Api to get error analysis

[RachamallaKiran]

Hi all,

I am giving an api to customer to write thier own code and we execute it. So not to interpret the normal flow we called that in try endtry. Now the customer want him to show the error analysis on dump of thier code. As that is not registered in st22. Is there any api to get the text of the analysis like what happened ? Where dump caused, call stack ,. What came be done etc

[former_member147723]

Hi Kiran,

If you generate the code and that fails, you can show the error message(s) of the generation. If the code fails while executing, you can only return what the code of your customer returns as messages. if there's a dump you can suggest ST22. If some exception occurs you can catch this in your own catch coding, and format something based on that using the information the exception provides. use routines like get_text or get_source_position. These are methods of cx_root so you can look up the proper name and API there.

Hope this helps.

Marcel

[Sandra_Rossi]

Wow! I hope it's not free source code! (nice vulnerability! Your system is ready for attacks!)

(but if it's not free source code, then it would mean the short dump is caused by your own API, so I'm afraid that your system is vulnerable)

[RachamallaKiran]

Hi Hesen,

Thanks for considering. thing is i already done that i mean used cx_root and provided details from get_text and get_source_position. but they want complete details like in case of duplicate dump they are not knowing in through which table dump caused.

Regards,

kiran rachamalla.

[Sandra_Rossi]

Please use the COMMENT button for comments, questions, adding details, etc., ANSWER is only to propose a solution, dixit SAP text at the right of the answer area.

[MateuszAdamus]

I would suggest rethinking the solution. Especially from the security point of view. Surely the logic executed by the 3rd party application cannot be so dynamic, that you're not able to prepare the code in API beforehand (together with error handling).

I would also advise you to create some sort of a log of API calls, if you decide to stick with the current dynamic solution. Just so that you have logs of what has been executed through the API.

[RachamallaKiran]

Hi sandra Rossi,

No its not free source code. thing is i have few programs which i call dynamically and execute. but if there is a dump in those its really hard to find exactly where the error is. so they are asking for something like st22 error analysis.

[MateuszAdamus]

Hi kiran.rachamalla

If I understand it correctly, you're creating an API for some 3rd application. In these cases it's normal to have some return parameter in the function(s) which will return information about the result of the executed action. This could be a simple integer field or, to be more precise in error reporting, some more complex structure or set of fields.

Now, as I see it, your API should not return SAP errors directly. It should first try to handle these errors and "fix" them, whenever possible. It should also try to avoid any errors beforehand, if that's possible.

In case error is not avoidable and not fixable you should return information to the 3rd party application, but also process it before returning - make it standardized, maybe add some descriptive text to the error message (some SAP errors are not clear at all). Make it in a way, that 3rd party application knows what has happened and why. However, do not return the SAP error directly without processing it first.

regards,
Mateusz

Edit: also, as I just noticed what you're doing with the API - allowing 3rd party to execute ABAP code in your system, I would strongly advise against that kind of solution. Not mentioning the obvious worst case scenario, where 3rd party application can simply delete data from SAP, the other issues could be: incorrect records in DB if inserted directly, performance issues related to not optimized code, lack of possibility to buffer or streamline the logic.
API should allow for certain operations within the system, but the operations should be clearly defined and programmed inside of the API itself. Not dynamically defined by the 3rd party software.

[Sandra_Rossi]

I don't understand how people who don't have access to the SAP system could understand the short dump better than the SAP people.

Note that they don't just receive nothing when there's a short dump, they should be able to receive at least the name of the runtime error (like SYNTAX_ERROR, CONVT_NO_NUMBER, etc.) + very short description