Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Troubleshooting

Troubleshoot the Microsoft Sentinel solution for SAP applications agentless data connector

4 September 2026Doc update+50 / −302 lines

In brief

The page was retitled and revised from the data connector agent to the agentless data connector. It updates related links and guidance, adds connection-reset troubleshooting, and removes agent-specific deployment procedures and connection pivots.

What Defender admins need to know

Administrators troubleshooting SAP data ingestion should follow the updated agentless deployment links and troubleshooting guidance.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This article includes troubleshooting steps to help you ensure accurate and timely data ingestion and monitoring for your SAP environment with Microsoft Sentinel.

:::zone pivot="connection-agentless"

When working with the agentless data connector, most troubleshooting is done directly in the SAP Integration Suite, where the message log displays errors indicating the nature of the issue encountered.

[!INCLUDE data-connector-agent-deprecation]

Start by examining the message processing logs. For more information, see the SAP documentation. The error messages there can help you diagnose issues with missing permissions, connectivity errors, and other misconfigurations.

When you set up the Microsoft Sentinel for SAP - agentless data connector, under the Initial connector configuration > Step 1: Trigger automatic deployment of required Azure resources / SOC Engineer, after you select Deploy required resources, you might see the "Deploy required Azure resources" error or similar (errors may vary). This error might indicate that you're missing the required permissions for the Entra ID app registration.

If you don't have the Entra ID Application Developer role or higher, you need to work with a colleague that has this permission to finish setting up the Azure resources. For more information, follow the procedure in the data connector agent connectionagentless data connector connection step.

Missing "Last address routed"

If you see sudden spikes in message volumes and processing times on SAP Cloud Integration, consider filtering responsible sources on the NetWeaver side. There are two options available.

  1. Use transaction SM19 and SAP's best practices to apply filter settings on Users and message classes causing the spike
  2. Use the filter capabilitiesfilter capabilities of the Sentinel package on SAP Cloud Integration to apply filtering on log read. The parameter max-rows are pre-populated to protect the integration flow from message flooding by design.

Note that log filters on NetWeaver impact what is written to the audit log on the source while a filter on SAP Cloud Integration only chooses not to read the problematic entries.

Timeouts during connector registration or log polling

The Microsoft Sentinel agentless poller enforces two timeouts when calling the SAP Cloud Integration Data Collector iflow. Exceeding either limit causes incomplete ingestion or repeated retries. Error messages on SAP Cloud Integration may vary based on which part of the data extraction pipeline fails first.

Initial connect (45-second limit) – partial data and failed connector registration

To remediate:

  1. Run the Prerequisite checker iflow and review its runtime measurements to identify the slow downstream call (RFC destination, audit log read, user master read).
  2. Tune the SAP integration downstream of SAP Cloud Integration to bring the response time below 45 seconds. Common levers include audit log filter settings (SM19/RSAU best practices), data connector parameter overrides such as max-rows and offset-in-seconds (see Customize data connector behaviorCustomize data connector behavior), and SAP Cloud Connector / RFC sizing.
  3. If the response time still can't be reduced, switch to the SAP CPI–internal scheduler approach by deploying the Data Collector Scheduler iflow from the Microsoft Sentinel for SAP community repository. With the scheduler iflow, Microsoft Sentinel doesn't poll or register the connector; it only receives data pushed by SAP Cloud Integration. This approach trades real-time threat protection for higher tolerance to long-running SAP responses.

For an end-to-end discussion of the tradeoffs, see the blog post Run agentless SAP connector cost-efficiently.

  1. Delete the connector from Microsoft Sentinel and wait for the scheduled Sentinel requests to calm down. This breaks the retry snowball.
  2. Run the Prerequisite checker iflow to identify the root cause of the slow audit log read response times on SAP (for example, missing indexes, oversized audit log, expensive user master reads on legacy releases).
  3. Apply the relevant remediation — audit log filter tuning (SM19/RSAU best practices) and, Data Collector parameter overrides such as max-rows and, offset-in-seconds, and force-sal-filesystem (see Customize data connector behaviorCustomize data connector behavior) — before reconnecting the data connector in Microsoft Sentinel.
  4. If response times still can't be reduced below the 180-second limit, deploy the Data Collector Scheduler iflow from the Microsoft Sentinel for SAP community repository. Switching to the SAP CPI–internal scheduler compromises real-time threat protection but avoids the retry pattern enforced by the Microsoft Sentinel poller.

