SLES4SAP-guide_SUSE_en

SUSE Linux Enterprise Server for SAP Applications
15 SP1
Guide
Guide
SUSE Linux Enterprise Server for SAP Applications 15 SP1
Publication Date: September 14, 2023
https://documentation.suse.com
Copyright © 2010–2023 SUSE LLC and contributors. All rights reserved.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Docu-
mentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright
notice and license. A copy of the license version 1.2 is included in the section entitled “GNU Free Documentation
License”.
For SUSE trademarks, see http://www.suse.com/company/legal/ . All third-party trademarks are the property of
their respective owners. Trademark symbols (®, ™ etc.) denote trademarks of SUSE and its affiliates. Asterisks
(*) denote third-party trademarks.
All information found in this book has been compiled with utmost attention to detail. However, this does not
guarantee complete accuracy. Neither SUSE LLC, its affiliates, the authors nor the translators shall be held liable
for possible errors or the consequences thereof.
Contents
About This Guide x

1 Overview x
2 Available Documentation and Resources x
3 Improving the documentation xi
4 Documentation conventions xii
5 Support xiv
Support statement for SUSE Linux Enterprise Server for SAP
Applications xiv • Technology previews xv
1 What Is SUSE Linux Enterprise Server for SAP

Applications? 1
1.1 Software Components 2
SUSE Linux Enterprise Server 2 • SUSE Linux Enterprise High
Availability Extension 2 • Simplified SAP HANA System Replication
Setup 3 • Installation Workflow 5 • Malware Protection with
ClamSAP 5 • SAP HANA Security 5 • Simplified Operations
Management 6
1.2 Software Repository Setup 8
1.3 Included Services 9
2 Planning the Installation 12

2.1 Hardware Requirements 12
2.2 Installation Image 13
2.3 Offline Migration 13
2.4 Installation Methods 14
2.5 Overview of the Installation Workflow 14
iv Guide
2.6 Required Data for Installing 15
2.7 Partitioning 16
Partitioning for the Operating System (stage 1) 16 • Partitioning for the SAP
System (stage 2) 16
3 Installing the Operating System 17

3.1 Using the Installation Workflow 17
3.2 Using SLES-SAP media from the network 25
3.3 Using an External AutoYaST Profile 26
3.4 Converting an SLES Installation to an SLES-SAP Installation 26
4 Installing SAP Applications 28

4.1 Products That Can Be Installed Using SAP Installation Wizard 28
4.2 First Steps 29
4.3 Using the SAP Installation Wizard 30
4.4 Continuing an Installation Using an Installation Profile 40
4.5 Partitioning for an SAP Application without the SAP Installation

Wizard 41
4.6 Automated Installation of SAP Applications with AutoYaST 41

SAP HANA Installation 41 • SAP NetWeaver Installation 42
5 Upgrading an SAP HANA Cluster 46

5.1 Preparing the Upgrade 46
5.2 Upgrading your SAP HANA Cluster 47
5.3 Finishing the Upgrade Task 48
v Guide
6 Setting Up an Installation Server for SAP Media
Sets 49
7 Setting Up an SAP HANA Cluster 51

7.1 Prerequisites 51
7.2 Setup 52
7.3 Unattended Setup Using SAP HANA-SR Wizard 59
7.4 Using Hawk 59
7.5 For More Information 60
8 Tuning systems with sapconf5 61

8.1 Overview of sapconf5 61
8.2 Verifying sapconf setup 62
8.3 Enabling and disabling sapconf and viewing its status 63
8.4 Configuring sapconf5 64
8.5 Removing sapconf 65
8.6 Using tuned together with sapconf 65
8.7 For more information 66
9 Tuning systems with saptune 67

9.1 Enabling saptune 67
9.2 Disabling saptune 69
9.3 Updating saptune 69
9.4 Managing SAP Notes 69

Customizing an SAP Note 70 • Creating a new SAP Note 70 • Deleting
an SAP Note 70 • Renaming an SAP Note 70 • Showing the
configuration of an SAP Note 71 • Verifying an SAP Note or an
SAP Solution 71 • Simulating the application of an SAP Note or an
vi Guide
SAP Solution 71 • Reverting an SAP Note 72 • Editing a SAP
Note 72 • Listing all enabled or applied SAP Notes 72
9.5 Managing SAP Solutions 72

Creating a new SAP Solution 72 • Deleting SAP Solution 73 • Renaming
an SAP Solution 73 • Showing the configuration of an SAP
Solution 73 • Reverting an SAP Solution 74 • Editing a custom SAP
Solution 74 • Listing enabled/applied SAP Solution 74
9.6 Verification and troubleshooting 74
9.7 Machine-readable output 75
9.8 Staging 76
9.9 Tuning kernel parameters manually using sysctl 77
9.10 For more information 78
10 Tuning Workload Memory Protection 79

10.1 Architecture 79
10.2 Support for Workload Memory Protection 80
10.3 Setting up Workload Memory Protection 81

Preparing for Workload Memory Protection 81 • Reboot and
verification 84
10.4 Configuring Workload Memory Protection 86
10.5 Changing the value of MemoryLow 87
10.6 Monitoring memory usage 87
10.7 Verifying correct operation 89
10.8 Uninstalling Workload Memory Protection 90
10.9 Systems running both systemd-based and regular SAP instances 92
10.10 Systems running only systemd-based instances 93
vii Guide
11 Firewalling 96
11.1 Configuring firewalld 96
11.2 Configuring HANA-Firewall 96
11.3 SAProuter Integration 99
12 Encrypting Directories Using cryptctl 100

12.1 Setting Up a cryptctl Server 101
12.2 Setting Up a cryptctl Client 103
12.3 Checking Partition Unlock Status Using Server-side Commands 106
12.4 Unlocking Encrypted Partitions Manually 107
12.5 Maintenance Downtime Procedure 107
13 Protecting Against Malware with ClamSAP 108

13.1 Installing ClamSAP 108
13.2 Creating a Virus Scanner Group in SAP NetWeaver 109
13.3 Setting Up the ClamSAP Library in SAP NetWeaver 110
13.4 Configuring the default location of virus definitions 111
13.5 Engaging ClamSAP 112
14 Connecting via RDP 115
15 Creating Operating System Images 116

15.1 Creating Images with KIWI NG 116
15.2 Cleaning Up an Instance Before Using It as a Master Image 117

Configuring clone-master-clean-up 118 • Using clone-master-clean-
up 118 • For More Information 118
viii Guide
16 Important Log Files 119
A Additional Software for SLES-SAP 120

A.1 Identifying a Base Product for SUSE Linux Enterprise Server for SAP
Applications 120
A.2 SUSE Connect Program 121
A.3 SUSE Package Hub 122
B Partitioning for the SAP System Using AutoYaST 123
C Supplementary Media 125

C.1 product.xml 125
C.2 Own AutoYaST Ask Dialogs 126
C.3 Installing Additional Packages 127
C.4 Example Directory for Supplementary Media 128
D GNU Licenses 129
ix Guide
About This Guide
SUSE® Linux Enterprise Server for SAP Applications is the reference platform for the software
development of SAP. It is optimized for SAP applications. This document provides detailed
information about installing and customizing SUSE Linux Enterprise Server for SAP Applications.
SUSE Linux Enterprise High Availability Extension is also part of SUSE Linux Enterprise Server
for SAP Applications.
1 Overview
The SUSE Linux Enterprise Server for SAP Applications Guide is divided into the following
chapters:
What Is SUSE Linux Enterprise Server for SAP Applications?

An overview of SUSE Linux Enterprise Server for SAP Applications.
Planning the Installation

Information on hardware requirements, the installation workflow, partitioning, and other
installation planning aspects.
Installing the Operating System

Installing the SUSE Linux Enterprise Server operating system that forms the basis of SUSE
Linux Enterprise Server for SAP Applications.
Installing SAP Applications

Installing SAP applications on SUSE Linux Enterprise Server for SAP Applications, either
directly after the installation of the operating system or in a running system.
Setting Up an Installation Server for SAP Media Sets

Setting up a server for all Installation Media used within your organization.
Software Components
Description of tools to configure SUSE Linux Enterprise Server for SAP Applications.
2 Available Documentation and Resources

This manual contains links to additional documentation resources that are either available on
the system or online.
x Overview SLES-SAP 15 SP1

Online documentation
Visit https://documentation.suse.com/#sles-sap for the latest version of this guide in dif-
ferent formats. You can nd whitepapers and other resources in the SUSE Linux Enterprise
Server for SAP Applications resource library: https://www.suse.com/products/sles-for-sap/
resource-library/ .
Find the online documentation for other products at https://documentation.suse.com/ .
Note: Latest updates

The latest documentation updates are normally available in the English version of
the documentation.
Release notes
For release notes, see https://www.suse.com/releasenotes/ .
In your system
For offline use, the release notes are also available under /usr/share/doc/re-
lease-notes on your system. The documentation for individual packages is available at
/usr/share/doc/packages .
Many commands are also described in their manual pages. To view them, run man , followed
by a specific command name. If the man command is not installed on your system, install
it with sudo zypper install man .
3 Improving the documentation

Your feedback and contributions to this documentation are welcome. The following channels
for giving feedback are available:
Service requests and support

For services and support options available for your product, see http://www.suse.com/sup-
port/ .
To open a service request, you need a SUSE subscription registered at SUSE Customer
Center. Go to https://scc.suse.com/support/requests , log in, and click Create New.
Bug reports
Report issues with the documentation at https://bugzilla.suse.com/ .
xi Improving the documentation SLES-SAP 15 SP1

To simplify this process, click the Report an issue icon next to a headline in the HTML
version of this document. This preselects the right product and category in Bugzilla and
adds a link to the current section. You can start typing your bug report right away.
A Bugzilla account is required.
Contributions
To contribute to this documentation, click the Edit source document icon next to a headline
in the HTML version of this document. This will take you to the source code on GitHub,
where you can open a pull request.
A GitHub account is required.
Note: Edit source document only available for English

The Edit source document icons are only available for the English version of each
document. For all other languages, use the Report an issue icons instead.
For more information about the documentation environment used for this documentation,
see the repository's README at https://github.com/SUSE/doc-slesforsap .
Mail
You can also report errors and send feedback concerning the documentation to doc-
team@suse.com . Include the document title, the product version, and the publication date
of the document. Additionally, include the relevant section number and title (or provide
the URL) and provide a concise description of the problem.
4 Documentation conventions
The following notices and typographic conventions are used in this document:
/etc/passwd : Directory names and le names
PLACEHOLDER : Replace PLACEHOLDER with the actual value
PATH : An environment variable
ls , --help : Commands, options, and parameters
user : The name of a user or group
xii Documentation conventions SLES-SAP 15 SP1

package_name : The name of a software package
Alt , Alt – F1 : A key to press or a key combination. Keys are shown in uppercase as
on a keyboard.
File, File Save As: menu items, buttons
AMD/Intel This paragraph is only relevant for the AMD64/Intel 64 architectures. The
arrows mark the beginning and the end of the text block.
IBM Z, POWER This paragraph is only relevant for the architectures IBM Z and POWER .
The arrows mark the beginning and the end of the text block.
Chapter 1, “Example chapter”: A cross-reference to another chapter in this guide.
Commands that must be run with root privileges. Often you can also prefix these com-
mands with the sudo command to run them as non-privileged user.
# command
> sudo command
Commands that can be run by non-privileged users.
> command
Notices
Warning: Warning notice

Vital information you must be aware of before proceeding. Warns you about security
issues, potential loss of data, damage to hardware, or physical hazards.
Important: Important notice

Important information you should be aware of before proceeding.
Note: Note notice

Additional information, for example about differences in software versions.
xiii Documentation conventions SLES-SAP 15 SP1

Tip: Tip notice
Helpful information, like a guideline or a piece of practical advice.
Compact Notices
Additional information, for example about differences in software versions.
Helpful information, like a guideline or a piece of practical advice.
5 Support
Find the support statement for SUSE Linux Enterprise Server for SAP Applications and gener-
al information about technology previews below. For details about the product lifecycle, see
https://www.suse.com/lifecycle .
If you are entitled to support, nd details on how to collect information for a support ticket at
https://documentation.suse.com/sles-15/html/SLES-all/cha-adm-support.html .
5.1 Support statement for SUSE Linux Enterprise Server for SAP
Applications
To receive support, you need an appropriate subscription with SUSE. To view the specific support
offers available to you, go to https://www.suse.com/support/ and select your product.
The support levels are defined as follows:
L1
Problem determination, which means technical support designed to provide compatibility
information, usage support, ongoing maintenance, information gathering and basic trou-
bleshooting using available documentation.
L2
Problem isolation, which means technical support designed to analyze data, reproduce
customer problems, isolate a problem area and provide a resolution for problems not re-
solved by Level 1 or prepare for Level 3.
xiv Support SLES-SAP 15 SP1

