SAP Basis / System Administration

Governs all SAP system administration activities. The landscape is the foundation everything else runs on — changes to production without proper controls, untested transports, and unmonitored systems create outages that are 100% preventable.

Content Routing

Iron Laws

1. NEVER CHANGE PRODUCTION WITHOUT CHANGE MANAGEMENT APPROVAL. Every change to a production system — transport import, manual configuration, kernel patch, support pack, user role change — requires a documented change request approved through the organization's change management process (Cloud ALM, Solution Manager, or equivalent). "Emergency" changes require emergency change procedures, not bypassing controls.
2. ALWAYS CHECK SYSTEM LOGS BEFORE AND AFTER MAINTENANCE WINDOWS. SM21 (system log) and ST22 (ABAP dumps) must be reviewed immediately before a maintenance window starts (to establish baseline) and within 30 minutes of completion. New dumps or log errors post-maintenance are caused by the maintenance — don't assume otherwise.
3. NEVER DELETE TRANSPORTS FROM THE IMPORT QUEUE WITHOUT DOCUMENTATION. Removing a transport from STMS import queue permanently excludes it from the landscape unless re-imported manually. Deleting without documentation makes the gap impossible to detect in future audits or when troubleshooting missing functionality.
4. ALWAYS VERIFY BUFFER CONSISTENCY AFTER SUPPORT PACK APPLICATION. Support packs modify ABAP repository objects, DDIC, and customizing. After application, run /SDF/CDPOS_REORG or use RSBC_BUFFER_CONSISTENCY to check buffer states. Inconsistent buffers after patching cause intermittent transaction failures that appear unrelated to the patch.

Rationalization Table

Red Flags

Watch for these in your own reasoning — each signals a controls or stability risk:

• "I'll just make this change directly in production..." → Stop. Raise a change request. No exceptions regardless of urgency — escalate through emergency change procedure.
• "The transport queue is getting long, let me clean it up..." → Do not delete transports without explicit approval. Long queues are a process problem, not a technical one.
• "The system is slow, let me restart the dispatcher..." → A dispatcher restart is a last resort that drops all active sessions. Investigate via SM50/SM66 and ST22 first.
• "ST22 shows old dumps, nothing new..." → Check the date filter. Old unresolved dumps in ST22 indicate recurring issues that were never root-caused.
• "I'll set the user's password directly in SU01..." → In SSO landscapes, manual password resets bypass identity provider sync. Confirm the authentication method (SU01 → Logon Data tab) before touching the password.
• "Let me increase the work process count to fix the bottleneck..." → Work process count is bounded by hardware and license. Check SM50 utilization pattern first — more processes rarely fix the real problem.

<HARD-GATE> Before any production system change: confirm a change request exists and is approved, a rollback procedure is documented, affected users/business processes have been notified, and a post-change verification plan is defined. Do not proceed with any production change without these four items confirmed in writing. </HARD-GATE>

Key Concepts

System Landscape

• Three-system landscape: DEV (development and customizing), QAS (testing and integration), PRD (production). Changes flow DEV → QAS → PRD via STMS transport management.
• Client: Logical separation within an SAP system. Clients share hardware but have independent application data. Client 000 (SAP default), 001 (copy template), customer clients (e.g., 100, 200).
• Client Settings (SCC4): Controls client changeability (modifiable, not modifiable), cross-client object changes, and client role (production, test, customizing). Production client must be set to "Not Modifiable."

Transport Management (STMS)

• Transport Request Types: Workbench requests (SE01 — cross-client, repository objects), Customizing requests (SE09 — client-specific settings).
• Transport Route: Defines which systems receive transports from which sources. Configured in STMS → Transport Routes.
• Import Queue: Pending transports for a system. STMS → Import Queue → select system. Imports should follow sequence (transport number order) unless explicitly desequenced with documentation.
• SE10: Overview of all transport requests for the logged-in user. Use to release and monitor request status.

User Management

• SU01: Single user maintenance — create, change, lock, unlock, assign roles, set validity dates.
• SU10: Mass user maintenance — apply role assignments or locks across multiple users simultaneously.
• SU53: Authorization check analysis — displays the failed authorization object with actual vs. required field values. First tool to use for "no authorization" errors.
• SU24: Transaction code to authorization object mapping — defines which auth objects are checked for each tcode, and whether the check is active, inactive, or proposed.
• Profile Generator (PFCG): Role maintenance — creates authorization profiles from organizational levels and object selections. Always use PFCG to manage roles, never direct profile editing.

