topic Re: disable abap debugging from productive system in Application Development and Automation Discussions

disable abap debugging from productive system

nicola_blasi — Thu, 02 Apr 2009 09:15:42 GMT

Good morning

I hope is the right forum

I'd like to know if there is a manner to deactivate the ABAP debugging in a system...(a productive system 46c).

I have found a parameter rdisp/wpdbug_max_no that is set = 1; anyway i've noted that i can open more than 1 debug sessions in this system .

Any help is appreciated

Thanks

Nicola

Re: disable abap debugging from productive system

Former Member — Thu, 02 Apr 2009 10:21:53 GMT

Hi:

It can be done by modifing the roles of user.

Like under profile of developer, there ia an object which allows the user to debug the program so by removing it , you can restrict the user.

Regards

Shashi

Re: disable abap debugging from productive system

ThomasZloch — Thu, 02 Apr 2009 10:51:31 GMT

The respective authorization object is S_DEVELOP with field OBJTYPE = "DEBUG". If you remove that from all roles (except super users), you essentially have disabled debugging in the system.

Thomas

Re: disable abap debugging from productive system

matt — Thu, 02 Apr 2009 12:05:08 GMT

Do bear in mind that there will be times when debugging will be absolutely required in your productive system, and build that into whatever procedures you implement.

matt

Re: disable abap debugging from productive system

nicola_blasi — Thu, 02 Apr 2009 12:56:18 GMT

Hello

Ok I solved the problem..thank you very much.

I've applied this change only for custom roles that permitted the debug in productive system.

Now if some developer wants to debug a trx or other, they have to pass through Firefighter (SAP GRC) where there is a FFID with a role with the object type available for debug.

Thanks

Nicola

Re: disable abap debugging from productive system

Former Member — Thu, 02 Apr 2009 13:08:55 GMT

Also bear in mind that although you do want to allow debugging in some circumstances, in the production system, you do not want to allow changes to variables during debugging.

Rob

Re: disable abap debugging from productive system

ThomasZloch — Thu, 02 Apr 2009 13:21:54 GMT

Darn right, so you better grant ACTVT = "03" only to FFID.

Thomas

Re: disable abap debugging from productive system

matt — Fri, 03 Apr 2009 11:32:31 GMT


> Also bear in mind that although you do want to allow debugging in some circumstances, in the production system, you do not want to allow changes to variables during debugging.
> 
> Rob

Occasionally there's even a requirement for that!

matt

Re: disable abap debugging from productive system

Former Member — Fri, 03 Apr 2009 13:30:55 GMT


> Occasionally there's even a requirement for that!

Maybe, but better not let the auditors find out.

Rob

Re: disable abap debugging from productive system

Former Member — Sat, 04 Apr 2009 20:01:06 GMT

An auditor would find it in the syslog if available... and a good one should look for it and read the log.

Message type "A14" and "A19" and for the "go to" feature there is another one + a list of others which only auditors are allowed to know...

What you can also do, is tweak the instance parameters of your production system to protect the external debugging at the dispatcher level, as generally the calling user needs the authority.

See these params in RZ11 (the factory defaults are for a development system...)

rfc/ext_debugging

rfc/disable_debugger_command_field

abap/ext_debugging_possible

Some of them are dynamic, so when Matt's program is dumping you can let him in temporarily to take a look without having to restart the instance...

Cheers,

Julius

Re: disable abap debugging from productive system

Former Member — Wed, 25 Feb 2015 15:35:14 GMT

I am pretty new to SAP.

I don't think debug should be allowed in production at all. Debug can be allowed in non-production. Remove the debug authorization from roles can basically achieve no one can debug, but I would prefer to disable to debug options.