L3
Problem resolution, which means technical support designed to resolve problems by en-
gaging engineering to resolve product defects which have been identified by Level 2 Sup-
port.
For contracted customers and partners, SUSE Linux Enterprise Server for SAP Applications is
delivered with L3 support for all packages, except for the following:
Technology previews.
Sound, graphics, fonts, and artwork.
Packages that require an additional customer contract.
Some packages shipped as part of the module Workstation Extension are L2-supported only.
Packages with names ending in -devel (containing header les and similar developer
resources) will only be supported together with their main packages.
SUSE will only support the usage of original packages. That is, packages that are unchanged
and not recompiled.
5.2 Technology previews

Technology previews are packages, stacks, or features delivered by SUSE to provide glimpses
into upcoming innovations. Technology previews are included for your convenience to give you
a chance to test new technologies within your environment. We would appreciate your feedback.
If you test a technology preview, please contact your SUSE representative and let them know
about your experience and use cases. Your input is helpful for future development.
Technology previews have the following limitations:
Technology previews are still in development. Therefore, they may be functionally incom-
plete, unstable, or otherwise not suitable for production use.
Technology previews are not supported.
Technology previews may only be available for specific hardware architectures.
xv Technology previews SLES-SAP 15 SP1

Details and functionality of technology previews are subject to change. As a result, up-
grading to subsequent releases of a technology preview may be impossible and require a
fresh installation.
SUSE may discover that a preview does not meet customer or market needs, or does not
comply with enterprise standards. Technology previews can be removed from a product
at any time. SUSE does not commit to providing a supported version of such technologies
in the future.
For an overview of technology previews shipped with your product, see the release notes at
https://www.suse.com/releasenotes .
xvi Technology previews SLES-SAP 15 SP1

1 What Is SUSE Linux Enterprise Server for SAP Appli-
cations?
SUSE® Linux Enterprise Server for SAP Applications is a bundle of software and
services that addresses the specific needs of SAP users. It is the only operating sys-
tem that is optimized for all SAP software solutions.
Target use cases include:
Unix to Linux migrations and replatforming
SAP appliances
SAP cloud deployments
SUSE Linux Enterprise Server for SAP Applications consists of software components and service
offerings which are described in the following sections. The figure Offerings of SUSE Linux Enter-
prise Server for SAP Applications shows an overview of which software components and services
are also available with other products from SUSE (green) and which are exclusively available
with SUSE Linux Enterprise Server for SAP Applications (blue).
24×7 Priority Support for SAP
Extended Service Pack Overlap Support

18 Month Grace Period
HA Cluster Antivirus SAP HANA Simplified

Connector ClamSAP Security Operations
Management
High Availability for Faster

SAP NetWeaver & SAP HANA SAP HANA Installation
SUSE Linux Enterprise
HA Resource Installation
High Availability Extension Agents Workflow
Reliable, Scalable and Secure Operating System

SUSE Linux Enterprise Server
24×7 Priority Support for SAP
FIGURE 1.1: OFFERINGS OF SUSE LINUX ENTERPRISE SERVER FOR SAP APPLICATIONS
1 SLES-SAP 15 SP1
1.1 Software Components
As depicted in Figure 1.1, “Offerings of SUSE Linux Enterprise Server for SAP Applications”, SUSE Linux
Enterprise Server for SAP Applications is based on SUSE Linux Enterprise Server but contains
several additional software components such as SUSE Linux Enterprise High Availability Exten-
sion, and the installation workflow. These software components are briey explained in the
following sections.
1.1.1 SUSE Linux Enterprise Server

The current release is based on SUSE Linux Enterprise Server 15 SP1. SUSE Linux Enterprise
Server is the most interoperable platform for mission-critical computing, both physical and vir-
tual.
1.1.2 SUSE Linux Enterprise High Availability Extension

This component consists of:
Flexible, policy-driven clustering
Cluster-aware le system and volume management
Continuous data replication
Setup and installation
Management and administration tools
Resource agents, also for SAP
Virtualization-aware
SUSE Linux Enterprise High Availability Extension provides two resource agents specifically for
working with SAP applications:
SAPInstance which allows starting and stopping instances of SAP products.
SAPDatabase which allows starting and stopping all databases supported by SAP appli-
cations (SAP HANA, SAP MaxDB, SAP ASE, Oracle, Sybase, IBM DB2).
2 Software Components SLES-SAP 15 SP1

For more information about SUSE Linux Enterprise High Availability Extension, see the Adminis-
tration Guide (https://documentation.suse.com/sle-ha-15 ) and the White Papers and Best Prac-
tice Guides in the SUSE Linux Enterprise Server for SAP Applications Resource Library (https://
www.suse.com/products/sles-for-sap/resource-library/ ).
1.1.3 Simplified SAP HANA System Replication Setup

SUSE Linux Enterprise Server for SAP Applications supports SAP HANA System Replication using
components of SUSE Linux Enterprise High Availability Extension and two additional resource
agents (RA). Additionally, SUSE Linux Enterprise Server for SAP Applications ships with a YaST
wizard that simplifies the cluster setup.
1.1.3.1 SAPHana Resource Agent
This resource agent from SUSE supports scale-up scenarios by checking the SAP HANA database
instances for whether a takeover needs to happen. Unlike with the pure SAP solution, takeovers
can be automated.
It is configured as a master/slave resource: The master assumes responsibility for the SAP HANA
databases running in primary mode, whereas the slave is responsible for instances that are op-
erated in synchronous (secondary) status. In case of a takeover, the secondary (slave resource
instance) can automatically be promoted to become the new primary (master resource instance).
This resource agent supports system replication for the following scale-up scenarios:
Performance-Optimized Scenario. Two servers (A and B) in the same SUSE Linux Enter-
prise High Availability Extension cluster, one primary (A) and one secondary (B). The SAP
HANA instance from the primary server (A) is replicated synchronously to the secondary
server (B).
Cost-Optimized Scenario. The basic setup of A and B is the same as in the Performance-Op-
timized Scenario. However, the secondary server (B) is also used for non-productive pur-
poses, such as for an additional SAP HANA database for development or QA. The produc-
tion database is only kept on permanent memory, such as a hard disk. If a takeover needs
3 Simplified SAP HANA System Replication Setup SLES-SAP 15 SP1

to occur, the non-productive server will be stopped before the takeover is processed. The
system resources for the productive database are then increased as quickly as possible via
an SAP hook call-out script.
Chain/Multi-Tier Scenario. Three servers (A, B, and C), of which two are located in the
same SUSE Linux Enterprise High Availability Extension cluster (A and B). The third server
(C) is located externally. The SAP HANA system on the primary server (A) is replicated
synchronously to the secondary server (B). The secondary server (B) is replicated asyn-
chronously to the external server (C).
If a takeover from A to B occurs, the connection between B and C remains untouched.
However, B is not allowed to be the source for two servers (A and C), as this would be a
“star” topology, which is not supported with current SAP HANA versions (such as SPS11).
Using SAP HANA commands, you can then manually decide what to do:
The connection between B and C can be broken, so that B can connect to A.
If replication to the external site (C) is more important than local system replication,
the connection between B and C can be kept.
For all of the scenarios, SUSE Linux Enterprise Server for SAP Applications supports both sin-
gle-tenant and multi-tenant (MDC) SAP HANA databases. That is, you can use SAP HANA data-
bases that serve multiple SAP applications.
1.1.3.2 SAPHanaTopology Resource Agent
To make configuring the cluster as simple as possible, SUSE has developed the SAPHanaTopol-
ogy resource agent. This agent runs on all nodes of a SUSE Linux Enterprise High Availability
Extension cluster and gathers information about the status and configurations of SAP HANA
system replications. It is designed as a normal (stateless) clone.
1.1.3.3 YaST Wizard to Set Up SAP HANA Clusters
SUSE Linux Enterprise Server for SAP Applications now additionally ships a YaST wizard that
manages the initial setup of such clusters according to best practices. The wizard is part of the
package yast2-sap-ha and can be started using YaST, via HA Setup for SAP Products.
For more information, see Chapter 7, Setting Up an SAP HANA Cluster.
4 Simplified SAP HANA System Replication Setup SLES-SAP 15 SP1

1.1.3.4 For More Information
For more information, see:
The Administration Guide at https://documentation.suse.com/sles-15 .
The Best Practices in the Resource Library at https://www.suse.com/products/sles-for-sap/

resource-library/ . In particular, see Setting up a SAP HANA SR performance optimized in-
frastructure and Setting up a SAP HANA SR cost optimized infrastructure.
1.1.4 Installation Workflow

The installation workflow offers a guided installation path for both the SUSE Linux Enterprise
Server operating system and the SAP application. For more information, see Section 2.5, “Overview
of the Installation Workflow”.
Additionally, the installation workflow can be extended by third-party vendors or customers

using Supplementary Media. For more information about creating Supplementary Media, see
Appendix C, Supplementary Media.
1.1.5 Malware Protection with ClamSAP

ClamSAP integrates the ClamAV anti-malware toolkit into SAP NetWeaver and SAP Mobile Plat-
form applications to enable cross-platform threat detection. For example, you can use ClamSAP
to allow an SAP application to scan for malicious uploads in HTTP uploads.
For more information, see Chapter 13, Protecting Against Malware with ClamSAP.
1.1.6 SAP HANA Security

SUSE Linux Enterprise Server for SAP Applications contains additional features to help set up
well-secured SAP HANA installations.
1.1.6.1 Firewall for SAP HANA

Securing SAP HANA can require many additional firewall rules. To simplify firewall setups for
SAP HANA, SUSE Linux Enterprise Server for SAP Applications contains the package HANA-
Firewall which provides preconfigured rules and integrates with firewalld .
5 Installation Workflow SLES-SAP 15 SP1

For more information, see Section 11.2, “Configuring HANA-Firewall”.
1.1.6.2 Hardening Guide for SAP HANA
For information on hardening the underlying operating system, see the SUSE Linux Enter-
prise Server for SAP Applications resource library: https://www.suse.com/products/sles-for-sap/
resource-library/ . There, nd the document OS Security Hardening for SAP HANA.
1.1.7 Simplified Operations Management

SUSE Linux Enterprise Server for SAP Applications combines several features that enable sim-
plified operations management.
1.1.7.1 System Tuning with saptune
The system tuning application saptune allows you to automatically and comprehensively tune
your system as recommended by SAP for use with SAP S/4HANA, SAP NetWeaver, or SAP
HANA/SAP BusinessOne. This allow tuning several kernel parameters, depending on the hard-
ware components you are using, such as the amount of available RAM.
For more information, see Chapter 9, Tuning systems with saptune.
1.1.7.2 Storage Encryption for Hosted Applications with cryptctl
Today, databases and similar applications are often hosted on external servers that are serviced
by third-party sta. Certain data center maintenance tasks require third-party sta to directly
access affected systems. In such cases, privacy requirements necessitate disk encryption.
cryptctl allows encrypting sensitive directories using LUKS and offers the following additional
features:
Encryption keys are located on a central server, which can be located on customer premis-
es.
Encrypted partitions are automatically remounted after an unplanned reboot.
For more information, see Chapter 12, Encrypting Directories Using cryptctl.
6 Simplified Operations Management SLES-SAP 15 SP1

1.1.7.3 Patterns Providing Dependencies of SAP Applications
To simplify working with software dependencies of SAP applications, SUSE has created patterns
that combine relevant dependency RPM packages for specific applications:
SAP BusinessOne Server Base
SAP HANA Server Base
SAP NetWeaver Server Base
Important: Packages May Be Missing from Patterns

The selection of packages of the software patterns is defined while a specific release
(Service Pack or major version) of SUSE Linux Enterprise Server for SAP Applications is
developed. This package selection is stable over the lifetime of this particular release.
When working with SAP applications that have been released more recently than your
SUSE Linux Enterprise Server for SAP Applications version, dependencies can be missing
from the patterns.
For definitive information about the dependencies of your SAP application, see the doc-
umentation provided to you by SAP.
1.1.7.4 ClusterTools2
ClusterTools2 provides tools that help set up and manage a Corosync/ pacemaker cluster.
Among them are wow which helps create highly available system resources, and ClusterSer-
vice which allows managing a cluster.
Additionally, ClusterTools2 provides scripts that automate common cluster tasks:
Scripts that perform checks. For example, to nd out whether a system is set up correctly
for creating a pacemaker cluster.
Scripts that simplify configuration. For example, to create a Corosync configuration.
Scripts that monitor the system and scripts that show or collect system information. For
example, to nd known error patterns in log les.
For more information, see the man page of the respective tool, included with the package Clus-
terTools2 .
7 Simplified Operations Management SLES-SAP 15 SP1

1.2 Software Repository Setup
Software included with operating systems based on SUSE Linux Enterprise is delivered as RPM
packages, a form of installation package that can have dependencies on other packages. On a
server or an installation medium, these packages are stored in software repositories (sometimes
also called “channels”).
By default, computers running SUSE Linux Enterprise Server for SAP Applications are set up
to receive packages from multiple repositories. Of each of the standard repositories, there is
a “Pool” variant that represents the state of the software when it was rst shipped. There is
also an “Update” variant that includes the newest maintenance updates for the software in the
“Pool” variant.
If you registered your system during installation, your repository setup should include the fol-
lowing:
TABLE 1.1: STANDARD REPOSITORIES
Content Base repository (“Pool”) Update repository
Base packages of SUSE Linux SLE-Module-Basesys- SLE-Module-Basesys-

