nfs://server/path1
sap
nfs://server/path3
supplement
PASSWORD
SID
INSTANCE_NUMBER
no
40 Partitioning for an SAP application without the SAP Installation Wizard SLES-SAP 15 SP3
The sapMDC element is only applicable to SAP HANA.
The sapVirtHostname element must be specied for distributed or highly available
installations.
For a full SAP HANA example, including partitioning, see /usr/share/doc/packages/sap-
installation-wizard/hana-autoyast.xml .
4.6.2 SAP NetWeaver installation
For SAP NetWeaver, the following example shows how the installation can be automated.
Specically, this example is tailored to installing ASCS Instance of an SAP NetWeaver 7.5 ABAP
Server distributed system with MaxDB (product ID NW_ABAP_ASCS:NW750.ADA.ABAP ). When
installing other products based on SAP NetWeaver, not all of the following variables may be
necessary or these variables might need to be replaced by others:
The master password for the SAP NetWeaver instance: MASTER_PASSWORD
The SAP Identier (SID): SID
The SAP kernel: KERNEL
The SAP instance number: INSTANCE_NUMBER
The ASCS virtual host name: ASCS_VIRTUAL_HOSTNAME
The SCS virtual host name: SCS_VIRTUAL_HOSTNAME
nfs://SERVER/PATH1
sap
nfs://SERVER/PATH2
sap
41 SAP NetWeaver installation SLES-SAP 15 SP3nfs://SERVER/PATH3
supplement
NW_ABAP_ASCS:NW750.ADA.ABAP
adm user. Provided value
# may be encoded.
DiagnosticsAgent.dasidAdmPassword =
# Windows domain in which the Diagnostics Agent users must be created.
# The property is Microsoft Windows only. This is an optional property.
DiagnosticsAgent.domain =
# Password for the Diagnostics Agent specific SAPService user.
# Provided value may be encoded.
# The property is Microsoft Windows only.
DiagnosticsAgent.sapServiceDASIDPassword =
NW_GetMasterPassword.masterPwd = MASTER_PASSWORD
# Human readable form of the Default Login language - valid names are stored
# in a table of the subcomponent NW_languagesInLoadChecks. Used when freshly
# installing an ABAP stack for the machine that performs an ABAP load (in the
# case of a distributed system, that is the database, otherwise it is used by
# the normal installer). The available languages must be declared in the
# LANGUAGES_IN_LOAD parameter of the product.xml . In this file, the one
# character representation of the languages is used. Check the same table in
# the subcomponent mentioned above.
NW_GetSidNoProfiles.SAP_GUI_DEFAULT_LANGUAGE =
# The drive to use (Windows only)
NW_GetSidNoProfiles.sapdrive =
# The /sapmnt path (Unix only)
NW_GetSidNoProfiles.sapmnt = /sapmnt
# The SAP System ID of the system to install
NW_GetSidNoProfiles.sid = SID
# Will this system be unicode system?
NW_GetSidNoProfiles.unicode = true
NW_SAPCrypto.SAPCryptoFile = /data/SAP_CDs/745-UKERNEL-SAP-Unicode-Kernel-745/DBINDEP/
SAPEXE.SAR
42 SAP NetWeaver installation SLES-SAP 15 SP3NW_SCS_Instance.ascsInstanceNumber =
NW_SCS_Instance.ascsVirtualHostname = ASCS_VIRTUAL_HOSTNAME
NW_SCS_Instance.instanceNumber = INSTANCE_NUMBER
NW_SCS_Instance.scsInstanceNumber =
NW_SCS_Instance.scsMSPort =
NW_SCS_Instance.scsVirtualHostname = SCS_VIRTUAL_HOSTNAME
NW_System.installSAPHostAgent = true
NW_Unpack.igsExeSar =
NW_Unpack.igsHelperSar =
NW_Unpack.sapExeDbSar =
NW_Unpack.sapExeSar =
NW_Unpack.sapJvmSar =
NW_Unpack.xs2Sar =
NW_adaptProfile.templateFiles =
# The FQDN of the system.
NW_getFQDN.FQDN =
# Do we want to set the FQDN for the system?
NW_getFQDN.setFQDN = false
# The path to the JCE policy archive to install into the Java home directory
# if it is not already installed.
NW_getJavaHome.jcePolicyArchive =
hostAgent.domain =
# Password for the SAP Host Agent specific sapadm user. Provided value may be
# encoded.
hostAgent.sapAdmPassword = MASTER_PASSWORD
nwUsers.sapDomain =
nwUsers.sapServiceSIDPassword =
43 SAP NetWeaver installation SLES-SAP 15 SP3nwUsers.sidadmPassword =
]]>
44 SAP NetWeaver installation SLES-SAP 15 SP35 Upgrading an SAP HANA cluster
This chapter describes how to upgrade your SAP HANA cluster with the YaST
module SUSE HANA Cluster Update. This acts as a wizard and guides you through all
the SAP HANA cluster maintenance procedures.
The ocial SAP HANA documentation describes the so-called Near Zero Downtime Upgrade
Process. The YaST module is based on this process and handles the part of the procedure related
to the SUSE cluster. Not all steps can be done automatically. Some steps need to be performed
manually by the SAP HANA administrator. The YaST module will inform you during the process.
This YaST module is available in the yast2-sap-ha package for SUSE Linux Enterprise Server
for SAP Applications 12 SP3 and higher. Currently, the wizard is only prepared to handle the
SAP HANA Scale-up Performance Optimized scenario.
The upgrade covers the following tasks:
1. Section 5.1, “Preparing the upgrade”
2. Section 5.2, “Upgrading your SAP HANA cluster”
3. Section 5.3, “Finishing the upgrade task”
5.1 Preparing the upgrade
1. Install the yast2-hana-update package on both nodes:
root # zypper install yast2-hana-update
After the installation, you can nd the module SUSE HANA Cluster Update in the YaST
Control Center.
2. On the secondary node, start the YaST Control Center and open the SUSE HANA Cluster
Update module.
3. In the YaST module, review the prerequisites. Make sure to fulll all of them before
continuing with the next step. Keep in mind that the wizard supports only the HANA Scale-
up Performance Optimized scenario.
4. To upgrade the SAP HANA system, select the secondary node.
45 Preparing the upgrade SLES-SAP 15 SP35. Select the location of the installation medium.
Point to the location where the SAP medium is located. If wanted, check Mount an update
medium on all hosts and provide the NFS share and path.
Important: Differences between SAP HANA version 1.0 and
2.0
If you are upgrading from SAP HANA version 1.0 to version 2.0, make sure to check
This is a HANA 1.0 to HANA 2.0 upgrade.
The YaST module will copy the PKI SSFS keys from the former secondary node to
the former primary node. More information is available through the Help button.
Continue with Section 5.2, “Upgrading your SAP HANA cluster”.
5.2 Upgrading your SAP HANA cluster
1. Review the update plan generated by the wizard.
The wizard shows you two steps: automatic and manual. In this automatic step, the wizard
puts cluster resources into maintenance mode before it starts with the automatic steps.
The manual steps are SAP HANA specic and need to be executed by an SAP HANA
administrator. For more information, see the ocial SAP HANA documentation.
2. Update the SAP HANA software.
The wizard executes the automatic actions and waits until the SAP HANA administrator
performs the SAP HANA upgrade.
3. Perform the SAP HANA upgrade.
4. Review the plan for the primary (remote) node.
After the SAP HANA upgrade is done, the wizard shows the update plan. When you
continue with this step, the wizard turns the primary node into a secondary node to make
it ready for the upgrade.
Keep in mind that this step can take some time.
Continue with Section 5.3, “Finishing the upgrade task”.
46 Upgrading your SAP HANA cluster SLES-SAP 15 SP35.3 Finishing the upgrade task
1. Update the former primary node.
Pay special attention to the --hdbupd_server_nostart option in this step.
2. Restore the previous state of the cluster.
By default, the wizard registers the former master as now being secondary on the SAP
HANA system replication. If you want to revert the system replication to its original state,
click the Reverse button.
3. Review the update summary.
You can review the original and current SAP HANA versions and the cluster state.
Note: Dealing with intermediate cluster state
If the wizard is faster than the status update of the cluster resources, the summary
shows an intermediate cluster state. The cluster state is UNDEFINED or DEMOTED .
To overcome this, check the cluster status again with the command SAPHanaSR-
showAttr and make sure the former secondary node is now in the state PROMOTED .
Refer to the SUSE blog post https://www.suse.com/c/how-to-upgrade-your-suse-sap-hana-cluster-
in-an-easy-way/ for further information.
47 Finishing the upgrade task SLES-SAP 15 SP36 Setting up an installation server for SAP media sets
Using the SAP Installation Wizard, it is possible to copy the SAP media sets from a remote server
(for example, via NFS or SMB). However, using the option provided there means that you need
to install the product at the same time. Additionally, it does not allow for copying all SAP media
used in your organization to a single server.
However, you can easily create such a server on your own. For example, to put the SAP media
sets on an NFS Server, proceed as follows:
PROCEDURE 6.1: ADDING SAP PRODUCT INSTALLATION FILES TO AN NFS SERVER
1. On your installation server, create the directory /srv/www/htdocs/sap_repo .
2. Open the le /etc/exports and add the following:
/srv/www/htdocs/sap_repo *(ro,no_root_squash,sync,no_subtree_check,insecure)
Important: Executable rights must be visible
Clients must be able to see which les are executable. Otherwise, SUSE''s SAP
Installation Wizard cannot execute the SAP Installer.
3. In /srv/www/htdocs/sap_repo , create a directory for every SAP medium you have. Give
these directories speaking names, so you can identify them later on. For example, you
could use names like kernel , java , or hana .
4. Copy the contents of each SAP medium to the corresponding directory with cp -a .
Important: Avoid using Windows* operating systems for
copying
Using a Windows operating system for copying from/to Windows le systems like
NTFS can break permission settings and capitalization of les and directories.
You can now install from the NFS server you set up. In the SAP Installation Wizard, specify
the path this way: server_name/srv/www/htdocs/sap_repo . For more information about
specifying the path, see Table 4.1, “Media source path”.
48 SLES-SAP 15 SP3For information about setting up an NFS server from scratch, see Administration Guide, Part
“Services”, Chapter “Sharing File Systems with NFS”, Section “Installing NFS Server” (https://
documentation.suse.com/sles-15 ).
For information about installing SUSE Linux Enterprise Server from an NFS server, see
Deployment Guide, Chapter “Remote Installation”, Section “Setting Up an NFS Repository Manually”
(https://documentation.suse.com/sles-15 ).
49 SLES-SAP 15 SP37 Setting up an SAP HANA cluster
You can use a YaST wizard to set up SAP HANA or SAP S/4HANA Database Server clusters
according to best practices, including SAP HANA system replication. A summary of the setup
options is given in Section 1.1.3, “Simplified SAP HANA system replication setup”.
