Your Basis team is too small for the landscape it runs
Most teams cover a dozen SIDs with four people and a SAPGUI window per system. Farrenio puts SM50, SM37, ST22, ST04 and the rest in one browser tab, and flags the disk filling before users feel it.
- First metrics inside an hour
- Outbound-only, no firewall change
- Credentials envelope-encrypted, PIN-gated
Who this is actually for
One production system or forty across a dozen customers. The operating model is the same and only the tenancy changes.
Basis teams
Run SM50, SM37, ST22 and RFC checks from one console, with no Windows GUI.
See SAP operations
Service desks
Read-only alert monitoring with escalation tracking and audit-grade history.
Inspect alerts
Managed-service providers
Multi-tenant by design. Per-customer RBAC and isolated audit trails.
Multi-tenant model
Security & compliance
MFA-gated reveal, 92-permission RBAC, tiered audit retention, SOC2-aligned.
Review the security modelThe transactions your team already lives in
Twelve Basis transactions, mapped to where they live in the stack, from the ABAP dispatcher down to the HANA indexserver and the OS. One web console, cross-system search, every action on the audit trail.
Application server
The ABAP dispatcher, its work processes, sessions and the enqueue lock table.Workload, jobs & diagnostics
Batch, runtime errors, the system log and where response time actually goes.Database, host & connectivity
The HANA / anyDB layer, the operating system, and the RFC links between systems.Nothing gets opened on your SAP hosts
The question every Basis lead asks first, answered plainly: one Python daemon runs on the host, reads what it is allowed to read, and pushes outbound over HTTPS. There is no inbound listener and nothing to open on your perimeter.
One Python daemon per SID, under its own unprivileged service account rather than <sid>adm. Each collector is isolated, so one failing source never takes the others down with it.
The agent polls for its config and pushes metrics on 443. No firewall change, no NAT rule, no exposed port on a production SAP box.
RFC and HANA credentials are encrypted under a key issued per agent, never returned in plaintext on a read, and unlocked only behind a PIN or a fresh TOTP code, with every reveal on the audit trail.
From install to audit-ready, in one console
Scroll the four steps a landscape goes through with Farrenio. The panel keeps pace.
Get an agent reporting the same afternoon
A three-step wizard hands you an install script and a scoped token. The agent dials out and starts streaming while you watch. No firewall change, no inbound port.
Search the whole landscape in one query
SM50, SM37, ST22, DB02 and SM21 indexed across every SID. "Which system has the long-running job?" is one search with the answer attached, rather than twelve SAPGUI logons.
The right person hears about it first
Per-metric, per-customer thresholds. Escalation ladders by severity and fans out to Slack, Teams, PagerDuty and email. Any alert can be promoted to an incident workflow.
Every privileged action on the record
Ninety-two permissions across eight roles, PIN- or MFA-gated token reveal, auto-block on credential-stuffing, and an audit trail carrying operator, IP and outcome behind every action.
Start where your problem is
Monitoring, automation, the HANA database and the move to S/4HANA on AWS. Each has a page of its own.
Four things a Basis team does every week
Roll out collectors, watch the landscape, control who can touch what, and route what breaks to whoever is on call.
Get a new SID reporting the same afternoon
Onboarding a system is usually a ticket, a firewall request and a week of waiting. Here it is a wizard that hands you an install script and a scoped token, then the agent dials out and starts streaming while you watch.
- Three-step wizard: pick system → configure → deploy
- HANA SYSTEMDB + tenant out of the box
- Per-collector freshness dots, so a stalled source is visible
- Adopt existing agents, no duplicate registrations
What this is worth in hours
Based on benchmark workflows from teams running 6–25 SAP systems. Your mileage will vary, so we ship live dashboards you can measure it with yourself.
Cross-system SM50 / SM37 / ST22 queries take seconds instead of opening one GUI window per SID.
A single Python daemon, no firewall changes, no inbound ports. Heartbeat shows up immediately.
Tiered audit retention: 365 days for auth and role events, 180 for the rest. Every login, every config change, every sapcontrol command.
Plug in your estate and see your numbers
SAP GUI · 12 windows · per-SID hops
- Open GUI, pick SID, run SM50, screenshot
- Repeat for QAS, DEV, sandbox…
- No history, no cross-SID search
- Audit trail = your memory + Confluence page
One web console · all systems · audit-logged
- Cross-SID search across SM50 / SM37 / ST22 in one query
- Live WebSocket updates, no manual refresh
- Every command logged with user, IP, before/after state
- Mobile-friendly, so you can triage from your phone if it pages you
Built like a fortress,
delegated like a SaaS.
Permissions, audit, and brute-force protection aren't bolted on. They are the spine of every endpoint and every UI surface.
- 92 permissions across 8 roles, every checkbox enforced at the API layer
- Role-permission edits logged with full diff (granted / revoked / by whom)
- Privilege-escalation refused at the boundary and audited as denied attempts
- Auto-block on 10 failures in 5 min OR ≥3 distinct emails
- Allowlist exempts known-good probes and office IPs
- JWT revoked on role / email / customer change
- Token reveal requires PIN or fresh TOTP, via a one-shot verification JWT
An AWS Reseller and Cloud Services provider
Farrenio acts as an AWS Reseller and Cloud Services provider, supporting customers throughout their cloud adoption, optimization and operational journey. We help organizations leverage Amazon Web Services for:
- Infrastructure modernization
- SAP workloads on AWS, RISE-aligned where it makes sense
- Migration projects · landing zones · account vending
- Cloud operations · monitoring · incident response
- Cost optimization · rightsizing · reserved-capacity strategy
Written by people who run these systems
Kernel patching, HANA signals, S/4HANA on AWS. Deep-dives written from the Basis work itself rather than by the marketing team.
SAP BasisIntroducing Farrenio Cloud Control: your whole SAP estate in one console
A walk through the platform: what it watches across ABAP, HANA, the instance and the host layer, how the collector connects outbound-only over HTTPS, the path from alert to SLA evidence, the automation it runs, the 92-permission access model, and what it does not do.
SAP on AWSHigh availability for SAP on AWS: HANA System Replication with Pacemaker and ENSA2
Designing SAP HA across two AWS Availability Zones: HANA System Replication modes and operation modes, a Pacemaker cluster with the SAPHana agents and AWS fencing, overlay IPs and Route 53, and ENSA2 for the ASCS, plus why an untested cluster is not HA.
Security & ComplianceSAP security patching: security notes, SNOTE, and staying current without breaking production
How SAP Security Patch Day works, what note priorities (HotNews to Low) and CVSS mean, applying fixes via SNOTE / SPAM / kernel, using System Recommendations to find what applies, and a risk-based cadence auditors accept.
What Basis leads ask us first
Does the agent need inbound network access to my SAP hosts?
Where do the SAP credentials live, and who can read them?
What happens to my data, and is this multi-tenant?
Can I bring my own SSO?
Do you support S/4HANA and classic NetWeaver?
How do you handle credential stuffing and password attacks?
Can my service desk see alerts without touching production?
How long does a proof of concept take?
See it against your own SIDs
Thirty minutes to scope it, about an hour to get your first production SID streaming. No commitment past that.