Enterprise Server tem15-SP1-Pool tem15-SP1-Updates
Basic server functionality of SLE-Module-Server-Appli- SLE-Module-Server-Appli-

SUSE Linux Enterprise Server cations15-SP1-Pool cations15-SP1-Updates
Packages specific to SUSE SLE-Module-SAP-Applica- SLE-Module-SAP-Applica-

Linux Enterprise Server for tions15-SP1-Pool tions15-SP1-Updates
SAP Applications
Packages specific to SUSE SLE-Product-HA15-SP1- SLE-Product-HA15-SP1-Up-

Linux Enterprise High Avail- Pool dates
ability Extension
The tables in this section do not show Debuginfo and Source repositories, which are also set up but
disabled by default. The Debuginfo repositories contain packages that can be used for debugging
regular packages. The Source repositories contain source code for packages.
Depending on your installation method, you may also see SLE-15-SP1-SAP-15.1-0 which is
the installation medium. It contains packages from all of the base software repositories listed
above.
8 Software Repository Setup SLES-SAP 15 SP1

Because there are own repositories for SUSE Linux Enterprise Server for SAP Applications, SUSE
can ship packages and patches that are specific to SUSE Linux Enterprise Server for SAP Appli-
cations.
Note: ESPOS Updates Shipped Directly in Update Repositories

Unlike in SUSE Linux Enterprise Server for SAP Applications 11, updates related to Ex-
tended Service Pack Overlay Support (ESPOS) are shipped directly from the Update
repositories. This means there is no separate ESPOS repository to set up.
In addition to the standard repositories, you can enable SLE Modules and SLE Extensions either
during the installation or from the running system using YaST or the command SUSEConnect .
For information about all modules and extensions available for the SUSE Linux Enterprise prod-
uct line, see https://documentation.suse.com/sles/15-SP1/html/SLES-all/art-modules.html .
For more information about SUSE Package Hub, see Section A.3, “SUSE Package Hub”. For informa-
tion about life cycle and support of modules and extensions, see Section 1.3, “Included Services”.
1.3 Included Services

Extended Service Pack Overlap Support (ESPOS)
Subscriptions for SUSE Linux Enterprise Server for SAP Applications include Extended
Service Pack Overlap Support (ESPOS). It extends the overlap between the support periods
of two consecutive service packs by three years. During this period, you receive support
and all relevant maintenance updates under the terms of Long Term Service Pack Support
(LTSS).
Extended Service Pack Overlap Support allows you to perform service pack migrations
within three and a half (3½) years instead of only six months. This enables you to schedule
migrations more easily and perform testing before a migration under less restrictive time
constraints.
The last service pack of a SUSE Linux Enterprise Server for SAP Applications major release
has a separate lifecyle without ESPOS as there is no overlap to the next service pack.
Instead, LTSS is offerend for this last service pack at an additional cost.
9 Included Services SLES-SAP 15 SP1

For more information, refer to the following resources:
Product Lifecycle Support Policies: https://www.suse.com/support/policy-products/
Product Support Lifecycle Lifecycle Dates by Product: https://www.suse.com/lifecy-

cle/
Long Term Service Pack Support: https://www.suse.com/products/long-term-ser-

vice-pack-support/
SUSE Linux Enterprise Server Priority Support for SAP Applications

Subscriptions for SUSE Linux Enterprise Server for SAP Applications include SUSE Linux
Enterprise Server Priority Support for SAP Applications. It offers technical support for
SUSE Linux Enterprise Server for SAP Applications directly from SAP. The joint support
infrastructure is provided by support engineers from SUSE Technical Support and SAP. It
is based upon SAP Resolve and offers seamless communication with both SAP and SUSE.
This “One Face to the Customer” support model reduces complexity and lowers the total
cost of ownership.
For more information, see SAP Note 1056161: SUSE Priority Support for SAP Applications
(https://launchpad.support.sap.com/#/notes/1056161 ).
Important: Life Cycle and Support for Modules and Extensions

Modules and extensions have a different life cycle than SLES-SAP and SUSE provides
different support offerings for them:
Modules:
Life Cycle. Varies depending on the module.
Support. Only up-to-date packages are supported. Support is included with

your subscription for SUSE Linux Enterprise Server for SAP Applications. You
do not need an additional registration key.
Extensions

Life Cycle. Releases are usually coordinated with SUSE Linux Enterprise Serv-
er for SAP Applications.
Support. Support is available but not included with your subscription for
SUSE Linux Enterprise Server for SAP Applications. You need an additional
registration key.
Unsupported Extensions (SUSE Package Hub and SUSE Software Development Kit)
Life Cycle. Releases are usually coordinated with SUSE Linux Enterprise Serv-
er for SAP Applications.
Support. There is no support beyond fixes for security and packaging issues.
You do not need an additional registration key.

2 Planning the Installation
Read this chapter carefully, as it helps you plan the installation: It lists requirements and helps
you collect data about your system.
2.1 Hardware Requirements

This section lists minimum hardware requirements for the installation of SUSE Linux Enterprise
Server for SAP Applications and gives basic guidance on the expected hardware requirements
of certain SAP software. For the most up-to-date information about the hardware requirements
of SAP software, see the official sizing guidelines at https://service.sap.com/sizing .
Supported CPU
Intel 64
IBM POWER 8 (with PowerVM)
IBM POWER 9 (with PowerVM)
Hard Disk
SUSE Linux Enterprise Server for SAP Applications requires at least 41 GB (without swap)
of hard disk space for the system volume. In addition to that, reserve an appropriate
amount of hard disk space for the swap partition.
To install an SAP application such as SAP NetWeaver, you need at least 200 GB of free
disk space in addition to the required space for the operating system for the application's
/data partition.
To install SAP HANA, you need either:
An SAP BusinessOne-certified machine
A compatible machine that meets the requirements for SAP HANA TDI (Tailored
Datacenter Integration). That is, you need the following amounts of free disk space
in addition to the required space for the operating system:
52 GB of free disk space for the partition /usr/sap
Space for three partitions for SAP HANA data: /hana/data (same size as RAM),
/hana/log (same size as RAM up to a maximum of 512 GB), and /hana/
shared (same size as RAM up to a maximum of 1 TB).
12 Hardware Requirements SLES-SAP 15 SP1

For more information about SAP HANA refer to https://help.sap.com/docs/SAP_HANA_PLAT-
FORM (the section Implement SAP HANA Master Guide SAP HANA Deployment Options
On-Premise Deployments).
RAM
The SUSE Linux Enterprise Server operating system itself requires a minimum of 1024 MB
of total RAM or a minimum of 512 MB of RAM per CPU core (choose whichever is higher).
Any SAP software you install will require additional RAM.
To install SAP HANA, your machine needs a minimum of 24 GB of RAM.
For more information about configuring hardware for SAP HANA, see SAP Note 1944415: Hard-
ware Configuration Guide and Software Installation Guide for SUSE Linux Enterprise Server with SAP
HANA and SAP Business One (https://launchpad.support.sap.com/#/notes/1944415 ).
For more information about partitioning, see Section 2.7, “Partitioning”.
2.2 Installation Image

1. Unlike previous SLE products, the entire SLE 15 SP1 product line can be installed using the
same ISO image: The SLE 15 SP1 Installer DVD 1. If you want to install without network
access, additionally download the ISO image of SLE 15 SP1 Packages DVD 1.
Both ISO images are available from https://download.suse.com/ .
2. Burn the image/images onto a physical DVD and ensure that it is/they are bootable. Al-
ternatively, use a virtual DVD-ROM device for installation in a virtual machine.
2.3 Offline Migration

The migration paths for SUSE Linux Enterprise Server for SAP Applications are identical to those
for SUSE Linux Enterprise Server with Enhanced Service Pack Overlay Support (ESPOS). Find
detailed information in the SUSE Linux Enterprise Server Upgrade Guide at https://documenta-
tion.suse.com/sles/html/SLES-all/cha-upgrade-paths.html .
13 Installation Image SLES-SAP 15 SP1

2.4 Installation Methods
There are multiple ways of installing SUSE Linux Enterprise Server for SAP Applications:
Using the Installation Workflow (standard way of installation)
Using an External AutoYaST Profile
2.5 Overview of the Installation Workflow

The installation workflow of SUSE Linux Enterprise Server for SAP Applications consists of the
following steps:
1. Installation of the operating system (SUSE Linux Enterprise Server). See Section 3.1, “Using
the Installation Workflow”.
2. SAP Installation Wizard, part 1: Copying all required SAP media to the local disk or se-
lecting a shared storage medium to use. See Section 4.3, “Using the SAP Installation Wizard”,
in particular Step 1.
3. SAP Installation Wizard, part 2: Collecting all parameters for the actual installation by
querying the user interactively. See Section 4.3, “Using the SAP Installation Wizard”, in partic-
ular Step 10.
4. SAP Installation Wizard, part 3: Running the SAP Installer. See Section 4.3, “Using the SAP
Installation Wizard”, in particular Step 13.
Most of these steps do not need to be run immediately after each other, which allows for flexi-
bility in how you install systems. This means that you can prepare a single installation as a rst
step and then continue from there. For example:
Install the operating system (SUSE Linux Enterprise Server) only.

or
Install the operating system (SUSE Linux Enterprise Server), copy SAP media, and collect
SAP installation parameters.
Then, create disk images, copy them to other systems, and adjust SAP installation parameters.
Finally, finish the installation on each machine individually.
14 Installation Methods SLES-SAP 15 SP1

2.6 Required Data for Installing
Operating System
The SUSE Linux Enterprise Server installation requires the following data for every physical
server:
Network configuration parameters, such as host name, domain, IP address, subnet

mask, domain search list (DNS), IP for name server, IP for gateway
Administrator ( root ) password for the SUSE Linux Enterprise Server installation
SAP Application
The installation of an SAP application generally requires specifying:
SAP SID
SAP Instance Number
A password for the SAP application
Depending on the SAP application you are installing, more parameters may be necessary,
such as T-Shirt Sizing or parameters for virtual networking.
SAP HANA Database

The installation of SAP HANA requires specifying:
SAP SID
SAP Instance Number
Whether to enable Multitenant Database Containers (MDC). The multi-tenant support

of SAP HANA allows having multiple databases that run as one SAP HANA installa-
tion. (To use SAP HANA MDC, you need SAP HANA Life Cycle Manager.)
For a single-tenant installation, choose No.
For a multi-tenant instance administrated by one SIDadm user, choose Yes with low
isolation.
For a multi-tenant instance administrated in which each database has its own SIDadm
user, choose Yes with high isolation.
A password for the SAP HANA database
For more information about installing SAP software, see the SAP documentation at https://help.s-
ap.com and https://support.sap.com .
15 Required Data for Installing SLES-SAP 15 SP1

2.7 Partitioning
SUSE Linux Enterprise Server for SAP Applications creates the partitioning table in two stages:
1. Partitioning for the Operating System (stage 1) (during the installation of the operating system)
2. Partitioning for the SAP System (stage 2) (during the installation of the SAP product)
2.7.1 Partitioning for the Operating System (stage 1)

During the installation of the operating system, partitions for the operating system are created.
A logical volume group (LVG) named /dev/system will be created. This LVG contains two
logical volumes (LVs):
/dev/system/root : by default 60 GB to account for the operating system and SAP media
/dev/system/swap : by default 2 GB, avoid setting a smaller size. See also SAP Note
2578899: SUSE Linux Enterprise Server 15: Installation notes (https://launchpad.support.s-
ap.com/#/notes/2578899 ).
Additionally, a boot or UEFI partition will be created as necessary.
2.7.2 Partitioning for the SAP System (stage 2)

The partitioning for the SAP system can be created by:
The SAP Installation Wizard (see Section 4.3, “Using the SAP Installation Wizard”).
Using YaST on the command line (see Section 4.5, “Partitioning for an SAP Application without
the SAP Installation Wizard”).
This part of the partitioning can only be created after the operating system has been installed.
That means the partitions are created either in the installation workflow after the reboot or in
the running system.
Depending on the product you are installing and your particular use case, the amount of hard
disk space necessary can vary.
For information on partitioning for the SAP system using AutoYaST, see Appendix B, Partitioning
for the SAP System Using AutoYaST.
16 Partitioning SLES-SAP 15 SP1

3 Installing the Operating System
The following section provides instructions for installing the base operating system. Using the
installation workflow, you can install either using a local installation medium or over the net-
work. Alternatively, you can install using AutoYaST.
3.1 Using the Installation Workflow

The installation workflow is a guided installation of the operating system with optimized settings
for SAP applications. During the installation workflow, you can choose whether you want to
install an SAP application. If so, you will be asked to provide SAP installation media when the
SUSE Linux Enterprise Server installation is finished. You can also choose whether to install
third-party extensions.
This section assumes that you are starting the installation from a local medium. To learn how
to start the installation from a remote medium, see Section 3.2, “Using SLES-SAP media from the
network”.
For more information, see Section 2.5, “Overview of the Installation Workflow”.
This section guides you through the installation of the SUSE Linux Enterprise Server for SAP
Applications operating system.
Important: Installing Oracle Databases

To be able to install an Oracle database later, install SUSE Linux Enterprise Server rst
and then convert your installation to SUSE Linux Enterprise Server for SAP Applications.
This is necessary because the installer for Oracle databases queries for the existence of
certain les, not all of which are included in an SLES-SAP installation.
For more information about converting, see Section 3.4, “Converting an SLES Installation to
an SLES-SAP Installation”.
PROCEDURE 3.1: STARTING THE OS INSTALLATION
1. On AMD64/Intel 64, boot from the DVD. From the DVD boot menu, select Installation.
On POWER, follow the instructions in the SUSE Linux Enterprise Server documen-
tation, see Deployment Guide, Part “Installation Preparation”, Chapter “Installation on
IBM POWER” (https://documentation.suse.com/sles-15 ).
17 Using the Installation Workflow SLES-SAP 15 SP1

FIGURE 3.1: DVD BOOT MENU
While the initial operating system is starting, you can view boot messages by pressing
Esc . When this process has completed, the graphical installation workflow will start. As
the rst step, the installation workflow will check for updates for itself. After that, it will
be ready to start the installation.
2. Select the default system language under Language.

