GRC AC 10.

0 Configuration Steps:
Client activation

SICF services activation

BC sets activation

Create connectors

Create sub sequence connectors

Define groups

Assign connector to connector type

Assign connector to connector groups

Maintain connection settings

Schedule background jobs

Maintain configuration settings (parameter maintenance)

Maintain connector settings

Maintain mapping for actions and connector groups

Timeout parameters settings using t-code SMICM

Perform automatic workflow customizing

Configure RFC destination

Configure 4 components of GRC AC 10.0

MSMP workflow creation (full cycle of user provisioning)

BRF+(Business Rule Framework plus) creation

Post installation steps:
If you install GRCFND_A add-on in your system, you will get Access Control (AC), Process
Control (PC), Risk Management (RM) modules.

If you want you can select Access Control (AC) module only.

Note: t-code for install add-ons in your system is SAINT

You need to activate AC in your system, if you want you can add 3 (AC,PC,RM)

Default clients in your system 000,001 and 066.

Now create 2 clients for our practiced 100 and 200

Client 100 is front end system means GRC AC system and client 200 is back end system

Copy all data from client 000 to 100 as well as 000 to 200.

Note: with in the system no need to install plug-ins. If client is in some other system we need to
install plug-ins in that system. Plug-in name is GRCPINW (need to install)

If it is HR activate one more GRCPIERP install

Client Activation
Go to t-code SPRO

To activate GRCFND_A for Access Components

Click on SAP reference IMG

Expand Governance, Risk and Compliance

Expand General settings and click on Activate Applications in Client

In that screen you can see no.of active applications in client.

If no one are there or need to add one more click on New Entries button

You can select GRC-AC form drop down menu as shown below

Check the check box Active

Note: if you want GRC-PC and GRC-RM activation you can select

Then click on save button

System prompts on box to create customizing request

Click on create button

Give short description

Click on save button

Then transport request created.

Click on nike button.

ICF services activate

Go to t-code SICF

Select Hierarchy type as Service using option

Click on execute

Now select virtual host as DEFAULT_HOST as shown below

Scroll down You can see the default_host and sap connect

Now we need to Activate for that right click on default_host and select activate virtual host
Note: SAP Connect, if any domain we need to select this option we can use

Activate BC sets
Go to t-code SCPR20

Select *GRC* BC sets

You can see 3 BC sets as show below

Select one after one and click on nike button

Now click on Activate button as shown below

You need to create customizing request. If you want to new request click on create button

Otherwise same request

Select option radio button do not overwrite default values

Select option radio button expert mode

You need to do same process again for another 2 BC sets activation

Now search for *GRAC* BC sets.

GRAC_ACCESS_REQUEST_APPL_MAPPING

GRAC_ACCESS_REQUEST_EUP

GRAC_ACCESS_REQUEST_PRIORITY
GRAC_ACCESS_REQUEST_REQ_TYPE

GRAC_RA_RULESET_COMMON

GRAC_RA_RULESET_JDE

GRAC_RA_RULESET_ORACLE

GRAC_RA_RULESET_PSOFT

GRAC_RA_RULESET_SAP_APO

GRAC_RA_RULESET_SAP_BASIS

GRAC_RA_RULESET_SAP_CRM

GRAC_RA_RULESET_SAP_ECCS

GRAC_RA_RULESET_SAP_HR

GRAC_RA_RULESET_SAP_NHR

GRAC_RA_RULESET_SAP_R3

GRAC_RA_RULESET_SAP_SRM

GRAC_ROLE_MGMT_LANDSCAPE

GRAC_ROLE_MGMT_METHODOLOGY

GRAC_ROLE_MGMT_PRE_REQ_TYPE

GRAC_ROLE_MGMT_ROLE_STATUS

GRAC_ROLE_MGMT_SENTIVITY

GRAC_SPM_CRITICALITY_LEVEL

You will get above BC sets

In that,

First 4 related to AEM BC sets

Next 12 related to ARA BC sets

Next 4 related to BRM BC sets

Last 1 related to SPM BC sets

Based on requirement select and activate

We need to activate one after another.