Administrators can now use the SAP HANA-SR Wizard to run the module unattended, usually
for on-premises deployments. Additionally, it is possible to congure the SAP HANA cluster on
Azure now. The YaST module identies automatically when running on Azure and congures
an extra resource needed on Pacemaker.
The following Best Practices from the SUSE Linux Enterprise Server for SAP Applications
Resource Library (https://www.suse.com/products/sles-for-sap/resource-library/ ) contain setup
instructions:
Performance-optimized scenario and multi-tier/chained scenario: Setting up a SAP HANA
SR Performance Optimized Infrastructure
Cost-optimized scenario: Setting up a SAP HANA SR Cost Optimized Infrastructure
Important: Wizard can only be used for initial configuration
The YaST wizard described in the following can only be used for the initial cluster
conguration.
To recongure a cluster, use the separate YaST module Cluster (available from package
yast2-cluster ). For more information about its usage, see Administration Guide, Part
“Installation, Setup and Upgrade”, Chapter “Using the YaST Cluster Module” at https://
documentation.suse.com/sle-ha-15 .
7.1 Prerequisites
The following procedure has prerequisites:
Two machines which both have an SAP HANA installation created by the SAP Installation
Wizard or SAP HANA Application Lifecycle Management. Both machines need to be on
the same L2 network (subnet).
In the case of a multi-tier/chained scenario, there must also be a third machine elsewhere.
The machines are not yet set up as a high-availability cluster.
50 Prerequisites SLES-SAP 15 SP3openSSH is running on both machines and the nodes can reach each other via SSH.
However, if that has not already happened, the wizard will perform the SSH key exchange
itself.
For more information about SSH, see Security Guide, Part “Network Security”, Chapter “SSH:
Secure Network Operations” at https://documentation.suse.com/sles-15 .
A disk device that is available to both nodes under the same path for SBD. It must not
use host-based RAID, cLVM2 or reside on a DRBD instance. The device can have a small
size, for example, 100 MB.
You have created either:
A key in the SAP HANA Secure User Store on the primary node
An initial SAP HANA backup on the primary node
The package yast2-sap-ha is installed on both the primary and the secondary node.
HANA-Firewall is set up on both computers with the rules HANA_HIGH_AVAILABILITY and
HANA_SYSTEM_REPLICATION on all relevant network interfaces.
For information about setting up HANA-Firewall, see Section 9.2, “Configuring HANA-Firewall”.
Cost-optimized scenario only: The secondary node has a second SAP HANA installation. The
database may be running but will be stopped automatically by the wizard.
Cost-optimized scenario only: For the non-production SAP HANA instance, you have created
an SAP HANA Secure User Store key QASSAPDBCTRL for monitoring purposes. For more
information, see SAP HANA SR Cost Optimized Scenario, Chapter “Installing the SAP HANA
Databases on both cluster nodes”, Section “Postinstallation conguration”, Section “Install the
non-productive SAP HANA database (QAS)” at https://www.suse.com/products/sles-for-sap/
resource-library/ .
7.2 Setup
The following procedure needs to be executed on the primary node (also called the
“master”). Before proceeding, make sure the prerequisites listed in Section 7.1, “Prerequisites”
are fullled.
1. Open the YaST control center. In it, click HA Setup for SAP Products in the category High
Availability.
51 Setup SLES-SAP 15 SP32. If an SAP HANA instance has been detected, you can choose between the scale-up scenarios
Performance-optimized, Cost-optimized, or Chained (multi-tier). For information about these
scale-up scenarios, see Section 1.1.3, “Simplified SAP HANA system replication setup”.
Continue with Next.
3. This step of the wizard presents a list of prerequisites for the chosen scale-up scenario.
These prerequisites are the same as those presented in Section 7.1, “Prerequisites”.
Continue with Next.
4. The next step lets you congure the communication layer of your cluster.
Provide a name for the cluster.
The default transport mode Unicast is usually appropriate.
Under Number of rings, a single communication ring usually suces.
For redundancy, it is often better to use network interface bonding instead of
multiple communication rings. For more information, see Administration Guide,
Part “Conguration and Administration”, Chapter “Network Device Bonding” at https://
documentation.suse.com/sle-ha-15 .
From the list of communication rings, congure each enabled ring. To do so, click
Edit selected, then select a network mask (IP address) and a port (Port number) to
communicate over.
52 Setup SLES-SAP 15 SP3Finish with OK.
Additionally, decide whether to enable the conguration synchronization service
Csync2 and Corosync secure authentication using HMAC/SHA1.
For more information about Csync2, see Administration Guide Part “Installation, Setup
and Upgrade”, Chapter “Using the YaST Cluster Module”, Section “Transferring the
Conguration to All Nodes” at https://documentation.suse.com/sle-ha-15 .
For more information about Corosync secure authentication, see Administration
Guide, Part “Installation, Setup and Upgrade”, Chapter “Using the YaST Cluster
Module”, Section “Dening Authentication Settings” at https://documentation.suse.com/
sle-ha-15 .
Proceed with Next.
5. The wizard will now check whether it can connect to the secondary machine using SSH.
If it can, it will ask for the root password to the machine.
Enter the root password.
The next time the primary machine needs to connect to the secondary machine, it will
connect using an SSH certicate instead of a password.
6. For both machines, set up the host names and IP address (for each ring).
Host names chosen here are independent from the virtual host names chosen in SAP HANA.
However, to avoid issues with SAP HANA, host names must not include hyphen characters
( - ).
53 Setup SLES-SAP 15 SP3If this has not already been done before, such as during the initial installation of SAP
HANA, host names of all cluster servers must now be added to the le /etc/hosts . For
this purpose, activate Append to /etc/hosts.
Proceed with Next.
7. If NTP is not yet set up, do so. This avoids the two machines from running into issues
because of time dierences.
a. Click Recongure.
b. On the tab General Settings, activate Now and on Boot.
c. Add a time server by clicking Add. Click Server and Next. Then specify the IP address
of a time server outside of the cluster. Test the connection to the server by clicking
Test.
To use a public time server, click Select Public server and select a time server. Finish
with OK.
Proceed with OK.
d. On the tab Security Settings, activate Open Port in Firewall.
e. Proceed with Next.
8. In the next step, choose fencing options. The YaST wizard only supports the fencing
mechanism SBD (STONITH block device). To avoid split-brain situations, SBD uses a disk
device which stores cluster state.
The chosen disk must be available from all machines in the cluster under the same path.
Ideally, use either by-uuid or by-path for identication.
The disk must not use host-based RAID, cLVM2 or reside on a DRBD instance. The device
can have a small size, for example, 100 MB.
Warning: Data on device will be lost
All data on the chosen SBD device or devices will be deleted.
To dene a device to use, click Add, then choose an identication method such as by-uuid
and select the appropriate device. Click OK.
To dene additional SBD command line parameters, add them to SBD options.
If your machines reboot particularly fast, activate Delay SBD start.
54 Setup SLES-SAP 15 SP3For more information about fencing, see the Administration Guide at https://
documentation.suse.com/sle-ha-15 .
Proceed with Next.
9. The following page allows conguring watchdogs which protect against the failure of the
SBD daemon itself and force a reboot of the machine in such a case.
It also lists watchdogs already congured using YaST and watchdogs that are currently
loaded (as detected by lsmod ).
To congure a watchdog, use Add. Then choose the correct watchdog for your hardware
and leave the dialog with OK.
For testing, you can use the watchdog softdog . However, we highly recommend
using a hardware watchdog in production environments instead of softdog . For more
information about selecting watchdogs, see Administration Guide, Part “Storage and
Data Replication”, Chapter “Storage Protection”, Section “Conceptual Overview”, Section
“Setting Up Storage-based Protection”, Section “Setting up the Watchdog” at https://
documentation.suse.com/sle-ha-15 .
Proceed with Next.
10. Set up the parameters for your SAP HANA installation or installations. If you have selected
the cost-optimized scenario, additionally ll out details related to the non-production SAP
HANA instance.
Production SAP HANA instance
Make sure that the System ID and Instance number match those of your SAP
HANA conguration.
Replication mode and Operation mode usually do not need to be changed.
For more information about these parameters, see the HANA Administration
Guide provided to you by SAP.
Under Virtual IP address, specify a virtual IP address for the primary SAP HANA
instance. Under Virtual IP Mask, set the length of the subnetwork mask in CIDR
format to be applied to the Virtual IP address.
Prefer site takeover denes whether the secondary instance should take over the
job of the primary instance automatically (true). Alternatively, the cluster will
restart SAP HANA on the primary machine.
55 Setup SLES-SAP 15 SP3Automatic registration determines whether primary and secondary machine
should switch roles after a takeover.
Specify the site names for the production SAP HANA instance on the two nodes
in Site name 1 and Site name 2.
Having a backup of the database is a precondition for setting up SAP HANA
replication.
If you have not previously created a backup, activate Create initial backup.
Under Backup settings, congure the File name and the Secure store key for the
backup. The key in the SAP HANA Secure User Store on the primary node must
have been created before starting the wizard.
For more information, see the documentation provided to you by SAP.
Cost-optimized scenario only: Within Production system constraints, congure how
the production instance of SAP HANA should behave while inactive on the
secondary node.
Setting the Global allocation limit allows directly limiting memory usage.
Activating Preload column tables will increase memory usage.
For information about the necessary global allocation limit, see documentation
provided to you by SAP such as How to Perform System Replication for SAP HANA
at https://archive.sap.com/documents/docs/DOC-47702 .
Cost-optimized scenario only: non-production SAP HANA instance
Make sure that the System ID and Instance number match those of your non-
production SAP HANA instance.
These parameters are needed to allow monitoring the status of the non-
production SAP HANA instance using the SAPInstance resource agent.
Generate a hook script for stopping the non-production instance and starting
the production instance and removing the constraints on the production system.
The script is written in Python 2 and can be modied as necessary later.
Click Hook script and then set up the correct user name and password for the
database. Then click OK.
You can now manually verify and change the details of the generated hook
script. When you are done, click OK to save the hook script at /hana/shared/
SID/srHook .
56 Setup SLES-SAP 15 SP3Warning: Passwords stored in plain text
By default, the hook script stores all credentials in plain text. To improve
security, modify the script yourself.
Proceed with Next.
FIGURE 7.1: SAP HANA OPTIONS (COST-OPTIMIZED SCENARIO)
11. On the page High-Availability Conguration Overview, check that the setup is correct.
To change any of the conguration details, return to the appropriate wizard page by
clicking one of the underlined headlines.
Proceed with Install.
12. When asked whether to install additional software, conrm with Install.
13. After the setup is done, there is a screen showing a log of the cluster setup.
To close the dialog, click Finish.
14. Multi-tier/chain scenario only: Using the administrative user account for the production
SAP HANA instance, register the out-of-cluster node for system replication:
SIDadm > hdbnsutil -sr_register --remoteHost=SECONDARY_HOST_NAME \
--remoteInstance=INSTANCE_NUMBER --replicationMode=async \
--name=SITE_NAME
57 Setup SLES-SAP 15 SP37.3 Unattended setup using SAP HANA-SR wizard
An unattended setup requires a manual installation of HANA rst. The result is saved into a le
containing all conguration options that were chosen. If the administrator needs to reproduce
the installation, with this le the installation can be run automatically and unattended.
