Troubleshooting for Landscape Management

This page helps you to analyze common errors in Landscape Management. 

Missing cloud services in LMS can have several reasons. Please check if one of the following applies.

  • The service type is not in scope:
    • If this is your first subscription for this service type, the service type is not automatically added to the scope after the service was imported
    • Add the service type to the scope:
      1. Open the scope selection
      2. Search for your service type using the service types filter or the live search
      3. Check the checkbox in front of the service type name
      4. Click "Apply"
  • The service wasn't imported yet: 
    • If you just subscribed to the cloud service it possibly hasn't been imported yet. Before a cloud service can be imported into LMS it first has to be created in SAP's Cloud Landscape Directory. This is done by a job that runs once a day. After this, the cloud service can be imported into LMS. The automatic import into LMS happens once a day. 
    • By default, we will only import cloud services that belong to the same customer number as SAP Cloud ALM itself. If your cloud service belongs to another customer number, you have to maintain the SAP Corporate Group (CCC) S-User. See the next question for details. 
    • You can trigger the import ad-hoc:
      1. Open the configuration panel
      2. Open the "Import of Subscribed SAP Services" tray
      3. Click on the status icon under "Status of imports"
      4. Click on "Import My Subscribed Cloud Services"

If the solutions above didn't fix your issue please open a ticket using the components described under "Customer Support".

There is a difference between a licensed solution or product and the actual cloud tenant supporting it. 

You can see your licensed product in SAP for Me under the view "Portfolio & Products" on the tab "My Product Portfolio". 

Every product is supported by cloud tenants. These can be customer tenants or internal tenants (e.g. SAP Store). You can find all your customer cloud tenants under "Systems & Provisioning". Internal tenants are not visible to you.

Customer cloud tenants are what we import and support in SAP Cloud ALM Landscape Management. 

You can check which of your cloud tenants support which of your products please proceed as follows:

  1. Find the product you want to check in SAP 4 Me under "Portfolio & Products" > "My Product Portfolio"
  2. Click on the product name
  3. Switch to the tab "Systems"
  4. Here you find a list of all customer cloud tenants that belong to the product
    1. The column software product tells you the system type of this tenant in SAP Cloud ALM
    2. You can use the system number to find the tenant in SAP Cloud ALM Landscape Management via the global search

If you find a tenant that is not imported into SAP Cloud ALM Landscape Management but should have been, please note:

  • We only import cloud tenants if the software product is supported by a SAP Cloud ALM use case or downtime notifications are created for this product
  • If you find a tenant that is indeed missing in SAP Cloud ALM, but should be imported, please open a ticket under component SV-CLM-INF-LMS

If you want to use one SAP Cloud ALM to manage cloud service for more than one company, you can do this using the SAP Corporate Group (CCC) function.

Information on how to create a CCC Group can be found in the following SAP Notes:

  • 2632518 - Information about the SAP Corporate Group (CCC) function
  • 2459283 - How to link customer numbers using the Corporate Group function CCC - SAP ONE Support Launchpad
  • 2691631 - Information about the Corporate Group (CCC) Function - Guided Answers
  • 2632735 - Information to review before requesting to close or delete a customer number from a Corporate Group (CCC) - SAP for Me
  • 2626887 - How to remove customer number(s) from a Corporate Group (CCC) or close the group - SAP for Me
  • 3070306 - Multiple Customer Numbers - not all Systems are visible in SAP Cloud ALM Landscape Management Services?

Please note the following rules:

  • The SAP Corporate Group should only be used for customer numbers that belong to the same global ultimate, i.e. only subsidiaries of the same global company should be part of a corporate group
  • It must not be used by partners or service providers to add their end customers to their partner corporate group

To import the cloud services that belong to customer numbers in the CCC Group, you need an S-User that belongs to the CCC Group and can access all services and systems in the CCC Group.

There are two options how to get an S-User:

Option 1: If you want to use a technical S-User

It is possible to use a technical S-User as the Corporate Group (CCC) S-User in Landscape Management.

