2751378 - sybsecurity audit log full and hung "SET SWITCH" processes - SAP ASE for Business Suite

• ASE is reporting 'sapsa'-owned spid(s) in 'sleeping' status and command "SET SWITCH" (thru sp_who command or Processes Monitor list from DBACockpit), ie for sp_who output:

0   64 sleeping   sapsa     sapsa     NULL                0 saptools    sapsatempdb SET SWITCH                   0 syb_default_pool

Note: The "set switch" works like a dbcc traceon (to set trace flags).
         The "sleeping" state means: "Waiting on a disk I/O, or some other resource (often indicates a process that is running, but doing extensive disk I/O)".

• The spid cannot be killed
• An ASE restart is also not possible unless a kill -9 done
• But even after a restart a new similar sleeping spid reappears.
  
  
• When checking more details for the same spid, using commands:
  
  • "select * from master..sysprocesses"
  • or from Sybdiag output > Adaptive Server Monitoring Data > Adaptive Server Processes
  
   you can confirm the session spid is coming from JS Agent / ATM WINDOW 1 or 2, i.e.:

sapsa 64 18153611 1 sleeping 4 null JS Agent - sapsa 35399 SET SWITCH 1 0 10 0 5 1 0 $chained_transaction null 16384 0 EC2 LOW syb_default_pool 82096302 114 379 null 0 ATM WINDOW 1

• This may also be seen during SUM upgrades UPDATE STATISTICS phase - ASE process executing sp_flushstats after completing UPDATE INDEX STATITICS hangs.
  The corresponding stack for the hanging spid references functions: 
  
  

  uboallocw
  send_audit

   
• Checking the ASE error log, you can see this message reported (one or more times) that indicates the auditing is enabled:

AUDIT PROCESS EXCEPTION: Can't allocate space for either syslogs or the current sysaudit table in database 'sybsecurity' because the corresponding segment is full/has no free extents. Please refer to Security Administration Guide for details.

• Any dbcc command leads to more stuck sessions.
• As consequence, saptools log segment is running full (error Msg 1105 being reported in the ASE error log).
• Issue is reproduced as soon ASE is restarted.
• ASE configuration parameter "suspend audit when device full" is enabled (equal to 1) as required:
• Refer to SAP Note ASE configuration 1581695 for ASE 16.0
• Refer to SAP Note ASE configuration 1749935 for ASE 15.7

• SAP Adaptive Server Enterprise (ASE) 15.7 for Business Suite
• SAP Adaptive Server Enterprise (ASE) 16.0 for Business Suite
• SAP NetWeaver (NW) - All versions 

sybsecurity, audit process, sleeping, "set switch", sleeping, auditing queue size, 1105, saptools, log segment, "maintenance token", "user connections", send_audit, uboallocw , KBA , BC-DB-SYB , Business Suite on Adaptive Server Enterprise , How To