Background Job Management

• Job Classes: A (high priority, reserved processing), B (normal), C (low priority, background). Production critical jobs should be class A or B.
• Job Chains: Predecessor dependencies set in SM36 → "After Job" to sequence jobs. Avoids time-based scheduling that fails when previous job runs long.
• SM37: Job monitoring — filter by user, job name, date, status. Check for status "Cancelled" or "Active" jobs running longer than expected.

System Monitoring

• SM50: Work processes on the current application server — status, type (DIA, BTC, SPO, UPD), CPU, report name. Identify running long or stuck processes.
• SM51: List of active application servers. Allows SM50 drill-through to individual servers.
• SM66: Global work process overview across all application servers — critical for production load analysis.
• SM21: System log — OS-level and R/3 messages. Filter to ERROR and WARNING class for post-change review.
• ST22: ABAP Runtime Error (short dump) viewer. Contains program, line, runtime value, and call stack. Must be analyzed before restart.

Performance Analysis

• ST02: Buffer statistics — hit ratios for program buffer, table buffer, CUA buffer, screen buffer. Hit ratio below 95% for program/table buffers indicates undersizing.
• ST03N / ST03: Workload Monitor — analysis of dialog, background, update, RFC response times by hour/day. Baseline performance before maintenance windows.
• ST06: OS Monitor — CPU, memory, disk I/O at OS level. Correlates with SM50/SM66 work process saturation.
• SM12: Lock entry table — identify and release stuck enqueue locks. Stuck locks block user transactions.

HANA Administration

• HANA Studio / HANA Cockpit: Primary tools for DBA tasks — backup scheduling, alert monitoring, memory analysis, user management.
• Backup/Recovery: HANA supports full, incremental, and differential data backups plus log backups. Recovery point objective (RPO) drives log backup frequency — production typically every 15–30 minutes.
• HANA Alerts: Configured in HANA Cockpit. Critical alerts: low memory, high CPU, backup failure, replication lag (in scale-out). Integrate with SAP Alert Notification Service.
• Table Distribution (Scale-Out): In scale-out HANA, monitor partition placement and rebalancing operations. Avoid manual redistribution during business hours.

Maintenance Procedures

• SPAM (Support Package Manager): Applies ABAP support packages (SPs) and SAP Notes. Import queue shows available packages from SAP support portal. Always apply in the correct sequence.
• SAINT (Add-On Installation Tool): Installs and upgrades add-on components (e.g., IS-Retail, SAP GRC, third-party add-ons). Requires system downtime in most cases.
• Kernel Upgrade: Replace executables in the OS-level kernel directory. Requires system stop. Always verify the new kernel is certified for the current database and OS version via SAP Product Availability Matrix (PAM).
• Cloud ALM / Solution Manager: Central hub for transport monitoring, system monitoring dashboards, job monitoring, and IT calendar (maintenance window management).

Transaction Codes

Integration Points

• Cloud ALM / Solution Manager: Receives system monitoring data via Diagnostics Agent (SMD Agent). Provides centralized dashboards, transport tracking, and IT calendar for maintenance window coordination.
• ITSM Tools (ServiceNow, Jira): Change requests and incident tickets must reference SAP transport numbers and system change details for audit trail.
• HANA Database: Application servers connect via HANA JDBC. DBA Cockpit (DBACOCKPIT) provides SQL-level monitoring from ABAP; HANA Cockpit for native DBA tasks.
• Identity Providers (LDAP/AD/IAS): SNC (Secure Network Communications) or SAML integration for SSO. Changes to LDAP connectivity affect all user logons — treat as high-risk change.
• Backup Infrastructure: HANA backupcatalog must align with the organization's backup retention policy. Coordinate with infrastructure team for backup storage and off-site replication.

Verification

This skill is complete ONLY when ALL of the following are true:

• [ ] Change request exists, is approved, and references all affected systems and transport numbers
• [ ] Pre-change baseline captured: SM21 and ST22 reviewed, ST03N workload snapshot taken
• [ ] Post-change verification completed within 30 minutes: SM21 clear, ST22 no new dumps, SM50 work processes stable
• [ ] Transport import sequence verified in STMS: no transports skipped, import log shows no errors
• [ ] Buffer consistency checked after support pack or kernel change: no inconsistency errors reported
• [ ] Post-change communication sent to affected business users confirming system availability

Evidence required: STMS import log showing successful completion; ST22 showing no new dumps post-change; change request updated to "Closed" with actual end time.

Next Skill

After Basis maintenance or system change: verification-before-completion For security role and authorization changes: security-grc For integration connectivity issues post-change: integration-suite

Related Skills

• security-grc — User authorization concepts and SoD analysis
• abap-cloud — ABAP development impacting system objects
• troubleshooting — Diagnosing ABAP dumps and runtime errors
• integration-suite — RFC destinations and middleware connectivity