  • Using a technical S-User has the advantage that the password for this S-User never expires. 
  • A technical S-User, requested for the customer number which is on top of the group hierarchy (the main/parent account) can automatically see all customer numbers that are assigned to this CCC group.
    • It is not possible to restrict the authorizations of the technical S-User to only see a subset of the customers in the CCC group. 
    • Technical Communication Users have necessary authorizations automatically assigned in SAP backend systems when the user is activated. The customer cannot manually add, edit, or view these hidden authorizations.

To request a technical S-User for the main account follow the instructions in SAP Note:

  • 2174416 - Creation and activation of Technical Communication Users
  • Technical S-Users are not in the SAP ID Service (accounts.sap.com). Hence the password cannot be changed via SAP for Me. You set the password when you activate the S-User after creation.

Option 2: If you want to use a standard S-User

If you want more control over which subsidiaries of the CCC group an S-User can access you need to use a standard S-User. For this S-User you can maintain the authorizations yourself and to your requirements.

  • 1511008 - How to add or change S-user ID authorizations
  • 1898762 - What are the different S-user ID authorization levels that can be assigned?

Due to password expiration policies, it is not recommended to use an S-User that belongs to an actual person or is used in other SAP sites or applications. When the password of the S-User is changed, it also has to be changed in the SAP backend and the new password must immediately be maintained in SAP Cloud ALM to avoid password locking.

  • As long as the S-user ID is active and not expired (see KBA 2928052), the S-user ID's password for SAP for Me will not expire. Even though SAP for Me does not have an expiration for S-user ID passwords, other SAP sites may have different password policies.
    • 2907117 - Does the S-user ID password expire?
    • 2928052 - S-user ID Lifetime information
  • 2619351 - How to reset the password for your RFC connection (Use this for the password reset in the backend)
  • 1808560 - How to reset an S-user ID password

 

When you enter the CCC S-User and password in LMS, you receive the following error message:

  • Connection test failed with http Status: 401 UNAUTHORIZED. It might be due to an invalid username or password. Try again with different login details.

However, when you try to log on to SAP4Me with the same S-User and password you don't have a password error. 

LMS makes a direct call to the SAP Support Backbone and authenticates against the ABAP system. In some cases, it can happen that the password known in the ABAP user store gets out of sync with the password maintained in the SAP IDP accounts.sap.com. 

Follow SAP note 2619351 to reset the password of the S-User in the ABAP user store in the backend to the password that you use in SAP4Me. 

If you also need to reset your SAP4Me password, please follow SAP note 1808560.

 

In the SAP ABAP system, each client of the system has to be registered separately. Usually, you would only register the productive tenant for monitoring and client 000 for Transport Monitoring. However in SAP ABAP systems with more than one business client, you may want to register additional tenants to monitor client-dependent data using Integration or Business Process Monitoring. 

Each client of an SAP ABAP system is considered a logical system and hence has its own Lms ID. All logical systems are grouped under their technical system in LMS.

The Lms ID shown in transaction /n/SDF/ALM_SETUP is the Lms ID of the client. You find the Lms ID in the Clients table in the CLIENTS section of the technical system.

When you migrate your SAP ABAP system to a new hyperscaler or move it into the SAP Cloud with RISE with SAP, the migrated system will get a new system number. 

Landscape Management uses the system number to determine if a system is already known in Landscape Management. The SID of an ABAP system cannot be used as a unique identifier since it doesn't have to be unique in a customer's landscape.

When a system registers with a new system number a new entry will be created in Landscape Management. This leads to the perception that the system now exists twice in Landscape Management, but in reality, it is two different systems. The "old" system from before the migration and the "new" system from after the migration.

To remove the "old" system, please follow the answer to the question below.

Landscape Management provides the data for all use cases. Hence we have to be very mindful when we allow the deletion of a managed service or system. 

To delete a service or system from Landscape Management the service or system must meet the following criteria:

  1. The source must be "Manual" or "Registered" 
  2. It must have the Status "New".
    1. All supported use cases must have the status "Not Configured"
    2. The configuration can be removed in the respective applications for the use case
  3. It must have no endpoints 
    1. Endpoints can only be deleted if their use cases are in the status "Not Configured"
  4. For ABAP technical systems:
    1. The system must be deregistered (perform deregistration in transaction /SDF/ALM_SETUP)
    2. All logical systems must have been deleted.
      1. Logical systems (clients) can be deleted if all their use cases are in the status "Not Configured" and they have no endpoints.

