Data Request defined by SmartExporter.

Config. Shows the SAP® Components settings which were valid when running the Data Request.

Komp. Shows the requested tables/joins of the Data Request.

Files Displays a list of the files generated during asynchronous Data Requests.

Filters Displays a list of optional filter data of the Data Requests.

Fields Displays a list of the requested table fields of the Data Request.

Joins The list displays information referring to the tables used in the joins.

Join cond. The list displays the join conditions for the join of tables.

Auth. Flt. Shows the authorization filters which were added when the Data Request was run.

DP fields The list displays all table fields which were anonymized or encrypted when the Data Request was run. For each table field the method used and the parameters entered are displayed.

Strg.loc. This list shows the storage locations for output files and temporary files of asynchronous Data Requests.

Errors If errors occurred while the Data Request was run, they will be listed here.

TemSe Object name

The list displays the joblog of the background job generating the files during an asynchronous Data Request. The log of this job can be displayed by selecting a button in the "TemSe Object name" column.

Figure 63: Status of all selected Data Requests

Click the buttons in the Data Request list to show more details of the corresponding Data Request.


Figure 64: Components Overview

Figure 65: File overview


Figure 66: Filter overview

Figure 67: Job log

Using the buttons you can run the standard functions for the ALV lists. In addition, you can click the Refresh icon to refresh the list and you can use the Delete request data icon to delete the files and buffer table entries and the Delete status data icon to remove the entries for a specific request from the overview.

To run the Delete request data and Delete status data functions you have to select the line and click the corresponding button. In the corresponding security prompt click Yes.


Important note:

To decrypt data that was encrypted using the /AUDIC/SE_DPRV transaction you need the corresponding Request ID. This is the Request ID that was generated during the extraction of the encrypted data.

If you use the “Delete status data” function, also the corresponding Request IDs will be deleted. Once the Request IDs are deleted, the corresponding encrypted data cannot be decrypted anymore.

Export

You can use the Export button to save all the information on a Data Request for the selected row as a ZIP file. The name of the ZIP file is a combination of the Request ID and the .zip extension. The ZIP file contains a separate XML file for each detail (parameters, configuration, etc.).

Here is a list of the XML files which may be generated:

COMP_VERS.XML Components of the SAP® system

CUS_DATA.XML SmartExporter Customizing parameters and list of SmartExporter transports or Add-Ons installed

JOBLOG.XML Job log for asynchronous or synchronous extraction via buffer table method

LOGAFT.XML Definition of the authorization profile table filters

LOGCFG.XML Information on the SmartExporter configuration

LOGCOL.XML Table fields of the Data Request

LOGCOM.XML Information on the plug-ins used

LOGDPR.XML Data Privacy field definitions

LOGERR.XML Error texts which are not sent to the client

LOGFIL.XML List of the files created in the SAP® format

LOG_FILE.xml Log file in the client format when running asynchronous extraction

LOGFLT.XML Filters of the Data Request

LOGHD.XML Information on the requester, creator, creation date, etc.

LOGJ1.XML Joins

LOGJ2.XML Join conditions

LOGPAR.XML Data Request options

SHORTDUMP.XML Short dump if caused by a runtime error and if the user is authorized for the ST22 transaction (Display)

SYS_DATA.XML Information on the SmartExporter SAP® components version installed and on the SAP® system

If no information is available or a different extraction type was used, no XML file will be created. For example, if the Data Request does not contain any joins, the LOGJ1.XML and LOGJ2.XML files will not be created.


Clean up data

Use this function to delete the files and buffer table entries generated by the asynchronous Data Requests. This is useful when Data Requests are cancelled or the files are no longer required and are occupying memory space.

The file log will be updated by a deletion stamp.

You can call this function via the /AUDIC/SE_CLEAN transaction.


Figure 68: Selection screen of /AUDIC/SE_CLEAN

Selections

Request ID Specifies the Request ID of the Data Request to be deleted, Match code search using F4.