Connection reset error

:::zone-endIf the Data Collector iFlow fails with an error such as java.lang.Exception: Connection reset, the connection to the SAP backend was unexpectedly closed before processing completed. This is typically caused by network interruptions in the log extraction chain between SAP Cloud Integration <-> SAP Cloud Connector <-> SAP backend, connectivity issues, timeouts, or SAP backend issues.

:::zone pivot=Resolution:

  • The Sentinel log poller handles small interruptions gracefully through limited retries - no action needed. Longer down times result in abandoned time slices in favor of stable operations.
  • Confirm sizing for the SAP Cloud Connector master instance: Sizing for master instance.
  • Be aware of SAP Cloud Connector connection limits. Use SAP note 3403815 to tune limits.
  • Use SAP's application health monitors to verify connectivity between SAP Cloud Integration, SAP Cloud Connector, and the SAP system in case investigation is needed.
  • Enable runtime monitoring: Cloud Connector monitoring.
  • Isolate the problematic SID log data flow and consult the other timeout related guidance in this section.

"connection-agentMemory Exhaustions" reported by SAP Cloud Integration

The System > Memory > Usage tile in SAP Cloud Integration may report memory exhaustions with the Data collector iflow as major contributor across several intervals. A considerable based-load allocation on its own is expected for a log-reading integration flow for multiple SIDs and isn't an error by default. Investigate when memory exhaustions are counted alongside it, when message processing times increase, a new system onboarding attempt, or recent SAP upgrade is happening.

Selected troubleshooting proceduresTwo patterns typically cause this:

  • Growing request backlog for a single SAP system (SID). The SAP system responds more slowly than the requested log time slice, so requests accumulate and each subsequent poll adds load on top of the unfinished one. This is commonly a downstream effect of the retry pattern described in the Timeouts during connector registration or log polling section or too large polling interval configurations. It is recommended to keep the 1 min default setting for heavily used SAP systems.
  • Resource saturation on a shared tenant. High parallel loads from other integration flows or SAP systems on the same SAP Cloud Integration tenant reduce the resources available to the Data Collector iflow, extending processing times across all flows.

To recover, first apply the remediation in the timeouts section to break the retry pattern and reduce the volume returned per message. If memory exhaustions continue, use SAP Cloud Integration monitoring to determine whether the pressure originates from one SAP system or from overall tenant load. Sustained saturation may require additional SAP Cloud Integration capacity, or distributing SAP systems across multiple Cloud Integration instances.

Timeouts when SAP security audit logs are only relevant when your data connector agent is deployed via the command line. If you used the recommended procedure to deploy the agent from the portal, use the portal to make any configuration changes.

Useful Docker commandsfilesystem-backed

When troubleshooting yourIf Microsoft Sentinel integration requests time out during connector onboarding or ongoing log reads, review how your SAP Security Audit Log is recorded and retrieved, especially when recording is configured as Filesystem and database.

Selecting audit logs from SAP HANA database often provides the best performance. Other databases and filesystem-backed selection might require tuning.

To remediate:

  1. Confirm with your SAP administrator whether Security Audit Log recording targets include filesystem storage.
  2. Implement following SAP notes by using SNOTE or by importing the referenced support package (applies to SAP_BASIS 750+):
    • 3726943 - RSAU_API_GET_LOG_DATA | Dataselection only from Filesystem details
    • 3407647 - RSAU_READ_LOG | Optimization of reading audit log files
  3. After implementing the correction, use filesystem-only selection with required parameters ID_FILESYSTEM_SEL_ONLY and ID_FILE_SEL_SIMPLEfor faster retrieval. For behavior details and explanation, see SAP data connector, you might findnote 3500090.
  4. Re-run connector validation.

Applying these SAP notes often improves retrieval performance significantly. If delays continue, they're typically related to SAP-side factors such as log shipping between application servers and network latency.

SAP Cloud Connector sizing, throughput, and isolation guidance

If timeout or throughput issues persist, validate SAP Cloud Connector sizing and runtime health by using Optimize SAP Cloud Connector sizing, throughput, and isolation.

