Administration & Troubleshooting

/IWFND/ERROR_LOG and /IWBEP/ERROR_LOG

/IWFND/ERROR_LOG and /IWBEP/ERROR_LOG are the SAP Gateway error logs: /IWFND/ERROR_LOG records failed OData requests on the Gateway hub side, and /IWBEP/ERROR_LOG records errors raised in the backend service implementation. Together, the two SAP Gateway error logs are the first diagnostic stop when an SAP Fiori app shows an error or no data.

Quick facts

Type: SAP Gateway troubleshooting transactions
Layer: Services & APIs
/IWFND/ERROR_LOG: Hub side: routing, authorization, framework errors
/IWBEP/ERROR_LOG: Backend side: errors from the service implementation
Key features: Error context, call stack, replay in SAP Gateway Client
Who uses it: SAP Fiori support teams, ABAP developers, basis administrators
Applies to: SAP S/4HANA on-premise and Private Edition, SAP ERP (ECC)

Layer: Services & APIsWhere it sits ▾

Layer: Services & APIs

Open the architecture map →

What do /IWFND/ERROR_LOG and /IWBEP/ERROR_LOG do?

SAP Gateway writes an entry whenever an OData request fails at runtime. The two logs follow the split between the hub and backend components:

/IWFND/ERROR_LOG runs on the Gateway hub system. It records routing, service lookup and framework errors, plus errors returned by the backend, with request context for all users of the client.
/IWBEP/ERROR_LOG runs on the backend system. It records the error where the service implementation raised it, including the call stack.

In an embedded deployment both run in the same system. Each entry offers the error context, request data and replay options. /IWFND/ERROR_LOG tells you that and where a request failed; /IWBEP/ERROR_LOG tells you why the backend refused it.

How do you trace a failing request step by step?

A buyer at Alder Manufacturing opens a purchase order app and gets no data for Bright Freight:

Reproduce and note the time, and find the failing OData call and its HTTP status in the browser developer tools.
Open /IWFND/ERROR_LOG, filter by the user and time, and select the entry.
Read the error context: the service, the request URI, the HTTP method and the message text.
Follow the entry to the backend and open the matching entry in /IWBEP/ERROR_LOG for the call stack and the backend message.
Replay the request in the SAP Gateway Client, without the app, changing one parameter at a time.
Raise the log level temporarily if detail is missing: under Global Configuration, switch from the default Secure level to Full, then back.

Following the hub entry to the backend entry turns the SAP Gateway error logs from a symptom list into a root-cause path.

What do common SAP Gateway error log entries mean?

Entry pattern	Likely cause	Next step
Service not found for a namespace and name	Service not registered or wrong version	Check /IWFND/MAINT_SERVICE
No system alias found	Missing alias for the service	Assign the alias
Resource not found for the segment '…'	Wrong entity set or key in the URI	Compare the URI with the service metadata
Business error from the backend	Validation or posting logic rejected the data	Read the backend message in /IWBEP/ERROR_LOG
Runtime exception	Dump in the implementation	Check ST22 for the short dump

Authorization failures often show more clearly in SU53 or STAUTHTRACE. Most entries in /IWFND/ERROR_LOG point to configuration; most root causes in /IWBEP/ERROR_LOG point to data or code.

When should you use the SAP Gateway error logs?

Open the error logs first when:

an SAP Fiori app opens but shows an error, an empty list or an endless busy indicator;
a save fails with a generic message;
an integration reports HTTP 4xx or 5xx responses from an OData service.

Do not start there when the tile is missing or the app does not open at all: those are launchpad content or role problems, diagnosed in the launchpad layer. The SAP Gateway error logs answer questions about failed data requests, not about launchpad navigation.

/IWFND/GW_CLIENT: replays and edits the failing request.
/IWFND/TRACES: records payload and performance traces for one user, useful when nothing is logged but results are wrong.
/IWFND/APPS_LOG and /IWBEP/VIEW_LOG: application logs on the hub and backend sides.
/IWFND/CACHE_CLEANUP and /IWBEP/CACHE_CLEANUP: clear stale metadata after changes.
SU53 and STAUTHTRACE: confirm authorization failures.
ST22: shows the short dump when the backend entry reports a runtime exception.
/IWFND/MAINT_SERVICE: checks registration and system aliases for "not found" entries.

The error logs locate the failure; these transactions confirm the cause and the fix.

/IWFND/ERROR_LOG vs. /IWBEP/ERROR_LOG vs. /IWFND/GW_CLIENT: what is the difference?

	/IWFND/ERROR_LOG	/IWBEP/ERROR_LOG	/IWFND/GW_CLIENT
Runs on	Gateway hub system	Backend system	Gateway hub system
Shows	Failed requests with hub-side context	Backend errors with call stack	Live responses to requests you send
Question it answers	Did the request fail, and where?	Why did the backend reject it?	Does the service work without the app?
Typical use	First look after a user report	Root cause in service code or data	Reproduce and test a fix

FAQ

Why is my error not in /IWFND/ERROR_LOG?

The request may never have reached SAP Gateway, for example when the tile's intent did not resolve or the browser blocked the call. Check the browser's network tab first, and in a hub deployment look in the hub system.

Do I need both error logs in an embedded deployment?

Yes, but both run in the same system. /IWFND/ERROR_LOG shows the request from the Gateway side, and /IWBEP/ERROR_LOG shows the backend view with the call stack. Moving from one to the other is the normal analysis path.

Why does the error log entry hide details such as the service name?

The default error log level is Secure, which leaves out some sensitive application data. Switch the level to Full under Global Configuration while you analyze a problem, and return it to Secure afterwards to limit what the log stores.

How long are SAP Gateway error log entries kept?

SAP documents a default of 14 days from the date of the error, changeable under Error Log > Global Configuration in either transaction. Expired entries are removed by the SAP Gateway cleanup job for support utilities, which administrators schedule. Reproduce a problem soon after it is reported, so that its entry is still available.

Sources

Applies to: SAP S/4HANA on-premise · SAP S/4HANA Cloud Private Edition · SAP ERP (ECC)
Last reviewed: 2026-11-08

/IWFND/MAINT_SERVICE /IWFND/GW_CLIENT SAP Gateway