This page helps you to analyze common errors in Landscape Management. 

Missing cloud services in LMS can have several reasons. Please check if one of the following applies.

  • The service type is not in scope:
    • If this is your first subscription for this service type, the service type is not automatically added to the scope after the service is imported
    • Add the service type to the scope:
      1. Open the scope selection
      2. Search for your service type using the service types filter or the live search
      3. Check the checkbox in front of the service type name
      4. Click "Apply"
  • The service wasn't imported yet: 
    • If you just subscribed to the cloud service it possibly hasn't been imported yet. Before a cloud service can be imported into LMS it first has to be created in SAP's Cloud Landscape Directory. This is done by a job that runs once a day. After this, the cloud service can be imported into LMS. The automatic import into LMS happens once a day. 
    • By default, we will only import cloud services that belong to the same customer number as SAP Cloud ALM itself. If your cloud service belongs to another customer number, you have to maintain the SAP Corporate Group (CCC) S-User. See the next question for details. 
    • You can trigger the import ad-hoc:
      1. Open the configuration panel
      2. Open the "Import of Subscribed SAP Services" tray
      3. Click on the status icon under "Status of imports"
      4. Click on "Import My Subscribed Cloud Services"
  • In your SAP Cloud ALM tenant, Landscape Management Access Control is activated, and you have no authorization to see the service
    • Landscape Management Access Control uses rules to define Access Control Lists
    • Users can only see systems if they are assigned to an Access Control List that covers the system
    • If a new tenant is imported, it will not always automatically be part of an Access Control List
      • If the Access Control List was built using rules (e.g., all systems with customer number 123456), the system will automatically be covered if it fits the rules
      • If the Access Control List was created by selecting single services, the new system needs to be explicitly added to the Access Control List
      • If the Access Control List was created using customer units as a filter, the system needs to be added to the respective customer unit to be in the Access Control List
    • Contact a user with the role "Landscape Management Access Controller" to learn if Access Control is active in your system
      1. The Access Controller needs to open the configuration panel
      2. Scroll to the section "Attribute-based Access Control"
      3. Check if the global setting is set to "Active"
      4. Add the system to the Access Control List as described in the Access Control documentation

If the solutions above didn't fix your issue please open a ticket using the components described under "Customer Support".

The most likely reason for the missing systems in that Landscape Management Access Control is activated in your SAP Cloud ALM tenant, and you have no authorization to see the service

  • Landscape Management Access Control uses rules to define Access Control Lists
  • Users can only see systems if they are assigned to an Access Control List that covers the system
  • If a new system is registered, it will not automatically be part of an Access Control List
    • If the Access Control List was built using rules (e.g., all systems of type SAP S/4HANA), the system will automatically be covered if it fits the rules
      • Please note that the registration does not maintain the customer number for the on-premise system. If you use the customer number as a rule in Access Control Lists, you have to maintain the customer number for the registered on-premise system
        1. You can maintain the customer number in the system details, but to access the system you first need to find a user with Landscape Management Access Controller authorizations
        2. Then follow the steps below.
    • If the Access Control List was created by selecting single services, the new system needs to be explicitly added to the Access Control List
    • If the Access Control List was created using customer units as a filter, the system needs to be added to the respective customer unit to be in the Access Control List
  • Contact a user with the role "Landscape Management Access Controller" to learn if Access Control is active in your system
    1. The Access Controller needs to open the configuration panel
    2. Scroll to the section "Attribute-based Access Control"
    3. Check if the global setting is set to "Active"
    4. Add the system to the Access Control List as described in the Access Control documentation

If the solutions above didn't fix your issue please open a ticket using the components described under "Customer Support".

There is a difference between a licensed solution or product and the actual cloud tenant supporting it. 

You can see your licensed product in SAP for Me under the view "Portfolio & Products" on the tab "My Product Portfolio". 

Every product is supported by cloud tenants. These can be customer tenants or internal tenants (e.g. SAP Store). You can find all your customer cloud tenants under "Systems & Provisioning". Internal tenants are not visible to you.