Use the following commands useful:symptom-to-SAP-note mapping for incident triage:

FunctionSymptom CommandReference
Stop the Docker containerCPI logs IOError on tunnel socket during connect attempt; ingestion stalls under parallel load docker stop sapcon-[SID]SAP note 3403815
Start the Docker containerSAP Cloud Connector sessions appear stale or unresponsive docker start sapcon-[SID]SAP note 2485510
View Docker system logsRepeated shared-connector saturation from other integrations docker logs -f sapcon-[SID]
Enter the Docker containerdocker exec -it sapcon-[SID] bashIsolate Microsoft Sentinel traffic on a dedicated SAP Cloud Connector instance

For more information, see the Docker CLI documentation.

Review system logsInvalid Credential or cannot get credential for example OAuth2 access token

We highly recommend that you review the system logs after installing or resetting the data connector.

Run:

docker logs -f sapcon-[SID]

Enable/disable debug mode printing

This procedure is only supported if you've deployed the data connector agent from the command line.

  1. On your data collector agent container virtual machine, edit the /opt/sapcon/[SID]/systemconfig.json file.

  2. Define the General section if it wasn't previously defined. In this section, define logging_debug = True to enable debug mode printing, or logging_debug = False to disable it.

    For example:

    [General]
logging_debug = True

  3. Save the file.

The change takes effect approximately two minutes after you save the file. You don't need to restart the Docker container.

View all container execution logs

Connector execution logs for your Microsoft Sentinel solution for SAP applications data connector deployment are stored on your VM in /opt/sapcon/[SID]/log/. Log filename is OmniLog.log. A historyBesides normal misconfigurations of logfiles is kept, suffixed with .[number] such as OmniLog.log.1, OmniLog.log.2, and so on.

Review and update the Microsoft Sentinel for SAP agent connector configuration file

This procedure is only supported if you've deployed the data connector agent from the command line. If you deployed your agent via the portal, continue to maintain and change configuration settings via the portal.

If you deployed via the command line, perform the following steps:

  1. On your VM, open the configuration file: sapcon/[SID]/systemconfig.json

  2. Update the configuration if needed, and save the file. For more information, see the Microsoft Sentinel solution for SAP applications systemconfig.json file reference.

The change takes effect approximately two minutes after you save the file. You don't need to restart the Docker container.

Reset the Microsoft Sentinel for SAP data connector

The following steps reset the connector and reingest SAP logs from the last 30 minutes.

  1. Stop the connector. Run:

    docker stop sapcon-[SID]

  2. Delete the metadata.db file from the /opt/sapcon/[SID] directory. Run:

    cd /opt/sapcon/<SID>
rm metadata.db

  1. Start the connector again. Run: 

    docker start sapcon-[SID]

Make sure to Review system logs when you're done.

Common issues

After having deployed both the Microsoft Sentinel for SAP data connector and security content, you might experience the following errors or issues:

Corrupt or missing SAP SDK file

This error might occur when the connector fails to boot with PyRfc, or zip-related error messages are shown.

  1. Reinstallcredentials during registration of the SAP SDK.
  2. Verify that you're the correct Linux 64-bit version, such as nwrfc750P_8-70002752.zip.

If you'd installedRFC destination on the data connector manually, make sure that you'd copied the SDK file into the Docker container.

Run:

docker cp nwrfc750P_8-70002752.zip /sapcon-app/inst/

ABAP runtime errors appearpane on Microsoft Sentinel, this could be a large system

This procedure is only supported if you've deployed the data connector agent from the command line.

If ABAP runtime errors appear on large systems, try setting a smaller chunk size:

  1. Edit the /opt/sapcon/[SID]/systemconfig.json file andsymptom of attempting integration with unsupported SAP Cloud Platform Integration in the Connector Configuration section define timechunk = 5NEO environment. See SAP note 3351844 for details the end-of-life of services in the NEO environment. Microsoft Sentinel Solution for SAP officially supports SAP Cloud Integration in the Cloud Foundry environment. See the reference on the SAP preparation guide.