To use it, perform the following steps on both nodes:
1. On the production machines with SAP HANA installed, create a conguration le by
running the sap_ha YaST module.
2. On the last screen, click the Save conguration button.
3. Decide what you want to do:
• To review the conguration, upload and validate the conguration on the primary
SAP HANA machine and run:
root # yast2 sap_ha readconfig CONFIGURATION_FILE_PATH
It is possible to start the installation on the review screen.
• To start the installation based on the provided conguration le unattended, run:
root # yast2 sap_ha readconfig CONFIGURATION_FILE_PATH unattended
4. Import, validate, and install the cluster unattended, based on the provided conguration
le:
root # yast2 sap_ha readconfig CONFIGURATION_FILE_PATH unattended
7.4 Using Hawk
After you have set up the cluster using the wizard, you can open Hawk directly from the last
screen of the HA Setup for SAP Products wizard.
To revisit Hawk, open a browser and as the URL, enter the IP address or host name of any cluster
node running the Hawk Web service. Alternatively, enter the virtual IP address you congured
in Section 7.2, “Setup”.
https://HAWKSERVER:7630/
58 Unattended setup using SAP HANA-SR wizard SLES-SAP 15 SP3On the Hawk login screen, use the following login credentials:
Username: hacluster
Password: linux
Important: Secure password
Replace the default password with a secure one as soon as possible:
root # passwd hacluster
7.5 For more information
Hawk. Administration Guide, Part Conguration and Administration, Chapter Conguring and
Managing Cluster Resources with Hawk (https://documentation.suse.com/sle-ha-15 ).
Near zero downtime for SAP HANA system replication. Use
SAP HANA System Replication for Near Zero Downtime
Upgrades (https://help.sap.com/viewer/2c1988d620e04368aa4103bf26f17727/2.0.03/en-US/
ee3fd9a0c2e74733a74e4ad140fde60b.html) .
Implementing the Python hook SAPHanaSR. https://documentation.suse.com/sbp/all/html/
SLES4SAP-hana-sr-guide-PerfOpt-15/
59 For more information SLES-SAP 15 SP38 Tuning
This chapter presents information about tuning SUSE Linux Enterprise Server for SAP
Applications to work optimally with SAP applications.
8.1 Tuning systems with saptune
Using saptune , you can tune a system for SAP NetWeaver, SAP HANA/SAP BusinessObjects,
and SAP S/4HANA applications. This method relies on the system tuning service tuned .
To use saptune , make sure that the packages tuned and saptune are installed on your system.
8.1.1 Enabling saptune to tune for an SAP application
1. To tune a system, rst nd a tuning solution. To nd the appropriate solution, use:
tux > saptune solution list
saptune knows the following tuning solutions (groups of SAP notes):
BOBJ . Solution for running SAP BusinessObjects.
HANA . Solution for running an SAP HANA database.
MAXDB . Solution for running an SAP MaxDB database.
NETWEAVER . Solution for running SAP NetWeaver application servers.
S4HANA-APPSERVER . Solution for running SAP S/4HANA application servers .
S4HANA-APP+DB . Solution for running both SAP S/4HANA application servers and
SAP HANA on the same host .
S4HANA-DBSERVER . Solution for running the SAP HANA database of an SAP
S/4HANA installation .
SAP-ASE . Solution for running an SAP Adaptive Server Enterprise database.
NETWEAVER+HANA . Solution for running both SAP application servers and SAP HANA
on the same host.
60 Tuning systems with saptune SLES-SAP 15 SP3Alternatively, you can tune the computer according to recommendations from specic
SAP Notes. A list of notes that you can tune for is available via:
root # saptune note list
2. To set up saptune with a precongured solution, use:
root # saptune solution apply SOLUTION
To set up saptune for the recommendations of a specic SAP Note, use:
root # saptune note apply NOTE
Note: Combining optimizations
You can combine solutions and notes. However, only one solution can be active at
a time. In rare cases, notes can have conicting options or parameters. To avoid
conicts, order your notes, keeping in mind that the last note always overrides
conicting options or parameters of previous notes.
3. To start saptune and enable it at boot, make sure to run the following command:
root # saptune daemon start
In the background, saptune applies a tuned prole also named saptune that is dynamically
customized according to selected “solutions” and “notes”. Using tuned-adm list , you can also
see this prole.
8.1.2 Customizing an SAP note
Every SAP note can be congured freely with:
root # saptune note customise
The command includes changing a value or disabling a parameter.
61 Customizing an SAP note SLES-SAP 15 SP38.1.3 Creating a new SAP note
It is possible to create a new SAP note with:
root # saptune note create
All features of saptune are available.
8.1.4 Deleting an SAP note
This command allows deleting a created note, including the corresponding override le if
available:
root # saptune note delete test
Note to delete is a customer/vendor specific Note.
Do you really want to delete this Note (test2)? [y/n]: y
The note may not be applied at the time. Keep in mind the following points:
A conrmation is needed to nish the action.
Internal SAP notes shipped by saptune cannot be deleted. Instead, the override le is
removed when available.
If the note is already applied, the command will be terminated with the information, that
the note rst needs to be reverted before it can be deleted.
8.1.5 Renaming an SAP note
This command allows renaming a created note to a new name. If a corresponding override le
is available, this le will be renamed too:
root # saptune note rename test test2
Note to rename is a customer/vendor specific Note.
Do you really want to rename this Note (test) to the new name ''test2''? [y/n]: y
The note may not be applied at the time. Keep in mind the following points:
A conrmation is needed to nish the action.
Internal SAP notes shipped by saptune cannot be renamed.
If the note is already applied, the command will be terminated with the information, that
the note rst needs to be reverted before it can be deleted.
62 Creating a new SAP note SLES-SAP 15 SP38.1.6 Showing the configuration of an SAP note
The shipped conguration of a note can be listed with:
root # saptune note show
8.1.7 Verifying an SAP note or an SAP solution
The commands saptune note verify NOTE and saptune solution verify SOLUTION list
the following data for each active or requested note:
The parameter name
The expected value (default)
A congured override (created using saptune customise )
The current system value
Whether the current state is in accordance with the SAP recommendation
8.1.8 Simulating the application of an SAP note or an SAP solution
To show each parameter of a note , use:
root # saptune note simulate
To show each parameter of a solution , use:
root # saptune solution simulate
It lists the current system value and the expected values (default and override).
8.1.9 Disabling saptune
To disable saptune and to stop and disable tuned run:
root # saptune daemon stop
63 Showing the configuration of an SAP note SLES-SAP 15 SP38.1.10 For more information
See the following man pages:
man 8 saptune
man 8 saptune_v1
man 8 saptune_v2
man 8 saptune-migrate
man 8 saptune-note
Also see the project home page https://github.com/SUSE/saptune/ .
8.2 Tuning kernel parameters manually using sysctl
In addition to or instead of tuning kernel parameters using saptune , you can also use sysctl
to make manual adjustments to kernel parameters. However, such changes using sysctl do
not persist across reboots by default. To make them persist across reboots, add them to one of
the conguration les read by sysctl .
Tip: sysctl and saptune
If you plan to congure sysctl parameters for your SAP system, consider using saptune
as the central tool for managing such congurations.
For more information about sysctl , see the man pages sysctl(8) , sysctl.conf(5) , and
sysctl.d(5) .
8.3 Tuning Workload Memory Protection
Keeping SAP applications in physical memory is essential for their performance. In older product
versions, the Page Cache Limit prevented a swap out to disk by a growing page cache (in SUSE
Linux Enterprise Server for SAP Applications 11 SP1 onwards and in SUSE Linux Enterprise
Server for SAP Applications 12). In SUSE Linux Enterprise Server for SAP Applications 15, the
Page Cache Limit has been replaced by the more advanced Workload Memory Protection.
64 For more information SLES-SAP 15 SP3Workload Memory Protection puts SAP instances into a dedicated cgroup (v2) and tells the
kernel, by the memory.low parameter, the amount of memory to keep in physical memory. This
protects the processes in this cgroup against any form of memory pressure outside that cgroup,
including a growing page cache. Workload Memory Protection cannot protect against memory
pressure inside this cgroup. It covers the memory of all instances together on one host.
The value for memory.low depends on the kind of SAP instance and the workload and needs to
be congured manually. If the system is under extreme pressure, the Linux kernel will ignore
the memory.low value and try to stabilize the whole system, even by swapping or invoking
the OOM killer.
For more information about cgroups, see https://documentation.suse.com/sles-15/html/SLES-all/
cha-tuning-cgroups.html .
8.3.1 Architecture
WMP relies on three components:
cgroup2 memory controller (Linux kernel)
The cgroup2 memory controller parameter memory.low allows dening an amount of
memory, which the Linux kernel will keep in physical memory. This amount of memory
will be excluded from the reclaiming process unless the entire system is in a critical memory
situation.
WMP uses memory.low to prevent memory from SAP processes from being paged or
swapped out to disk. Apart from the memory controller, cgroup1 controllers are still
available, but are not mounted any more.
systemd
Systemd provides the infrastructure to create and maintain the cgroup hierarchy and allows
the conguration of cgroup parameters. WMP ships systemd conguration les to allow
easy conguration of memory.low via systemd methods.
SAP start service
The SAP start service manages the starting and stopping of SAP instances. An important
feature for WMP is the congurable execution of programs before the instance itself gets
started in the instance prole. WMP uses this method to call a program to move the
sapstart process into a designated cgroup, so the SAP instance will be started inside
that cgroup.
65 Architecture SLES-SAP 15 SP38.3.2 Support for Workload Memory Protection
WMP is supported for SUSE Linux Enterprise Server for SAP Applications 15 SP3 on Intel 64/
AMD64 and POWER for one or multiple SAP systems on one host, such as:
App Server (SAP NetWeaver, SAP S/4HANA) or
SAP HANA 1.0/2.0
Workload Memory Protection does not cover databases other than SAP HANA. Depending on
their start method, the processes might run inside or outside the dedicated cgroup. If they run
inside, the memory consumption needs to be taken into account when determining memory.low .
Important: Restrictions of WMP
Using WMP comes with benets, but you should be aware of some restrictions:
WMP cannot protect against memory pressure inside the dedicated cgroup.
WMP cannot protect SAP systems or their instances from each other. All SAP
processes share the same memory limit. If you have multiple SAP systems (for
example, SAP NetWeaver and SAP S/4HANA), WMP cannot shield one SAP
application from the other.
Support for SUSE’s HA cluster solution is not yet available.
8.3.3 Setting up Workload Memory Protection
8.3.3.1 Preparing for Workload Memory Protection
1. Check if your SAP software (SAP HANA, SAP NetWeaver etc) is installed. The group
sapsys is needed during the package installation of sapwmp later. If you skip that part,
you will get a warning message (see Important: Watch out for order of packages).
