Collector for User Password Monitoring

The technical name of the Collector for User Password Monitoring is /DVD/MON_CL_COL_USR.

This collector reports data about SAP users in a compliance context: How many users are locked, how many users have initial passwords, how many old passwords exist, and how many users are no longer valid. The expected maximum age of passwords is configurable.

Default KPIs Delivered with This Collector

The following default KPIs are delivered with this collector:

KPI name	Description	Unit	Detail table
USR_INVALID	Number of expired users	Count	No
USR_LOCK	Number of locked users	Count	No
USR_INIT	Number of users who have never logged in	Count	No
USR_INIT_PW	Number of users with an initial password	Count	No
USR_OLD	Number of users with a password age that is above the preset threshold	Count	No
USR_SAPS_DEL	Number of deleted SAP* users on the system (across all clients)	Count	No
USR_SAPS_KER	If filled, this field indicates an imminent security risk on a system. The value 1 is returned if the SAP* user has been removed on any client and a kernel login using SAP* is permitted. The profile parameter login/no_automatic_user_sapstar is related to this field.	Bool	No

Parameters

The following parameters are used for this collector:

Parameter name	Description	Default value
OLD_PASSWORD	Specifies the threshold for the number of days since the last password change. The number of users with aged passwords are reported by the KPI USR_OLD.	180