FIGURE 3.2: LANGUAGE, KEYBOARD AND PRODUCT SELECTION
3. Select the appropriate keyboard layout under Keyboard Layout. To test whether the select-
ed layout matches your physical keyboard, use the text box Keyboard Test.
4. SLE 15 SP1 provides a single installation ISO for the entire product line. Therefore, you
need to select the product to install on this page.
Under Product to install, choose SUSE Linux Enterprise Server for SAP Applications 15 SP1.
5. Read the license agreement. If you agree, select I Agree to the License Terms. Proceed with
Next.
Otherwise, cancel the installation with Abort Abort Installation.
6. (Optional) If automatic network configuration via DHCP fails, the screen Network Settings
will open.
If instead the screen Registration appears, your network connection works. To change net-
work settings anyway, click Network Configuration.
When you are finished configuring networking, proceed with Next.
Important: Configure Networking as Recommended by SAP

Make sure to configure the network connection as recommended in the documen-
tation provided to you by SAP.

For information about configuring networking, see Administration Guide, Chapter “Basic
Networking”, Section “Configuring a Network Connection with YaST” (https://documenta-
tion.suse.com/sles-15 ).
7. On the screen Registration, enter your E-mail Address and Registration Code. Successful reg-
istration is a prerequisite for receiving product updates and the entitlement to technical
support.
Proceed with Next.
Important: Register at This Step

Make sure to register your system at this step in the installation. Otherwise, you
can only install a minimal SLE system and will not receive updates.
To install a full (but not updated) SLES-SAP system without network access dur-
ing the installation, use the SLE 15 SP1 Packages ISO image from https://down-
load.suse.com . You can then choose Skip registration on this page and select the
SLE 15 SP1 Packages ISO image as an add-on product on the next page.
FIGURE 3.3: REGISTRATION
8. When asked whether to enable update repositories, choose Yes.

9. After the system is successfully registered, YaST lists available modules for SUSE Linux
Enterprise Server for SAP Applications from the SUSE Customer Center. The default selec-
tion covers the most common cases. To enable an additional module, activate its entry.
Proceed with Next.
Note: Release Notes

From this point on, the Release Notes can be viewed from any screen during the
installation process by selecting Release Notes.
Proceed with Next.
10. (Optional) The Add On Product dialog allows you to add additional software sources (so-
called “repositories”) to SUSE Linux Enterprise Server for SAP Applications, that are not
provided by the SUSE Customer Center. Such add-on products may include third-party
products, drivers, or additional software for your system.
11. Choose the System Role. System roles are predefinied use cases which tailor the system
for the selected scenario. For SUSE Linux Enterprise Server for SAP Applications, you can
choose between:
SLES for SAP Applications: Default, recommended for most situations. This system
role contains the following properties:
Supports the installation wizard for SUSE Linux Enterprise Server for SAP Ap-
plications.
Enables RDP access (Remote Desktop Protocol)
Provides special partitioning recommendations.
SLES with GNOME: Can be necessary in specific cases. This installation path is not
covered in this document. For more information about this installation path, see In-
stallation Quick Start, Section “Installing SUSE Linux Enterprise Server” (https://docu-
mentation.suse.com/sles-15 ).
Additonal system roles are available for specific use cases (High Availability, text mode,
minimal, and KVM/XEN virtualization hosts).
Proceed with Next.

FIGURE 3.4: SYSTEM ROLE
PROCEDURE 3.2: FINISHING THE OS INSTALLATION
1. Choose whether to enable the following options:
To install an SAP Application along with the system, activate Launch the SAP Instal-
lation Wizard right after the operating system is installed.
To enable RDP access (Remote Desktop Protocol) to this machine, activate Enable
RDP service and open port in firewall.
For more information about connecting via RDP, see Chapter 14, Connecting via RDP.
2. Review the proposed partition setup for the volumes /dev/system/root and /dev/sys-
tem/swap . The volume /dev/system/data will be created later, as described in Sec-
tion 2.7, “Partitioning”.
Suitable values are preselected. However, if necessary, change the partition layout. You
have the following options:
Guided Setup
Create a new partitioning suggestion based on your input.
Expert Partitioner
Open the Expert Partitioner described in Deployment Guide, Chapter “Advanced Disk Set-
up”, Section “Using the YaST Partitioner” (https://documentation.suse.com/sles-15 ).

For partitioning advice specific to SUSE Linux Enterprise Server for SAP Applications,
see Section 2.7, “Partitioning”.
To accept the proposed setup without changes, proceed with Next.
FIGURE 3.5: SUGGESTED PARTITIONING
3. Select the clock and time zone to use on your system. To manually adjust the time or
to configure an NTP server for time synchronization, choose Other Settings. For detailed
information, see Deployment Guide, Chapter “Installation with YaST”, Section “Clock and
Time Zone” (https://documentation.suse.com/sles-15 ).
Proceed with Next.
4. Type a password for the system administrator account (called root ) and repeat the pass-
word under Confirm Password. You can use the text box Test Keyboard Layout to make sure
that all special characters appear correctly.
In case you would like to enable password-less authentication via SSH login, you can
import a key via Import Public SSH Key. If you want to completely disable root login
via password, upload a key only and do not provide a root password. A login as system
administrator will only be possible via SSH using the respective key in this case.
For more information, see Deployment Guide, Chapter “Installation with YaST”, Section “Pass-
word for the System Administrator root” (https://documentation.suse.com/sles-15 ).
Proceed with Next.

Important: Do Not Forget the root Password
The user root has the permission to carry out all administrative tasks. Without
this password, you cannot log in to the system as root . The password entered here
cannot be retrieved later.
5. On the screen Installation Settings, you can review and, if necessary, change several pro-
posed installation settings. Each setting is shown alongside its current configuration. To
change parts of the configuration, click the appropriate headline or other underlined items.
Important: Firewall Configuration

The software firewall of SLES-SAP is enabled by default. However, often, the ports
your SAP product requires to be open are not opened automatically. This means
that there may be network issues until you open the required ports manually.
For details, see Section 11.1, “Configuring firewalld”.
FIGURE 3.6: INSTALLATION SETTINGS
6. When you are satisfied with the system configuration, click Install.
Depending on your software selection, you may need to agree to further license agreements
before you are asked to confirm that you want to start the installation process.

Warning: Deletion of Data
The installation process fully or partially overwrites existing data on the disk.
In the installation confirmation box, click Install.

When the installation of the operating system is finished, the system will reboot automat-
ically:
If you chose to only prepare the system for installation, the system will boot to a
desktop login screen.
If you chose to install an SAP application now, the installation will continue after a
reboot. Continue with Chapter 4, Installing SAP Applications.
3.2 Using SLES-SAP media from the network

This section provides a short description of how to install from an installation medium served
over the network. This allows, for example, using a regular SLES medium to install SLES-SAP.
1. Copy the content of the SUSE Linux Enterprise Server for SAP Applications DVD to a Web
server (for example, example.com ), to the directory /srv/www/htdocs/sap_repo .
2. Boot from an SLES installation medium.
3. Select one of the boot menu options using the keys ↓ / ↑ . Then add to the command
line. To do so, specify the parameters listed below:
To allow network usage, add ifcfg=*=dhcp (though this should be the default).
Add the parameter install=SERVER/DIRECTORY .
4. Follow the instructions in Section 3.1, “Using the Installation Workflow”.
For more information, see Deployment Guide, Chapter “Remote Installation” (https://documenta-
To avoid having to use an SLES installation medium to initialize the system, you can boot over
the network via PXE. For details, see AutoYaST Guide, Chapter “Booting via PXE over the Network”
(https://documentation.suse.com/sles-15 ).
25 Using SLES-SAP media from the network SLES-SAP 15 SP1

3.3 Using an External AutoYaST Profile
For more information about installing with AutoYaST, see:
Deployment Guide, Part “Automated Installations”, Chapter “Automated Installation” (https://

documentation.suse.com/sles-15 ).
AutoYaST Guide (https://documentation.suse.com/sles-15 ).
For more information about partitioning for SAP applications with AutoYaST, see Section 2.7,
“Partitioning”.
If you plan to deploy SUSE Linux Enterprise Server for SAP Applications from a SUSE Manager
server, refer to SUSE Manager “Reference Manual”, “Systems”, “Autoinstallation” and SUSE Man-
ager “Advanced Topics”, Chapter “Minimalist AutoYaST Profile for Automated Installations and Use-
ful Enhancements” (https://documentation.suse.com/suma ).
3.4 Converting an SLES Installation to an SLES-SAP

Installation
To convert an installation of SUSE Linux Enterprise Server 15 SP1 or JeOS 15 SP1 to an installa-
tion of SLES-SAP, use the script Migrate_SLES_to_SLES-for-SAP.sh . The script will register
the system correctly and subscribe it to the appropriate repositories.
Make sure that you have an e-mail address for registration and a registration code for SLES-SAP.
1. Install the package migrate-sles-to-sles4sap .
2. Execute the following command:
# Migrate_SLES_to_SLES-for-SAP.sh
3. When asked to confirm to continue the migration, press Y , then Enter .
4. When asked, type the e-mail address to use for registration, then press Enter .
5. When asked, type the registration key, then press Enter .

Wait until the script is finished. Afterward, you are subscribed to the SUSE Linux Enter-
prise Server for SAP Applications software repositories and the package SLES-release
is removed in favor of SLES_SAP-release .
26 Using an External AutoYaST Profile SLES-SAP 15 SP1

Important: Script Does Not Install Default SLES-SAP Packages
The script does not install all packages that are included with a default SLES-SAP instal-
lation. However, you can install these yourself manually. To install the default package
selection, use:
# zypper in patterns-server-enterprise-sap_server
27 Converting an SLES Installation to an SLES-SAP Installation SLES-SAP 15 SP1

4 Installing SAP Applications
This section guides you through the installation of SAP media sets you received from SAP.
If you are installing an SAP application within the installation workflow, continue with
Section 4.2, “First Steps”.
If you are installing an SAP application within an installed system, continue with Section 4.3,
“Using the SAP Installation Wizard”.
4.1 Products That Can Be Installed Using SAP

Installation Wizard
Using the SAP Installation Wizard, you can install stand-alone SAP HANA database instances.
Additionally, the following SAP products (along with a database) can be installed using the SAP
Installation Wizard:
SAP S/4HANA, on-premise edition 1511
SAP NetWeaver 7.5
SAP NetWeaver 7.4 Support Release 2
SAP NetWeaver 7.4 Support Release 1
SAP NetWeaver 7.4
SAP Enhancement Package 1 for SAP NetWeaver 7.3
SAP NetWeaver 7.3
SAP NetWeaver Composition Environment (CE) 7.2
SAP EHP1 for SAP NetWeaver Composition Environment (CE) 7.1
SAP NetWeaver Composition Environment (CE) 7.1
SAP EHP1 for SAP NetWeaver Mobile/Banking 7.1
SAP EHP1 SAP NetWeaver Process Integration 7.1
SAP EHP1 for SAP NetWeaver Adaptive Computing Controller 7.1
SAP NetWeaver Mobile/Banking 7.1
28 Products That Can Be Installed Using SAP Installation Wizard SLES-SAP 15 SP1
SAP NetWeaver Process Integration 7.1
SAP NetWeaver Adaptive Computing Controller 7.1
SAP Business Suite powered by SAP HANA
SAP Business Suite 7i 2016
SAP Business Suite 7i 2013 Support Release 2
SAP Business Suite 7i 2013 Support Release 1
SAP Business Suite 7i 2011 Java
SAP Business Suite 7i 2010 Java
SAP Business Suite 7 Support Release 1 Java
SAP Solution Manager 7.2 Support Release 1
SAP Solution Manager 7.1 powered by SAP HANA
SAP NetWeaver AS ABAP 7.4, OEM version 1.0
Important: Installation of Oracle Databases Not Possible