Create connectors
Here source is client 100

Target is client 200

We need to create RFC connections

For that create one user in client 200 with user ID RFC_USR

User type : system user (wrong see the note Below)

Profiles: sap_new and sap_all

Go to T-code SPRO

Expand Governance, risk and compliance

Expand common component settings

Expand integrate framework

Click on create connectors

You will get below screen

Click on create button

Enter RFC Destination ex: GRCCLNT200

Enter connection type as 3

Enter Description1 and description2 and description3

Now select logon&security tab

Enter language as EN

Enter client 200

Enter User

Now click on Connection text and click on Remote logon

If you click on connection test you can see the below screen

If you click on remote logon you can see the below screen
Connection test and remote logon working successfully.

Note: while user creation we selected system user. But system user cannot go to with RFC. So
we need to choose user type as service user

Now go to SPRO T-code

Expand Governance, risk and compliance

Expand common component settings

Expand integrate framework

Click on maintain connectors and connection types

You will get below screen, in that select SAP system as shown below
Now Double click on Define connectors from left side.

Now click on New Entries

Select Target connector as grcclnt200 shown below

Note: logical port and target connectors should be same.

Select max.no.BCG is 3

Click on save button

Create customize request

Now select target connector grcclnt200 and double click on define subsequent connector from
left side.

Select connection type SAP

Click on save button

Note: if I have 10 clients then do same above process to no. of clients to support.

Define Groups

Assign connector to connector type

Assign connector to connector groups

Go to t-code SPRO

Expand Governance, risk and compliance

Expand common component settings

Expand integration framework

Click on maintain connectors and connection types

Select connection type as SAP

Double click on define connectors from left side

Select target connector as grcclnt200 and double click on subsequent connector folder

Select the connection type SAP

Double click on define connector groups you will get below screen

In that select existed connector group SAP_R3_LG

Now double click on Assign connector group to group type

Now should be selected logical group under connector grope type

Note: now we selected logical group from the list, because within the system. If it is some other
system should be selected cross system group

Click on save button

Now select the logical group and double click on Assign connectors to connector group

Select target connector as grcclnt200 and connector type as SAP

Click on save button

Create transport request if required.

Maintain connection settings

Go to t-code SPRO

Expand Governance, risk and compliance

Expand common component settings

Expand integration framework

Click on maintain connection settings

You can see on popup

If you click on work area browse, you can see 4 integration scenarios you can see.
AUTH for ARA means RAR

PROV for ARM means CUP

ROLMG for BRM means ERM

SUPMG for SPM means ERM

Now select AUTH and click on Nike button.

Now double click on scenario connection type link from left side.

Select SAP row

Click on save button

Now double click on scenario-connector link

Select target connector and connector type row and click on save.

Click on save button

Create customizing request

Note: Do the same process to rest of 3 scenarios

PROV for ARM means CUP

ROLMG for BRM means ERM

SUPMG for SPM means ERM

Common configuration settings completed it is related to AC.

Now we have to do GRC access control configuration settings

Go to t-code SPRO

Expand Governance, risk and compliance

Expand Access Control

Click on maintain connector settings

Click on new entries

Select target connector grcclnt200

Select application type 001 SAP

Environment should be selected as production

Based on requirement select path ID and PSS check

Here PSS means Password Self Services

Click on save button

Create transport request

Maintain mapping for action for connection groups
Go to t-code SPRO

Expand Governance, risk and compliance

Expand Access Control

Click on maintain mapping for action for connection groups

Click on new entries you will get below screen.

Select connection group which is already existed SAP_R3_LG

Check the check box active

Select application type as 001 SAP

Select the connection group row and double click on assign default connector to connector
group from left side
Check all the check boxes like below screen

Here 4 check boxes means application type 001, 002, 003 and 004

Click on save button

Select connector group as SAP_R3_LG

Maintain plug-in settings

Go to t-code SPRO

Expand Governance, risk and compliance

Expand Access Control

Click on maintain plug-in settings

If you have done plug-ins in different systems

Perform workflow related activities

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand General settings

Expand workflow

Click on perform automatic workflow configuration

You will get below screen with red into marks

Expand maintain runtime environment.

Then you will get below screen with red marks

Select Configuration RFC destination

Automatic/manual

Click on generate button.

Click on yes.
If you done above activity, In SU01 you can see the WR-BATCH user automatically created

Select logon data tab and give password

Click on save button

Again click on generate button

Now click on execute button

Give password

Actually you can see the green button. But here it show red only because user has no roles.

