Live-Presentation

Procedure Stand: February 2008

Marketing and Sales:

CheckAud® for SAP® Systems

Contents
1 Installation..........................................................................................................................3
2 Required rights in the SAP® System.................................................................................4
3 Executing Scans ................................................................................................................4
4 Securing data for the Presentation ....................................................................................5
5 Connections over router or firewall systems ......................................................................6
6 Important recommendations for optimization.....................................................................7
7 Contact ..............................................................................................................................8

For a live presentation of CheckAud® for SAP® Systems or an audit by IBS employees, it is
required that the data be prepared before the scheduled appointment.

CheckAud® for SAP® Systems is split into three modules:

CheckScan
- Reads the relevant data from the SAP System

CheckIns
- Prepares the data and creates a database structure

CheckAud
- The foundation of CheckAud® for SAP® Systems, offers diverse evaluation options for
the prepared data.

The preparation of the data consists of running the first two modules (CheckScan followed
automatically by CheckIns); once for each system and client.

Follow the instructions given below.

IBS Schreiber GmbH Seite 2

CheckAud® for SAP® Systems

1 Installation
The scan module of CheckAud® for SAP® Systems is ready for you to use in the download
area of our homepage: http://www.check-aud.de/95.0.html.
First, unzip the archive in any directory. Execute the installation with a double click on the
folder SETUP.EXE. At this point, you are free to select your own target path. The standard
path will be given:
C:\Program Files\ibs schreiber gmbh\CheckScanR3 version 3.1
No other changes are necessary.
The module CheckIns is automatically installed with the CheckScan installation.
Installation time: < 1 Minute.
Installation size: ca. 20 MB
So that the scan module works as fast as possible with the least amount of strain on the
SAP® system, the data is read from the SAP® system and saved in raw form. Between four
and eight data accesses take place for every SAP® object, which means there are between
four and eight million data accesses during the scan of an SAP® Version 4.6 system.
Virus scanners that check the write-access to the hard drive should be de-activated (see
“Important recommendations for optimization” in this document) at the workstation where the
scan is run. This will significantly decrease the run-time of the scan.
Computer requirements for ca. 500 users and R/3-Release 4.6x:
Processor: 1000 MHz
Memory: 500 MB
Free disk space: 500 MB
Operating system: Windows XP / 2000 / 2003 / Vista

IBS Schreiber GmbH Seite 3

CheckAud® for SAP® Systems

2 Required rights in the SAP® System

Logging onto the SAP system through the scan module is done using the RFC interface. A
user account (dialog or CPIC/communication) with the following rights is required:
Authorization object S_RFC (RFC-access)
Field Activity: 16 (Execute)
Field Name of the RFC to be protected: KKC2, SDTX, SR1T, SRFC,
SUGI, SXPT, SIFP, FRFC, SYST
Field Type of RFC object to be protected: FUGR
Authorization object: S_TABU_DIS (table maintenance)
Field Activity: 03 (Display)
Field Authorization group: * (All Tables)
The authorization group can be limited as much as is necessary so that the personnel tables
are not included. The following value is recommended:
&NC&, 0 - 9*, A - P9*, PB - Z*

3 Executing Scans
To execute the scan, start the file CHECKSCANR3.EXE by selecting the menu entries: Start
– Program – ibs schreiber gmbh – CheckAudR3 - scan module version 3.1 presentation –
CheckScanR3 version 3.1, scan module.
The following entries are required in the program window fields:
Host-Name: Name or IP address of an SAP® application server or an SAP router-
address:
System-Number: The number of SAP instances to be scanned which run on the server
Client: The client to be scanned
User name: The user under whose name the scan was run
Language: The language in which the system was scanned (select EN). This
pertains to documentation and long text for objects.
Password: Password of the user
Identifier for the scan:
Any descriptive name for the scan
Automatically transferred to the database:
Activate this item!

IBS Schreiber GmbH Seite 4

CheckAud® for SAP® Systems
As a rule, the settings in the button Define options and Define scan complexity should not be
modified. If you have questions at any time, please contact the distribution department of IBS
Schreiber GmbH.
To start the scan, click on the button Start of Scan. Enter a name for the file in which the
scanned data is to be saved. The file should be stored locally on the computer.
The scan can take between 15-45 minutes, based on the speed of the workstation and the
connection. During the scan, ca. 550 tables are read from the SAP system. Determining an
exact number is not possible because most of the required tables are not determined until
the scan. The scan deals exclusively with tables of the authorization concept, customizing, or
the system configuration. Management data (especially HR data) is not read.
Two files with the endings .SDA and .SIX are created at the time of the scan and are given
the name already entered by you. The combined size of the two files can range from 100 to
300 MB, depending on the size of the SAP® system.
After the scan has finished successfully, a second program (CheckInsR3) is called automati-
cally and it creates a database out of the raw data. In so doing, the data is prepared so that
the evaluation requires as little computer capacity as possible. This process can take hours,
depending on the complexity of the recorded data and the capacity of the workstation. During
this time, no other work should be done on the workstation.

