SAP Note 25526 - Central system log not available

Symptom:

You cannot display the central system log.

Other terms

SM21, System log

Reason and Prerequisites

The mechanisms for the central system log have not been ported to all platforms. On Windows NT, there is no central system log, and on AS/400 it is only available as of Release 6.40. Here, you must use alternative methods to access the information:

• System log evaluation using all instances collects the current data by RFC. Procedure:
  Call Transaction SM21 and select System log -> Choose -> All remote System logs.

• Determine via the computing center management system which application servers are having problems, and then look at the local system log on that machine.
  

Central system log on UNIX

Certain requirement must be met for the global system log to work:

• On the instance that collects the central system log, the collector demon rslgcoll must run as a process. This process is started from the start profile START_.

• On every instance, a send demon rslgsend must run as a process. This process is also started from the start profile START_.

• The rslg/... parameters must be defined correctly. These are explained in detail on the documentation CD. Please note that the default values are incorrect in the online documentation. The list below contains the correct default values.
  In particular, the following parameters must be correct:

• rslg/collect_demon/host (host name of the instance on
  which the collector is running)

• rslg/central/file (the current system log file)

• rslg/central/old_file (the last system log file)

• rslg/collect_daemon/listen_port (socket; default = 14xx)

• rslg/collect_daemon/talk_port (socket; default = 15xx)

• rslg/send_daemon/listen_port (socket; default = 12xx)

• rslg/send_daemon/talk_port (socket; default = 13xx)
  

The four service numbers may be chosen arbitrarily. According to the naming convention, "xx" is the instance number. These numbers should be identical for all instances. If they are not, the naming convention cannot be fully followed and you are recommended to include them in DEFAULT.PPL .

If several R/3 instances are configured on a host, the parameter

rslg/send_daemon/listen_port

rslg/send_daemon/talk_port

must be set for the sender in the individual instance profiles so that the combination host name + port number is unique. For example:

The instances 'instance01' and 'Instance02' are running on 'Host A'. Then for example

rslg/send_daemon/listen_port 1201

rslg/send_daemon/talk_port 1301 for instance01

and

rslg/send_daemon/listen_port 1202

rslg/send_daemon/talk_port 1302 for Instance02

can be selected.

• It must be possible for the instance to access the system log files (unix: NFS-mount, WindowsNT: UNC-share)
  

Remark: New messages are written into file SLOGJ. When SLOGJ is full, it is copied to SJOGJO and SLOGJ is initialized. SJOGJO is then overwritten. Transaction SM21 always reads both files.
Solution

Make sure that these conditions are fulfilled.

• If the central system log is visible in some instances but not in others, you should assume that there is a problem with the link to the global directory.

• If the central system log is not available anywhere, it is probably not written or evaluated at all. In a standard installation, the current system log file is called SLOGJ and is to be found on /usr/sap/SID/SYS/global (unix). On operating system level, you can check whether

• the file exists

• data is written to the file

• the file system has enough space left

• the send processes and the collector process are running.
  If they are not, look for more information in the start log and in the 'stderr' files in the 'work' directory (Transaction ST11). See also Note 15291.

• If entries from one or several servers are missing in the central system log, you should check that

• the port (socket) numbers are equal for all instances (see above: system parameters rslg/.../..._port).
  If any of the parameters have to be changed, you must restart the R/3 System. After stopping R/3, please check that the send and collector processes have actually gone. Unfortunately, the START profiles often contain parameter errors which result in these programs being detached from the "stopsap" mechanisms. They must then be exited manually.
  Remark: there are no aliases for ports that the syslog daemons use. Therefore there are no corresponding entries in /etc/services. The system administrator has to make sure that no other process occupies these ports (cf. Note 40003).

• the send process is running on this server.

• If some entries are missing in the central syslog

• maybe the connection was broken temporarily.

• If the most recent entries are missing, they might be delayed due to heavy system load. You can do nothing but wait.

• If the oldest entries are missing in the central log but still available in the local log the maximum file size may be not large enough (system parameter 'rslg/max_diskspace/central'). You can increase this parameter. However, the display transaction (SM21) will become slower.