Microsoft Sentinel
TroubleshootingSap Deploy Troubleshoot
In brief
The troubleshooting guidance covers manually calling the Data Collector iFlow with the affected startTimeUTC and endTimeUTC values. This recovery is separate from automatic retries and requires the source logs to remain available.
What Defender admins need to know
Administrators can use this guidance to selectively recover previously failed windows; no configuration change is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Review the SAP Cloud Integration message processing logs. Identify the affected SAP system (SID), the failed UTC collection window, and the reported error.
- Resolve the underlying connectivity, permissions, or resource issue with your SAP Basis team. For connection interruptions, see Connection reset or Connection broken on handle errors. For requests that repeatedly exceed the polling timeout, follow the timeout guidance.
- Allow automatic retries to recover the failed window, and verify that the expected records for that SID and original event-time interval arrive in the relevant SAP log table. Don't check only the most recent records. See Monitor the health and role of your SAP systems for connectivity and ingestion checks.
- If you need to selectively recover previously failed windows, call the Data Collector iFlow from a REST client or script, specifying the affected
startTimeUTCandendTimeUTCvalues. This manual recovery is separate from the automatic retry policy and requires the source logs to remain available in SAP. Forsupporting utilities and troubleshooting references,an optional sample PowerShell REST client, see theSAP tools folder on GitHubSAP time-slice backfill tool on GitHub. Test it in a nonproduction environment first, and follow its sizing and load-protection guidance to avoid overloading SAP components or disrupting live collection. Reload only confirmed missing windows: overlapping previously ingested windows creates duplicate records.
Timeouts during connector registration or log polling
@@ -160,7 +160,7 @@ To check recovery and address persistent failures: 1. Review the [SAP Cloud Integration message processing logs](https://help.sap.com/docs/cloud-integration/sap-cloud-integration/monitor-message-processing-monitor). Identify the affected SAP system (SID), the failed UTC collection window, and the reported error.
2. Resolve the underlying connectivity, permissions, or resource issue with your SAP Basis team. For connection interruptions, see Connection reset or Connection broken on handle errors. For requests that repeatedly exceed the polling timeout, follow the timeout guidance.
3. Allow automatic retries to recover the failed window, and verify that the expected records for that SID and original event-time interval arrive in the relevant SAP log table. Don't check only the most recent records. See [Monitor the health and role of your SAP systems](../monitor-sap-system-health) for connectivity and ingestion checks.
-4. If you need to selectively recover previously failed windows, call the **Data Collector** iFlow from a REST client or script, specifying the affected `startTimeUTC` and `endTimeUTC` values. This manual recovery is separate from the automatic retry policy and requires the source logs to remain available in SAP. For supporting utilities and troubleshooting references, see the [SAP tools folder on GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SAP/Tools).
+4. If you need to selectively recover previously failed windows, call the **Data Collector** iFlow from a REST client or script, specifying the affected `startTimeUTC` and `endTimeUTC` values. This manual recovery is separate from the automatic retry policy and requires the source logs to remain available in SAP. For an optional sample PowerShell REST client, see the [SAP time-slice backfill tool on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/SAP/Tools/TimeSliceBackfill/README.md). Test it in a nonproduction environment first, and follow its sizing and load-protection guidance to avoid overloading SAP components or disrupting live collection. Reload only confirmed missing windows: overlapping previously ingested windows creates duplicate records.
## Timeouts during connector registration or log polling