So, we need to assign roles to WR-BATCH user

Now go to SU01 and select role tab and give SAP_BC_BMT_WFM_SERV_USER role.

And give profiles sap_new and sap_all.

Click on execute button now

You can see the green color

Now select maintain workflow system administrator

Click on generate button

You can see the green color

Now select document generation/form integration

Click on generate button

You can see the green color.

Now select background job for missed deadlines

Click on execute button scheduled in background job

Now select background job for condition evaluation

Click on execution button you can see the green color.

Now select scheduled background job for event queue

Click on generate button

Now select scheduled background job for clearing report

Click on generate button. You can see the green color.

Now expand maintain definition environment

Select maintain prefix numbers

Click on change button

Click on create

Enter profile number 999

Click on save

Now click on local object

Click Nike button

Go back and refresh

Now select check entries for HR control tables.

Go to t-code SA38

Execute RHSOBJCH

Click on execute

Select all
Execute button

Now go back click on execute. Then you can see the green button.

Note : in the same way expand classify tasks as general

And expand guided procedures

Click on generate button then you can see green color.

Perform task-specific customizing

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand General settings

Expand workflow

Click on perform task-specific customizing

You can see below screen with folders from left side

Expand GRC folder. You can see subfolders as shown below

Note: if no subfolders under GRC folders you need to execute on report

Go to t-code SA38

Enter RS_APPL_REFRESH

Click on execute

Now go back and see the GRC folder. Now you can see the subfolders under GRC folder.

Now click on Assign Agents

Select on TS76300011 as shown below

Now click on Attribute

You can see the below screen. Select option general task

Click on transfer button

Note: same do above process to all assign agents

Now go back to the GRC folder screen

Now click on Activate event as shown below

You can see the below screen

Now expand WS 76300001 you can see the below screen

Click on detail view

Check the check box Event linkage activated

And select Do not change linkage from dropdown menu as shown below
Click on save button

Create customizing request

Go back and do same above process for remaining WS XXXXXXX.

Important steps,
For GRC folder we have no TS (Assign agents) and WS (Activate event)

Then we need to do below process

Go to t-code SWE2

You can see the below screen

O

Select one object type CL_GRAC_ACCESS_APPROVAL_WF and double click on it.

You can see the below screen

In the same screen, check the check box linkage activated and select do not linkage change as
shown below screen

Click on save button

Now go back to the GRC folder screen and do the same process (Assign agent and activate
event) to activate.

Important steps,

Go to t-code PFTC

Select task type as standard task as shown below

Select task as ex: 7630918 (these no. belongs to TS, which we were done in previous step assign
agent)

Click on change button

In that screen go to menu bar select additional data ----- agent assignment -------- maintain

Should select display role (name)

If popup box will display click on no

Note: Event linkage also do same as above

Next step,

Now go to t-code SWDD

You will get below screen

Select workflow are under information area

For that *GRAC* enter in browse

You will get list of GRAC as shown below

Select any one of GRAC workflow

Ex: GRAC_AR selected , screen like below

Now click on Activate button

You can see the graphical model on right side for that workflow.

Background job synchronization

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access control

Expand synchronization jobs

Click on Authorization synch

You will get below screen

Select connector as grcclnt200

If you want direct click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

Next step,

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access control

Expand synchronization jobs

Click on Repository object synch

you will get below screen

Select the connector grcclnt200

If repository object synch is first time then select option Full sync mode as shown below
If you want direct click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

Next step,

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access control

Expand synchronization jobs

Click on Action usage synch

You will get below screen and select connector grcclent200

If you want direct click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

Next step,

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access control

Expand synchronization jobs

Click on Role usage synch

If you want direct click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

Configuration of four components

ARA configuration

Maintain configuration settings (setting parameters for risk analysis)

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access Control

Click on maintain configuration settings

You will get below screen

Set the parameters for Risk analysis from parameter ID 1022 to 1053 as shown below
Note: Risk Analysis is 2 types one is Online Risk analysis and Off-line risk analysis

What is the difference between them?

Online Risk Analysis--- Direct went to the Backend system every time while Risk analysis

Offline Risk Analysis---- While risk analysis data will be stored into either Data base (D) or File(F)

Whenever risk analysis Data fetch from D or F only based on configuration parameters.