The SAP Installation Wizard does not allow installing products together with Oracle data-
bases. To install an Oracle database, install the base product SUSE Linux Enterprise Server
rst, then install the Oracle database and later convert your installation to SLES-SAP. This
is necessary because the Oracle databases installer queries for the existence of certain
les, not all of which are included in a SLES-SAP installation.
For more information about converting, see Section 3.4, “Converting an SLES Installation to
an SLES-SAP Installation”.
4.2 First Steps

These rst steps are only relevant during the installation workflow.
1. When the system is booted, it displays the screen Welcome. Proceed with Next.
2. The screen Network Settings will now open. This gives you an opportunity to change the
network settings.
When you are finished configuring networking, proceed with Next.
29 First Steps SLES-SAP 15 SP1

Important: Configure Networking as Recommended by SAP
Make sure to configure the network connection according to the documentation of
your SAP application.
For information about configuring networking, see Administration Guide, Chapter “Basic
Networking”, Section “Configuring a Network Connection with YaST” (https://documenta-
(While the next screen loads, the Welcome screen may appear again for a few seconds.)
3. Choose one of the following options:
Create SAP file systems and start SAP product installation

Allows installing an SAP application and setting up the system as a server providing
SAP installation routines to other systems.
Continue with Section 4.3, “Using the SAP Installation Wizard”.
Only create SAP HANA file systems, do not install SAP products now
Create an SAP HANA le system on SAP BusinessOne-certified hardware.
Important: Hardware Requirements

Make sure your machine fulfills the hardware requirements for SAP HANA
detailed in Section 2.1, “Hardware Requirements”. Otherwise, this option will not
create a new le system and the installation workflow ends at this point.
Finish wizard and proceed to OS login

Do not install an SAP application and continue to the login screen of SUSE Linux
Enterprise Server for SAP Applications.
Proceed with Next.
4.3 Using the SAP Installation Wizard

Use the SAP Installation Wizard to install an SAP NetWeaver system (including database) or an
SAP HANA system.
30 Using the SAP Installation Wizard SLES-SAP 15 SP1

To install other SAP applications or to create a more advanced SAP HANA setup, directly use
one of the installation methods provided by SAP instead of this wizard.
Tip: Installing an SAP Application in a Fully Installed System

This process is documented as it appears during the installation workflow. However, it
also applies to the YaST module SAP Installation Wizard which is available in the installed
system.
To start the SAP Installer, from the desktop, choose Applications System YaST, continue
in the YaST control center by choosing Miscellaneous SAP Installation Wizard.
Tip: SAP Installation Wizard Configuration

The SAP Installation Wizard configuration is specified and documented in /etc/syscon-
fig/sap-installation-wizard . You can change it according to your needs.
1. In the screen SAP Installation Wizard, provide the Location of the SAP Installation Master
(Figure 4.1, “Location of SAP Installation Master”). The location can either be a local, remov-
able, or remote installation source.
FIGURE 4.1: LOCATION OF SAP INSTALLATION MASTER

Select the appropriate option from the drop-down box. In the text box, specify the path to
your source according to the format given in the following table.
TABLE 4.1: MEDIA SOURCE PATH
Option Description Format of Path
Local Sources
dir:// a local directory /path/to/dir/
Removable Sources
device:// a locally connected hard devicename/path/to/dir/on/device

disk
usb:// a USB mass storage de- /path/to/dir/on/USB

vice
cdrom:// a CD or DVD //
Remote Sources
nfs:// an NFS share server_name/path/to/dir/on/device
smb:// an SMB share [user_name:password@]server_name//

path/to/dir/on/server[?workgroup=work-
group_name]
Tip: Remote Location Specification

To install from an NFS source, specify the name of the server and the complete path
to the media data. For information about setting up a remote installation server,
see Chapter 6, Setting Up an Installation Server for SAP Media Sets.
If you have installed an SAP application from an installation server before or set up your
system to be an installation server, you can also directly choose that server as the provider
of the Installation Master. To do so, use the drop-down box below Choose an installation
master.

2. Under Advanced Options, choose from the following options:
Collect installation profiles for SAP products but do not execute installation
Use this option to set the installation parameters, but not perform the actual instal-
lation. With this option, the SAP Installer (SAPinst) will stop without performing the
actual SAP product installation. However, the steps that follow fully apply.
For more information, see Section 4.4, “Continuing an Installation Using an Installation
Profile”.
Serve all installation media (including master) to local network via NFS
Set up this system as an installation server for other SUSE Linux Enterprise Server
for SAP Applications systems. The media copied to this installation server will be
offered through NFS and can be discovered via Service Location Protocol (SLP).
Proceed with Next.

The SAP Installation Wizard will now copy the Installation Master to your local disk.
Depending on the type of Installation Master you selected, the installation will continue
differently:
If you are installing an SAP HANA database, skip ahead to Step 8.
If you are installing an SAP NetWeaver application, continue with the next step.
3. On the screen SAP Installation Wizard, provide the location of additional Installation Media
you want to install. This can include an SAP kernel, a database, and database exports.
Copy a medium
Specify a path to additional Installation Media. For more information about specify-
ing the path, see Table 4.1, “Media Source Path”.
Skip copying of medium

Do not copy additional Installation Media. Choose this option if you do not need
additional Installation Media or to install additional Installation Media directly from
their source, for example CDs/DVDs or ash disks.
When choosing this option despite your SAP product requiring additional Installation
Media, you will later need to provide the SAP Installer (SAPinst) with the relevant
paths.
Proceed with Next.

If you chose to copy Installation Media, the SAP Installation Wizard will copy the relevant
les to your local hard disk.
FIGURE 4.2: SAP INSTALLATION WIZARD: ADDITIONAL INSTALLATION MEDIA
4. After copying the Installation Media, you will be asked whether you want to prepare
additional Installation Media. To do so, click Yes. Then follow the instructions in Step 3.
Otherwise, click No.
5. In the screen What Would You Like to Install, under The SAP product is, choose how you
want to install the product:
SAP Standard System

Install an SAP application including its database.
SAP Standalone Engines

Engines that add functionality to a standard product: SAP TREX, SAP Gateway, and
Web Dispatcher.
Distributed System
An SAP application that is separated onto multiple servers.
SAP High-Availability System

Installation of SAP NetWeaver in a high-availability setup.

System Rename
Allows changing the various system properties such as the SAP system ID, database
ID, instance number, or host name. This can be used to install the same product in
a very similar configuration on different systems.
FIGURE 4.3: SAP INSTALLATION WIZARD: INSTALLATION TYPE AND DATABASE
6. If you selected SAP Standard System, Distributed System, or SAP High-Availability System,
additionally choose a back-end database under Back-end Databases.
Proceed with Next.
7. You will now see the screen Choose a Product. The products shown depend on the Media
Set and Installation Master you received from SAP. From the list, select the product you
want to install.
Proceed with Next.

FIGURE 4.4: SAP INSTALLATION WIZARD: CHOOSE A PRODUCT
8. You will be asked whether to copy Supplementary Media or Third-Party Media. To do so,
click Yes and then follow the instructions in Step 3.
Otherwise, click No.
Note: Difference Between Supplementary Media/Third-

Party Media and Additional Software Repositories
Both types of delivery mechanisms allow installing software that is neither part
of the SUSE Linux Enterprise Server for SAP Applications media nor part of your
Media Set from SAP. However, the delivery mechanism is different:
Supplementary Media/Third-Party Media is installed using an AutoYaST le

which allows creating an installation wizard and custom installation scripts.
Additional software repositories are RPM package repositories that you will
remain subscribed to. This means you receive updates for Third-Party Media
along with your regular system updates.
For information on creating Supplementary Media, see Appendix C, Supplementary Media.

9. On the screen Additional software repositories for your SAP installation, you can add further
software repositories. For example, for add-ons that are packaged as RPM. To do so, click
Add new software repositories. For more information about adding repositories, see Deploy-
ment Guide, Chapter “Installing and Removing Software”, Section “Adding Software Reposito-
ries” (https://documentation.suse.com/sles-15 ).
Proceed with Next.
Note: Location of Copied SAP Media

At this point, all data required for the SAP installation has been copied to /da-
ta/SAP_CDs (unless you chose to skip the process of copying). Each Installation
Medium is copied to a separate directory. You might nd the following directory
structure, for example:
> ls /data/SAP_CDs
742-KERNEL-SAP-Kernel-742
742-UKERNEL-SAP-Unicode-Kernel-742
RDBMS-MAX-DB-LINUX_X86_64
SAP-NetWeaver-740-SR2-Installation-Export-CD-1-3
/data/SAP_CDs is the default directory as specified in the /etc/sysconfig/sap-

installation-wizard configuration le.
10. Depending on the product you are installing, one or more dialogs will prompt you to supply
values for several configuration parameters for the SAP application you are installing.
Supply the values as described in the documentation provided to you by SAP. Help for
the configuration parameters is also available on the left side of the dialog. For more
information, see Section 2.6, “Required Data for Installing”.
Fill out the form (or forms), then proceed with OK.

FIGURE 4.5: PRODUCT PARAMETERS
When you are done, the SAP Installation Wizard will download additional software pack-
ages.
11. You will be asked whether to continue the installation or prepare another SAP product
for installation. If you choose to prepare another SAP product, start from the beginning
of this procedure.
12. (Optional) When installing SAP HANA on a system that is not certified for SAP HANA
and does not meet the minimum hardware requirements for SAP HANA TDI (Tailored
Datacenter Integration), you will be asked whether to continue. If you receive this message
unexpectedly, check Section 2.1, “Hardware Requirements” and the sizing guidelines from
SAP at https://service.sap.com/sizing (you need your SAP ID to access the information).
Otherwise, continue with Yes.
13. The following steps differ depending on the type of SAP application you are installing:
When installing an SAP HANA database, SAP HANA will now be installed without
further question.
When installing an SAP NetWeaver application, the actual installation will be per-
formed using the SAP Installer (SAPinst). After a few seconds, SAP Installer will open
automatically.

Follow the SAP Installer as described in the documentation provided by SAP. Most
configuration parameters are correctly lled already.
FIGURE 4.6: SAP INSTALLER: DEFINING PARAMETERS
Tip: Installation Log Files

If the installation of the SAP application fails, refer to the installation log les. They
are located in /var/adm/autoinstall . Failed installations are recorded in les
with names ending in .err .
For more information about log les, see Chapter 16, Important Log Files.
14. The final screen is Installation Completed.

To create an AutoYaST le for this installation, activate Clone This System for AutoYaST.
The AutoYaST le will be placed in /root/autoinst.xml .
Click Finish.

4.4 Continuing an Installation Using an Installation
Profile
If you chose Collect installation profiles but do not execute installation during the previous run of
the SAP Installation Wizard, this section will show you how to continue the installation of the
selected SAP applications.
When collecting an installation profile, the SAP Installation Wizard copies product images to /
data/SAP_CDs . It also prepares an installation environment for every product under the path
/data/SAP_INST :
/data/SAP_INST/0/Instmaster
[...]
These les are re-used in the following. To continue the installation, follow these steps:
1. In /etc/sysconfig/sap-installation-wizard , set the following:
SAP_AUTO_INSTALL="yes"
2. In the case of an SAP HANA/SAP BusinessOne installation, the SAP Installation Wizard will
later use the parameters documented in the AutoYaST les in /data/SAP_INST/number .
If you need to change any parameters, make sure to adapt the AutoYaST les at this point.
3. Open the YaST control center and start SAP Installation Wizard.
4. You will be asked whether to continue the pending installation. Select Install.
5. All further interactions happen within the SAP Installer. Follow the steps of SAP Installer
as described in the documentation provided to you by SAP.
In the case of an SAP NetWeaver installation, all parameters of the SAP Installer will
be offered again for ne-tuning.
In the case of an SAP HANA/SAP BusinessOne installation, the installer will not be
offer to make any changes to parameters.
40 Continuing an Installation Using an Installation Profile SLES-SAP 15 SP1

4.5 Partitioning for an SAP Application without the
SAP Installation Wizard
If you do not want to use the SAP Installation Wizard, you can also create the partitioning
for SAP applications directly from the command line. First, nd the correct partitioning le in
the directory /usr/share/YaST2/include/sap-installation-wizard/ or create your own
partitioning le. For more information, see Section 2.7.2, “Partitioning for the SAP System (stage 2)”.
When you have determined the correct partitioning XML le, run:
# yast2 sap_create_storage_ng ABSOLUTE_PATH_TO_PARTITIONING_FILE
4.6 Automated Installation of SAP Applications with

AutoYaST
The SAP Installation Wizard can be used from AutoYaST to automate the installation of SAP
Applications.
4.6.1 SAP HANA Installation