Customer cloud tenants are what we import and support in SAP Cloud ALM Landscape Management. 

You can check which of your cloud tenants support which of your products please proceed as follows:

  1. Find the product you want to check in SAP 4 Me under "Portfolio & Products" > "My Product Portfolio"
  2. Click on the product name
  3. Switch to the tab "Systems"
  4. Here you find a list of all customer cloud tenants that belong to the product
    1. The column software product tells you the system type of this tenant in SAP Cloud ALM
    2. You can use the system number to find the tenant in SAP Cloud ALM Landscape Management via the global search

If you find a tenant that is not imported into SAP Cloud ALM Landscape Management but should have been, please note:

  • We only import cloud tenants if the software product is supported by a SAP Cloud ALM use case or downtime notifications are created for this product
  • If you find a tenant that is indeed missing in SAP Cloud ALM, but should be imported, please open a ticket under component SV-CLM-INF-LMS

If you want to use one SAP Cloud ALM to manage cloud service for more than one company, you can do this using the SAP Corporate Group (CCC) function.

Information on how to create a CCC Group can be found in the following SAP Notes:

  • 2632518(opens in new tab) - Information about the SAP Corporate Group (CCC) function
  • 2459283(opens in new tab) - How to link customer numbers using the Corporate Group function CCC - SAP ONE Support Launchpad
  • 2691631(opens in new tab) - Information about the Corporate Group (CCC) Function - Guided Answers
  • 2632735(opens in new tab) - Information to review before requesting to close or delete a customer number from a Corporate Group (CCC) - SAP for Me
  • 2626887(opens in new tab) - How to remove customer number(s) from a Corporate Group (CCC) or close the group - SAP for Me
  • 3070306 - Multiple Customer Numbers - not all Systems are visible in SAP Cloud ALM Landscape Management Services?

Please note the following rules:

  • The SAP Corporate Group should only be used for customer numbers that belong to the same global ultimate, i.e. only subsidiaries of the same global company should be part of a corporate group
  • It must not be used by partners or service providers to add their end customers to their partner corporate group

To import the cloud services that belong to customer numbers in the CCC Group, you need an S-User that belongs to the CCC Group and can access all services and systems in the CCC Group.

There are two options how to get an S-User:

Option 1: If you want to use a technical S-User

It is possible to use a technical S-User as the Corporate Group (CCC) S-User in Landscape Management.

  • Using a technical S-User has the advantage that the password for this S-User never expires. 
  • A technical S-User, requested for the customer number which is on top of the group hierarchy (the main/parent account) can automatically see all customer numbers that are assigned to this CCC group.
    • It is not possible to restrict the authorizations of the technical S-User to only see a subset of the customers in the CCC group. 
    • Technical Communication Users have necessary authorizations automatically assigned in SAP backend systems when the user is activated. The customer cannot manually add, edit, or view these hidden authorizations.

To request a technical S-User for the main account follow the instructions in SAP Note:

  • 2174416(opens in new tab) - Creation and activation of Technical Communication Users
  • Technical S-Users are not in the SAP ID Service (accounts.sap.com). Hence the password cannot be changed via SAP for Me. You set the password when you activate the S-User after creation.

Option 2: If you want to use a standard S-User

If you want more control over which subsidiaries of the CCC group an S-User can access you need to use a standard S-User. For this S-User you can maintain the authorizations yourself and to your requirements.

  • 1511008 - How to add or change S-user ID authorizations
  • 1898762 - What are the different S-user ID authorization levels that can be assigned?

Due to password expiration policies, it is not recommended to use an S-User that belongs to an actual person or is used in other SAP sites or applications. When the password of the S-User is changed, it also has to be changed in the SAP backend and the new password must immediately be maintained in SAP Cloud ALM to avoid password locking.

