Operational configuration

SPOT 2.0 separates producer and reader: the agent publishes schema v2 SAP telemetry to metrics and logs, and the backend reads those same Data Streams. There are no separate Jobs, Events, or WPInfo index fields.

Storage

Backend spot.yaml and agent .spot-agent-sap.yaml configure only the Elasticsearch URL, credentials, and namespace. SPOT derives spot-integration-<namespace>-metrics, spot-integration-<namespace>-logs, and the isolated operational agent log stream. Storage, exporter, SAP index, and pipeline selectors do not exist.

Embedded setup enables manage_data_streams_ilm. External targets leave it off, so bootstrap checks connectivity without creating resources. When explicitly enabled, SPOT manages metrics and logs only.

TLS trust and destination-bound secrets

Import corporate CAs in Configuration > Trust store. SPOT displays name, SHA-256 fingerprint, subject, issuer, expiration, and assigned destinations. System packages store them below /etc/spot/tls; portable installs use $SPOT_HOME/config/tls. The UI accepts no arbitrary path and does not delete an assigned CA.

External Elastic, LDAP/AD, and HTTPS AI providers can use system CAs, an imported CA, or explicit insecure_skip_verify. The exception never changes HTTPS into HTTP, permits redirects, or disables DNS/IP controls. A persistent warning remains visible and Save/Test are audited while it is active.

A masked credential belongs to the exact destination identity. If protocol, host, port, base path, authentication, user/bind DN, SNI, CA, or TLS policy changes, enter the full secret again. Test and Save apply the same rule and never test an old secret against a new destination.

LDAP and Active Directory

LDAPS and StartTLS are supported, including RFC1918 destinations. Choose strict validation, an imported CA, or disabled certificate verification. The bind password is bound to protocol, host, port, bind DN, SNI, and TLS policy. SPOT pins the validated IP for the connection to prevent DNS rebinding.

AI providers

Providers with an API key require HTTPS. They can use a valid CA or disabled certificate verification, with redirects blocked. Loopback HTTP is allowed only without an API key. Private LAN HTTP also requires no API key and an explicit risk acknowledgement; the UI presents that risk separately from unverified HTTPS.

Sources and collections

Each SAP source has a stable ID, IANA time zone, and seven collections:

Family	Default	Content
Metrics	300 s	CCMS and Operations metrics
CCMS events	300 s	Normalized events
Jobs	300 s	Runs and log lines
Work processes	300 s	Process snapshots
ABAP dumps	300 s	Sanitized ST22 evidence
RFC failures	300 s	tRFC/aRFC/qRFC/bgRFC without payload
Certificates	86400 s	Public inventory and transitions

Every interval is a wall-clock-aligned fixed frequency. At 300 seconds, the families start at deterministic phases within the first minute of each five-minute block. Every source/family runs independently, so one slow call does not shift the others. Startup and configuration reload perform a staggered bootstrap extraction and coalesce missed cycles instead of queuing late runs.

Each capability reports supported, unauthorized, unavailable, or error, plus last success and a sanitized error. Missing sub-capabilities do not stop the remaining collections.

SAP passwords are write-only. SPOT retains a saved password during unrelated edits only while the connection ID, ASHOST, system number, client, and RFC user remain unchanged. If any of those values changes, re-enter the complete password; a mask or empty field does not reuse the previous credential for the new destination.

The same destination controls block cloud metadata, link-local, multicast, and unspecified addresses. RFC1918 is allowed on-prem; insecure_skip_verify does not bypass these limits.

Incremental state and safety

Watermarks/capabilities are stored under /var/lib/spot-agent-sap (or $SPOT_HOME/data). Full pagination, overlap, and deterministic event_id protect restarts; the first Jobs, dump, and RFC backfill covers 24 hours.

Dumps exclude memory/business data, RFC records exclude call payloads, and certificate records never include private keys. Viewer/admin reads remain source-scoped; only admins change configuration. ML uses sparse dump/RFC counts, while certificates are deterministic and non-forecastable. AI tools are read-only and source-scoped.

A 2.0 backend filters schema_version=2 only. An older on-prem producer is shown as Agent upgrade required / producer_upgrade_required, never as synthetic zero.