disable abap debugging from productive system

[nicola_blasi]

Good morning

I hope is the right forum

I'd like to know if there is a manner to deactivate the ABAP debugging in a system...(a productive system 46c).

I have found a parameter rdisp/wpdbug_max_no that is set = 1; anyway i've noted that i can open more than 1 debug sessions in this system .

Any help is appreciated

Thanks

Nicola

[nicola_blasi]

Good morning

I hope is the right forum

I'd like to know if there is a manner to deactivate the ABAP debugging in a system...(a productive system 46c).

I have found a parameter rdisp/wpdbug_max_no that is set = 1; anyway i've noted that i can open more than 1 debug sessions in this system .

Any help is appreciated

Thanks

Nicola

[Former Member]

Hi:

It can be done by modifing the roles of user.

Like under profile of developer, there ia an object which allows the user to debug the program so by removing it , you can restrict the user.

Regards

Shashi

[ThomasZloch]

The respective authorization object is S_DEVELOP with field OBJTYPE = "DEBUG". If you remove that from all roles (except super users), you essentially have disabled debugging in the system.

Thomas

[matt]

Do bear in mind that there will be times when debugging will be absolutely required in your productive system, and build that into whatever procedures you implement.

matt

[Former Member]

Also bear in mind that although you do want to allow debugging in some circumstances, in the production system, you do not want to allow changes to variables during debugging.

Rob

[ThomasZloch]

Darn right, so you better grant ACTVT = "03" only to FFID.

Thomas

[matt]

>

> Also bear in mind that although you do want to allow debugging in some circumstances, in the production system, you do not want to allow changes to variables during debugging.
> 
> Rob

Occasionally there's even a requirement for that!

matt

[Former Member]

>

> Occasionally there's even a requirement for that!  

Maybe, but better not let the auditors find out.

Rob

[Former Member]

An auditor would find it in the syslog if available... and a good one should look for it and read the log.

Message type "A14" and "A19" and for the "go to" feature there is another one + a list of others which only auditors are allowed to know...

What you can also do, is tweak the instance parameters of your production system to protect the external debugging at the dispatcher level, as generally the calling user needs the authority.

See these params in RZ11 (the factory defaults are for a development system...)

rfc/ext_debugging

rfc/disable_debugger_command_field

abap/ext_debugging_possible

Some of them are dynamic, so when Matt's program is dumping you can let him in temporarily to take a look without having to restart the instance...

Cheers,

Julius

[Former Member]

I am pretty new to SAP.

I don't think debug should be allowed in production at all. Debug can be allowed in non-production. Remove the debug authorization from roles can basically achieve no one can debug, but I would prefer to disable to debug options.

[nicola_blasi]

Hello

Ok I solved the problem..thank you very much.

I've applied this change only for custom roles that permitted the debug in productive system.

Now if some developer wants to debug a trx or other, they have to pass through Firefighter (SAP GRC) where there is a FFID with a role with the object type available for debug.

Thanks

Nicola