  • As long as the S-user ID is active and not expired (see KBA 2928052), the S-user ID's password for SAP for Me will not expire. Even though SAP for Me does not have an expiration for S-user ID passwords, other SAP sites may have different password policies.
  • 1808560(opens in new tab) - How to reset an S-user ID password

 

When you enter the CCC S-User and password in LMS, you receive the following error message:

  • Connection test failed with http Status: 401 UNAUTHORIZED. It might be due to an invalid username or password. Try again with different login details.

However, when you try to log on to SAP4Me with the same S-User and password you don't have a password error. 

LMS makes a direct call to the SAP Support Backbone and authenticates against the ABAP system. In some cases, it can happen that the password known in the ABAP user store gets out of sync with the password maintained in the SAP IDP accounts.sap.com. 

To reset the password in the backend please proceed as following:

  1. Open RFC password reset link here: https://me.sap.com/app/umsetpassword
  2. Highlight and select the S-user ID
  3. Click Password change (lower right)
  4. Enter the new password (2 times)
  5. Click OK

 

When the CCC S-User is added, we now check immediately which customer numbers the S-User can access. For security reasons, it is imperative that the S-user can also access the SAP Cloud ALM customer number itself. 

This means you have to make sure that the customer number under which SAP Cloud ALM was provisioned is also part of the CCC you created and that the S-User you plan to use can access this customer number. 

In the SAP ABAP system, each client of the system has to be registered separately. Usually, you would only register the productive tenant for monitoring and client 000 for Transport Monitoring. However in SAP ABAP systems with more than one business client, you may want to register additional tenants to monitor client-dependent data using Integration or Business Process Monitoring. 

Each client of an SAP ABAP system is considered a logical system and hence has its own Lms ID. All logical systems are grouped under their technical system in LMS.

The Lms ID shown in transaction /n/SDF/ALM_SETUP is the Lms ID of the client. You find the Lms ID in the Clients table in the CLIENTS section of the technical system.

When you migrate your SAP ABAP system to a new hyperscaler or move it into the SAP Cloud with RISE with SAP, the migrated system will get a new system number. 

Landscape Management uses the system number to determine if a system is already known in Landscape Management. The SID of an ABAP system cannot be used as a unique identifier since it doesn't have to be unique in a customer's landscape.

When a system registers with a new system number a new entry will be created in Landscape Management. This leads to the perception that the system now exists twice in Landscape Management, but in reality, it is two different systems. The "old" system from before the migration and the "new" system from after the migration.

To remove the "old" system, please follow the answer to the question below.

Landscape Management provides the data for all use cases. Hence we have to be very mindful when we allow the deletion of a managed service or system. 

To delete a service or system from Landscape Management the service or system must meet the following criteria:

  1. The source must be "Manual" or "Registered" 
  2. It must have the Status "New".
    1. All supported use cases must have the status "Not Configured"
    2. The configuration can be removed in the respective applications for the use case
  3. It must have no endpoints 
    1. Endpoints can only be deleted if their use cases are in the status "Not Configured"
  4. For ABAP technical systems:
    1. The system must be deregistered (perform deregistration in transaction /SDF/ALM_SETUP)
    2. All logical systems must have been deleted.
      1. Logical systems (clients) can be deleted if all their use cases are in the status "Not Configured" and they have no endpoints.

Services imported from SLIS cannot be deleted manually. They will be marked as deleted once the customer unsubscribes. They will be deleted with the next SLIS import once all use cases have the status "Not Configured" and all endpoints are deleted.

Please note: If you are trying to delete an "old" ABAP system that was migrated to a new hyperscaler, please make sure that the "new" ABAP system doesn't have the old Cloud ALM connection information in the configuration tables. This can happen if you didn't deregister the ABAP system before the migration. The new ABAP system will then try to send its metrics to the LMS entry for the old ABAP system. Which will interfere with your clean-up. 

