“Failed to connect System Landscape Directory (SLD)” in SAP Business One®: what to check

At logon, users see:

Failed to connect System Landscape Directory (SLD); contact your system administrator

Add-ons and integrations that use the DI API report the same problem as -4009 “Failed to connect SLD, make sure SLD server is correct and available”. The Service Layer returns error 312 “Fail to connect to SLD.” We found no SAP message number for the logon text.

All three mean the same thing: the program couldn’t reach the System Landscape Directory (SLD), the server component that checks who you are and knows where every part of your SAP Business One landscape lives. Without it, nobody logs on.

1. Is the SLD running?

The SLD runs in a Windows service on the SAP Business One server: SAP Business One Server Tools Service (64-bit). Its logon checks run in a second one, SAP Business One Server Tools Authentication Service.

1. On the server, open Windows Services and find both.
2. If either is stopped, start it. If both run but users still can’t log on, restart the Server Tools Service. A restart stops the SLD for everyone for a moment, so do it when few people are working.

Restarting this service is also the first fix that users and partners report in SAP Community.

2. Can the workstation reach the SLD?

On the workstation that shows the error, open a browser and go to:

https://<your server name>:40000/ControlCenter

40000 is SAP’s default port for the SLD (the address is case-sensitive). If the SLD Control Center’s logon page opens, this workstation can reach the SLD on port 40000: go to step 3. If it doesn’t:

• Name: try the server’s IP address instead of its name. If the IP works and the name doesn’t, it’s a DNS problem. Users also report fixing it with an entry in the workstation’s hosts file.
• Firewall: SAP’s default ports for the SLD are 40000 (SLD) and 40020 (SLD authentication service). Since SP 2511 the license service has its own port, 40002. SAP’s own advice after upgrading to SP 2511 is to review firewall settings for the new ports.
• Proxy: if the workstation uses an HTTP proxy, SAP says the SLD server must be in the proxy’s exceptions list.

3. Is the SLD address right?

There are two places to check.

On the workstation. The desktop client asks for the SLD address and port the first time it starts, in the System Landscape Directory Server Selection window. We found no SAP page on changing it later on an existing workstation. Users and partners report two ways: run the client once as administrator and enter the address again, or correct the address in the client’s b1-local-machine.xml configuration file. If you edit the file, close SAP Business One first, keep a copy of the file, and change only the SLD address in it.

In the SLD itself. In the SLD Control Center, on the Security tab, there is one SLD and authentication address for the whole landscape (since FP 2208). SAP warns that if this address is wrong, the whole landscape stops working, and that it must be reachable from every network your users connect from. If you upgraded from a release below FP 2208, SAP says to set this address again; after changing it, restart all component services.

4. After a server move, rename or new IP address

If the server’s name or IP address changed, SAP’s tool for updating SAP Business One to match is the Components Wizard in reconfiguration mode:

1. On the server, run setup.exe in C:\Program Files\SAP\SAP Business One SetupFiles\ (or SAP Business One Components Wizard in Programs and Features).
2. Choose Reconfiguration.
3. Set the new network address, and in the Landscape Server window the new SLD address and port.

Then check the Security tab address (step 3) and the workstations.

5. The SLD’s security certificate

The connection to the SLD runs over HTTPS and needs a certificate. Since SP 2411, certificate verification can be switched on at installation (it is ticked by default in the server wizard). With verification on, SAP doesn’t allow a self-signed certificate, and the server name users connect to must match the certificate.

• Since FP 2602 the SLD Control Center shows each component’s certificate expiry date and warns 30 days before it runs out.
• SAP’s way to renew or replace the certificate is the same Components Wizard reconfiguration (step 4), in its Specify Security Certificate window.

We found no SAP page that says a certificate problem shows exactly this logon message, so treat it as a check, not a confirmed cause.

6. Two less common causes

• The database password changed. If the password of the database user that the SLD was installed with is changed later, SAP says the SLD stops working. Set the new password through the reconfiguration (step 4).
• The clocks differ. If logon to the SLD Control Center fails with “Error: exp is in the past”, SAP says to check the time synchronization between the workstation and the SLD server.

Where the logs are

SAP lists these log folders:

• SLD: %programdata%\SAP\SAP Business One\Log\SAP Business One ServerTools\System Landscape Directory\
• Desktop client: %LOCALAPPDATA%\SAP\SAP Business One\Log\BusinessOne
• DI API: %LOCALAPPDATA%\SAP\SAP Business One\Log\DIAPI

A failed client logon is also recorded in the Windows Event Viewer.

Service Layer and Web Client

• Service Layer error 312: SAP has a knowledge-base article for it (KBA 3654819). SAP’s guide lets you check the Service Layer at https://<server>:<port>/balancer-manager and restart it with b1s.bat restart in the ServiceLayer installation folder.
• Web Client service won’t start: SAP’s fix is in the SLD Control Center, Services tab: bind the Service Layer and the Web Client to a registered database instance (Edit, choose a valid service unit), then restart the Web Client.

Quick answers

← All guides