    For example:

    [Connector Configuration]
timechunk = 5

  2. Save the file.

The change takes effect approximately two minutes after you save the file. You don't needCustomers that want to restart the Docker container.

Empty or no audit log retrieved, with no special error messages

  1. Check that audit logging is enabled in SAP.
  2. Verify the SM19 or RSAU_CONFIG transactions.
  3. Enable any events as needed.
  4. Verify whether messages arrive and exist in the SAP SM20 or RSAU_READ_LOG, without any special errors appearing on the connector log.

Incorrect workspace ID or key in key vault

If you realize that you entered an incorrect workspace ID or key in your deployment script, update the credentials stored in Azure Key Vault.

After verifying your credentials in Azure KeyVault, restart the container: 

docker restart sapcon-[SID]

Incorrect SAP ABAP user credentials in key vault

Check your credentials and fix them as needed, applying the correct values to the ABAPUSER and ABAPPASS values in Azure Key Vault.

Then, restart the container: 

docker restart sapcon-[SID]

Incorrect SAP ABAP user credentials in a fixed configuration

This section is only supported if you've deployed the data connector agent from the command line.

A fixed configuration is when the password is stored directlyprotect their SAP landscape using Cloud Platform Integration in the systemconfig.json configuration file.NEO environment ahead of their migration to SAP Cloud Integration on the Cloud Foundry environment (Integration Suite), can do so by adopting the provided "Data Collector Scheduler" iflow.

If your credentials there are incorrect, verify your credentials.

Use base64 encryptionIt uses a simplified scheduler. The SAP threat protection scope remains the same. The Sentinel hosted Scheduler is dropped from the setup to encryptavoid the user and password. You can use online encryption tools to do encrypt your credentials, such as https://www.base64encode.org/.

Missing ABAP (SAP user) permissions

If you get anmentioned handshake error message similar to: ..Missing Backend RFC Authorization.., your SAP authorizations and role weren't applied properly.

  1. Ensure thatwith the MSFTSEN/SENTINEL_CONNECTOR role was imported as partdownside of a change request transport, and applied to the connector user.

  2. RunSentinel team having no insight on the role generation and user comparison process usinghealthiness of the Cloud Integration endpoints other than the SAP transaction PFCG.

Missinglog data in your workbooks or alerts

If you find that you're missing data in your Microsoft Sentinel workbooks or alerts, ensure thatarrival. Often this is no concern, since the Auditlog policy is properly enabled onscope of monitoring resides with the SAP side, with no errorsCloud Platform Integration team anyways.

CL_SAL_HELPER=>TT_R_CLIENT type not found

This error can occur for various reasons in a variety of SAP Support Package levels that require import of SAP notes to fix the container log file.

Use the RSAU_CONFIG_LOG transaction for this step.

For more information, see the SAP documentation and Collect SAP HANA audit logs in Microsoft Sentinel.

We recommend that you configure auditing for all messages from the audit log, instead of only specific logs. Ingestion cost differences are generally minimal and the data is useful for Microsoft Sentinel detections and in post-compromise investigations and hunting. For more information, see Configure SAP auditing.

Missing IP address or transaction code fieldsunderlying bugs in the SAP audit log

In SAP systems with versions for SAP BASIS 7.5 SP12 and above, Microsoft Sentinel can reflect extra fields instandard code. Ensure the ABAPAuditLog_CL and SAPAuditLog tables.

If you're using SAP BASIS versions higher than 7.5 SP12 and are missing IP address or transaction code fields in the SAP audit log, verify that the SAP system from which you're extracting the data contains the relevant change requests (transports). For more information, see Configure support for extra data retrieval (recommended).

Missing SAP change request

If you see errors that you're missingfunction module RSAU_API_GET_LOG_DATA is remote enabled, trigger a required SAP change request, make sure you've imported the correct SAP change request for your system. For more information, see SAP prerequisites and Configure your SAP system for the Microsoft Sentinel solution.

No data is showing in the SAP table data log

In SAP systems with versions for SAP BASIS 7.5 SP12 and above, Microsoft Sentinel can reflect table data log changes in the ABAPTableDataLog_CL table.

If no data is showing in the ABAPTableDataLog_CL table, verify that the SAP system from which you're extracting the data contains the relevant change requests (transports). For more information, see Configure support for extra data retrieval (recommended).