2. Stop the SAP system:
root # systemctl stop sapinit
66 Support for Workload Memory Protection SLES-SAP 15 SP3The service can be enabled, but all SAP processes need to be terminated.
3. Install the package sapwmp :
tux > sudo zypper install sapwmp
Important: Watch out for order of packages
The following message should only appear if no SAP software has been installed
on the system:
Warning: sapsys group not found warning: group sapsys does not exist - using
root
Remove the package sapwmp and install the SAP software rst before installing
sapwmp again.
As an alternative, you can x ownership and permission after installing the SAP
software with:
tux > sudo chgrp sapsys /usr/lib/sapwmp/sapwmp-capture && \
chmod +s /usr/lib/sapwmp/sapwmp-capture
The following message can be ignored:
Warning: Found memory controller on v1 hierarchy. Make sure unified hierarchy only
is used.
Switching to unied hierarchy is done in the next step.
4. Add systemd.unified_cgroup_hierarchy=true to the kernel command line by adding
it to GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub like:
GRUB_CMDLINE_LINUX_DEFAULT="... systemd.unified_cgroup_hierarchy=true swapaccount=1"
With this change, only cgroup2 controllers will be mounted on /sys/fs/cgroup . Cgroup1
controllers, except the memory controller, are still available and can be used though. Tools
using cgroup1 might not work out of the box any more and might need reconguration.
Also, the required mount structure for cgroup1 needs to be provided.
The parameter swapaccount=1 is not needed for WMP to work, but it aids the analysis
in support cases to show the amount of swapped out memory for each cgroup.
67 Setting up Workload Memory Protection SLES-SAP 15 SP35. Rewrite the GRUB2 conguration:
tux > sudo grub2-mkconfig -o /boot/grub2/grub.cfg
After reboot (will be done later), the cgroup hierarchy is switched to v2 (unied hierarchy)
only.
6. Congure MemoryLow for the SAP.slice :
tux > sudo systemctl set-property SAP.slice MemoryLow=...
This command creates a drop-in in /etc/systemd/system.control/SAP.slice.d/ to
set MemoryLow .
The sapwmp package includes the systemd conguration SAP.slice which creates the
cgroup of the same name for the SAP instances. MemoryLow is the systemd equivalent
of the cgroup parameter memory.low mentioned in the introduction. The value for
MemoryLow depends on the type of the SAP application and the workload.
For SAP HANA
Since SAP HANA has a Global Allocation Limit, its value can be used directly.
SAP Application Server (SAP NetWeaver, SAP S/4HANA)
For the Application Server, the sizing for the workload should indicate the value for
MemoryLow . The sapwmp package contains a monitoring part which might be useful
to determine MemoryLow . See Section 8.3.6, “Monitoring memory usage”.
Keep in mind:
All SAP instances on one host are inside the SAP.slice . MemoryLow must cover the
amount of memory of all instances together on that host. You cannot protect SAP
systems or their instances from each other.
If you are using a database other than SAP HANA, some database processes might
be part of SAP.slice . Their memory consumption needs to be taken into account
when determining the MemoryLow value.
Never choose a value for MemoryLow very close to or larger than your physical
memory. System services and additional installed software require memory too. If
they are forced to use swap too extensively, at the expense of the SAP application,
your system can become unresponsive.
68 Setting up Workload Memory Protection SLES-SAP 15 SP3Note: Correctly calculate MemoryLow value
MemoryLow takes the memory size in bytes. If the value is suxed with K, M, G,
or T, the specied memory size is parsed as Kibibytes, Mebibytes, Gibibytes, or
Tebibytes (with the base 1024 instead of 1000, see https://en.wikipedia.org/wiki/
Binary_prefix ), respectively. Alternatively, a percentage value may be specied,
which is taken relative to the installed physical memory on the system.
The underlying cgroup memory controller will round up the value to a multiple
of the page size. To avoid confusion, set the value for MemoryLow to a multiple of
the page size.
7. Create a backup of each SAP instance prole. Errors in a prole can prevent a SAP system
from starting.
8. For each SAP instance, add the following line to the instance prole (usually located in /
usr/sap/SID/SYS/profile/ ) after the last Execute_ line:
Execute_20 = local /usr/lib/sapwmp/sapwmp-capture -a
If necessary, increase the number of the Execute statement so that it is the highest one,
which means that that line is executed last.
Important: Editing instance profiles
Edit the instance proles directly only if you do not have the proles imported
into the database to manage them via the SAP GUI (transaction RZ11). If you have
imported them, use the SAP GUI to add the lines. Prole les located in the le
system are overwritten and any manual changes would be lost!
Now the system is ready for a reboot.
8.3.3.2 Reboot and verification
1. Reboot the system.
2. After rebooting, verify that cgroups v2 has indeed been used:
root # grep cgroup /proc/mounts
69 Setting up Workload Memory Protection SLES-SAP 15 SP3cgroup /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime 0 0
3. Verify that the cgroup was created successfully and the low memory value has been set:
tux > systemctl show -p MemoryLow SAP.slice
MemoryLow=18487889920 <- Should be your chosen value (always in bytes)!
# cat /sys/fs/cgroup/SAP.slice/memory.low
18487889920 <- Should be your chosen value!
The variable MemoryLow can be set to any value, but the content of the variable is always
a multiple of the page size. Keep this in mind if you notice a slight dierence between
the values.
4. Check that all SAP instance processes are in the correct system slices/cgroup.
If you have not enabled sapinit.service start the service now. If autostart is not enabled
in the instance proles, start the instances before you check.
Example:
root # systemd-cgls -a /sys/fs/cgroup/SAP.slice
Directory /sys/fs/cgroup/SAP.slice:
|-wmp-rd91fd6b3ca0d4c1183659ef4f9a092fa.scope
| |-3349 sapstart pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
| `-3375 er.sapHA0_ERS10 pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er N...
|-wmp-r360ebfe09bcd4df4873ef69898576199.scope
| |-3572 sapstart pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
| |-3624 dw.sapHA0_D01 pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
...
The sapstartsrv process of an instance always remains in the user slice of SIDadm . Only
the sapstart process and its children will be moved to the target cgroup.
For each instance, a directory wmp-rSCOPEID.scope exists with all processes of this
instance. The SCOPEID is a random 128-bit value in hexadecimal.
The SAP HostAgent is not covered by WMP and remains partly in sapinit.slice and
partly in the user slice of sapadm .
5. If the processes are not in the cgroup, check if the Execute lines in the instance proles
are correct. Also each instance start should now be logged in the system log /var/log/
messages :
...
2020-06-16T18:41:28.317233+02:00 server-03 sapwmp-capture: Found PIDs:
2020-06-16T18:41:28.317624+02:00 server-03 sapwmp-capture: 17001
70 Setting up Workload Memory Protection SLES-SAP 15 SP32020-06-16T18:41:28.317813+02:00 server-03 sapwmp-capture: 16994
2020-06-16T18:41:28.317959+02:00 server-03 sapwmp-capture: 16551
2020-06-16T18:41:28.319423+02:00 server-03 sapwmp-capture: Successful capture into
SAP.slice/wmp-r07a27e12d7f2491f8ccb9aeb0e080aaa.scope
2020-06-16T18:41:28.319672+02:00 server-03 systemd[1]: Started wmp-
r07a27e12d7f2491f8ccb9aeb0e080aaa.scope.
...
To verify the correct setup, run wmp-check . The script checks the setup of Workload Memory
Protection:
Correct setup of cgroup2.
Ownership and permission of the capture program.
WMP entries of SAP instance proles.
Correct cgrop of running SAP instance processes.
Correct setup of SAP.slice .
Sane conguration of MemoryLow. However, it cannot determine if the MemoryLow value
has been chosen wisely.
Setup of the optional memory sampler.
Setup of optional swap accounting.
It assumes SAP instances proles can be found beneath /usr/sap/SID/SYS/profile/ .
8.3.4 Configuring Workload Memory Protection
To congure WMP, edit /etc/sapwmp.conf :
# NOTE: Local changes may be reverted after update of WMP package. Check for
# .rpmsave file to restore & merge changes.
## Description: Slice unit name where workload is put into
## Type: string
## Default: "SAP.slice"
DEFAULT_SLICE="SAP.slice"
## Description: Comma-separated list of command names to which capture is
## applied (matching against /proc/$PID/stat)
## Type: string
71 Configuring Workload Memory Protection SLES-SAP 15 SP3## Default: sapstart
PARENT_COMMANDS=sapstart
After any change, restart all SAP instances.
Warning
Altering /etc/sapwmp.conf should not be necessary. Do not do it until you know exactly
what you are doing!
8.3.5 Changing the value of memoryLow
To change the value of MemoryLow run:
root # systemctl set-property SAP.slice MemoryLow=...
The changes will take eect immediately.
The underlying cgroup memory controller will round up the value to a multiple of the page size.
To avoid confusion, set the value of MemoryLow to a multiple of the page size.
Important: Value of MemoryLow
Never set MemoryLow to a value lower than the memory already accounted in
SAP.slice . To check, run:
root # systemctl show -p MemoryCurrent SAP.slice
8.3.6 Monitoring memory usage
Logging the memory usage can be necessary not only to determine the value for memory.low ,
but also for monitoring the correct operation of WMP.
To enable monitoring, activate the shipped timer unit:
root # systemctl enable --now wmp-sample-memory.timer
Now the timer should be listed by systemctl list-timers :
root # systemctl list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
72 Changing the value of memoryLow SLES-SAP 15 SP3...
Tue... 9min left Tue... 4s ago wmp-sample-memory.timer wmp-sample-memory.service
...
If you check the current conguration, you can see that memory data is collected every
10 minutes with a randomized delay of three minutes:
root # systemctl cat wmp-sample-memory.timer
# /usr/lib/systemd/system/wmp-sample-memory.timer
[Unit]
Description=WMP periodic log of memory consumption
[Timer]
OnCalendar=*:0/10
RandomizedDelaySec=180
AccuracySec=60
[Install]
WantedBy=timers.target
To change this, create a drop-in le and reload systemd (for example, by increasing the interval
to 30 minutes):
root # mkdir /etc/systemd/system/wmp-sample-memory.timer.d
# cat <
/etc/systemd/system/wmp-sample-memory.timer.d/override.conf
[Timer]
OnCalendar=
OnCalendar=*:0/30
EOF
# systemctl daemon-reload
(The rst OnCalendar= line is important for deleting previously dened OnCalendar= settings.)
To see the memory consumption, check the system log for lines written by
wmp_memory_current :
root # grep wmp_memory_current /var/log/messages
...