Next step,

Generate SOD rules

Go to T-code SPRO

Expand Governance, Risk and Compliance

Expand Access Control

Expand Access Risk analysis

Expand SOD rules

Click on Generate SOD rules

You will get below screen put * in Risk ID field.

Now click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

Note: whenever we activate BC sets in SCPR20 t-code (GRAC_RA_RULESET_COMMON).

Automatically we are getting some .txt files in back end system.

Files are :

business process.txt

function action.txt

function business process.txt

function permission.txt

functions.txt

risk disc.txt

risk rule set relationship.txt

risk.txt

rule set.txt

Next step,

Batch risk analysis for offline risk analysis

Go to T-code SPRO

Expand Governance, Risk and Compliance

Expand Access Risk Analysis

Expand Batch Risk Analysis

Click on Execute Batch risk analysis

Under system selection enter as below

Job name: Risk Analysis Batch mode. New run

System: grcclent200

Batch processing mode: Full

Rule set: GLOBAL

Select under object selection

Check the check box User Analysis

Check the check box Technical Role

Select under risk analysis type

Check the check box Permission/critical action/critical permission level

Check the check box critical role/profile level

Now go to menu tab select program-------click on execute in background (offline)

Or click on execute button (online)

If offline click on immediate button

Save in same screen.

IMP NOTE: After execution of above step risk analysis report will generate and store into File (F)

Location which we specified in the parameters 1052 risk analysis-spool D:\spool\

Next Step,
To see these Reports

Go to NWBC in client 100

Click on /nwbc

Select Access Management tab

And click on user level under Access Risk Analysis as shown below
You well get below screen
Select the system as shown below and click on ok button

Select the user as shown below and click on ok button

Select the required fields and click on Run in foreground button

Now you can see the Result page as shown below screen
You can select summary report from dropdown menu based on requirement as shown below

Next Step,
Mitigation ID Creation. For that need to do some steps

Step1: Create Mitigation owner and controller

Step2: Define Organization structure

Step3: Define Access control owner (mitigation controller, owner)

Step4: Assign controller, owner to the organization hierarchy

Step5: Creating mitigation ID’s and Assigning controller approver

Step6: Parameter settings for mitigation control

Step1: Create Mitigation owner and controller

Create Mitigation owner and controller in GRC system (in client 100)

Ex: MGT_CON and MGR_OWN

Go to SU01
With roles

SAP_GRAC_CONTROL_MONITOR

SAP_GRAC_CONTROL_OWNER

Step2: Define Organization structure

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Shared master data settings

Click on create root organization hierarchy

You will get below screen

Select organization view as standard hierarchy

Under details

Enter Root Org unit : GRC USA

Child Org Unit: GRC California

Click on execute button

Next step,

Where we can see these Org structure?

Go to t-code NWBC

Click on setup tab

Under organization click on organizations

You can see the Hierarchy as shown below screen

Step3: Define Access control owner (mitigation controller, owner)

Go to t-code NWBC

Select setup tab

Click on access control owners under access owners

You will get below screen

Then click on create button

You will get below screen

Now under group type select option owner

Under group details select user ID which we create earlier i.e, controller userID : MTG_CON
Under owner type, check the check box mitigation monitors

Same above process do again for MGT_OWN and check the check box mitigation approver
Click on save button

Step4: Assign controller, owner to the organization hierarchy

Go to t-code NWBC

Select Master Data

Under organizations click on Organizations

Select Organization Hierarchy

Select the org structure ex: GRC California

Click on Open button

In next screen select owners tab

Click on Add row button

Select owner, controller user IDs as shown below and click on ok button
Click on save button

Step5: Creating mitigation ID’s and Assigning controller approver

Go to t-code NWBC

Select setup tab

Click on mitigating controls under mitigation controls

You will get below screen

Then click on create button

Then next screen select general tab and fill the required fields based on requirement as shown
below and enter notes (write something related to process)
Now select access risks tab and click on Add row button

Select the Risk ID and Enter the Rule ID (enter * in this field) as shown below
Now select owners tab

Select controller --as---monitor

Select owner ---as---- approver

Click on save button

Step6: Parameter settings for mitigation control

Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access control

Click on Maintain Configuration settings

Then you will get below screen

You need set the parameters from 1011 to 1013 as shown below screen

Click on save button

Related topics:

Mitigation logs

Where we can assign mitigation control ID’s to user

How to mitigate the risk

Mass mitigation process

Mass user risk analysis

Simulation process.
Next Topic:

EAM (SPM)- Emergency Access Management:

Purpose of EAM is to allow users to take Responsibility for tasks outside their normal job
function.

