SAP Note 17083 - Adapting the sapsys groups in a system network

Symptom:

The transport system does not work properly. Various authorization problems occur during transport.
The sapsys group was not installed with the same group identification number on all the computers of the SAP R/3 system network.

Cause and prerequisites

The sapsys group was not installed with the same group identification number on all the computers of the SAP R/3 system network.
When an SAP R/3 System is installed, the sapsys group must always be created under the same group identification number (gid).

Solution
Contents

1. Checking the gids
2. Determining a master gid (Mgid)
3. Changing the assignment of gids to the master gid (Mgid)
4. Changing the gid of existing files
----------------------------------------------------------------------

1. Checking the gids

Log on to all the computers of your SAP R/3 system network, one after another, as user root and issue the following command:
grep sapsys /etc/group
This command will display the entry of group sapsys from the operating system file /etc/group. This entry will appear as follows (example):
sapsys:*:201:...................
The third field (separated by ":") contains the gid of the group.

We recommend recording all the gids in a three-column table: host name, gid, and mgid. In this step, the Mgid field is still empty.
When all the determined gids are the same, there is nothing else to do. The described problem does not have the cause assumed here, and this note is not relevant for solving your problem.
----------------------------------------------------------------------

2. Determining the Mgid

Now determine one gid as Mgid according to the following perspectives:
On all the computers of the SAP R/3 system network, the Mgid must either be set to the sapsys group or must still be available
(Help: command (as user root):
sort -t: -k 3n,3 /etc/group
Generates a list of file /etc/group sorted by the third column.)
For safety's sake, once you have decided on an Mgid, you should make sure that this gid can be used as Mgid. To do this, log on to all the hosts of your SAP R/3 system network as user root and issue the following command:
grep Mgid /etc/group
If the system does not issue any messages, or outputs "sapsys:*:Mgid:...." (or similar), that Mgid is fine.

Comment:

You have now determined a usable Mgid; enter it in the list you created in step 1.
Now, for every computer in the SAP R/3 system network where the gid and Mgid differ, perform the actions described in steps 3. and 4. below.
----------------------------------------------------------------------

3. Changing the assignment of gid to Mgid

Log on to the appropriate computer as user root. Edit the /etc/group file. In the file, change the gid of group sapsys to the Mgid.
Example: if the line
sapsys:*:203:....................
appears in the /etc/group file, 203 is the gid you determined for this computer in step 1, and 304 is the Mgid you selected, change the line to:
sapsys:*:304:...............
(The ".................." stands for the end of the line, which you should not alter.)

4. Changing the gid of existing files

At this point, all the R/3 systems in the system network must be stopped, as the files changes required cannot be performed when the system is running.
Log on to the appropriate computers as user root and enter the command that changes the group identification number for the following five directories (or mount points):
Directories:
/usr/sap/trans/
/usr/sap//
/sapmnt//
/usr/sap/tmp/
~adm/ (Home directory of adm)
Command to change the gid:
find

-print | xargs chgrp sapsys
or
find -exec chgrp sapsys {} \;
(The "\;" at the end of the line is particularly important.)
Replace by each of the five directories specified above.
-----------------------------------------------------------------------

Closing comment:
Once you have performed steps 3. and 4. of this note for all the computers in your SAP R/3 system network, we recommend making sure that all the gids of the sapsys group now agree by repeating the procedure described in step 1.
You can now restart your R/3 systems.