SAP System logs
System logs record what happens inside an SAP system, errors, warnings and significant events, and are a primary tool for diagnosing problems. The main one is the system log (SM21), complemented by developer traces and other logs.
SM21 is the SAP system log: time-stamped entries per instance for failed logons, database problems, work-process errors and configuration issues. Around it sit ST22 for dumps, SM13 for failed updates, SM37 for job logs and the developer traces in ST11. Diagnose by correlating them at the moment a user reports, and set retention long enough to investigate.
- Watch out: Ignoring SM21 when diagnosing incidents.
The SAP system log (SM21)
SM21 shows the system log: time-stamped entries for events like failed logons, database problems, work-process errors and configuration issues, per instance. When something goes wrong, SM21 is one of the first places to look for what the system itself recorded around that time.
Other important logs
- Developer traces (ST11 / dev_* files): low-level work-process traces for deep issues.
- ST22 dumps: ABAP runtime errors with full context.
- Update log (SM13): failed asynchronous updates.
- Job logs (SM37): per-job output and errors.
Using logs to diagnose
Effective troubleshooting correlates logs by time: an error a user reports at 10:05 is investigated by looking at SM21, ST22 and relevant job/update logs around that moment. The logs together usually pinpoint the cause.
Housekeeping and retention
Logs need appropriate retention, enough to investigate incidents, not so much they consume space, and some (like security-relevant events) may have compliance retention requirements.
Common pitfalls
- Ignoring SM21 when diagnosing incidents.
- Not correlating logs by time.
- Poor log retention, evidence gone when needed.