2020-09-14T12:02:40.337266+02:00 server-03 wmp_memory_current: SAP.slice :
memory.low=21474836480 memory.current=2294059008 memory.swap.current=0 , user.slice :
memory.low=0 memory.current=5499219968 memory.swap.current=0 , init.scope :
memory.low=0 memory.current=8364032 memory.swap.current=0 , system.slice : memory.low=0
memory.current=1863335936 memory.swap.current=0
73 Monitoring memory usage SLES-SAP 15 SP32020-09-14T12:03:00.767838+02:00 server-03 wmp_memory_current: SAP.slice :
memory.low=21474836480 memory.current=2294022144 memory.swap.current=0 , user.slice :
memory.low=0 memory.current=5499473920 memory.swap.current=0 , init.scope :
memory.low=0 memory.current=8364032 memory.swap.current=0 , system.slice : memory.low=0
memory.current=1862586368 memory.swap.current=0
2020-09-14T12:04:00.337315+02:00 server-03 wmp_memory_current: SAP.slice :
memory.low=21474836480 memory.current=2294022144 memory.swap.current=0 , user.slice :
memory.low=0 memory.current=5499207680 memory.swap.current=0 , init.scope :
memory.low=0 memory.current=8355840 memory.swap.current=0 , system.slice : memory.low=0
memory.current=1862746112 memory.swap.current=0
...
Here is a reformatted log line to get a better impression:
2020-09-14T12:02:40.337266+02:00 server-03 wmp_memory_current:
SAP.slice : memory.low=21474836480 memory.current=2294059008 memory.swap.current=0 ,
user.slice : memory.low=0 memory.current=5499219968 memory.swap.current=0 ,
init.scope : memory.low=0 memory.current=8364032 memory.swap.current=0 ,
system.slice : memory.low=0 memory.current=1863335936 memory.swap.current=0
For each cgroup directly below /sys/fs/cgroup/ one comma-separated block exists. On a
normal system, you should nd at least user.slice , system.slice , and init.scope . WMP
adds SAP.slice .
Each block contains the information about the current value of memory.low and
memory.current , and the currently allocated amount of physical memory of processes in this
cgroup.
If you enabled swap accounting ( swapaccount=1 ) during setup, you also have
memory.swap.current , the amount of swapped-out memory of the cgroup.
All values are in bytes. See Step 6 in Section 8.3.3.1, “Preparing for Workload Memory Protection”.
Tip: Script for printing
You can nd a script to print the information as table or CSV here: https://github.com/
scmschmidt/wmp_log_extract
8.3.7 Verifying correct operation
Besides monitoring memory consumption and swapping (see Section 8.3.6, “Monitoring memory
usage”), you should also regularly check that all SAP instance processes are in their scopes below
SAP.slice .
74 Verifying correct operation SLES-SAP 15 SP3To do so, run systemd-cgls and check each instance process.
Example:
root # systemd-cgls -a /sys/fs/cgroup/SAP.slice
Directory /sys/fs/cgroup/SAP.slice:
|-wmp-rd91fd6b3ca0d4c1183659ef4f9a092fa.scope
| |-3349 sapstart pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
| `-3375 er.sapHA0_ERS10 pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er N...
|-wmp-r360ebfe09bcd4df4873ef69898576199.scope
| |-3572 sapstart pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
| |-3624 dw.sapHA0_D01 pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
...
A simpler test would be to list all processes, including cgroups, for all SID s used on the system.
Example:
tux > ps -eo user,pid,cgroup:60,args | grep -e [h]a0adm
ha0adm 2062 0::/user.slice/user-1001.slice/user@1001.service/init.scope /usr/lib/
systemd/systemd --user
ha0adm 2065 0::/user.slice/user-1001.slice/user@1001.service/init.scope (sd-pam)
ha0adm 3081 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope sapstart pf=/
usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3133 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope
ms.sapHA0_ASCS00 pf=/usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3134 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope
en.sapHA0_ASCS00 pf=/usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3327 0::/SAP.slice/wmp-ra42489517eb846c282c57681e627a496.scope sapstart pf=/
usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
...
All instance processes except sapstartsrv need to be in a scope below 0::/SAP.slice/ .
To verify the correct setup, use the wmp-check tool. See Section 8.3.3.2, “Reboot and verification”
for more details.
8.3.8 Uninstalling Workload Memory Protection
1. Stop the SAP system completely. The sapinit.service has to be stopped, but can stay
enabled. All SAP processes have to be terminated.
2. Remove any changes made to SAP.slice , such as setting MemoryLow :
root # systemctl revert SAP.slice
75 Uninstalling Workload Memory Protection SLES-SAP 15 SP33. (Optional) Remove the package sapwmp :
root # zypper remove sapwmp
This step is optional. The package can stay on the system without having an inuence.
4. (Optional) Remove systemd.unified_cgroup_hierarchy=true from
GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub .
This step is optional. You can keep cgroup2 without using WMP.
5. Rewrite the GRUB2 conguration:
root # grub2-mkconfig -o /boot/grub2/grub.cfg
After the next boot, the system is switched back to the hybrid cgroup hierarchy.
6. Remove the line to call sapwmp-capture from each SAP instance prole (usually located
in /usr/sap/SID/SYS/profile/ ):
Execute_20 = local /usr/lib/sapwmp/sapwmp-capture -a
Important: Backup is necessary
Before editing an instance prole, create a backup! Errors in a prole can prevent
an SAP system from starting!
Important: About editing profiles directly
Edit the instance proles directly only if you have not imported the proles into the
database to manage them via the SAP GUI (transaction RZ11). If you have imported
them, use the SAP GUI to add the lines. Prole les located in the le system are
overwritten, and any manual changes will be lost!
7. Reboot the system and verify that your SAP system has been started successfully.
76 Uninstalling Workload Memory Protection SLES-SAP 15 SP39 Firewalling
This chapter presents information about restricting access to the system using rewalling and
encryption and gives information about connecting to the system remotely.
9.1 Configuring firewalld
By default, the installation workow of SUSE Linux Enterprise Server for SAP Applications
enables firewalld .
Note: firewalld replaces SuSEfirewall2
SUSE Linux Enterprise Server for SAP Applications 15 GA introduces firewalld as
the new default software rewall, replacing SuSErewall2. SuSErewall2 has not been
removed from SUSE Linux Enterprise Server for SAP Applications 15 GA and is still part of
the main repository, though not installed by default. If you are upgrading from a release
older than SUSE Linux Enterprise Server for SAP Applications 15 GA, SuSErewall2 will
be unchanged and you must manually upgrade to firewalld (see Security Guide).
The rewall needs to be manually congured to allow network access for the following:
SAP application
Database (see the documentation of your database vendor; for SAP HANA, see Section 9.2,
“Configuring HANA-Firewall”)
Additionally, open the ports 1128 (TCP) and 1129 (UDP).
SAP applications require many open ports and port ranges in the rewall. The exact numbers
depend on the selected instance. For more information, see the documentation provided to you
by SAP.
9.2 Configuring HANA-Firewall
To simplify setting up a rewall for SAP HANA, install the package HANA-Firewall . HANA-
Firewall adds rule sets to your existing SuSErewall2 conguration.
77 Configuring firewalld SLES-SAP 15 SP3HANA-Firewall consists of the following parts:
YaST module SAP HANA firewall. Allows conguring, applying, and reverting rewall rules
for SAP HANA from a graphical user interface.
Command-line utility hana-firewall . Creates XML les containing rewall rules for SAP
HANA.
If you prefer, you can congure the rule sets using the conguration le at /etc/
sysconfig/hana-firewall instead of using YaST.
Important: SAP HANA MDC databases
For multi-tenant SAP HANA (MDC) databases, determining the port numbers that need
to be opened is not yet possible automatically. If you are working with a multi-tenant
SAP HANA database system, before you use YaST, run a script on the command line to
create a new service denition:
root # cd /etc/hana-firewall.d
root # hana-firewall define-new-hana-service
You need to switch to the directory /etc/hana-firewall.d , otherwise the rule le for
the new service will be created in a place where it cannot be used.
The script will ask several questions: Importantly, it will ask for TCP and UDP port ranges
that need to be opened.
Note: Install HANA-Firewall packages
Before continuing, make sure that the packages HANA-Firewall and yast2-hana-
firewall are installed.
PROCEDURE 9.1: USING HANA-FIREWALL
1. Make sure the SAP HANA databases for which you want to congure the rewall are
correctly installed.
2. To open the appropriate YaST module, select Applications YaST, Security and Users SAP
HANA Firewall.
3. Under Global Options, activate Enable Firewall. Additionally, decide whether to Allow
Remote Shell Access (SSH).
78 Configuring HANA-Firewall SLES-SAP 15 SP34. Choose a network interface under Allowed Services on Network Interface.
5. Allow network services by selecting them in the list box on the left and clicking →. Remove
services by selecting them in the list box on the right and clicking ←.
To add services other than the precongured ones, use the following notation:
SERVICE_NAME:CIDR_NOTATION
For more information about the CIDR notation, see https://en.wikipedia.org/wiki/
Classless_Inter-Domain_Routing . To nd out which services are available on your system,
use getent services .
6. Repeat from Step 4 for all network interfaces.
7. When you are done, click OK.
The rewall rules from HANA-Firewall will now be compiled and applied. Then, the
service hana-firewall will be restarted.
8. Finally, check whether HANA-Firewall was enabled correctly:
root # hana-firewall status
HANA firewall is active. Everything is OK.
For more information, see the man page of hana-firewall .
79 Configuring HANA-Firewall SLES-SAP 15 SP39.3 SAProuter integration
The SAProuter software from SAP allows proxying network trac between dierent SAP
systems or between an SAP system and outside networks. SUSE Linux Enterprise Server for SAP
Applications now provides integration for SAProuter into systemd . This means that SAProuter
will be started and stopped properly with the operating system and can be controlled using
systemctl .
Before you can use this functionality, make sure the following has been installed, in this order:
An SAP application that includes SAProuter
The SAProuter systemd integration, packaged as saprouter-systemd
If you got the order of applications to install wrong initially, reinstall saprouter-systemd .
To control SAProuter with systemctl , use:
Enabling the SAProuter service: systemctl enable saprouter
Starting the SAProuter service: systemctl start saprouter
Showing the Status of SAProuter service: systemctl status saprouter
Stopping the SAProuter service: systemctl stop saprouter
Disabling the SAProuter service: systemctl disable saprouter
80 SAProuter integration SLES-SAP 15 SP310 Protecting against malware with ClamSAP
ClamSAP integrates the ClamAV anti-malware toolkit into SAP NetWeaver and SAP Mobile
Platform applications. ClamSAP is a shared library that links between ClamAV and the SAP
NetWeaver Virus Scan Interface (NW-VSI). The version of ClamSAP shipped with SUSE Linux
Enterprise Server for SAP Applications 15 SP3 supports NW-VSI version 2.0.
10.1 Installing ClamSAP
1. On the application host, install the packages for ClamAV and ClamSAP. To do so, use the
command:
tux > sudo zypper install clamav clamsap
2. Before you can enable the daemon clamd , initialize the malware database:
tux > sudo freshclam
3. Start the service clamd :
tux > sudo systemctl start clamd
4. Check the status of the service clamd with:
tux > systemctl status clamd
● clamd.service - ClamAV Antivirus Daemon
Loaded: loaded (/usr/lib/systemd/system/clamd.service; enabled; vendor preset:
disabled)
Active: active (running) since Tue 2017-04-11 10:33:03 UTC; 24h ago
[...]