This component allows temporary access for users when assigned with solving a problem,
giving them provisionally broad. But regulated access.

Temporary access is monitored and recorded in the application.

Advantages of GRC 10.0 EAM:

EAM with ability to manage and utilize firefighting activities centrally from access control 10.0
application.

The log files can be distributed to the controllers, owners via workflow for additional approval.

Difference between 5.3 and 10.0 EAM:

GRC AC 5.3

This access can be get through SPM1

Fire fighter can access FFID through t-code /n/virsa/vfat

Fire fighter needs to login into the same system which is assigned FFID access to the firefighter
user.

Fire fighter logs can be read from the same system

Fire fighter owner, controller and fire fighter should be exist in the same system

No need to assign any other common role except required emergency access role to FFID

GRC AC 10.0

Here access can be get EAM

Here can be access through t-code GRAC_SPM

Here user needs to login through central system (GRC) and remotely loged into backend system
through RFC or connectors

Logs can be maintained or read from central system GRC

Fire fighter owner, controller should be exist in central system and fire fighter need to exist in
both system GRC+Backend

We need to assign a common role which we define or configured parameter called EAM=4010

Ex: SAP_GRAC_SPM_FFID (ROLE)

If you assign this role user can act as FF user.

Pre-requisites
Create users and assign required access roles

Create basis FFID and assign below the roles

Login to GRC system (client 200)

Execute T-code SU01

Enter user ID FFID_BC

User type should be service type

Select roles tab

Assign already created emergency access role Z:BC_clientadm

T-code in that role SCCL,SCC4,SCC8,SCC9,SCC5

Authorization object S_RFC

And assign which we configured role in the parameter 4010 (ex:SAP_GRAC_SPM_FFID)

CREATE FIRE FIGHTER CONTROLLER

Login GRC system with client 100

Enter user ID as FFC_BC

User type : dialog

Select role tab enter role SAP_GRAC_SUPER_USER_MGMT_CNTLR.

CREATE FIRE FIGHTER OWNER

Login GRC system with client 100

Enter user ID FFO_BC

User type: dialog

Role: SAP_GRAC_SUPER_USER_MGMT_OWNER

CREATE FIREFIGHTER USER

Login GRC system with client 100 and backend system client 200 (login user ID sap*)

Go to t-code SU01

User ID: FF_USER

User type: dialog

Role: SAP_GRAC_SUPER_MGMT_USER

STEP1:
Go to t-code SPRO

Expand Governance, Risk and Compliance

Expand Access Control

Expand synchronization jobs

Click on Repository object synch

you will get below screen

Select the connector grcclnt200

If repository object synch is first time then select option Full sync mode as shown below

If you want direct click on execute button

Otherwise go to menu bar and select program ----------click on execute in background

Then you will get one popup window as shown below

Don’t select any one just click on Nike button

Now click on immediate button

Now click on save button in same screen

OR
Go to SA38

Execute a program GRAC_ROLEREP_USER_SYNC

STEP2:
Go to t-code NWBC

Select Setup tab

Under Access owners, select Access Control owners

You will get below screen, in that click on create button.

Select the radio option owner, under Group type

Select the owner user ID FFC_BC, under group details as shown below

Now under owner type, check the check box Fire Fighter ID controller

Click on save button

Next step,

Again go to t-code NWBC

Select setup tab

Select access control owner

Click on create

Select radio option owner

Select owner user ID FFO_BC

Click on Save button

STEP3:
Go to t-code NWBC

Select setup tab

Select owners, under super user assignment

You will get below screen, in that click on assign button

Select FFO_BC row

Click on OK button

Click on ADD button

Select Fire fighter ID FFID_BC row

Click on right arrow to move to right side

Click on OK button

Click on save button, then you will get screen like below
STEP4:
Go to t-code NWBC

Select setup tab

Click on Fire fighter IDs, under super user assignment

Click on Assign button

Select FFID_BC row

Click on OK button
Click on ADD button (select Fire fighter tab)

Popup window open, in that select firefighter FF_USER

Click on save.