Services imported from SLIS cannot be deleted manually. They will be marked as deleted once the customer unsubscribes. They will be deleted with the next SLIS import once all use cases have the status "Not Configured" and all endpoints are deleted.

Please note: If you are trying to delete an "old" ABAP system that was migrated to a new hyperscaler, please make sure that the "new" ABAP system doesn't have the old Cloud ALM connection information in the configuration tables. This can happen if you didn't deregister the ABAP system before the migration. The new ABAP system will then try to send its metrics to the LMS entry for the old ABAP system. Which will interfere with your clean-up. 

  1. Please check the value for LMS_ID of the new ABAP client in transaction /SDF/ALM_SETUP
  2. Open the new ABAP system in LMS and compare the value found in the ABAP system with the value LMS Id in the clients table for the respective client
  3. If they do not match or the client doesn't exist yet, please click the "Unregister" button in the ABAP system and then "Register" the system again. This should create a client in the new ABAP system and correct the monitoring configuration in ABAP.
  4. Once this is correct you can go ahead and clean up the old ABAP system in LMS

To learn how the delete the configuration for the use cases please read:

SAP HANA Enterprise Cloud ABAP systems are mapped to their original product type (E.g. SAP S/4HANA, SAP Business Suite, etc.) during the import process. 

Hence you can find them under the system type for this product. You can also use the "Live Search" and search for the SID. By pressing the ENTER button after entering the SID in the Live Search to whole LMS will be searched.

See KBA 3332806 - "Status Events for Systems hosted by SAP ECS in SAP HANA Enterprise Cloud" for more details.

In LMS you can upload the service key, that was created for SAP Cloud ALM APIs to enable managed services and systems to send monitoring data to SAP Cloud ALM. The service key upload is available in the "Configuration Panel" in the section "SAP Cloud ALM Service Key". 

  • If you cannot see this section, please make sure that your user has the role Landscape Management Security Administrator
  • If you can see the section but the upload is rejected, please make sure that you upload a service key with the following characteristics:
    • The service key in the TXT file must be in valid JSON
    • The service key belongs to THIS SAP Cloud ALM (verify the field uaa.identityzone)
    • The service key contains the fields uaa.clientid and uaa.clientsecret
    • The field uaa.credential-type = instance-secret

The seemingly identical entry is completely normal. It is not a duplicate but rather reflects the way SAP Integration Suite is modeled in SAP's Cloud Landscape Directory. 

It has to do with the activated product modules on the SAP Integration Suite. Every product module other than "Cloud Integration" is always attached to a productive SAP Integration Suite tenant.

So if a customer has a Test SAP Integration Suite with activated "Cloud Integration", "API Management" and "Open Connectors", he will have one SAP Integration Suite with the role "Test" to which the "Cloud Integration" capability is attached and one SAP Integration Suite with the role "Production" to which all the other modules are attached.

The two SAP Integration Suite tenants will look identical in name and data center, but the System Role and System Number will differ.

The Attribute-based Access Control is in the configuration section of Landscape Management. Please read the setup instructions before using or activating Access Control.

If you cannot find it in the configuration section, please make sure that one of the following roles is assigned to your user:

  • Landscape Management Access Controller
  • Landscape Management Access Controller Viewer

If you just assigned the roles to yourself, please make sure to log off and log on to SAP Cloud ALM for the role changes to take effect.

 

You got an alert email from SAP Cloud ALM, but when you try to click the link in the alert you get the following error: 

This error can happen when you try to access a monitoring use case, but don't have sufficient authorizations to read Landscape Objects from LMS.

Currently, all necessary LMS scopes are part of the monitoring use case roles. Please ask your user administrator to assign at least the following role to you:

  • The viewer role for the use case you are trying to access, e.g. Health Monitoring Viewer