10.2 Creating a virus scanner group in SAP
NetWeaver
1. Log in to the SAP NetWeaver installation through the GUI. Do not log in as a DDIC or
SAP* user, because the virus scanner needs to be congured cross-client.
2. Create a Virus Scanner Group using the transaction VSCANGROUP.
81 Installing ClamSAP SLES-SAP 15 SP33. To switch from view mode to change mode, click the button Change View ( ).
Conrm the message This table is cross-client by clicking the check mark. The table is now
editable.
4. Select the rst empty row. In the text box Scanner Group, specify CLAMSAPVSI . Under
Group Text, specify CLAMSAP .
Make sure that Business Add-in is not checked.
5. To save the form, click the button Save ( ).
10.3 Setting up the ClamSAP library in SAP
NetWeaver
1. In the SAP NetWeaver GUI, call the transaction VSCAN.
2. To switch from view mode to change mode, click the button Change View ( ).
Conrm the message This table is cross-client by clicking the check mark. The table is now
editable.
3. Click New entries.
82 Setting up the ClamSAP library in SAP NetWeaver SLES-SAP 15 SP34. Fill in the form accordingly:
Provider Type: Adapter (Virus Scan Adapter)
Provider Name: VSA_HOSTNAME (for example: VSA_SAPSERVER )
Scanner Group : The name of the scanner group that you set up in Section 10.2,
“Creating a virus scanner group in SAP NetWeaver” (for example: CLAMSAPVSI )
Server: HOSTNAME_SID_INSTANCE_NUMBER (for example: SAPSERVER_P04_00 )
Adapter Path: libclamdsap.so
5. To save the form, click the button .
10.4 Configuring the default location of virus
definitions
By default, ClamAV expects the virus denitions to be located in /var/lib/clamsap . To change
this default location, proceed as follows:
1. Log in to the SAP NetWeaver installation through the GUI. Do not log in as a DDIC or
SAP* user, because the virus scanner needs to be congured cross-client.
2. Select the CLAMSAPVSI group.
83 Configuring the default location of virus definitions SLES-SAP 15 SP33. In the left navigation pane, click Conguration Parameters.
4. To switch from view mode to change mode, click the button Change View ( ).
Conrm the message This table is cross-client by clicking the check mark. The table is now
editable.
FIGURE 10.1:
5. Click New Entries and select INITDRIVERDIRECTORY .
FIGURE 10.2:
6. Enter the path to a dierent virus scanner location.
7. To save the form, click the button Save ( ).
10.5 Engaging ClamSAP
To run ClamSAP, go to the transaction VSCAN. Then click Start.
84 Engaging ClamSAP SLES-SAP 15 SP3FIGURE 10.3: CHANGE VIEW “VIRUS SCAN PROVIDER DEFINITION”
Afterward, a summary will be displayed, including details of the ClamSAP and ClamAV (shown
in Figure 10.4, “Summary of ClamSAP data”).
85 Engaging ClamSAP SLES-SAP 15 SP3FIGURE 10.4: SUMMARY OF CLAMSAP DATA
10.6 For more information
For more information, also see the project home page https://sourceforge.net/projects/
clamsap/ .
86 For more information SLES-SAP 15 SP311 Connecting via RDP
If you installed SLES-SAP with the RDP option activated or if you installed from a KIWI image,
RDP is enabled on the machine via the service xrdp . Alternatively, you can enable RDP later
as described at the end of this section.
You can connect using any software that supports RDP, such as:
Linux: Vinagre (available in SUSE Linux Enterprise Desktop/SLE-WE and openSUSE) or
Remmina (available in openSUSE)
Windows: Remote Desktop Connection
Important: Connection parameters
Make sure to set up the connection with the following parameters:
Port: 3389
Color depth: 16-bit or 24-bit only
PROCEDURE 11.1: SETTING UP RDP
If you have not set up an RDP connection during the installation, you can also do so later
using the following instructions.
1. First, create the necessary exception for your rewall, opening port TCP 3389 in all
relevant zones. For example, if your internal network uses the internal zone, use the
following command:
root # firewall-cmd --zone=internal --add-port=3389/tcp
This is a temporary assignment for testing the new setting. If you need to change more
than one zone, change and test each zone one at a time.
2. When you are satised that new conguration is correct, make it permanent:
root # firewall-cmd --runtime-to-permanent
root # firewall-cmd --reload
Find more information on using rewalld in https://docs.suse.com/sles/15/single-html/SLES-
security/#sec-security-firewall-firewalld .
87 SLES-SAP 15 SP312 Creating operating system images
There are multiple ways to create custom operating system images from SUSE Linux Enterprise
Server for SAP Applications. The preferred way is generally to use KIWI, which ingests an XML
conguration le and then runs fully automatically.
Alternatively, you can also create an image from an existing installation that is cleaned up before
re-use.
12.1 Creating images with KIWI
KIWI is a tool to create operating system images that can be easily copied to new physical or
virtual machines. This section will present information on creating SLES-SAP images with KIWI.
SUSE Linux Enterprise Server for SAP Applications now supports creating images with
KIWI using the template from the package kiwi-template-sap . However, there are certain
restrictions in the current implementation:
Only building VMX disk images is supported. Building other image types is not supported.
You must provide an ISO image of SUSE Linux Enterprise Server for SAP Applications at
/tmp/SLES4SAP.iso , as the Open Build Service does not contain all necessary packages.
To build a basic image, use the following two commands:
1. Build the root le system:
root # kiwi -p SLES4SAP --root fsroot
2. Build the VMX image:
root # kiwi --create fsroot --type vmx -d build
To enable running graphical installations using SAPinst, the default settings of the image enable
the following:
Installation of an IceWM desktop
The service xrdp is started automatically, so you can connect to the machine via RDP.
For more information, see Chapter 11, Connecting via RDP.
88 Creating images with KIWI SLES-SAP 15 SP3For more information about KIWI and SLES-SAP:
On the KIWI conguration for SLES-SAP, see /usr/share/kiwi/image/SLES4SAP/
README .
On KIWI in general, see the openSUSE-KIWI Image System Cookbook (https://
doc.opensuse.org/projects/kiwi/doc/ ).
12.2 Cleaning up an instance before using it as a
master image
In some cases, it makes sense to use an image of an already-congured master instance on
multiple systems instead of generating a KIWI image from scratch. For example, when your
image needs to contain additional software or conguration that cannot be installed using KIWI.
However, normally such an image would contain certain conguration data that should not be
copied along with the rest of the system.
To avoid needing to clean up manually, use the script clone-master-clean-up (available from
the package of the same name).
It deletes the following data automatically:
Swap device (zero-wiped, then re-enabled)
SUSE registration information and repositories from SUSE, and the Zypper ID
User and host SSH keys and domain and host names
The generated HANA-Firewall script (but not the conguration itself)
Shell history, mails, cron jobs, temporary les ( /tmp , /var/tmp ), log les ( /var/log ),
random seeds, systemd journal, collectd statistics, postfix conguration, parts of /
root
/var/cache , /var/crash , /var/lib/systemd/coredump
Additionally, the following conguration is restored to defaults:
Network interfaces that do not use DHCP and network conguration ( /etc/hostname , /
etc/hosts , and /etc/resolv.conf )
sudo settings
89 Cleaning up an instance before using it as a master image SLES-SAP 15 SP3Additionally, you can choose to set up a new root password. UUID-based entries in /etc/
fstab are replaced by device strings. This script also ensures that if the rst-boot section of the
installation workow was used for the original installation, it is run again on the next boot.
12.2.1 Configuring clone-master-clean-up
Before running clone-master-clean-up , the script can be congured in the following ways:
To congure the script to not clean up certain data, use the conguration le /etc/
sysconfig/clone-master-clean-up .
This le also gives short explanations of the available options.
To congure the script to clean up additional directories or les, create a list with the
absolute paths of such directories and les:
/additional/file/to/delete.now
/additional/directory/to/remove
Save this list as /var/adm/clone-master-clean-up/custom_remove .
12.2.2 Using clone-master-clean-up
To use the script, do:
root # clone-master-clean-up
Then follow the instructions.
12.2.3 For more information
The following sources provide additional information about clone-master-clean-up :
For general information, see the man page clone-master-clean-up .
For information on which les and directories might additionally be useful to delete, see
/var/adm/clone-master-clean-up/custom_remove.template .
90 Configuring clone-master-clean-up SLES-SAP 15 SP313 Important log files
The most important log les for this product can be found as follows:
The SAP Installation Wizard is a YaST module. You can nd its log entries in /var/log/
YaST/y2log .
All SAP knowledge is bundled in a library. You can nd its log entries in /var/log/
SAPmedia.log .
You can nd log les related to auto-installation in /var/adm/autoinstall/logs .
91 SLES-SAP 15 SP3A Additional software for SLES-SAP
SUSE Linux Enterprise Server for SAP Applications makes it easy to install software that is not
included with your subscription:
Extensions and modules allow installing additional software created and supported by
SUSE. For more information about extensions and modules, see Deployment Guide, Part
“Initial System Conguration”, Chapter “Installing Modules, Extensions, and Third Party Add-
On Products” at https://documentation.suse.com/sles-15 .
SUSE Connect Program allows installing packages created and supported by third parties,
specically for SLES-SAP. It also gives easy access to third-party trainings and support. See
Section A.2, “SUSE Connect Program”.
SUSE Package Hub allows installation of packages created by the SUSE Linux Enterprise
community without support. See Section A.3, “PackageHub”.
A.1 Identifying a base product for SUSE Linux
Enterprise Server for SAP Applications
To identify and distinguish SUSE products, use one of the following les:
/etc/os-release
A text le with key-value pairs, similar to shell-compatible variable assignments. Each key
is on a separate line.
You can search for the CPE_NAME key; however, between dierent releases and service
packs, the value may have been changed. If you need further details, refer to the article
at https://www.suse.com/support/kb/doc/?id=7023490 .
/etc/product.d/baseproduct
A link to an XML le. The /etc/product.d/ directory contains dierent .prod les.
Depending on which products you have purchased and how you installed your system,
the link /etc/product.d/baseproduct can point to a dierent .prod le, for example,
sle-module-sap-applications.prod . The same information as CPE_NAME is stored in
the tag .
Identifying a base product for SUSE Linux Enterprise Server for SAP Applications SLES-SAP
92 15 SP3Among other information, both les contain the operating system and base product. The
base product (key CPE_NAME and tag ) follow the Common Platform Enumeration
Specification (http://scap.nist.gov/specifications/cpe/) .
You can extract any information from the le /etc/product.d/baseproduct either with the
commands grep or xmlstarlet (both are available for your products). As XML is also text,
use grep for “simple searches” when the format of the output does not matter much. However,
if your search is more advanced, you need the output in another script, or you want to avoid
the XML tags in the output, use the xmlstarlet command instead.
