Most problems fall into one of two shapes: a file that was not recognized, or an analysis that ran successfully and found nothing. The second is more dangerous, because it looks like good news.
An analysis returned no risks
Work through these in order. The first two account for the large majority of cases.
1. The ruleset System value does not match the data source name. Each ruleset row names the system where its function is expected to be exercised, and matching is exact and case-sensitive. If your data source is named PRD and the ruleset says PRDCLNT100, nothing fires. Open the ruleset, compare its System column against your data source name, and align one to the other.
2. A mandatory criterion was left unselected. Risk types, risk levels, and business processes are filters, and an unselected filter excludes everything rather than including everything. There is no "empty means all" behaviour anywhere in the analysis criteria.
3. The ruleset does not match the system. A ruleset written for S/4HANA finds little in an ECC system, and an on-premise ruleset finds nothing at all against an S/4HANA Public Cloud source, which uses IAM apps rather than transactions and authorization objects.
4. An action is defined without S_TCODE. In a ruleset, Action is a permission group, not a transaction code. If a rule was meant to require a transaction, the S_TCODE object has to be listed explicitly. Without it the rule checks only the other objects, which usually makes it too narrow to match.
5. Excel reformatted your values. A ruleset built in a workbook is prone to this: Excel turns 01 into 1, and a value that looks like a date gets converted. ACTVT of 1 does not match an authorization holding 01. Open the worksheet and confirm the value columns read as you intended. Formatting them as Text prevents it recurring.
6. Tables loaded with fewer rows than expected. Check the data source Info tab. See below.
A file was not detected
Files are matched on their header row, not their filename. A file is read as a given table when every required column for that table is present.
| Symptom | Cause |
|---|---|
| Error reading {file}: does not contain AGR_XXXX data | The header row does not carry the required columns for that table |
| File {file} does not match content heuristic | No table's required headers were found under any supported delimiter |
| {file} is not a valid ruleset file, missing headers: … | A ruleset is missing one or more of the ten required columns. The message names them |
| worksheet '{name}' not found | The Worksheet name typed on import does not match a sheet in the workbook. It is exact, including spaces |
| not a valid xlsx: … | The file is not a real .xlsx. Legacy .xls and .ods are not supported; re-save as .xlsx |
| Provided file is not a valid ruleset file, expected format is .csv | A file imported as CSV could not be parsed at all, usually a non-UTF-8 encoding or a workbook imported with the CSV option selected |
| Missing mandatory file '{table}' for SAP Public Cloud datasource | All six Public Cloud exports are required |
| Nothing appears at all | The file is not UTF-8, so the header row could not be read |
Checks, in order:
- Encoding must be UTF-8. An export saved as ANSI or UTF-16 fails before any header is examined. Re-save as UTF-8
- Headers must use exact technical names.
AGR_NAMEworks,Role Namedoes not. Renaming columns in Excel is a common way to break an otherwise good export - Delimiter is detected from comma, semicolon, tab, or pipe. If none of the four produce a valid header row, the file is skipped
- Two-column files must be exactly two columns. The canonical mapping and both exclusion tables are rejected if a third column is present
- Exclusion, canonical mapping and HR files are read but produce Cannot open … if the path is unreadable
Row counts look wrong
The data source Info tab reports four numbers per table. Read them before trusting any result.
| Observation | Likely cause |
|---|---|
| Unparsable is non-zero | A delimiter appears inside an unquoted field, usually a comma or semicolon in a description. Re-export with tab as the delimiter |
| Effective far below total, nothing unparsable | Rows fall outside the analysis window, typically expired assignments. Usually legitimate |
| Total far below the source system | A truncated export, or a row limit left set on the download |
| Duplicate mapping for user … | The canonical mapping file maps one account to two different canonical names. One row must go |
Any non-zero unparsable count matters: those rows are absent from the analysis, so a conflict they would have created is not reported.
Users or roles are missing
| Missing | Table to check |
|---|---|
| All users | AGR_USERS for assignments, USR02 for master records |
| Roles | AGR_DEFINE |
| Authorizations inside roles | AGR_1251 |
| Composite structure | AGR_AGRS |
| Organizational values | AGR_1252 |
| Access granted by directly assigned profiles | UST04, UST10S, UST12, AGR_1016, all four |
| IAM-granted access | The IAM data source, plus IAM analysis enabled in the criteria |
The profile tables are the quiet one. In systems where authorizations reach users through directly assigned profiles rather than roles, omitting those four leaves that access invisible and a genuine conflict unreported.
Cross-system conflicts are not reported
- Cross system must be enabled in the analysis criteria, and all the systems selected
- A
USER_CANONICAL_MAPPINGfile must be present on each data source, with exactly two columns - The ruleset must have functions naming different systems, with values matching the data source names
- Simulated new users need a canonical name, or they are treated as separate people per system
Confirm the mapping table appears with a row count on each data source. A mapping file that was silently not recognized produces a clean-looking analysis that reports nothing cross-system. See Cross-System Analysis.
Changelog detail is unavailable
"Transaction changelog file is being indexed, details cannot be shown yet."
CDPOS is indexed in the background after the data source loads, and field-level detail is unavailable until that finishes. On a 50 GB file this takes a while. Header-level data is available meanwhile. Replacing the CDPOS export triggers a rebuild, because the index is validated against the file's path and modification time. See Did-Do Analysis.
SAP connection errors
| Error | Check |
|---|---|
| Cannot connect to sap instance due to: … | Host, system number, client, and credentials |
| Cannot locate sap rfc native library / Unable to open the rfc lib | The SAP NetWeaver RFC SDK is not installed or not on the library path. This is a prerequisite MTC Skopos cannot ship |
| Timeout | Network path to the application server, and whether the system is under load |
| Authorization failure | The RFC user needs read access to USR* and AGR_* tables and execute rights on the RFC-enabled function modules |
| SNC failure | SNC library path, quality of protection, and partner name |
Performance
| Symptom | Action |
|---|---|
| Analysis is slow | Scope before running rather than filtering after. Narrow user types, risk levels and business processes |
| Memory pressure | Unload data sources you are not analyzing. Everything loaded is held in memory |
| Result table slow to scroll | Expected on first pass over a large report; rows load incrementally and are fast once touched |
| Export takes a long time | Exports run in the background and report progress. Filter first if you do not need the whole table |
Windows blocks the application
Not a fault. SmartScreen reputation cold-start on a new release hash, despite the Extended Validation signature. See Windows SmartScreen & Enterprise Allow-Listing.
Still stuck
Contact support@meylan-tc.com. Include the version and build from the Info tab or the execution log, the data source type, and the row counts for the tables involved. If an analysis produced an unexpected result, the .log execution log is the single most useful thing to send, because it records the exact criteria, the ruleset checksum, and every table's checksum and row count.