SAP connections

A SAP connection defines the SAP system, assigned connector, and collections that runtime extracts. Data Streams and credentials are resolved by the server.

Each connection keeps a stable identity even when sources are reordered. If an applied configuration lacks that identity, the connector rejects it and shows a sanitized error instead of attaching cursors or durable state to another connection.

The saved password is bound to the assigned connector plus ASHOST, SYSNR, client, and RFC user. You can edit the alias, language, time zone, or collections without re-entering it. Changing any of those five trust fields requires a new password; ******** or an empty field cannot reuse the previous credential for another runtime or SAP system.

Eight collections

Collection	Default	Result
Metrics	300 s	CCMS and Operations metrics
CCMS events	300 s	Normalized events
Jobs	300 s	Job runs and long-running job snapshots
Program statistics	300 s	Standard ABAP program executions and dependencies
Work processes	300 s	Process snapshots
ABAP dumps	300 s	Sanitized ST22 dumps
RFC failures	300 s	RFC failures/recoveries without payload
Certificates	86400 s	Certificate inventory and transitions

Each control can be enabled and scheduled independently. The interval is a wall-clock-aligned fixed frequency, not a delay that starts when the previous extraction ends. At 300 seconds, all eight families start at deterministic phases after the exact boundary and within the first minute of each five-minute block. A bounded dispatcher keeps at most one pending execution per source/family, reserves capacity for Metrics, Work Processes, and the long-running Jobs snapshot, and fairly shares the remaining work. A slow CCMS or Jobs read therefore creates neither dozens of workers nor backlog and cannot delay priority collections or the heartbeat. Each ordinary task has a 75-second deadline: expiry cancels and retires only its SAP connection and never commits partial state. Before the isolated Program statistics child starts, source admission has an independent 30-second limit. Only after admission succeeds does it process one subwindow with a fresh 240-second budget and finite termination and reap reserves. It never inherits residual time from another read. An admission timeout or cancellation does not run the worker, bisect a subwindow, export, acknowledge, or move cursors; the next queued source can proceed. When the budget reaches its limit, the worker is interrupted and reaped within a finite bound. The parent retains sanitized descriptor lookup, parameter preparation, output selection, invoke, and decode boundaries even without a terminal record. Zero duration marks entry and a positive duration marks completion; no RFC values are included. This evidence diagnoses the last observed stage but does not validate data or permit export, acknowledgement, or checkpoint movement. If the child reaches its exact 240-second deadline and the active subwindow is still splittable, the coordinator exports nothing and keeps the cursor and prior acknowledgements unchanged. It durably replaces only that subwindow with two contiguous halves, preserves the rest of the queue and the backoff, and queues the continuation immediately with fair scheduling. An upgrade or reload cancellation takes precedence, never authorizes this split, and remains a cancellation rather than a handoff failure. Priority families retain their independent schedules. Startup and configuration reload perform one staggered bootstrap extraction without waiting a full interval.

Subwindows start at 60 seconds. A complete read that takes at least 60 seconds or returns more than 400 main records halves that source's durable maximum, down to one second. Exactly 400 does not reduce it, and the accepted leaf retains every execution. It may grow after eight fast, acknowledged leaves, for the next horizon only; it does not change acknowledged coverage or cross into a different SAP connection.

Capabilities

The card separates Scoped telemetry from connector heartbeat: data is available only when a v2 document exists for that exact source. Each collection distinguishes No source data yet—a successful lookup with no documents—from Source data status unavailable—a lookup that could not be completed—without exposing Elasticsearch implementation details. Each collection shows its current state, Last success, and Last check. An earlier error disappears after a successful collection; Details folds the latest sub-capability result rather than presenting an error history. One unsupported collection does not block the others.

When SAP omits a required table or list, the connector does not interpret that response as an empty result. The collection remains in error, keeps the latest confirmed state, and publishes no false removals or recoveries. An explicit, valid empty response is still reported as a successful query with no results.