  1. Please check the value for LMS_ID of the new ABAP client in transaction /SDF/ALM_SETUP
  2. Open the new ABAP system in LMS and compare the value found in the ABAP system with the value LMS Id in the clients table for the respective client
  3. If they do not match or the client doesn't exist yet, please click the "Unregister" button in the ABAP system and then "Register" the system again. This should create a client in the new ABAP system and correct the monitoring configuration in ABAP.
  4. Once this is correct you can go ahead and clean up the old ABAP system in LMS

To learn how the delete the configuration for the use cases please read:

SAP HANA Enterprise Cloud ABAP systems are mapped to their original product type (E.g. SAP S/4HANA, SAP Business Suite, etc.) during the import process. 

Hence you can find them under the system type for this product. You can also use the "Live Search" and search for the SID. By pressing the ENTER button after entering the SID in the Live Search to whole LMS will be searched.

See KBA 3332806(opens in new tab) - "Status Events for Systems hosted by SAP ECS in SAP HANA Enterprise Cloud" for more details.

In LMS you can upload the service key, that was created for SAP Cloud ALM APIs to enable managed services and systems to send monitoring data to SAP Cloud ALM. The service key upload is available in the "Configuration Panel" in the section "SAP Cloud ALM Service Key". 

  • If you cannot see this section, please make sure that your user has the role Landscape Management Security Administrator
  • If you can see the section but the upload is rejected, please make sure that you upload a service key with the following characteristics:
    • The service key in the TXT file must be in valid JSON
    • The service key belongs to THIS SAP Cloud ALM (verify the field uaa.identityzone)
    • The service key contains the fields uaa.clientid and uaa.clientsecret
    • The field uaa.credential-type = instance-secret

The seemingly identical entry is completely normal. It is not a duplicate but rather reflects the way SAP Integration Suite is modeled in SAP's Cloud Landscape Directory. 

It has to do with the activated product modules on the SAP Integration Suite. Every product module other than "Cloud Integration" is always attached to a productive SAP Integration Suite tenant.

So if a customer has a Test SAP Integration Suite with activated "Cloud Integration", "API Management" and "Open Connectors", he will have one SAP Integration Suite with the role "Test" to which the "Cloud Integration" capability is attached and one SAP Integration Suite with the role "Production" to which all the other modules are attached.

The two SAP Integration Suite tenants will look identical in name and data center, but the System Role and System Number will differ.

The Attribute-based Access Control is in the configuration section of Landscape Management. Please read the setup instructions before using or activating Access Control.

If you cannot find it in the configuration section, please make sure that one of the following roles is assigned to your user:

  • Landscape Management Access Controller
  • Landscape Management Access Controller Viewer

If you just assigned the roles to yourself, please make sure to log off and log on to SAP Cloud ALM for the role changes to take effect.

 

You got an alert email from SAP Cloud ALM, but when you try to click the link in the alert you get the following error: 

This error can happen when you try to access a monitoring use case, but don't have sufficient authorizations to read Landscape Objects from LMS.

Currently, all necessary LMS scopes are part of the monitoring use case roles. Please ask your user administrator to assign at least the following role to you:

  • The viewer role for the use case you are trying to access, e.g. Health Monitoring Viewer

You noticed a new section for your Technical System. The section is called SOFTWARE but it shows "No data".

We now import additional information for SAP ECS-hosted private cloud systems imported from the SAP backend. This information is:

  • Instances
  • Databases
  • Related systems (Which HANA database is used by which system)
  • Software

This information is only available for SAP ECS-hosted private cloud systems. If your system is installed on-premise or hosted by a non-SAP private cloud provider, we will not be able to retrieve this information yet. 

Please check your SAP system's "Deployment Model" and " Source." For SAP ECS-hosted systems, you will see the deployment model "SAP Private Cloud" and the source "Imported." Only then can you expect data in the sections Instances, Databases, Related Systems, and Software.

SAP LeanIX uses SAP Cloud ALM Landscape Management to automatically discover cloud services and on-premise systems in your landscape. Public and private cloud systems are discovered directly from SAP Cloud ALM Landscape Management. For on-premise systems, SAP LeanIX uses the customer number information available in SAP Cloud ALM to know which systems to discover from the Support Backbone. 