No records / late records

The data collector agent relies on time zone information to be correct. If you see that there are no records in the SAP audit and change logs, or if records are constantly a few hours behind, check whether the SAP TZCUSTHELP report presents any errors. For more information, see SAP note 481835.

There might also be issues with the clock on the virtual machine where the data collector agent container is hosted, and any deviation from the clock on the VM from UTC impacts data collection. Even more importantly, the clocks on both the SAP system machines and the data collector agent machines must match.

We recommend that you configure auditing for all messages from the audit log, instead of only specific logs. Ingestion cost differences are generally minimal and the data is useful for Microsoft Sentinel detections and in post-compromise investigations and hunting. For more information, see Configure SAP auditing.

Network connectivity issues

If you're having network connectivity issues to the SAP environment or to Microsoft Sentinel, check your network connectivity to make sure data is flowing as expected.

Common issues include:

  • Firewalls between the docker container and the SAP hosts might be blocking traffic. The SAP host receives communication via the following TCP ports, which must be open: 32xx, 5xx13manual run from the SAP transaction code SE37, and 33xxinspect the output, where xx. The response must show at least one entry in ET_LOG export parameters table.

    The connector prerequisites section lists typical SAP support notes that helped customers in such situations before. The list is thenot considered complete and only serves as entry point into a customer's individual path to fix SAP instance number.'s standard functions, which may vary based on their current support package level and associated upgrade journey.

  • Outbound communication from your SAP agent host to Microsoft Container Registry or Azure requires proxy configuration. This typically impacts the installation and requires you to configure the HTTP_PROXY and HTTPS_PROXY environmental variables. You can also ingest environment variables into the docker container when you create the container, by adding the -e flag to the docker create / run command.

Retrieving an audit log fails with warnings

This section is only supported if you've deployed the data connector agent from the command line.

If you attempt to retrieve an audit log without the required configurations and the process fails with warnings, verify that the SAP Auditlog can be retrieved using one of the following methods:

Related content

While your system should automatically switch to compatibility mode if needed, you might need to switch it manually. To switch to compatibility mode manually:

  1. Edit the /opt/sapcon/[SID]/systemconfig.json file.

  2. In the Connector Configuration section defineefine: auditlogforcexal = True

    For example:

    [Connector Configuration]
auditlogforcexal = True

  3. Save the file.

The change takes effect approximately two minutes after you save the file. You don't need to restart the Docker container.

SAPCONTROL or JAVA subsystems unable to connect

Check that the OS user is valid and can run the following command on the target SAP system:

sapcontrol -nr <SID> -function GetSystemInstanceList

SAPCONTROL or JAVA subsystem fails with timezone-related error message

If your SAPCONTROL or JAVA subsystem fails with a timezone-related error message, such as: Please check the configuration and network access to the SAP server - 'Etc/NZST', make sure that you're using standard timezone codes.

For example, use javatz = GMT+12 or abaptz = GMT-3**.

Audit log data not ingested past initial load

If the SAP audit log data, visible in either the RSAU_READ_LOAD or SM200 transactions, isn't ingested into Microsoft Sentinel past the initial load, you might have a misconfiguration of the SAP system and the SAP host operating system.

  • Initial loads are ingested after a fresh installation of the Microsoft Sentinel for SAP data connector, or after the metadata.db file is deleted.
  • A sample misconfiguration might be when your SAP system timezone is set to CET in the STZAC transaction, but the SAP host operating system time zone is set to UTC.

To check for misconfigurations, run the RSDBTIME report in transaction SE38. If you find a mismatch between the SAP system and the SAP host operating system:

  1. Stop the Docker container. Run

    docker stop sapcon-[SID]

  2. Delete the metadata.db file from the /opt/sapcon/[SID] directory. Run:

    rm /opt/sapcon/[SID]/metadata.db

  3. Update the SAP system and the SAP host operating system so that they have matching settings, such as the same time zone. For more information, see the SAP Community Wiki.

  4. Start the container again. Run:

    docker start sapcon-[SID]

Other unexpected issues

If you have unexpected issues not listed in this article, try the following steps:

:::zone-end

Related content

Reference files:

For more information, see Microsoft Sentinel solutions.