Lesson 5 of 6
Observability and audit
8 min
Listen to this lesson
Once agents are calling tools in production, three groups ask questions. Operations wants to know whether the servers are healthy. Security and audit want to know who called what, and whether anything was refused. The business wants to know whether the agent is actually used and helpful. Integration Suite answers the first two with the same monitoring it uses for API artifacts, plus analytics designed for MCP traffic.
Monitoring the runtime
Go to Monitor > Integrations and APIs and choose the Integration Cell runtime. Manage Integration Content shows each deployed MCP server with its runtime status (an agent can connect once it is Started) and its endpoint URL for the virtual host used at deployment. Monitor Message Processing shows message processing logs (MPL) for API and MCP server artifacts, which SAP made generally available in July 2026. Manage Access Logs helps with errors in inbound HTTP processing, and Manage Virtual Host shows the public host names.
| Log level | What is recorded | When to use it |
|---|---|---|
| None | Nothing is recorded during message processing | Rarely; you lose the audit trail |
| Info | Basic information; for failed messages, more detail is kept | Default for production |
| Debug | Detailed information for each step; expires after 24 hours | Development and test, or a short production investigation |
| Trace | All steps plus message content; expires after 10 minutes by default, and content is kept for about an hour | Short, approved troubleshooting only, because payloads may contain personal data |
Log levels as documented for Integration Cell artifacts (October 2026). Check the current defaults in your tenant.
Analytics for MCP servers
Under Analyze, set the artifact type to MCP Server. The dashboard has three report pages. Overview shows key performance tiles (total MCP server calls, response time, errors, each with a weekly change) and charts such as calls per day, top MCP servers, top subscriptions for agents, tools by agent and resources by agent. Health breaks errors down: by tool versus resource, policy errors, and errors by API, by MCP server URL, by HTTP URL and by RFC destination. Usage covers consumption over time. Some AI-assisted analytics features require the Premium or Enhanced edition.
Building an audit trail
An audit question usually sounds like: "On 14 October, who looked up order 1000457 through the assistant, and what did they see?" No single log answers it. Assemble the trail from layers: the identity provider's sign-in log (who obtained a token), the Developer Hub subscription (which agent), the MCP server's message processing log and analytics (which tool, when, with which result code), and, for user-propagated calls, the S/4HANA side (the user who ran the query, and change documents for any write). Agree with Nadia which of these are retained for how long, and test that the chain can be reconstructed before go-live.
| Question | Where the answer lives | Retention owner |
|---|---|---|
| Who signed in? | Identity provider logs (for example IAS) | Security team |
| Which agent and subscription? | Developer Hub subscription for agents | Integration team |
| Which tool, when, what result? | Message processing log and MCP analytics | Integration operations |
| What changed in SAP? | S/4HANA change documents and application logs | Process owner and Basis |
Alerts that matter
- A sudden rise in policy errors (401, 403, 429) for one subscription: an agent may be looping or misconfigured, or someone is probing.
- Rising tool errors by API after an S/4HANA or API change: the source changed and the MCP server may need synchronization.
- A tool that is never called: either the description is poor or the job was not real; fix or remove it.
- Latency well above the API artifact's own latency: look at the backend, the Cloud Connector and payload size.
What would you do?
Two weeks after go-live, the Health page shows that 30% of calls to <code>get_order_status</code> fail with policy errors, all from one agent subscription. The business says the assistant "mostly works". What should Theo do first?
- Monitor > Integrations and APIs shows MCP server status, endpoints and message processing logs on the Integration Cell.
- Use Info in production; Debug expires after 24 hours and Trace after about 10 minutes, and Trace captures content.
- MCP analytics (Overview, Health, Usage) break calls and errors down by agent, tool, resource, API and destination.
- An audit trail spans the IdP, Developer Hub, the MCP server logs and S/4HANA; test that you can rebuild it.
Check your understanding · not graded
Lesson check
1. Where do you check that a deployed MCP server is Started and see its endpoint URL?
2. Why is Trace a poor default for an MCP server in production?
3. Which Health chart helps most after an S/4HANA change breaks a tool?
4. An auditor asks who looked up a specific order through the assistant. Why can't the MCP analytics alone answer it?