You can find detailed information on the landscape discovery here(opens in new tab).

To discover all systems successfully, it is important that the customer number information is maintained in SAP Cloud ALM Landscape Management. This also includes the on-premise customer numbers. To make the customer numbers available to SAP LeanIX, you need to ensure the following prerequisites are met:

  1. Create a CCC that includes all customer numbers that shall be discovered by LeanIX, including on-prem only customer numbers (see earlier questions on this page)
  2. Maintain a CCC S-User for this CCC in the section "SAP Corporate Group (CCC) S-User"
  3. Check that all expected customer numbers show up in the table "Imported Customer Numbers"
    1. Initially, the customer numbers will not contain the customer name, which will later be added by the daily import
    2. For on-premise-only customer numbers, we cannot retrieve the name via the cloud import. They will remain as customer numbers only in the table
  4. The customer numbers have to be synced back into the SAP internal cross landscape management by the daily import job before LeanIX can retrieve them
    1. You can either wait for the job to run, which runs once a day
    2. Or you can trigger the job ad-hoc
      1. Click the status indicator in the section "Status of imports"
      2. Click "Import My Subscribed SAP Services"
    3. Make sure the job finished successfully

If all prerequisites are met and you still miss systems in SAP LeanIX or have problems setting up the connection, please open a support ticket on component LIX-INT-SAPCALM.

RISE with SAP 'RISE Methodology Dashboards' uses SAP Cloud ALM Landscape Management to discover which customer numbers can be accessed by this SAP Cloud ALM tenant.

To include all relevant systems in the RISE Methodology Dashboards, it is important that the customer number information is maintained in SAP Cloud ALM Landscape Management. This also includes the on-premise customer numbers. To make the customer numbers available, you need to ensure the following prerequisites are met:

  1. Create a CCC that includes all customer numbers that shall be shown on the RISE Methodology Dashboard, including on-prem only customer numbers (see earlier questions on this page)
  2. Maintain a CCC S-User for this CCC in the section "SAP Corporate Group (CCC) S-User"
  3. Check that all expected customer numbers show up in the table "Imported Customer Numbers"
    1. Initially, the customer numbers will not contain the customer name, which will later be added by the daily import
    2. For on-premise-only customer numbers, we cannot retrieve the name via the cloud import. They will remain as customer numbers only in the table
  4. The customer numbers have to be synced back into the SAP internal cross landscape management by the daily import job before we can retrieve them
    1. You can either wait for the job to run, which runs once a day
    2. Or you can trigger the job ad-hoc
      1. Click the status indicator in the section "Status of imports"
      2. Click "Import My Subscribed SAP Services"
    3. Make sure the job finished successfully

If all prerequisites are met and the systems still don't appear in the RISE Methodology Dashboards please open a support ticket on the component SV-CLM-RMD

 

The service name is identical in SAP Cloud ALM, SAP for Me, and the SAP Support Portal. To keep it consistent and the same everywhere, it is not possible to change it directly in SAP Cloud ALM. 

To change the service name, start a request “Cloud System Name and ID Rename” in SAP for Me for the respective cloud tenant:

  1. Go to https://me.sap.com/systemsprovisioning/systems(opens in new tab)
  2. Click the system number of the cloud tenant and note the system number for later use.
  3. Click Request for System Name/ID change.
  4. Click "New" (+) to create a new request.
  5. Click SaaS.
  6. Select the request type "Cloud System Name and ID Rename".
  7. Go to the next step and select the cloud system for which you want to change the name. If the list is too long, filter by the system number you noted before.
  8. Select the flag Change System Name.
  9. Enter the new name in New System Name.
  10. Go to the next step, confirm your entries, and submit the request.

The service request needs about one hour to be processed. You will receive an email once it is processed. The new name will appear in the landscape management after the daily import of subscribed cloud services. If you don’t want to wait, you may trigger the ad-hoc sync in the Configuration panel on LMS after the service request is processed. 