For example, to get your base product, use grep like this:
tux > grep cpeid /etc/products.d/baseproduct
cpe:/o:suse:sle-module-sap-applications:RELEASE:spSP_NUMBER
The RELEASE and SP_NUMBER are placeholders and describe your product release number and
service pack.
The same can be achieved with xmlstarlet . You need an XPath (the steps that lead you to
your information). With the appropriate options, you can avoid the / tags:
tux > xmlstarlet sel -T -t -v "/product/cpeid" /etc/products.d/baseproduct
cpe:/o:suse:sle-module-sap-applications:RELEASE:spSP_NUMBER
A more advanced search (which would be dicult for grep ) would be to list all required
dependencies to other products. Assuming that basename points to sle-module-sap-
applications.prod , the following command will output all product dependencies which are
required for SUSE Linux Enterprise Server for SAP Applications:
>tux > xmlstarlet sel -T -t -v "/product/productdependency[@relationship=''requires'']/
@name" /etc/products.d/baseproduct
SUSE_SLE
sle-ha
A.2 SUSE Connect Program
Start SUSE Connect Program from the YaST control center using SUSE Connect Program. Choose
from the available options. To enable a software repository, click Add repository.
All software enabled by SUSE Connect Program originates from third parties. For support,
contact the vendor in question. SUSE does not provide support for these oerings.
93 SUSE Connect Program SLES-SAP 15 SP3Note: SUSEConnect command line tool
The SUSEConnect command line tool is a separate tool with a dierent purpose: It allows
you to register installations of SUSE products.
A.3 PackageHub
PackageHub provides many packages for SLE that were previously only available on openSUSE.
Packages from SUSE Package Hub are created by the community and come without support.
The selection includes, for example:
The R programming language
The Haskell programming language
The KDE 5 desktop
To enable PackageHub, add the repository as described at https://packagehub.suse.com/how-to-
use/ .
For more information, see the PackageHub Web site at https://packagehub.suse.com .
94 PackageHub SLES-SAP 15 SP3B Partitioning for the SAP system using AutoYaST
Partitioning for the SAP system is controlled by the les from the directory /usr/share/YaST2/
include/sap-installation-wizard/ . The following les can be used:
SAP NetWeaver or SAP S/4HANA Application Server installation.
base_partitioning.xml
SAP HANA or SAP S/4HANA Database Server installation. hana_partitioning.xml
SAP HANA or SAP S/4HANA Database Server installation on SAP BusinessOne-certified
hardware. hardware-specic partitioning le
The les will be chosen as dened in /etc/sap-installation-wizard.xml . Here, the content
of the element partitioning is decisive.
If the installation is, for example, based on HA or a distributed database, no partitioning is
needed. In this case, partitioning is set to NO and the le base_partitioning.xml is used.
Note: autoinst.xml Cannot Be Used Here
autoinst.xml is only used for the installation of the operating system. It cannot control
the partitioning for the SAP system.
The les that control partitioning are AutoYaST control les that contain a partitioning
section only. However, these les allow using several extensions to the AutoYaST format:
If the partitioning_defined tag is set to true , the partitioning will be performed
without any user interaction.
By default, this is only used when creating SAP HANA le systems on systems certied for
SAP HANA (such as from Dell, Fujitsu, HP, IBM, or Lenovo).
For every partition, you can specify the size_min tag. The size value can be given as a
string in the format of RAM*N . This way you can specify how large the partition should
minimally be ( N times the size of the available memory ( RAM )).
PROCEDURE B.1: CREATING A CUSTOM SAP PARTITIONING SETUP
The steps below illustrate how to create a partitioning setup for TREX. However, creating
a partitioning setup for other applications works analogously.
95 SLES-SAP 15 SP31. In /usr/share/YaST2/include/sap-installation-wizard/ , create a new XML le.
Name it TREX_partitioning.xml , for example.
2. Copy the content of base_partitioning.xml to your new le and adapt the new le
to your needs.
3. Finally, adapt /etc/sap-installation-wizard.xml to include your custom le. In the
listitem for TREX , insert the following line:
TREX_partitioning
Important: Do not edit base_partitioning.xml
Do not edit base_partitioning.xml directly. With the next update, this le will be
overwritten.
For more information about partitioning with AutoYaST, see AutoYaST Guide, Chapter
“Partitioning” (https://documentation.suse.com/sles-15 ).
96 SLES-SAP 15 SP3C Supplementary Media
Supplementary Media allow partners or customers to add their own tasks or workows to the
Installation Wizard.
This is done by adding an XML le which will be part of an AutoYaST XML le. To be included
in the workow, this le must be called product.xml .
This can be used for various types of additions, such as adding your own RPMs, running your
own scripts, setting up a cluster le system or creating your own dialogs and scripts.
C.1 product.xml
The product.xml le looks like a normal AutoYaST XML le, but with some restrictions.
The restrictions exist because only the parts of the XML that are related to the second stage of
the installation are run, as the rst stage was executed before.
The two XML les ( autoyast.xml and product.xml ) will be merged after the media is read
and a “new” AutoYaST XML le is generated on the y for the additional workow.
The following areas or sections will be merged:
1
...
2
...
3
4
5
...
1 see Section C.2, “Own AutoYaST ask dialogs”
2 see Section C.3, “Installing additional packages”
3 after the package installation, before the rst boot
4 during the rst boot of the installed system, no services running
5 during the rst boot of the installed system, all services up and running
All other sections will be replaced.
97 product.xml SLES-SAP 15 SP3For more information about customization options, see AutoYaST Guide, Chapter “Conguration
and Installation Options”, Section “Custom User Scripts” (https://documentation.suse.com/
sles-15 ).
C.2 Own AutoYaST ask dialogs
For more information about the “Ask” feature of AutoYaST, see AutoYaST Guide, Chapter
“Conguration and Installation Options”, Section “Ask the User for Values During Installation”
(https://documentation.suse.com/sles-15 ).
For the Supplementary Media, you can only use dialogs within the cont stage ( cont ), which means they are executed after the rst reboot.
Your le with the dialogs will be merged with the base AutoYaST XML le.
As a best practice, your dialog should have a dialog number and an element number, best with
steps of 10. This helps to include later additions and could be used as targets for jumping over
a dialog or element dependent on decisions. We also use this in our base dialogs and if you
provide the right dialog number and element number, you can place your dialog between our
base dialogs.
You can store the answer to a question in a le, to use it in one of your scripts later. Be aware
that you must use the prex /tmp/ay for this, because the Installation Wizard will copy such
les from the /tmp directory to the directory where your media data also will be copied. This
is done because the next Supplementary Media could have the same dialogs or same answer le
names and would overwrite the values saved here.
Here is an example with several options:
cont
10
What is your name?
Enter your name here
Please enter your full name within the field
/tmp/ay_q_my_name
98 Own AutoYaST ask dialogs SLES-SAP 15 SP3
C.3 Installing additional packages
You can also install RPM packages within the product.xml le. To do this, you can use the
element for installation in stage 2.
For more information, see AutoYaST Guide, Chapter “Conguration and Installation Options”,
Section “Installing Packages in Stage 2” (https://documentation.suse.com/sles-15 ). An example
looks as follows:
...
yast2-cim
...
99 Installing additional packages SLES-SAP 15 SP3C.4 Example directory for Supplementary Media
A minimal example for the Supplementary Media directory contains only a le called
product.xml .
100 Example directory for Supplementary Media SLES-SAP 15 SP3D GNU licenses
XML for which the DTD and/or processing tools are not generally available, and the machine-
This appendix contains the GNU Free generated HTML, PostScript or PDF produced by some word processors for output purposes
only.
Documentation License version 1.2. The "Title Page" means, for a printed book, the title page itself, plus such following pages as
are needed to hold, legibly, the material this License requires to appear in the title page. For
works in formats which do not have any title page as such, "Title Page" means the text near the
GNU Free Documentation License most prominent appearance of the work''s title, preceding the beginning of the body of the text.
A section "Entitled XYZ" means a named subunit of the Document whose title either is precisely
Copyright (C) 2000, 2001, 2002 Free Software Foundation, Inc. 51 Franklin St, Fifth Floor, XYZ or contains XYZ in parentheses following text that translates XYZ in another language.
Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies (Here XYZ stands for a specic section name mentioned below, such as "Acknowledgements",
of this license document, but changing it is not allowed. "Dedications", "Endorsements", or "History".) To "Preserve the Title" of such a section when
you modify the Document means that it remains a section "Entitled XYZ" according to this
0. PREAMBLE denition.
The Document may include Warranty Disclaimers next to the notice which states that this
The purpose of this License is to make a manual, textbook, or other functional and useful License applies to the Document. These Warranty Disclaimers are considered to be included
document "free" in the sense of freedom: to assure everyone the eective freedom to copy by reference in this License, but only as regards disclaiming warranties: any other implication
and redistribute it, with or without modifying it, either commercially or non-commercially. that these Warranty Disclaimers may have is void and has no eect on the meaning of this
Secondarily, this License preserves for the author and publisher a way to get credit for their License.
work, while not being considered responsible for modications made by others.
This License is a kind of "copyleft", which means that derivative works of the document must 2. VERBATIM COPYING
themselves be free in the same sense. It complements the GNU General Public License, which
is a copyleft license designed for free software. You may copy and distribute the Document in any medium, either commercially or non-
We have designed this License to use it for manuals for free software, because free software commercially, provided that this License, the copyright notices, and the license notice saying
needs free documentation: a free program should come with manuals providing the same this License applies to the Document are reproduced in all copies, and that you add no other
freedoms that the software does. But this License is not limited to software manuals; it can conditions whatsoever to those of this License. You may not use technical measures to obstruct
be used for any textual work, regardless of subject matter or whether it is published as a or control the reading or further copying of the copies you make or distribute. However, you
printed book. We recommend this License principally for works whose purpose is instruction may accept compensation in exchange for copies. If you distribute a large enough number of
or reference. copies you must also follow the conditions in section 3.