The following AutoYaST snippet shows how an SAP HANA or SAP TREX installation can be
automated:
<sap-inst>
<products config:type="list">
<product>
<media config:type="list">
<medium>
<url>nfs://server/path1</url>
<type>sap</type>
</medium>
<medium>
<url>nfs://server/path3</url>
<type>supplement</type>
</medium>
</media>
<sapMasterPW>PASSWORD</sapMasterPW>
<sid>SID</sid>
<sapInstNr>INSTANCE_NUMBER</sapInstNr>
<sapMDC>no</sapMDC>
41 Partitioning for an SAP Application without the SAP Installation Wizard SLES-SAP 15 SP1
</product>
</products>
</sap-inst>
The sapMDC element is only applicable to SAP HANA.
The sapVirtHostname element must be specified for distributed or highly available in-
stallations.
For a full SAP HANA example, including partitioning, see /usr/share/doc/packages/sap-

installation-wizard/hana-autoyast.xml .
4.6.2 SAP NetWeaver Installation

For SAP NetWeaver, the following example shows how the installation can be automated. Specif-
ically, this example is tailored to installing ASCS Instance of an SAP NetWeaver 7.5 ABAP Server
distributed system with MaxDB (product ID NW_ABAP_ASCS:NW750.ADA.ABAP ). When installing
other products based on SAP NetWeaver, not all of the following variables may be necessary or
these variables might need to be replaced by others:
The master password for the SAP NetWeaver instance: MASTER_PASSWORD
The SAP Identifier (SID): SID
The SAP kernel: KERNEL
The SAP instance number: INSTANCE_NUMBER
The ASCS virtual host name: ASCS_VIRTUAL_HOSTNAME
The SCS virtual host name: SCS_VIRTUAL_HOSTNAME
<sap-inst>
<products config:type="list">
<product>
<media config:type="list">
<medium>
<url>nfs://SERVER/PATH1</url>
<type>sap</type>
</medium>
<medium>
<type>sap</type>
</medium>
<medium>
42 SAP NetWeaver Installation SLES-SAP 15 SP1

<type>supplement</type>
</medium>
</media>
<productID>NW_ABAP_ASCS:NW750.ADA.ABAP</productID>
<iniFile>
<![CDATA[
# Password for the Diagnostics Agent specific <dasid>adm user. Provided value
# may be encoded.
DiagnosticsAgent.dasidAdmPassword =
# Windows domain in which the Diagnostics Agent users must be created.

# The property is Microsoft Windows only. This is an optional property.
DiagnosticsAgent.domain =
# Password for the Diagnostics Agent specific SAPService<DASID> user.

# Provided value may be encoded.
# The property is Microsoft Windows only.
DiagnosticsAgent.sapServiceDASIDPassword =
NW_GetMasterPassword.masterPwd = MASTER_PASSWORD
# Human readable form of the Default Login language - valid names are stored
# in a table of the subcomponent NW_languagesInLoadChecks. Used when freshly
# installing an ABAP stack for the machine that performs an ABAP load (in the
# case of a distributed system, that is the database, otherwise it is used by
# the normal installer). The available languages must be declared in the
# LANGUAGES_IN_LOAD parameter of the product.xml . In this file, the one
# character representation of the languages is used. Check the same table in
# the subcomponent mentioned above.
NW_GetSidNoProfiles.SAP_GUI_DEFAULT_LANGUAGE =
# The drive to use (Windows only)

NW_GetSidNoProfiles.sapdrive =
# The /sapmnt path (Unix only)

NW_GetSidNoProfiles.sapmnt = /sapmnt
# The SAP System ID of the system to install

NW_GetSidNoProfiles.sid = SID
# Will this system be unicode system?

NW_GetSidNoProfiles.unicode = true
NW_SAPCrypto.SAPCryptoFile = /data/SAP_CDs/745-UKERNEL-SAP-Unicode-Kernel-745/DBINDEP/
SAPEXE.SAR

NW_SCS_Instance.ascsInstanceNumber =
NW_SCS_Instance.ascsVirtualHostname = ASCS_VIRTUAL_HOSTNAME
NW_SCS_Instance.instanceNumber = INSTANCE_NUMBER
NW_SCS_Instance.scsInstanceNumber =
NW_SCS_Instance.scsMSPort =
NW_SCS_Instance.scsVirtualHostname = SCS_VIRTUAL_HOSTNAME
NW_System.installSAPHostAgent = true
NW_Unpack.igsExeSar =
NW_Unpack.igsHelperSar =
NW_Unpack.sapExeDbSar =
NW_Unpack.sapExeSar =
NW_Unpack.sapJvmSar =
NW_Unpack.xs2Sar =
NW_adaptProfile.templateFiles =
# The FQDN of the system.

NW_getFQDN.FQDN =
# Do we want to set the FQDN for the system?

NW_getFQDN.setFQDN = false
# The path to the JCE policy archive to install into the Java home directory
# if it is not already installed.
NW_getJavaHome.jcePolicyArchive =
hostAgent.domain =
# Password for the SAP Host Agent specific sapadm user. Provided value may be
# encoded.
hostAgent.sapAdmPassword = MASTER_PASSWORD
nwUsers.sapDomain =
nwUsers.sapServiceSIDPassword =

nwUsers.sidadmPassword =
]]>
</iniFile>
</product>
</products>
</sap-inst>

5 Upgrading an SAP HANA Cluster
This chapter describes how to upgrade your SAP HANA cluster with the YaST mod-
ule SUSE HANA Cluster Update. This acts as a wizard and guides you through the en-
tire SAP HANA cluster maintenance procedures.
The official SAP HANA documentation describes the so-called Near Zero Downtime Upgrade
Process. The YaST module is based on this process and handles the part of the procedure related
to the SUSE cluster. Not all steps can be done automatically. Some steps need to be performed
manually by the SAP HANA administrator. The YaST module will inform you during the process.
This YaST module is available in the yast2-sap-ha package for SUSE Linux Enterprise Server
for SAP Applications 12 SP3 and higher. Currently, the wizard is only prepared to handle the
SAP HANA Scale-up Performance Optimized scenario.
The upgrade covers the following tasks:
1. Section 5.1, “Preparing the Upgrade”
2. Section 5.2, “Upgrading your SAP HANA Cluster”
3. Section 5.3, “Finishing the Upgrade Task”
5.1 Preparing the Upgrade

Ensure passwordless SSH access between the two nodes (primary and secondary) for root .
Keep in mind, some cloud service providers might not have set up SSH access for the
root by default.
1. Install the yast2-hana-update package on both nodes:
# zypper install yast2-hana-update
After the installation, you can nd the module SUSE HANA Cluster Update in the YaST
Control Center.
2. On the secondary node, start the YaST Control Center and open the SUSE HANA Cluster
Update module.
46 Preparing the Upgrade SLES-SAP 15 SP1

3. In the YaST module, review the pre-requirements. Make sure to fullfill all of them before
continuing with the next step. Keep in mind, the wizards supports only the HANA Scale-
up Performance Optimized scenario.
4. To upgrade the SAP HANA system, select the secondary node.
5. Select the location of the installation medium.

Point to the location where the SAP medium is located. If wanted, check the Mount an
update medium on all hosts and provide the NFS share and path.
Important: Differences between SAP HANA Version 1.0 and

2.0
If you are upgrading from SAP HANA version 1.0 to version 2.0, make sure to check
This is a HANA 1.0 to HANA 2.0 upgrade.
The YaST module will copy the PKI SSFS keys from the former secondary node to
the former primary node. More information provides the Help button.
Continue with Section 5.2, “Upgrading your SAP HANA Cluster”.
5.2 Upgrading your SAP HANA Cluster

1. Review the update plan generated by the wizard.
The wizard shows you two steps: automatic and manual. In this automatic step, the wizard
puts cluster resources into maintenance mode before it starts with the automatic steps.
The manual steps are SAP HANA specific and need to be executed by an SAP HANA ad-
ministrator. For more information, see the official SAP HANA documentation.
2. Update the SAP HANA software.

The wizard executes the automatic actions and waits until the SAP HANA administrator
performs the SAP HANA upgrade.
3. Perform the SAP HANA upgrade.
4. Review the plan for the primary (remote) node.

After the SAP HANA upgrade is done, the wizard shows the update plan. When you con-
tinue with this step, the wizard turns the primary node into a secondary node to make
it ready for the upgrade.
47 Upgrading your SAP HANA Cluster SLES-SAP 15 SP1

Keep in mind, this step can take some time.
Continue with Section 5.3, “Finishing the Upgrade Task”.
5.3 Finishing the Upgrade Task

1. Update the former primary node.
Pay special attention for the --hdbupd_server_nostart option on this step.
2. Restore the previous state of the cluster.

By default, the wizard registers the formater master now as secondary on the SAP HANA
system replication. If you desire to revert the system replication to its original state, click
the Reverse button.
3. Review the update summary.

You can review the original and current SAP HANA versions and the cluster state.
Note: Dealing with Intermediate Cluster State

If the wizard is faster than the status update of the cluster resources, the summary
shows an intermediate cluster state. The cluster state is UNDEFINIED or DEMOTED .
To overcome this, check the cluster status again with the command SAPHanaSR-
showAttr and make sure the former secondary node is now in the state PROMOTED .
Refer to the SUSE blog post https://www.suse.com/c/how-to-upgrade-your-suse-sap-hana-clus-

ter-in-an-easy-way/ for further information.
48 Finishing the Upgrade Task SLES-SAP 15 SP1

6 Setting Up an Installation Server for SAP Media Sets
Using the SAP Installation Wizard, it is possible to copy the SAP media sets from a remote server
(for example, via NFS or SMB). However, using the option provided there means that you need
to install the product at the same time. Additionally, it does not allow for copying all SAP media
used in your organization to a single server.
However, you can easily create such a server on your own. For example, to put the SAP media
sets on an NFS Server, proceed as follows:
PROCEDURE 6.1: ADDING SAP PRODUCT INSTALLATION FILES TO AN NFS SERVER
1. On your installation server, create the directory /srv/www/htdocs/sap_repo .
2. Open the le /etc/exports and add the following:
/srv/www/htdocs/sap_repo *(ro,no_root_squash,sync,no_subtree_check,insecure)
Important: Executable Rights Must Be Visible

Clients must be able to see which les are executable. Otherwise, SUSE's SAP In-
stallation Wizard will not be able to execute the SAP Installer.
3. In /srv/www/htdocs/sap_repo , create a directory for every SAP medium you have. Give
these directories speaking names, so you can identify them later on. For example, you
could use names like kernel , java , or hana .
4. Copy the contents of each SAP medium to the corresponding directory with cp -a .
Important: Avoid Using Windows* Operating Systems for

Copying
Using a Windows operating system for copying from/to Windows le systems like
NTFS can break permission settings and capitalization of les and directories.
You can now install from the NFS server you set up. In the SAP Installation Wizard, specify the
path this way: server_name/srv/www/htdocs/sap_repo . For more information about speci-
fying the path, see Table 4.1, “Media Source Path”.
49 SLES-SAP 15 SP1
For information about setting up an NFS server from scratch, see Administration Guide, Part
“Services”, Chapter “Sharing File Systems with NFS”, Section “Installing NFS Server” (https://docu-
mentation.suse.com/sles-15 ).
For information about installing SUSE Linux Enterprise Server from an NFS server, see De-
ployment Guide, Chapter “Remote Installation”, Section “Setting Up an NFS Repository Manually”
(https://documentation.suse.com/sles-15 ).
50 SLES-SAP 15 SP1
7 Setting Up an SAP HANA Cluster
You can use a YaST wizard to set up SAP HANA or SAP S/4HANA Database Server clusters
according to best practices, including SAP HANA system replication. A summary of the setup
options is given in Section 1.1.3, “Simplified SAP HANA System Replication Setup”.
Administrators can now use the SAP HANA-SR Wizard to run the modul unattended, usually
for on-premises deployments. Additionally, it is possible to configure the SAP HANA cluster on
Azure now. The YaST module identifies automatically when running on Azure and configures
an extra resource needed on Pacemaker.
The following Best Practices from the SUSE Linux Enterprise Server for SAP Applications Re-
source Library (https://www.suse.com/products/sles-for-sap/resource-library/ ) contain setup
instructions:
Performance-optimized scenario and multi-tier/chained scenario: Setting up a SAP HANA

SR Performance Optimized Infrastructure
Cost-optimized scenario: Setting up a SAP HANA SR Cost Optimized Infrastructure
Important: Wizard Can Only Be Used for Initial Configuration

The YaST wizard described in the following can only be used for the initial cluster con-
figuration.
To reconfigure a cluster, use the separate YaST module Cluster (available from package
yast2-cluster ). For more information about its usage, see Administration Guide, Part
“Installation, Setup and Upgrade”, Chapter “Using the YaST Cluster Module” at https://docu-
mentation.suse.com/sle-ha-15 .
7.1 Prerequisites
The following procedure has prerequisites:
Two machines which both have an SAP HANA installation created by the SAP Installation
Wizard or SAP HANA Application Lifecycle Management. Both machines need to be on
the same L2 network (subnet).
In the case of a multi-tier/chained scenario, there must also be a third machine elsewhere.
The machines are not yet set up as a high-availability cluster.
51 Prerequisites SLES-SAP 15 SP1

openSSH is running on both machines and the nodes can reach each other via SSH. How-
ever, if that has not already happened, the wizard will perform the SSH key exchange itself.
For more information about SSH, see Security and Hardening Guide, Part “Network Security”,
Chapter “SSH: Secure Network Operations” at https://documentation.suse.com/sles-15 .
A disk device that is available to both nodes under the same path for SBD. It must not
use host-based RAID, cLVM2 or reside on a DRBD instance. The device can have a small
size, for example, 100 MB.
You have created either:
A key in the SAP HANA Secure User Store on the primary node
An initial SAP HANA backup on the primary node
The package yast2-sap-ha is installed on both the primary and the secondary node.
HANA-Firewall is set up on both computers with the rules HANA_HIGH_AVAILABILITY and