  1. Open the configuration panel
  2. Open the "Import of Subscribed SAP Services" tray
  3. Click on the status icon under "Status of imports"
  4. Click on "Import My Subscribed Cloud Services"

We recently had some cases where an ABAP system appears unregistered in Landscape Management despite being successfully registered and showing as registered in transaction /SDF/ALM_SETUP.

Problem:

  • When you try to activate the Configuration & Security Analysis use case for the ABAP system, you get an error message that the monitoring cannot be activated because the system is not registered.
  • When you check the transaction /SDF/ALM_SETUP in the ABAP system, the system shows the status "Registered" and an LMS Id
  • When you check the system details in Landscape Management the system or the client show the registration status "Unregistered"

We are still investigating the root cause of this behavior. For now, we can only offer a workaround.

Workaround:

  1. Go to transaction /SDF/ALM_SETUP and deregister the system
  2. Immediately register the system again
  3. This should correct the status in Landscape Management
  4. Follow KBA 3149346(opens in new tab) - On-premise usecase "Performance Monitoring" and "Configuration Monitoring" for SAP Cloud ALM cannot be re-enabled via /n/SDF/ALM_SETUP to reactivate Real User Monitoring and Configuration and Security Analysis

Cloud Connector acts as a reverse proxy between SAP BTP applications and on-premise systems. It supports connections from the Cloud to the On-Premise and from the On-Premise to the Cloud.

In the context of SAP Cloud ALM, Cloud Connector is only required to establish a connection from SAP Cloud ALM towards the on-premise system (connections initiated by SAP Cloud ALM). It is not necessary for connections initiated by the on-premise system to send monitoring data to SAP Cloud ALM.

SAP Cloud ALM provides different use cases for on-premise systems and cloud services. To make these use cases work, usually, a connection needs to be established between the managed service or system and SAP Cloud ALM.

How this connection is established depends on the use case and the managed service. You can find more information for the supported services in the SAP Cloud ALM for Operations Expert Portal under Setup Managed Components (Services & Systems).

Here, we will focus on connections to on-premise systems and whether a Cloud Connector is needed to establish them.

As mentioned before, the need for a Cloud Connector to connect on-premise systems depends on the direction of the connection. This roughly translates to “Is the data being pushed or pulled?”

PUSH means that the managed system independently sends monitoring data to SAP Cloud ALM. In this case, Cloud Connector is not required. The following use cases use PUSH data collection and hence do not require a Cloud Connector:

  • Monitoring of SAP ABAP systems, like SAP S/4HANA, SAP Business Suite, and SAP Netweaver AS ABAP

PULL means that the data is transferred at the initiative of SAP Cloud ALM. To establish a connection, you have to create an endpoint for the on-premise system in Landscape Management. In these cases, you always need a Cloud Connector to allow SAP Cloud ALM to reach the on-premise system.

The following use cases use PULL data transfer and hence require a Cloud Connector:

  • The use case Business Transformation Center for SAP ABAP systems
  • Monitoring of SAP Netweaver AS Java (SAP Process Integration) systems
  • Monitoring of the Cloud Connector itself
  • Customers who want to use SAP Focused Run for the monitoring of cloud services via the SAP Focused Run Reverse Proxy. In this case, SAP Cloud ALM acts as a reverse proxy between the managed cloud services and SAP Focused Run and forwards the monitoring data via the Cloud Connector to SAP Focused Run. It also provides the cloud landscape via the Landscape Sync.

Connectivity via Cloud Connector from On-premise to Cloud is only possible for ABAP cloud systems, HANA Cloud databases, and specific SAP BTP services like K8s clusters. It cannot be used for SAP BTP services like SAP Cloud ALM.

For more information, see Cloud Connector FAQ(opens in new tab)  > Features > "Can I use the Cloud Connector from on-premise to cloud for any protocol?"