Does the agent need inbound network access to my SAP hosts?

No. The agent is outbound-only — it polls Farrenio over HTTPS for its config and pushes metrics the same way. No new firewall rules, no exposed ports on your SAP boxes.

Can my service desk see alerts without touching production?

Yes. The service_desk role is read-only on alerts and incidents — no SAP transaction access, no config changes, no token reveal. Granular 69-permission RBAC means you can carve out exactly what each team sees.

How long does a proof of concept take?

A 30-minute call to scope. We typically have one production SID streaming live metrics within an hour of agent install — the rest of the landscape follows as fast as you can roll out the package.

SAP Basis automation

Automate the routine Basis work — safely, and on the record.

Client copy, client deletion and instance lifecycle, run from one place with pre-checks, role-based access and a full audit trail. Batched across systems or scheduled for a window. No SAPGUI macro, no shell script nobody else can read.

Request a demo Read: client copy & system refresh

What runs today

Agent-executed operations with pre-checks and a recorded result — not a screen-scrape of SAPGUI.

SCCL

Local client copy

Copy a client within a system — customizing, master and transaction data — with guided pre-checks, a copy profile (SAP_ALL, SAP_APPL, SAP_CUST…), process count and background mode. Executed via the collector agent and tracked to completion.

SCC5

Client deletion

Permanently delete a client with pre-checks and guardrails — clients 000/001 are protected and a target-client login is verified first. Irreversible by nature, so it runs behind confirmation and is fully recorded.

sapcontrol

Start / stop / restart

Lifecycle control of SAP instances and services through sapcontrol — per instance or whole system, across ABAP, SCS, HDB and more. Run the same command across many systems as a batch, or schedule it for a window.

Automation you can hand to a team

Pre-checks before anything runs

Each automated operation validates its prerequisites first. The destructive ones (SCC5) verify state and require explicit confirmation.

Every action attributed

Who ran what, when, against which system, with the command output captured. The audit trail is exportable for compliance reviews.

Scoped by role

A 69-permission RBAC model decides who can execute versus who can only watch. Service desk sees results without touching production.

Scheduled and batched

Run a command now, schedule it for a maintenance window, or fan it out across many systems in one operation — results stream back as they complete.

Monitoring that informs the operation

You decide when to act on the levels below; the platform keeps them current across the landscape.

Kernel and patch levels

disp+work-derived kernel release and patch level, plus the DBSL patch level, surfaced per system so drift across the landscape is visible at a glance.

Support tool versions

SPAM and SAINT versions alongside ST-PI / ST-A/PI, so you know what each system is carrying before a support-package campaign.

On the roadmap — not shipped yet

Where automation is heading

We would rather under-promise. These are planned, tracked on the public roadmap, and not available today.

Planned

System refresh

End-to-end refresh orchestrating SCC5 + SCCL with post-processing as one guided multi-step operation.

Planned

Support packages

SPAM / SAINT support-package application with guided pre-checks and step tracking.

Planned

Kernel patching

Kernel updates (disp+work, sapstartsrv) with a rolling approach to minimise downtime.

See the full roadmap

Go deeper

Blog

SAP system refresh and client copy with SCC5 and SCCL

How a refresh actually works, the pre-checks that matter, and what to automate versus do by hand.

Blog

SAP kernel patching: a practical guide

What the kernel is, how a rolling patch works, and why tracking kernel and DBSL levels matters.

Topic

SAP Basis monitoring

The monitoring side: SM50, SM37, ST22 and related transactions, cross-system.

Capability

Security and audit

How execution is scoped by role and how every privileged action is recorded.

Common questions

What does the platform automate today?

Local client copy (SCCL) and client deletion (SCC5) as agent-executed operations with pre-checks, and SAP instance lifecycle (start, stop, restart) via sapcontrol — individually, as a batch across systems, or on a schedule. Every run is recorded with operator, system and output.

Does it patch SAP or the kernel?

Not yet. Today the platform monitors kernel and patch levels and SPAM/SAINT versions so you can see what is deployed and what has drifted. Support-package and kernel-patch automation are on the roadmap and are labelled as planned — we will not pretend otherwise.

Can it do a full system refresh?

The building blocks (SCCL and SCC5) are automated today and can be run in sequence. A single guided system-refresh operation that orchestrates them end to end with post-processing is on the roadmap.

How does it reach my systems to run anything?

Through the outbound-only collector agent on each SAP host. Commands are dispatched to the agent, which executes and returns results — there is no inbound connection into your landscape.

Is a destructive operation safe to expose?

SCC5 deletes data permanently, so it runs behind pre-checks, protected-client guards (000/001), an explicit confirmation, and a recommendation to verify a backup exists. It is also gated by role — most users can never reach it.

See the automation against a sandbox.

We will walk a client copy and a sapcontrol restart on a non-production system, show you the pre-checks and the audit record, and be straight about what is shipped versus planned.

Request a demo SAP Basis monitoring