HANA_SYSTEM_REPLICATION on all relevant network interfaces.
For information about setting up HANA-Firewall, see Section 11.2, “Configuring HANA-Fire-
wall”.
Cost-optimized scenario only: The secondary node has a second SAP HANA installation. The
database may be running but will be stopped automatically by the wizard.
Cost-optimized scenario only: For the non-production SAP HANA instance, you have created
an SAP HANA Secure User Store key QASSAPDBCTRL for monitoring purposes. For more
information, see SAP HANA SR Cost Optimized Scenario, Chapter “Installing the SAP HANA
Databases on both cluster nodes”, Section “Postinstallation configuration”, Section “Install the
non-productive SAP HANA database (QAS)” at https://www.suse.com/products/sles-for-sap/
resource-library/ .
7.2 Setup
The following procedure needs to be executed on the primary node (also called the “mas-
ter”). Before proceeding, make sure the prerequisites listed in Section 7.1, “Prerequisites”
are fulfilled.
1. Open the YaST control center. In it, click HA Setup for SAP Products in the category High
Availability.
52 Setup SLES-SAP 15 SP1

2. If an SAP HANA instance has been detected, you can choose between the scale-up scenarios
Performance-optimized, Cost-optimized, or Chained (multi-tier). For information about these
scale-up scenarios, see Section 1.1.3, “Simplified SAP HANA System Replication Setup”.
Continue with Next.
3. This step of the wizard presents a list of prerequisites for the chosen scale-up scenario.
These prerequisites are the same as those presented in Section 7.1, “Prerequisites”.
Continue with Next.
4. The next step lets you configure the communication layer of your cluster.
Provide a name for the cluster.
The default transport mode Unicast is usually appropriate.
Under Number of rings, a single communication ring usually suffices.

For redundancy, it is often better to use network interface bonding instead of multi-
ple communication rings. For more information, see Administration Guide, Part “Con-
figuration and Administration”, Chapter “Network Device Bonding” at https://documen-
tation.suse.com/sle-ha-15 .
From the list of communication rings, configure each enabled ring. To do so, click
Edit selected, then select a network mask (IP address) and a port (Port number) to
communicate over.

Finish with OK.
Additionally, decide whether to enable the configuration synchronization service

Csync2 and Corosync secure authentication using HMAC/SHA1.
For more information about Csync2, see Administration Guide Part “Installation, Setup
and Upgrade”, Chapter “Using the YaST Cluster Module”, Section “Transferring the Con-
figuration to All Nodes” at https://documentation.suse.com/sle-ha-15 .
For more information about Corosync secure authentication, see Administration
Guide, Part “Installation, Setup and Upgrade”, Chapter “Using the YaST Cluster Mod-
ule”, Section “Defining Authentication Settings” at https://documentation.suse.com/sle-
ha-15 .
Proceed with Next.
5. The wizard will now check whether it can connect to the secondary machine using SSH.
If it can, it will ask for the root password to the machine.
Enter the root password.
The next time the primary machine needs to connect to the secondary machine, it will
connect using an SSH certificate instead of a password.
6. For both machines, set up the host names and IP address (for each ring).
Host names chosen here are independent from the virtual host names chosen in SAP HANA.
However, to avoid issues with SAP HANA, host names must not include hyphen characters
( - ).

If this has not already been done before, such as during the initial installation of SAP
HANA, host names of all cluster servers must now be added to the le /etc/hosts . For
this purpose, activate Append to /etc/hosts.
Proceed with Next.
7. If NTP is not yet set up, do so. This avoids the two machines from running into issues
because of time differences.
a. Click Reconfigure.
b. On the tab General Settings, activate Now and on Boot.
c. Add a time server by clicking Add. Click Server and Next. Then specify the IP address
of a time server outside of the cluster. Test the connection to the server by clicking
Test.
To use a public time server, click Select Public server and select a time server. Finish
with OK.
Proceed with OK.
d. On the tab Security Settings, activate Open Port in Firewall.
e. Proceed with Next.
8. In the next step, choose fencing options. The YaST wizard only supports the fencing mech-
anism SBD (STONITH block device). To avoid split-brain situations, SBD uses a disk device
which stores cluster state.
The chosen disk must be available from all machines in the cluster under the same path.
Ideally, use either by-uuid or by-path for identification.
The disk must not use host-based RAID, cLVM2 or reside on a DRBD instance. The device
can have a small size, for example, 100 MB.
Warning: Data on Device Will Be Lost

All data on the chosen SBD device or devices will be deleted.
To define a device to use, click Add, then choose an identification method such as by-uuid
and select the appropriate device. Click OK.
To define additional SBD command-line parameters, add them to SBD options.
If your machines reboot particularly fast, activate Delay SBD start.

For more information about fencing, see the Administration Guide at https://documenta-
tion.suse.com/sle-ha-15 .
Proceed with Next.
9. The following page allows configuring watchdogs which protect against the failure of the
SBD daemon itself and force a reboot of the machine in such a case.
It also lists watchdogs already configured using YaST and watchdogs that are currently
loaded (as detected by lsmod ).
To configure a watchdog, use Add. Then choose the correct watchdog for your hardware
and leave the dialog with OK.
For testing, you can use the watchdog softdog . However, we highly recommend us-
ing a hardware watchdog in production environments instead of softdog . For more
information about selecting watchdogs, see Administration Guide, Part “Storage and Da-
ta Replication”, Chapter “Storage Protection”, Section “Conceptual Overview”, Section “Set-
ting Up Storage-based Protection”, Section “Setting up the Watchdog” at https://documenta-
tion.suse.com/sle-ha-15 .
Proceed with Next.
10. Set up the parameters for your SAP HANA installation or installations. If you have selected
the cost-optimized scenario, additionally ll out details related to the non-production SAP
HANA instance.
Production SAP HANA Instance
Make sure that the System ID and Instance number match those of your SAP
HANA configuration.
Replication mode and Operation mode usually do not need to be changed.

For more information about these parameters, see the HANA Administration
Guide provided to you by SAP.
Under Virtual IP address, specify a virtual IP address for the primary SAP HANA
instance. Under Virtual IP Mask, set the length of the subnetwork mask in CIDR
format to be applied to the Virtual IP address.
Prefer site takeover defines whether the secondary instance should take over the
job of the primary instance automatically (true). Alternatively, the cluster will
restart SAP HANA on the primary machine.

Automatic registration determines whether primary and secondary machine
should switch roles after a takeover.
Specify the site names for the production SAP HANA instance on the two nodes
in Site name 1 and Site name 2.
Having a backup of the database is a precondition for setting up SAP HANA

replication.
If you have not previously created a backup, activate Create initial backup. Un-
der Backup settings, configure the File name and the Secure store key for the
backup. The key in the SAP HANA Secure User Store on the primary node must
have been created before starting the wizard.
For more information, see the documentation provided to you by SAP.
Cost-optimized scenario only: Within Production system constraints, configure how

the production instance of SAP HANA should behave while inactive on the
secondary node.
Setting the Global allocation limit allows directly limiting memory usage. Acti-
vating Preload column tables will increase memory usage.
For information about the necessary global allocation limit, see documentation
provided to you by SAP such as How to Perform System Replication for SAP HANA
at https://archive.sap.com/documents/docs/DOC-47702 .
Cost-optimized Scenario Only: Non-production SAP HANA Instance
Make sure that the System ID and Instance number match those of your non-
production SAP HANA instance.
These parameters are needed to allow monitoring the status of the non-produc-
tion SAP HANA instance using the SAPInstance resource agent.
Generate a hook script for stopping the non-production instance and starting
the production instance and removing the constraints on the production system.
The script is written in Python 2 and can be modified as necessary later.
Click Hook script and then set up the correct user name and password for the
database. Then click OK.
You can now manually verify and change the details of the generated hook
script. When you are done, click OK to save the hook script at /hana/shared/
SID/srHook .

Warning: Passwords Stored in Plain Text
By default, the hook script stores all credentials in plain text. To improve
security, modify the script yourself.
Proceed with Next.
FIGURE 7.1: SAP HANA OPTIONS (COST-OPTIMIZED SCENARIO)
11. On the page High-Availability Configuration Overview, check that the setup is correct.
To change any of the configuration details, return to the appropriate wizard page by click-
ing one of the underlined headlines.
Proceed with Install.
12. When asked whether to install additional software, confirm with Install.
13. After the setup is done, there is a screen showing a log of the cluster setup.
To close the dialog, click Finish.
14. Multi-tier/chain scenario only: Using the administrative user account for the production
SAP HANA instance, register the out-of-cluster node for system replication:
SIDadm > hdbnsutil -sr_register --remoteHost=SECONDARY_HOST_NAME \

--remoteInstance=INSTANCE_NUMBER --replicationMode=async \
--name=SITE_NAME

7.3 Unattended Setup Using SAP HANA-SR Wizard
An unattended setup requires a manual installation of HANA rst. The result is saved into a le,
containing all configuration options that were chosen. If the administrator needs to reproduce
the installation, with this le the installation can be run automatically and unattended.
To use it, perform the following steps on both nodes:
1. On the production machines with SAP HANA installed, create a configuration le by run-
ning the sap_ha YaST module.
2. On the last screen, click the Save configuration button.
3. On the primary SAP HANA machine, upload and validate the configuration:
# yast2 sap_ha readconfig CONFIGURATION_FILE_PATH
4. Import, validate, and install the cluster unattended, based on the provided configuration
le:
# yast2 sap_ha readconfig CONFIGURATION_FILE_PATH unattended
7.4 Using Hawk

After you have set up the cluster using the wizard, you can open Hawk directly from the last
screen of the HA Setup for SAP Products wizard.
To revisit Hawk, open a browser and as the URL, enter the IP address or host name of any cluster
node running the Hawk Web service. Alternatively, enter the virtual IP address you configured
in Section 7.2, “Setup”.
https://HAWKSERVER:7630/
On the Hawk login screen, use the following login credentials:
Username: hacluster
Password: linux
59 Unattended Setup Using SAP HANA-SR Wizard SLES-SAP 15 SP1

Important: Secure Password
Replace the default password with a secure one as soon as possible:
# passwd hacluster
7.5 For More Information

Hawk. Administration Guide, Part Configuration and Administration, Chapter Configuring and
Managing Cluster Resources with Hawk (https://documentation.suse.com/sle-ha-15 ).
Near Zero Downtime for SAP HANA System Replication. Use

SAP HANA System Replication for Near Zero Downtime Up-
grades (https://help.sap.com/viewer/2c1988d620e04368aa4103bf26f17727/2.0.03/en-US/
ee3fd9a0c2e74733a74e4ad140fde60b.html) .
60 For More Information SLES-SAP 15 SP1

8 Tuning systems with sapconf5
The package sapconf is available in SUSE Linux Enterprise Server and SUSE Linux Enterprise
Server for SAP Applications. It sets recommended parameters for the following types of SAP
applications: SAP NetWeaver, SAP HANA and SAP HANA-based applications.
Note: The sapconf command has been removed

In SUSE Linux Enterprise Server and SUSE Linux Enterprise Server for SAP Applications
11 and 12, the sapconf command was included in the package with the same name.
For SUSE Linux Enterprise Server and SUSE Linux Enterprise Server for SAP Applications
15 this has been changed: the command sapconf have been removed from the sapconf
package. The package contains a systemd service only. There is no sapconf command
line tool anymore, no sapconf / tuned profiles, and no tuned .
Find more information about saptune at Chapter 9, Tuning systems with saptune.
8.1 Overview of sapconf5

OVERVIEW OF sapconf5 IN SUSE® LINUX ENTERPRISE SERVER 12
sapconf 5 (without tuned )
sapconf-netweaver ( sapconf profile as a replacement for tuned profile)
sapconf-hana ( sapconf profile as a replacement for tuned profile)
sapconf-bobj ( sapconf profile as a replacement for tuned profile)
sapconf-ase ( sapconf profile as a replacement for tuned profile)
OVERVIEW OF sapconf5 IN SUSE® LINUX ENTERPRISE SERVER 15
sapconf 5 (without tuned )

no profiles anymore
Note that if you previously made changes to the system tuning, those changes may be overwrit-
ten by sapconf .
sapconf 5 ships a systemd service which applies the tuning and ensures that related services
are running.
61 Overview of sapconf5 SLES-SAP 15 SP1

To use sapconf , make sure that the package sapconf is installed on your system.
Note: No profiles in SUSE Linux Enterprise Server and SUSE

Linux Enterprise Server for SAP Applications 15 SP1
In SUSE Linux Enterprise Server and SUSE Linux Enterprise Server for SAP Applications
15, sapconf no longer supports profiles.
8.2 Verifying sapconf setup