Requested by SmartExporter Windows user who ran the request (Data Request)

SAP User SAP® user who ran the request (Data Request)

Created on Date on which the request (Data Request) was created

The program presets a date that is less than or equal to the current date - 7. This means that all files older than 7 days will be deleted.

Time created Creation time of the request (Data Request)

Comment Comment which was passed on when the request (Data Request) was run


Selections

Mode Mode of the Data Request to be deleted

The only ones making sense here are:

A = asynchronous

B = buffer table method

As the data is only generated here on the SAP® system. By default S (= synchronous) and C (= count mode (table size)) cannot be selected.

Test run There will only be a test run. No files will be deleted. An overview of the Data Requests and the data to be deleted is displayed.

Older than ... days Only executed runs that are older than n days will be considered

Newer than ... days To reduce the runtime only executed runs younger than n days will be considered.

Table 33: Parameters of /AUDIC/SE_CLEAN

The request overview marks files as „deleted“.

The /AUDIC/SE_CLEAN transaction can be run regularly as a background job to delete both the requested files in the export directory and the content of the buffer table from the cancelled Data Requests. In the background all files older than 7 days will be deleted automatically. Please note that for the background job a variant (e.g. CUS&_BATCH) has to be used that is not marked as test run.

Table / Archive information

The /AUDIC/SE_INFO transaction allows you to determine various information that is relevant for SmartExporter. For example, you can check if a specific user has the authorizations for tables or a Data Request or you can check if he can access the archive.


Figure 69: Selection parameters of /AUDIC/SE_INFO

Selections

Table Name Database table(s)

Data Request The tables can be read from

Data Request file(s) in XML format

Data Request file(s) in text file format

Authorization profile file(s) in text file format

Text file(s)


Selections

Component ID You can also define the tables by specifying SAP® components, e.g. FI*, FI_GL*

Authorization check for user Checking the SAP® authorizations for a specific user.

Administrators can enter a specific user here to check his authorizations.

The Verify RFC authorizations icon allows you to also check the required RFC authorizations for the selected user.

Rowcount in database Determines the number of rows in the database for each table.

This might lead to a considerable load on the system and result in a long runtime.

Check change recording Determines if the change recording for the tables will be done on table level (DBTABLOG) or on application level (CDHDR).

Check SmartExporter auth. Determines if the specified user has the required authorizations to access the tables via SmartExporter.

Check archive access Determines if data from the tables was archived.

Apply Include/Exclude list Not in use

Check archive index Checks for archived data that already exists if the archive index is defined and if it is compiled completely.

Archived on or after Archives created before the specified date will be excluded from the check. This reduces the data volume to be checked. This may be advisable due to performance reasons.

Check PBS statistics If the optional PBS_STATS add-on is installed and data has been archived, this check determines if the PBS statistics are complete.

Check Data Aging (HANA) On systems with HANA DB this check determines if Data Aging is configured for the tables.

Group by table The results will be grouped by table.

Group by archive object The results will be grouped by archiving object.

Table usage for archive class Not in use

Tables with mult. usages Not in use

Table Name Tables for multiple usage

Not in use

Table 34: Parameters of /AUDIC/SE_INFO

In the following example the authorization profile file AUT800HSS_GDPDU_TABLES_NEWGL.XML from the SmartExporter SAP Components\Templates\ASE Authorization Templates directory of the SAP® Components CD was loaded.


Figure 70: Example for table or archive information for a specific user.

General information on the tables is displayed.

In the Data Type column an icon indicates if all table columns can be extracted with SmartExporter.

In the Auth.SE16 column an icon indicates if the specified user has the required authorizations for the extraction of the data via SmartExporter.

Click the S_TABU_DIS Authorizations or S_TABU_NAM Authorizations button to show a list of the required authorization values for the selected tables.


Figure 71: List of the required authorization values for the selected tables

smartexporter sap® components...smartexporter sap® components – manual 6 introduction...

Documents