共用方式為

Systemconfig.ini 檔案參考

  • 發行項

systemconfig.ini 檔案可用來設定數據收集器的行為。 組態選項分成數個區段。 本文列出可用的選項，並提供選項的說明。

重要

適用於 SAP® 應用程式的 Microsoft Sentinel 解決方案會針對 2023 年 6 月 22 日或之後發行的代理程式版本使用新的 systemconfig.json 檔案 。 針對先前的代理程式版本，您仍然 必須使用 systemconfig.ini 檔案。

如果您更新代理程式版本，則會自動移轉組態檔。

Systemconfig 組態檔區段

區段名稱 描述
秘密來源 本節會定義認證儲存的位置。
ABAP 中央實例 本節會定義要連線之 SAP 實例的一般選項。
Azure 認證 本節會定義連線至 Azure Log Analytics 的認證。
檔案擷取 ABAP 本節會定義使用 SAPControl 介面從 ABAP 伺服器擷取的記錄和認證。
檔案擷取 JAVA 本節會定義使用 SAPControl 介面從 JAVA 伺服器擷取的記錄和認證。
記錄啟用狀態 本節會定義從 ABAP 擷取哪些記錄。
連線 or 組態 本節會定義其他連接器選項。
ABAP 數據表選取器 本節定義從 ABAP 系統擷取哪些使用者主要數據記錄。

秘密來源區段

secrets=AZURE_KEY_VAULT|DOCKER_FIXED
# Storage location of SAP credentials and Log Analytics workspace ID and key
# AZURE_KEY_VAULT - store in an Azure Key Vault. Requires keyvault option and intprefix option
# DOCKER_FIXED - store in systemconfig.ini file. Requires user, passwd, loganalyticswsid and publickey options

keyvault=<vaultname>
# Azure Keyvault name, in case secrets = AZURE_KEY_VAULT

intprefix=<prefix>
# intprefix - Prefix for variables created in Azure Key Vault

ABAP 中央實例區段

[ABAP Central Instance]
auth_type=PLAIN_USER_AND_PASSWORD|SNC_WITH_X509
# Authentication type - username/password authentication, or X.509 authentication

ashost=<hostname>
# FQDN, hostname, or IP address of the ABAP server

mshost=<hostname>
# FQDN, hostname, or IP address of the Message server

msserv=<portnumber>
# Port number, or service name (from /etc/services) of the message server

group=<logon group>
# Logon group of the message server

sysnr=<Instance number>
# Instance number of the ABAP server

sysid=<SID>
# System ID of the ABAP server

client=<Client Number>
# Client number of the ABAP server

user=<username>
# Username to use to connect to ABAP server. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

passwd=<password>
# Password to use to connect to ABAP server. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

snc_lib=<path to libsapcrypto>
# Full path, to the libsapcrypto.so
# Used when SNC is in use
# !!! Note: the path must be valid within the container!!!

snc_partnername=<distinguished name of the server certificate>
# p: -prefixed valid SAP server SNC name, which is equal to Distinguished Name(DN) of SAP server PSE
# Used when SNC is in use

snc_qop=<SNC protection level>
# More information available at https://docs.oracle.com/cd/E19509-01/820-5064/ggrpj/index.html
# Used when SNC is in use

snc_myname=<distinguished name of the client certificate>
# p: -prefixed valid client SNC name, which is equal to Distinguished Name(DN) of client PSE
# Used when SNC is in use

x509cert=<server certificate>
# Base64 encoded server certificate value in a single line (with leading ----BEGIN-CERTIFICATE--- and trailing ----END-CERTIFICATE---- removed)

Azure 認證區段

[Azure Credentials]
loganalyticswsid=<workspace ID>
# Log Analytics workspace ID. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

publickey=<publickey>
# Log Analytics workspace primary or secondary key. Used only when secrets setting in Secrets Source section is set to DOCKER_FIXED

