GRC 10.0 SP14 - Poblems when generating rules for logical systems

[dyaryura]

Hello Experts!

We recently updated a DEV system to SP14 and we're having issues regarding the rule set generation. I'd like to know if you have faced a similar problem after installing SP14. The details are described below:

Create a test function ZTEST_F1

The action PFCG is associated to a Physical System (Test Connector SP14) and to a Logical System (Sistema Logico Retail)

The logical system contains D05 among other connectors:

 

And it’s defined as a logical group:

 

The connector “test connector Sp14” points to the same system as D05.

Now I create another function, let’s say ZTEST_F2

 

Now let’s define a SoD Risk ZTSTSP14

 

Generate rules and after that we check GRACSYSRULE table for such risk and we get:

Let’s add more transactions:

 

Generate rules:

 

Now in the table we get:

 

The logical system has been added to the GRACSYSRULE table for the new combination and also the physical system TST_D05, but there's no combinations for the system D05 for example.

Now if we run SoD analysis:

 

We have four combinations for the physical system TST_D05 but only two for D05 that belongs to the logical system:

Do you have any clue? have you faced a similar problem?

Thanks in advance.

Cheers,

Diego.

[Colleen · Accepted solution]

Hi Diego

I was looking in marketplace for something and stumbled on note below that might apply to your issue?

  1966007 - Incorrect Rule Generation for Logical Groups

Regards

Colleen

[dyaryura · Accepted solution]

Hello Collen,

Many Thanks for point that out. It's weird that the note is from January and SAP didn't include it on SP14 released on February taking into account that it's about rule generation.

By the way, I cannot understand why so many issues with rule generation that its a core functionality.

We are going to install the note and I'll update the thread.

Thank you!

Diego.

[Former Member · Accepted solution]

Colleen,

We are implementing a GRC 10.1 SP4 and we were having great issues with the Risk Analysis working correcly (out of the box).  The SAP Note 1966007 was spot-on in fixing our issue, as we can now successfully perform Risk Analysis.

[Colleen · Accepted solution]

Hi Diego

It may have been identified by SAP but missed the timing it takes for them to bundle their notes to a SP for customer release. Alternatively, it may have been in draft for SAP eyes only and not yet released to customer.

Did you ever check for side-effect notes for SP14 or have a look at what else SP15 bundle contains?

When I search for GRC 10 notes, I've taken to just searching for the module (e.g GRC-SAC-ARA) and sorting on date and then working back. There's almost too many notes now to do this but if you're checking marketplace every few days it's a way to keep across potential issues to your system. The exception is also if issues is related to basis stack.

Hope the note fixed your issue

Regards

Colleen

[dyaryura · Accepted solution]

Hello Collen!

First of all I want to thank you because after aplying the note the rules generated fine and now the Risk Analysis is OK for the example described above:

I've also tested with a huge number of risks and made a comparison between the results of the Physical conector and the Connector that belongs to a logical group and I got the same results as action level as well as Permission Level as expected.

Regarding the note itself, we usually check for notes and we have implemented many notes in advance related to rule generation issues.

The point is that, as my point of view is just not acceptable to get a new SP with this kind of issue. Rule generation is a core functionality and SAP must test such functionalities before releasing a SP and these checks cannot rely on the customer. For me, rule generation issues in GRC are just unnaceptable. I can accept issues with other modules or new functionalities, but with role generation they must guarantee that it works properly and perform the requiered tests before releasing an SP.

Well... bottom line the issue has been resolved and I really appreciate the help you provided!!!!

Many Thanks!!!

Diego.

[Colleen · Accepted solution]

Hi Diego

that's great news that the solution worked

The point is that, as my point of view is just not acceptable to get a new SP with this kind of issue.

There are quite a few regulars on this community who have voiced this same frustration. I noticed last year there were SPs coming out almost monthly for GRC 10 with a few 100+ notes. At least SP coming out a bit less frequent. Hopefully, quality improves

Cheers

Colleen