Question Re: Batch Risk Analysis sync in Additional Q&A

Batch Risk Analysis sync

Former Member — Mon, 11 May 2009 05:28:32 GMT

Hi,

We have configured CC 5.3 and we have scheduled Batch Risk Analysis for Role Analysis with Management Reports option. But this job is running from long time and there is no update.

Later we have scheduled one more job only for Z Roles sync by cancelling above mentioned job. But this job is also running from long time and it is running for all the roles other than Z Role also when we checked the Result.

Can you please advice me how we can do the first time sync in GRC CC for updating Management Report in lees time.

Thanks & Regards,

KKRao.

Re: Batch Risk Analysis sync

Former Member — Mon, 11 May 2009 07:10:24 GMT

Hi KK,

Please optimize your system for better performance. Check these notes-

723909 - JVM settings

871394 - Deactivate non-mandatory J2EE engine services

1121978 - Datasource name & max. number of conncetions / JCo Pool Configuration / RAR Performance Tuning Parameters

Regards,

Sabita

Re: Batch Risk Analysis sync

Former Member — Mon, 11 May 2009 07:31:54 GMT

Hi,

Please keep it under consideration also while doing performance optimization-

To speed up the time needed for batch risk analysis is focusing on only

those users that are really relevant for your analysis.

Therefore, in Configuration 􀃆 Risk Analysis 􀃆

Default Values we suggest excluding the following users:

Locked users

Expired users u2013 users outside of their validity period canu2019t logon

Mitigated users u2013 can be reported separately in Mitigation 􀃆 Mitigated Users

Default user type for risk analysis should be set to u2018Dialogu2019 to exclude all technical user types

We also recommend excluding critical roles and profiles from batch risk analysis, because profiles like

SAP_ALL carry all possible risks and consume a considerable amount of computation time when they are hit by a risk analysis.

You can exclude critical roles in Configuration 􀃆 Risk Analysis 􀃆 Additional Options setting the toggle u2018Ignore Critical Roles & Profilesu2019 to u2018Yesu2019.

Then define all roles and profiles in the Rule Architect as critical roles and profiles, respectively that match one of the following criteria:

SAP_ALL, SAP_NEW, Profiles listed in SAP Note 1034117 and similar profiles you have created.

All powerful roles you have created for emergency access or super-users Furthermore, try to identify activities you need to perform in the backend systems that are executed only once per month / quarter / year and add a considerable amount of risks to the users who have to perform them

Now, create in Superuser Privilege Management Firefighter IDs and grant the roles required for these activities to them. Then remove these privileges from your regular end users. As Firefighter IDs should be configured with user type u2018communicationu2019 they can be excluded from risk analysis as well.

Finally, another measure to increase efficiency is the usage of incremental synchronization and incremental batch risk analysis (refer to SAP note 1034117).

After the initial full synchronization, it is best practice to schedule a daily batch job to run an Incremental Synchronization and batch risk analysis. Please note that an incremental sync will only review those users changed in the back-end system (for example roles added or removed). The Incremental Analysis does not take into account front-end changes such as to the rules or addition/changes to mitigating controls, which would affect users / roles / profiles that werenu2019t tagged as u2018changedu2019 during the incremental synchronization.

Therefore, it is recommended that, in addition to the daily incremental batch risk analysis, a monthly full batch risk analysis is also scheduled. This will ensure that all changes made to the front-end are also appropriately reflected on the management reports.

Regards,

Sabita

Edited by: Sabita Das on May 11, 2009 3:32 AM

Edited by: Sabita Das on May 11, 2009 3:33 AM

Re: Batch Risk Analysis sync

Former Member — Mon, 11 May 2009 07:44:27 GMT

Hi,

Thank you.We have already checked those config settings. But the initial sync is running from past 36 Hours.

Regards,

KKRao.

Edited by: KKRao_2020 on May 11, 2009 9:45 AM

Re: Batch Risk Analysis sync

Former Member — Mon, 11 May 2009 07:52:30 GMT

Hi KK,

It depends upon your hardware resources too. It might take so long time in case it is full sync. Wait and watch, if it is not giving error, then it might be working fine.

Regards,

Sabita

Re: Batch Risk Analysis sync

Former Member — Tue, 12 May 2009 10:55:33 GMT

All,

Please check and advice on this issue.

Regards,

KKRao.

Re: Batch Risk Analysis sync

Former Member — Tue, 12 May 2009 11:57:10 GMT

Hi Rao,

Create an Index for the table VIRSA_CC_PRMVL and check the performance. Pls refer to the note 1044174.

Thank You

Regards,

Karthik

Re: Batch Risk Analysis sync

Former Member — Tue, 12 May 2009 12:14:49 GMT

Hi Karthik,

We have created the Index and that Job got completed within 15 mins.

Thank you very much for your help.

Regards,

KKRao.