Next, select Controller tab

Click on ADD button

Select fire fighter user ID row

Select FFC_BC

Write in notification log display

Click on save button, you can see the screen like below.

STEP5:
Go to t-code NWBC

Select setup tab

Click on Reason codes as shown below.

You will get below screen, in that click on create button.

Then you will get below screen

In that, enter Reason code Ex: client open

Enter Description

Then click on ADD button as shown below

Then you will get one popup window, and then select system grcclnt200.

Click on right arrow button to more right sides

Click on ok button

Click on save button. Then you can see the screen like below.
STEP6:
Log in to client 100 with user ID FF_USER

Execute the t-code GRAC_SPM

Click on button in column logon using FFID

You will get one popup window

Select Reason codes from Drop down which we defined in NWBC

Enter T-codes in Reason codes box

Enter description in below box

Click on continue button

Now you will be in client 200

You can do the any activities here based on requirement

Means you got the emergency activity to do some activities.

LOG REPORTS:
Note: Log on with controller or owner user ID’s

Reporting

1. Report types
2. Log collection
3. Log retrieval

Report types: The reports can be accessed using the NWBC the portal and are located under
reports and analytics

1) Consolidated log reports:

This Report provides information based on the following logs from the remote system.
Transaction log:

Capture transaction execution from transaction STAD.

Change log:

Capture change log from change document objects (table CSPOS and CDHDR)

System log:

Capture debug and replace information from transaction SM21

Security audit log:

Capture security audit log from transaction SM20

OS command log:

Captures changes to OS commands from transaction SM49

2) Invalid super report:

This report gives the details of the entire user (FIREFIGHTER, CONTROLLER, OWNER, and
FIREFIGHTER ID) who are expired, locked or deleted. In the case of role based fire fighter, it
gives the details of whether the role has been generated or not.

3) Fire fighter log summary:

It provides details of the session the fire fighter logged into the remote system using the
FFID for ID based FF application.
 4) Reason code and activity report:

This report provides the details of information of reason and activity used by the fire
fighter.
5) SOD conflict report for fire fighter ID:

When the firefighter logs in to the remote system using the FFID into the remote
system and perform certain transactions which violations access risk rules.

LOG COLLECTION:
The details of the transaction executed by the fire fighter lies in the remote system in the
CDHDR, CDPOS, STAD, SM19, SM49 and debug and replace information.

The data from the remote system can be fetched using the log collector which can be executed
as a foreground or background job.

LOG COLLECTION FOREGROUND JOB:

Go to t-code NWBC

Select the report and analytics

Click on consolidated log report under Emergency access management report

You can see the consolidated log report screen.

In that, select report name from dropdown menu (transaction log, change log, auditlog ect..)

Select system as grcclnt200

Select firefighter ex: FF_USER

Click on update fire fighter log button

You can see firefighter log updated successfully message.

 Then click on update firefighter log button

Log collection background job:

The background job for log collection can be scheduled from SM36. Which can be
scheduled on a periodic basis. The status of the background job can be checked from the SM37
transaction.

The program name for the background job is GRAC_SPM_LOG_SYNC_UPDATE.

Consolidated log report: (transaction log)

Go to t-code NWBC

Select Report and analytics

Click on consolidated log reports under Emergency access management Reports.

Select report name as transaction log

Select system as grcclnt200

Select firefighter ex: FF_USER

Click on Run in Foreground button

You can see the list in below result screen

Consolidated log report: (change log)

Now select change log from dropdown menu list instated of transaction log

Do the same above process.

Remaining log also do like above process.

Invalid super user Report:

Go to NWBC

Select report and analytics tab

Click on invalid super user report

Select system: grcclnt200

Select firefighter : FF_USER

Select owner: FFO_BC

Select firefighter ID: FFID_BC

Select controller : FFC_BC

Click on Run in foreground button

You can see result in below screen FFO_BC locked

Firefighter log summary report:

Go to t-code NWBC

Select report and analytics

Click on firefighter log summary report

Select required fields

Click on run in foreground button.

Reason codes and activity reports:

Go to t-code NWBC

Select Reports and Analytics

Select Reason codes and activity report

Under emergency access management report

Select required fields

Click on run in foreground button

You can see the result in below screen.