Program statistics uses the standard RFC function SWNC_GET_STATRECS_FRAME in the SCSM_NW_WORKLOAD group and installs no transport or custom ABAP code. The technical user needs minimum S_RFC access to that function. SPOT expresses the window with SAP's UTC code, pins the connection client, and sends READ_START_DATE/TIME, READ_END_DATE/TIME, and READ_TIME_ZONE. The same invocation descriptor must declare MAX_RECORDS as an optional IMPORT INT with default -1, READ_ONLY_MAINRECORDS as IMPORT CHAR, and ALL_STATRECS/PROTOCOL as EXPORT TABLE; SPOT sends READ_ONLY_MAINRECORDS="X", omits MAX_RECORDS, and applies its native default without an artificial limit. The release must expose the function as remote-enabled and retain the records. Each cycle rereads a 15-minute overlap and attempts to advance at most 30 minutes, in frames no wider than 60 seconds. A count does not indicate truncation; more than 400 records adapts only that source's future leaves. The protocol may be empty or contain only standard completion rows with a decimal-zero RC; a missing, ambiguous, differently shaped, or non-zero protocol keeps the leaf pending, and its error text is not logged. Explicit truncation also keeps the leaf pending and may be split down to one second, with at most 32 Programs RFC reads in any rolling 60 seconds across all sources, including after restart. Smaller leaves can use that capacity sooner; the continuation waits without holding a SAP connection or starting another worker. SPOT exports each complete leaf with its manifest and confirms its end only after acknowledgement. When cancellation, an error, or a missing acknowledgement leaves a leaf pending, SPOT preserves its exact subwindows and retries them with backoff without reading earlier acknowledged leaves again. This also applies to the first round. Only after that horizon is complete does the next cycle reread from 15 minutes before the checkpoint. If lag exceeds the collection interval plus 120 seconds, it starts immediately; normal cadence resumes near the present. No unread tail is presented as covered. Check the last confirmed SAP time, not only arrival. Each RFC result has a 20,000-row and 64 MiB decode budget. Each leaf retains at most 50,000 documents and 32 MiB of serialized normalized content, including the manifest. Exceeding a limit or repeating an identity with incompatible content leaves that leaf without export or checkpoint progress. These limits do not constrain memory inside the native RFC invoke. A valid leaf retains every main record and a manifest with the exact count and window; only its acknowledgement advances the checkpoint. A valid read is partial because batchstep, rfc, http, and epp are explicitly unavailable; their absence does not prove those steps, calls, or contexts did not occur.

When capability is error, the sanitized diagnosis separates call-budget exhaustion, minimum-frame saturation, an invalid window, aggregate size, and an identity/system conflict. Those classes are conclusive only when reported by the installed version; they do not reinterpret an earlier generic error.

The adaptive window reduces the expected working set but does not guarantee a universal memory ceiling for every SAP system. Eight consecutive full-size, acknowledged leaves under ten seconds, with at most 100 main records and 8 MiB normalized each, may double it up to 60 seconds for the next horizon only; failures reset the streak and timeout or saturation prevents growth for 15 minutes. If Program statistics coincides with sustained memory pressure or stops completing while heartbeat or other families advance, disable only that collection temporarily, preserve the prior configuration, and keep the rest enabled. Reclaim under memory.high without an OOM requires whole-process measurement; it does not by itself prove a Go heap leak or native spin. Install a corrected, supported connector version, measure it under real SAP load against host headroom, and confirm progress of every family before re-enabling the collection. Do not raise resource limits as the first step.

For Jobs, the connector queues terminal executions and collects their complete Job Log asynchronously. SAP does not paginate this response, so the read may temporarily increase agent memory use; later Job Runs observations continue independently. job_runs=supported and job_logs=unavailable may still coexist when SAP does not provide the log read. This does not block runs, their states, canceled-jobs, long-running jobs, or historical lines already indexed.

Dumps never include memory/business data, RFC never includes call payloads, and certificates expose public metadata only—never private keys.

Assign a connector with a recent heartbeat, save the source, wait for the applied configuration revision, and verify Metrics/Events, Programs, Job Monitoring, Certificates, and RFC & Integrations. Agent upgrade required means the producer must be upgraded to 2.0; it is not a valid zero.