You may also lend copies, under the same conditions stated above, and you may publicly
1. APPLICABILITY AND DEFINITIONS display copies.
This License applies to any manual or other work, in any medium, that contains a notice placed 3. COPYING IN QUANTITY
by the copyright holder saying it can be distributed under the terms of this License. Such a
notice grants a world-wide, royalty-free license, unlimited in duration, to use that work under If you publish printed copies (or copies in media that commonly have printed covers) of the
the conditions stated herein. The "Document", below, refers to any such manual or work. Any Document, numbering more than 100, and the Document''s license notice requires Cover Texts,
member of the public is a licensee, and is addressed as "you". You accept the license if you you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts:
copy, modify or distribute the work in a way requiring permission under copyright law. Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers
A "Modied Version" of the Document means any work containing the Document or a portion must also clearly and legibly identify you as the publisher of these copies. The front cover
of it, either copied verbatim, or with modications and/or translated into another language. must present the full title with all words of the title equally prominent and visible. You may
A "Secondary Section" is a named appendix or a front-matter section of the Document that add other material on the covers in addition. Copying with changes limited to the covers, as
deals exclusively with the relationship of the publishers or authors of the Document to the long as they preserve the title of the Document and satisfy these conditions, can be treated
Document''s overall subject (or to related matters) and contains nothing that could fall directly as verbatim copying in other respects.
within that overall subject. (Thus, if the Document is in part a textbook of mathematics, a If the required texts for either cover are too voluminous to t legibly, you should put the
Secondary Section may not explain any mathematics.) The relationship could be a matter rst ones listed (as many as t reasonably) on the actual cover, and continue the rest onto
of historical connection with the subject or with related matters, or of legal, commercial, adjacent pages.
philosophical, ethical or political position regarding them. If you publish or distribute Opaque copies of the Document numbering more than 100, you
The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being must either include a machine-readable Transparent copy along with each Opaque copy,
those of Invariant Sections, in the notice that says that the Document is released under this or state in or with each Opaque copy a computer-network location from which the general
License. If a section does not t the above denition of Secondary then it is not allowed to be network-using public has access to download using public-standard network protocols a
designated as Invariant. The Document may contain zero Invariant Sections. If the Document complete Transparent copy of the Document, free of added material. If you use the latter
does not identify any Invariant Sections then there are none. option, you must take reasonably prudent steps, when you begin distribution of Opaque copies
The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or in quantity, to ensure that this Transparent copy will remain thus accessible at the stated
Back-Cover Texts, in the notice that says that the Document is released under this License. A location until at least one year after the last time you distribute an Opaque copy (directly or
Front-Cover Text may be at most 5 words, and a Back-Cover Text may be at most 25 words. through your agents or retailers) of that edition to the public.
A "Transparent" copy of the Document means a machine-readable copy, represented in a It is requested, but not required, that you contact the authors of the Document well before
format whose specication is available to the general public, that is suitable for revising redistributing any large number of copies, to give them a chance to provide you with an
the document straightforwardly with generic text editors or (for images composed of pixels) updated version of the Document.
generic paint programs or (for drawings) some widely available drawing editor, and that
is suitable for input to text formatters or for automatic translation to a variety of formats
suitable for input to text formatters. A copy made in an otherwise Transparent le format
whose markup, or absence of markup, has been arranged to thwart or discourage subsequent
modication by readers is not Transparent. An image format is not Transparent if used for
any substantial amount of text. A copy that is not "Transparent" is called "Opaque".
Examples of suitable formats for Transparent copies include plain ASCII without markup,
Texinfo input format, LaTeX input format, SGML or XML using a publicly available DTD,
and standard-conforming simple HTML, PostScript or PDF designed for human modication.
Examples of transparent image formats include PNG, XCF and JPG. Opaque formats include
proprietary formats that can be read and edited only by proprietary word processors, SGML or
101 SLES-SAP 15 SP34. MODIFICATIONS The author(s) and publisher(s) of the Document do not by this License give permission to use
their names for publicity for or to assert or imply endorsement of any Modied Version.
You may copy and distribute a Modied Version of the Document under the conditions of
sections 2 and 3 above, provided that you release the Modied Version under precisely this 5. COMBINING DOCUMENTS
License, with the Modied Version lling the role of the Document, thus licensing distribution
and modication of the Modied Version to whoever possesses a copy of it. In addition, you You may combine the Document with other documents released under this License, under
must do these things in the Modied Version: the terms dened in section 4 above for modied versions, provided that you include in the
combination all of the Invariant Sections of all of the original documents, unmodied, and
A. Use in the Title Page (and on the covers, if any) a title distinct from that of the
list them all as Invariant Sections of your combined work in its license notice, and that you
Document, and from those of previous versions (which should, if there were any,
preserve all their Warranty Disclaimers.
be listed in the History section of the Document). You may use the same title as a
previous version if the original publisher of that version gives permission. The combined work need only contain one copy of this License, and multiple identical
Invariant Sections may be replaced with a single copy. If there are multiple Invariant Sections
B. List on the Title Page, as authors, one or more persons or entities responsible for with the same name but dierent contents, make the title of each such section unique by
authorship of the modications in the Modied Version, together with at least ve adding at the end of it, in parentheses, the name of the original author or publisher of that
of the principal authors of the Document (all of its principal authors, if it has fewer section if known, or else a unique number. Make the same adjustment to the section titles in
than ve), unless they release you from this requirement. the list of Invariant Sections in the license notice of the combined work.
C. State on the Title page the name of the publisher of the Modied Version, as the In the combination, you must combine any sections Entitled "History" in the various original
publisher. documents, forming one section Entitled "History"; likewise combine any sections Entitled
"Acknowledgements", and any sections Entitled "Dedications". You must delete all sections
D. Preserve all the copyright notices of the Document.
Entitled "Endorsements".
E. Add an appropriate copyright notice for your modications adjacent to the other
copyright notices. 6. COLLECTIONS OF DOCUMENTS
F. Include, immediately after the copyright notices, a license notice giving the public
permission to use the Modied Version under the terms of this License, in the form You may make a collection consisting of the Document and other documents released under
shown in the Addendum below. this License, and replace the individual copies of this License in the various documents with a
single copy that is included in the collection, provided that you follow the rules of this License
G. Preserve in that license notice the full lists of Invariant Sections and required Cover
for verbatim copying of each of the documents in all other respects.
Texts given in the Document''s license notice.
You may extract a single document from such a collection, and distribute it individually under
H. Include an unaltered copy of this License. this License, provided you insert a copy of this License into the extracted document, and follow
I. Preserve the section Entitled "History", Preserve its Title, and add to it an item this License in all other respects regarding verbatim copying of that document.
stating at least the title, year, new authors, and publisher of the Modied Version
as given on the Title Page. If there is no section Entitled "History" in the Document, 7. AGGREGATION WITH INDEPENDENT WORKS
create one stating the title, year, authors, and publisher of the Document as given
on its Title Page, then add an item describing the Modied Version as stated in A compilation of the Document or its derivatives with other separate and independent
the previous sentence. documents or works, in or on a volume of a storage or distribution medium, is called an
"aggregate" if the copyright resulting from the compilation is not used to limit the legal rights
J. Preserve the network location, if any, given in the Document for public access to
of the compilation''s users beyond what the individual works permit. When the Document is
a Transparent copy of the Document, and likewise the network locations given in
included in an aggregate, this License does not apply to the other works in the aggregate
the Document for previous versions it was based on. These may be placed in the
which are not themselves derivative works of the Document.
"History" section. You may omit a network location for a work that was published
at least four years before the Document itself, or if the original publisher of the If the Cover Text requirement of section 3 is applicable to these copies of the Document, then
version it refers to gives permission. if the Document is less than one half of the entire aggregate, the Document''s Cover Texts
may be placed on covers that bracket the Document within the aggregate, or the electronic
K. For any section Entitled "Acknowledgements" or "Dedications", Preserve the Title equivalent of covers if the Document is in electronic form. Otherwise they must appear on
of the section, and preserve in the section all the substance and tone of each of the printed covers that bracket the whole aggregate.
contributor acknowledgements and/or dedications given therein.
L. Preserve all the Invariant Sections of the Document, unaltered in their text and 8. TRANSLATION
in their titles. Section numbers or the equivalent are not considered part of the
section titles. Translation is considered a kind of modication, so you may distribute translations of the
M. Delete any section Entitled "Endorsements". Such a section may not be included Document under the terms of section 4. Replacing Invariant Sections with translations requires
in the Modied Version. special permission from their copyright holders, but you may include translations of some
or all Invariant Sections in addition to the original versions of these Invariant Sections. You
N. Do not retitle any existing section to be Entitled "Endorsements" or to conict in may include a translation of this License, and all the license notices in the Document, and
title with any Invariant Section. any Warranty Disclaimers, provided that you also include the original English version of this
O. Preserve any Warranty Disclaimers. License and the original versions of those notices and disclaimers. In case of a disagreement
between the translation and the original version of this License or a notice or disclaimer, the
If the Modied Version includes new front-matter sections or appendices that qualify as original version will prevail.
Secondary Sections and contain no material copied from the Document, you may at your If a section in the Document is Entitled "Acknowledgements", "Dedications", or "History", the
option designate some or all of these sections as invariant. To do this, add their titles to the requirement (section 4) to Preserve its Title (section 1) will typically require changing the
list of Invariant Sections in the Modied Version''s license notice. These titles must be distinct actual title.
from any other section titles.
You may add a section Entitled "Endorsements", provided it contains nothing but
endorsements of your Modied Version by various parties--for example, statements of peer 9. TERMINATION
review or that the text has been approved by an organization as the authoritative denition
You may not copy, modify, sublicense, or distribute the Document except as expressly
of a standard.
provided for under this License. Any other attempt to copy, modify, sublicense or distribute the
You may add a passage of up to ve words as a Front-Cover Text, and a passage of up to 25 Document is void, and will automatically terminate your rights under this License. However,
words as a Back-Cover Text, to the end of the list of Cover Texts in the Modied Version. Only parties who have received copies, or rights, from you under this License will not have their
one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through licenses terminated so long as such parties remain in full compliance.
arrangements made by) any one entity. If the Document already includes a cover text for the
same cover, previously added by you or by arrangement made by the same entity you are
acting on behalf of, you may not add another; but you may replace the old one, on explicit
permission from the previous publisher that added the old one.
102 SLES-SAP 15 SP310. FUTURE REVISIONS OF THIS LICENSE
The Free Software Foundation may publish new, revised versions of the GNU Free
Documentation License from time to time. Such new versions will be similar in spirit to the
present version, but may dier in detail to address new problems or concerns. See http://
www.gnu.org/copyleft/ .
Each version of the License is given a distinguishing version number. If the Document species
that a particular numbered version of this License "or any later version" applies to it, you have
the option of following the terms and conditions either of that specied version or of any
later version that has been published (not as a draft) by the Free Software Foundation. If the
Document does not specify a version number of this License, you may choose any version ever
published (not as a draft) by the Free Software Foundation.
ADDENDUM: How to use this License for your documents
Copyright (c) YEAR YOUR NAME.
Permission is granted to copy, distribute
and/or modify this document
under the terms of the GNU Free
Documentation License, Version 1.2
or any later version published by the Free
Software Foundation;
with no Invariant Sections, no Front-Cover
Texts, and no Back-Cover Texts.
A copy of the license is included in the
section entitled “GNU
Free Documentation License”.
If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, replace the
“with...Texts.” line with this:
with the Invariant Sections being LIST
THEIR TITLES, with the
Front-Cover Texts being LIST, and with the
Back-Cover Texts being LIST.
If you have Invariant Sections without Cover Texts, or some other combination of the three,
merge those two alternatives to suit the situation.
If your document contains nontrivial examples of program code, we recommend releasing
these examples in parallel under your choice of free software license, such as the GNU General
Public License, to permit their use in free software.
103 SLES-SAP 15 SP3">
Product Categories
