SAP incident triage diagnostics

Core idea

Good triage prevents wrong teams, missing evidence, and wasted time. The diagnostic goal in the first minutes is to classify the incident by symptom area, urgency, and the minimum evidence needed before assignment.

Common symptoms

• Incident description is vague or only says 'system is slow'.
• Ticket is routed to a team that does not own the failing area.
• Multiple users report different symptoms for the same underlying issue.
• Incident is treated as urgent but has no business impact yet.
• Previous incidents for the same symptom were closed without root cause.

Likely causes

• Missing classification: the ticket lacks module, process, or object information.
• Incorrect routing: routing rules rely on keywords that do not match the actual failure area.
• Insufficient evidence: logs, error messages, or timestamps were not collected.
• Urgency mismatch: priority is set by who reported it, not by business impact.
• No known-pattern link: the symptom matches a known diagnostic page but was not checked.

Where to check in SAP

• Ticket fields — module, process, object, error text, time, user.
• Atlas/Skill Hub diagnostic index — find a matching pattern.
• System status monitors — SM50, SM66, SM37 for workload or job issues.
• Application log (SLG1) or short dumps (ST22) for the time window.
• Recent changes — transports, jobs, master data updates.

Key tables / transactions / objects

• Incident/ticket system — classification and routing metadata.
• SM50 / SM66 — work process overview.
• TBTCO — background job status.

Diagnostic workflow

1. Read the ticket and extract: symptom, process area, object key, time, user, and business impact.
2. Classify as master data, configuration, integration, authorization, batch, or performance.
3. Check for matching diagnostic pages or known patterns in the Atlas.
4. Collect minimum evidence: error text, status, log object, or job name.
5. Set priority based on business impact, not reporter seniority.
6. Route to the team that owns the component and attach the evidence.

Typical fixes or next actions

• Add mandatory classification fields to the incident form.
• Maintain routing rules based on object type and module keywords.
• Link frequently seen symptoms to diagnostic pages in the knowledge base.
• Create an evidence checklist for each major symptom category.
• Review closed incidents for recurring patterns and update triage guidance.

Support takeaway

Triage tickets are most useful when they include a clear symptom, process area, affected object, time, user, and the business impact that justifies the priority.

Boundaries and non-goals

This page is a triage diagnostic, not an ITIL incident-management process guide. It does not cover SLA definitions or escalation policies.

This is not official SAP documentation and not a replacement for system-specific analysis.