4 Securing data for the Presentation

Both files with the endings .SDA and .SIX, as well as the newly created database, must be
burned onto a CD. The database can be found by default in the folder
C:\Programme\ibs schreiber gmbh\Database.CAR3

If you did not install CheckScanR3 on the standard path, then you can find the database in
the options of the scan module. Display the path by clicking on Define options.
The entire Database.CAR3 directory, including all of the sub-directories, is required. Beneath
the directory Database.CAR3, you will find the following directory structure:
Database.CAR3 (Æ Main directory, burn onto CD from here)
Database
Master
SAPaudit
Cache
The presentation will use the CD containing the .SDA and .SIX files, as well as the files found
in the Database.CAR3 directory shown above.

IBS Schreiber GmbH Seite 5

CheckAud® for SAP® Systems

5 Connections over router or firewall systems

Most of the time there is no direct connection to your SAP system via a router or a firewall. In
either case a scan is possible with CheckAud® for SAP® Systems using the host name or the
TCP/IP address.
Enter the necessary information as follows:
The port number for the connection to your SAP-system consists of four digits. This is con-
structed as follows:
for dialogue connections- 32 + system number (instance number)
for RFC connections- 33 + system number (instance number)
If you want to scan a system with the instance number 00, you have to use 3200 as the port
number or 3300 for an RFC connection. If these ports are closed they have to be opened by
the administration. Otherwise, the scan module cannot connect to your SAP system.
A router or firewall blocks host names and TCP/IP addresses which cannot be resolved, so
you may have to explicitly enter the data in the scan module. You can do this in SAPRFC.INI
or directly in the field host name. The entry has to match the SAP router string, which must
appear as follows:
/H /<SAP-router-address>/S /<port-address (32+system number)>/H/ <destination-
address respectively host-address>.

For example:
The router address is 192.192.168.23
The system (instance) you want to scan is number 99
The address of the SAP-server you want to scan to is 192.192.192.25
The string for this example would be as follows:
/H /192.192.168.23 /S /3299 /H /192.192.192.25
In the scan module you enter the string in the field host name:

Please note: the quoted port 3299 in this example is opened in your router (or firewall
system) for the machine from which you want to scan!

IBS Schreiber GmbH Seite 6

CheckAud® for SAP® Systems

6 Important recommendations for optimization

Operating principle

The scan module saves the scan data in two files with the file extensions .SDA and .SIX. In a
standard installation, these two files are located in the directory C:\Program Files\IBS Schrei-
ber GmbH\SCANFILE.CAR3. During a scan, these files can be accessed several million
times. The transfer module, CheckInsR3, generates a relational database from the two scan
files. This database will be stored in the directory \ibs Schreiber gmbh\DATABASE.CAR3.

The transfer module CheckInsR3, in the course of a transfer, accesses both the scan files
and the database directories several million times.

Optimization recommendation

The function of the virus scanner is to examine every “read from” or “write to” the hard drive.
The virus scanner is given high priority and can easily affect the performance (slow down) of
any program that repeatedly accesses the hard drive. Here is an example of the effect on
scan performance with and without the virus scanner, using 1,000 users and an average
number of authorizations:

Scan without virus scan Scan with virus scan

20 minutes 3 hours 40 minutes

Transfer without virus scan Transfer with virus scan

1 hour 20 minutes 6 hours 45 minutes

Many organizations simply turn off their virus scanner during a CheckAud® scan. Because of
the ever-present danger of virus infection, we do not recommend this method!

With one simple modification to the virus program settings, the system will continue to be
protected and the CheckAud® programs will run at maximum speed. You will require adminis-
trative rights to make this change to the system virus software. Take the following steps:
Open the attributes of the virus scanner software. Enter the directories to be excluded (…\ibs
Schreiber gmbh\), including the subdirectories. Save.

NOTE:

Some virus scanners are administered on the server and contain profiles of individual clients.
Where this is the case, the virus scan program must be modified on the server. Once the
change is made, all accesses to the specified directories will be ignored by the virus soft-
ware, but the rest of the system will continue to be protected.

IBS Schreiber GmbH Seite 7

CheckAud® for SAP® Systems

7 Contact

You can find the most current information about CheckAud® for SAP® Systems online at:

www.CheckAud.de
Please feel free to visit the IBS Schreiber GmbH internet pages (coming soon in English!):

www.ibs-hamburg.com

Sales Technical Support

IBS Schreiber GmbH IBS Schreiber GmbH

Atlantic Haus Atlantic Haus

Zirkusweg 1 Zirkusweg 1

20359 Hamburg 20359 Hamburg

Tel.: +49 40 69 69 85 25 Tel.: +49 40 69 69 85 42

Fax: +49 40 69 69 85 31

E-Mail: sales@ibs-hamburg.com E-Mail: support@ibs-hamburg.com