檔案擷取 ABAP 區段

[File Extraction ABAP]
osuser = <SAPControl username>
# Username to use to authenticate to SAPControl

ospasswd = <SAPControl password>
# Password to use to authenticate to SAPControl

appserver = <server>
#SAPControl server hostname/fqdn/IP address

instance = <instance>
#SAPControl instance name


abapseverity = <severity>
# 0 = All logs ; 1 = Warning ; 2 = Error

abaptz = <timezone>
# GMT FORMAT
# example - For OS Timezone = NZST (New Zealand Standard Time) use abaptz = GMT+12

檔案擷取 JAVA 區段

[File Extraction JAVA]
javaosuser = <username>
# Username to use to authenticate to JAVA server

javaospasswd = <password>
# Password to use to authenticate to JAVA server

javaappserver = <server>
#JAVA server hostname/fqdn/IP address

javainstance = <instance number>
#JAVA instance number

javaseverity = <severity>
# 0 = All logs ; 1 = Warning ; 2 = Error

javatz = <timezone>
# GMT FORMAT
# example - For OS Timezone = NZST (New Zealand Standard Time) use abaptz = GMT+12

[記錄啟用狀態] 區段

[Logs Activation Status]
# The following logs are retrieved using RFC interface
# Specify True or False to configure whether log should be collected using the mentioned interface
ABAPAuditLog = <True/False>
ABAPJobLog = <True/False>
ABAPSpoolLog = <True/False>
ABAPSpoolOutputLog = <True/False>
ABAPChangeDocsLog = <True/False>
ABAPAppLog = <True/False>
ABAPWorkflowLog = <True/False>
ABAPCRLog = <True/False>
ABAPTableDataLog = <True/False>
# The following logs are retrieved using SAP Control interface and OS Login
ABAPFilesLogs = <True/False>
SysLog = <True/False>
ICM = <True/False>
WP = <True/False>
GW = <True/False>
# The following logs are retrieved using SAP Control interface and OS Login
JAVAFilesLogs = <True/False>

連線 or 組態區段

extractuseremail = <True/False>
apiretry = <True/False>
auditlogforcexal = <True/False>
auditlogforcelegacyfiles = <True/False>
azure_resource_id = <Azure _ResourceId>
# Used to force a specific resource group for the SAP tables in Log Analytics, useful for applying RBAC on SAP data
# example - /subscriptions/1234568-qwer-qwer-qwer-123456789/resourcegroups/RESOURCE_GROUP_NAME/providers/microsoft.compute/virtualmachines/VIRTUAL_MACHINE_NAME
# for more information - https://learn.microsoft.com/azure/azure-monitor/logs/log-standard-columns#_resourceid.

timechunk = <value>
# Default timechunk value is 60 (minutes). For certain tables, the data connector retrieves data from the ABAP server using timechunks (collecting all events that occurred within a certain timestamp). On busy systems this may result in large datasets, so to reduce memory and CPU utilization footprint, consider configuring to a smaller value.

ABAP 數據表選取器區段

[ABAP Table Selector]
# Specify True or False to configure whether table should be collected from the SAP system
AGR_TCODES_FULL = <True/False>
USR01_FULL = <True/False>
USR02_FULL = <True/False>
USR02_INCREMENTAL = <True/False>
AGR_1251_FULL = <True/False>
AGR_USERS_FULL = <True/False>
AGR_USERS_INCREMENTAL = <True/False>
AGR_PROF_FULL = <True/False>
UST04_FULL = <True/False>
USR21_FULL = <True/False>
ADR6_FULL = <True/False>
ADCP_FULL = <True/False>
USR05_FULL = <True/False>
USGRP_USER_FULL = <True/False>
USER_ADDR_FULL = <True/False>
DEVACCESS_FULL = <True/False>
AGR_DEFINE_FULL = <True/False>
AGR_DEFINE_INCREMENTAL = <True/False>
PAHI_FULL = <True/False>
AGR_AGRS_FULL = <True/False>
USRSTAMP_FULL = <True/False>
USRSTAMP_INCREMENTAL = <True/False>
SNCSYSACL_FULL = <True/False> (Preview)
USRACL_FULL = <True/False> (Preview)

下一步

深入瞭解適用於 SAP® 應用程式的 Microsoft Sentinel 解決方案：

疑難排解：

參考檔案：

如需詳細資訊，請參閱 Microsoft Sentinel 解決方案。