With sapconf 5.0.2 onwards the check tool sapconf_check is available, which verifies the
correct setup of sapconf . For example:
# sapconf_check
This is sapconf_check v1.0.
It verifies if sapconf is set up correctly and will give advice to do so.
Please keep in mind:
- This tool does not check, if the tuning itself works correctly.
- Follow the hints from top to down to minimize side effects.
Checking sapconf
================
[ OK ] sapconf package has version 5.0.2
[ OK ] saptune.service is inactive
[ OK ] saptune.service is disabled
[WARN] tuned.service is enabled/active with profile 'virtual-guest -> Sapconf does not
require tuned! Run 'systemctl stop tuned.service', if not needed otherwise.
[FAIL] sapconf.service is inactive -> Run 'systemctl start sapconf.service' to activate
the tuning now.
[FAIL] sapconf.service is disabled -> Run 'systemctl enable sapconf.service' to activate
sapconf at boot.1 warning(s) have been found.
2 error(s) have been found.
Sapconf will not work properly!
If sapconf_check nds problems, it will give hints how to resolve the issue. The tool will not
verify if the system has been tuned correctly. It only checks that sapconf is setup correctly
and has been started.
62 Verifying sapconf setup SLES-SAP 15 SP1

8.3 Enabling and disabling sapconf and viewing its
status
After the installation of sapconf , the sapconf service is enabled.
You can inspect or change the status of sapconf as described in the following:
To see the status of the service sapconf :
# systemctl status sapconf
The service should be displayed as active (exited).
To start the service sapconf :
# systemctl start sapconf
Should sapconf be disabled, enable and start it with:
# systemctl enable --now sapconf
To stop the service sapconf :
# systemctl stop sapconf
This command will disable the vast majority of optimizations immediately. The only ex-
ceptions from this rule are options that require a system reboot to enable/disable.
To disable sapconf , use:
# systemctl disable sapconf
If you have not specifically enabled any of the services that sapconf depends on yourself,
this will also disable most tuning parameters and all services used by sapconf .
63 Enabling and disabling sapconf and viewing its status SLES-SAP 15 SP1
Tip: Additional services that sapconf relies on
In addition to the sapconf service it also relies on the following two services:
sysstat which collects data on system activity.
uuidd which generates time-based UUIDs that are guaranteed to be unique even
in settings where many processor cores are involved. This is necessary for SAP ap-
plications.
8.4 Configuring sapconf5

In general, the default configuration of sapconf already uses the parameter values recommend-
ed by SAP. However, if you have special needs, you can configure the tool to better suit those.
All parameters of sapconf can be found in the le /etc/sysconfig/sapconf . The le can be
edited directly. All parameters in this le are explained by means of comments and references
to SAP Notes which can be viewed at https://launchpad.support.sap.com/ .
When sapconf is updated, all customized parameters from this le will be preserved as much as
possible. However, sometimes parameters cannot be transferred cleanly to the new configuration
le. Therefore, after updating it is advisable to check the difference between the previous custom
configuration which during the update is moved to /etc/sysconfig/sapconf.rpmsave and
the new version at /etc/sysconfig/sapconf .
Log messages related to this le are written to /var/log/sapconf.log .
When editing either of these les, you will nd that some values are commented by means of
a # character at the beginning of the line. This means that while the parameter is relevant for
tuning, there is no suitable default for it.
Conversely, you can add # characters to the beginning of the line to comment specific parame-
ters. However, you should avoid this practice, as it can lead to sapconf not properly applying
the profile.
To apply edited configuration, restart sapconf :
# systemctl restart sapconf
64 Configuring sapconf5 SLES-SAP 15 SP1

Confirming that a certain parameter value was applied correctly works differently for different
parameters. Hence, the following serves as an example only:
EXAMPLE 8.1: CHECKING PARAMETERS
To confirm that the setting for TCP_SLOW_START was applied, do the following:
View the log le of sapconf to see whether it applied the value. Within /var/log/
sapconf.log , check for a line containing this text:
Change net.ipv4.tcp_slow_start_after_idle from 1 to 0
Alternatively, the parameter may have already been set correctly before sapconf
was started. In this case, sapconf will not change its value:
Leaving net.ipv4.tcp_slow_start_after_idle unchanged at 1
The underlying option behind TCP_SLOW_START can be manually configured at

/proc/sys/net.ipv4.tcp_slow_start_after_idle . To check its actual current
value, use:
# sysctl net.ipv4.tcp_slow_start_after_idle
8.5 Removing sapconf

To remove sapconf from a system, uninstall its package with:
# zypper rm sapconf
Note that when doing this, dependencies of sapconf will remain installed. However, the service
sysstat will go into a disabled state. If it is still relevant to you, make sure to enable it again.
8.6 Using tuned together with sapconf

With version 5 sapconf does not rely on tuned anymore. This means both tools can be used
independently. sapconf will print a warning in it's log if tuned service is started.
65 Removing sapconf SLES-SAP 15 SP1

Note: Important: using tuned and sapconf together
If you are going to use tuned and sapconf simultaneously, be very careful, that bot
tools do not configure the same system parameters.
8.7 For more information

The following man pages provide additional information about sapconf :
Detailed description of all tuning parameters set by sapconf : man 5 sapconf
Information about configuring and customizing the sapconf profile: man 7 sapconf
Also see the blog series detailing the updated version of sapconf at:
A new sapconf is available: https://www.suse.com/c/a-new-sapconf-is-available/
A way to prepare a SLES system for SAP workload - Part 1: https://www.suse.com/c/sap-

conf-a-way-to-prepare-a-sles-system-for-sap-workload-part-1/
66 For more information SLES-SAP 15 SP1

9 Tuning systems with saptune
This chapter presents information about tuning SUSE Linux Enterprise Server for SAP Applica-
tions to work optimally with SAP applications.
Using saptune , you can tune a system for SAP NetWeaver, SAP HANA/SAP BusinessObjects,
and SAP S/4HANA applications.
Important
This chapter describes saptune version 3 which does not use tuned anymore.
9.1 Enabling saptune

To enable saptune to tune an SAP application, use the following procedure:
1. To tune a system, rst nd a tuning solution. To nd the appropriate solution, use:
> saptune solution list
saptune recognizes the following tuning solutions (groups of SAP Notes):
BOBJ . Solution for running SAP BusinessObjects.
HANA . Solution for running an SAP HANA database.
MAXDB . Solution for running an SAP MaxDB database.
NETWEAVER . Solution for running SAP NetWeaver application servers.
S4HANA-APPSERVER . Solution for running SAP S/4HANA application servers.
S4HANA-APP+DB . Solution for running both SAP S/4HANA application servers and
SAP HANA on the same host.
S4HANA-DBSERVER . Solution for running the SAP HANA database of an SAP

S/4HANA installation.
SAP-ASE . Solution for running an SAP Adaptive Server Enterprise database.
67 Enabling saptune SLES-SAP 15 SP1

NETWEAVER+HANA . Solution for running both SAP application servers and SAP HANA
on the same host.
NETWEAVER+MAXDB . Solution for running both SAP application servers and MAXDB
on the same host.
Alternatively, you can tune the computer according to recommendations from specific
SAP Notes. A list of notes that you can tune for is available via:
# saptune note list
2. To set up saptune with a preconfigured solution, use:
# saptune solution apply SOLUTION
To set up saptune for the recommendations of a specific SAP Note, use:
# saptune note apply NOTE
3. To start saptune and enable it at boot, make sure to run the following command:
# saptune service enablestart
To make sure that sapconf and tuned gets stopped and disabled too, run instead:
# saptune service takeover
Note: Combining optimizations

It is possible to combine solutions and notes. However, only one solution can be active at
a time. In rare cases, notes can have conflicting options or parameters. Arrange your notes
carefully to avoid conflicts. The last note always takes priority over conflicting options
or parameters of previous notes.
Note: Switching solutions

Starting with saptune version 3.1, it is easier to switch to a different solution using the
saptune solution change NEW_SOLUTION command.
Keep in mind that internally the current solution is reverted rst, and then the new solu-
tion is applied. If you have additional notes configured, the order is not preserved.
68 Enabling saptune SLES-SAP 15 SP1

9.2 Disabling saptune
To disable and stop saptune , run:
# saptune service disablestop
9.3 Updating saptune

To update saptune to a new version, just update the package.
Since a package update can contain updates of SAP Notes and SAP Solutions, restart saptune
with saptune service restart to re-apply the tuning. Check afterwards with saptune note
verify if all recommendations are still met.
Important
The saptune tool does not rely on tuned anymore. Configuring tuned to set up sap-
tune 3 will not work. To start and enable saptune 3 use one of the following methods:
saptune service enablestart
Enables and starts the saptune.service .
saptune service takeover
Enables and starts the saptune.service and also disables sapconf as well as
tuned .
saptune daemon start
Deprecated. Gets redirected to saptune service takeover.
9.4 Managing SAP Notes

In the following sections you will learn how to create, delete, and rename SAP Notes and much
more.
69 Disabling saptune SLES-SAP 15 SP1

9.4.1 Customizing an SAP Note
Every SAP Note can be configured freely with:
# saptune note customise NOTE
The command includes changing a value or disabling a parameter.
9.4.2 Creating a new SAP Note

It is possible to create a new SAP Note with:
# saptune note create NOTE
All features of saptune are available.
9.4.3 Deleting an SAP Note

The following command deletes a created note, including the corresponding override le, if
available:
# saptune note delete test

Note to delete is a customer/vendor specific Note.
Do you really want to delete this Note (test2)? [y/n]: y
The note may not be applied at the time. Keep in mind the following points:
A confirmation is needed to finish the action.
Internal SAP Notes shipped by saptune cannot be deleted. Instead, the override le is
removed when available.
If the note is already applied, the command is terminated with the information that the
note rst needs to be reverted before it can be deleted.
9.4.4 Renaming an SAP Note

This command allows renaming a created note to a new name. If a corresponding override le
is available, this le is renamed, too:
# saptune note rename test test2

Note to rename is a customer/vendor specific Note.
70 Customizing an SAP Note SLES-SAP 15 SP1

Do you really want to rename this Note (test) to the new name 'test2'? [y/n]: y
The note may not be applied at the time. Keep in mind the following points:
Internal SAP Notes shipped by saptune cannot be renamed.
If the note is already applied, the command is terminated with the information that the
note rst needs to be reverted before it can be deleted.
9.4.5 Showing the configuration of an SAP Note

The shipped configuration of a note can be listed with:
# saptune note show NOTE
9.4.6 Verifying an SAP Note or an SAP Solution

The commands saptune note verify NOTE and saptune solution verify SOLUTION list
the following data for each active or requested note:
The parameter name
The expected value (default)
A configured override (created using saptune customise )
The current system value
Whether the current state follows the SAP recommendation
9.4.7 Simulating the application of an SAP Note or an SAP Solution

To show each parameter of a note , use the following command:
# saptune note simulate
The command to show each parameter of a solution is as follows:
# saptune solution simulate
The command lists the current system value and the expected values (default and override).
71 Showing the configuration of an SAP Note SLES-SAP 15 SP1

9.4.8 Reverting an SAP Note
To revert an SAP Note, run the following command:
# saptune note revert NOTE
This restores all parameters of the SAP Note to their values at the time of application.
To revert everything, use the following command:
# saptune note revert all
9.4.9 Editing a SAP Note

Each custom SAP Note can be edited by:
# saptune note edit NOTE
9.4.10 Listing all enabled or applied SAP Notes

To list all enabled SAP Notes, run:
# saptune note enabled
To list all applied SAP Notes, run:
# saptune note applied
9.5 Managing SAP Solutions

This chapter explains how to work with SAP Solutions.
9.5.1 Creating a new SAP Solution

To create a new SAP Solution, run:
# saptune solution create SOLUTION
72 Reverting an SAP Note SLES-SAP 15 SP1

9.5.2 Deleting SAP Solution
To delete an SAP Solution, run the following command:
# saptune solution delete myHANA
Solution to delete is a customer/vendor specific Solution.

Do you really want to delete this Solution 'myHANA'? [y/n]: y
The SAP Solution may not be applied at the time. Keep in mind the following points:
A confirmation is required to finish the action.
SAP Solutions shipped by saptune cannot be deleted.
If the SAP Solution is already applied, the command is terminated with the information
that the SAP Solution rst needs to be reverted before it can be deleted.
9.5.3 Renaming an SAP Solution

To rename an SAP Solution, run the following command:
# saptune solution rename myHANA myHANA2
Solution to rename is a customer/vendor specific Solution.

Do you really want to rename this Solution 'myHANA' to the new name 'myHANA2'? [y/n]:
The SAP Solution may not be applied at the time. Keep in mind the following points:
SAP Solutions shipped by saptune cannot be renamed.
If the SAP Solution is already applied, the command will be terminated with the informa-
tion, that the SAP Solution rst needs to be reverted before it can be renamed.
9.5.4 Showing the configuration of an SAP Solution

To list the configuration of an SAP Solution, run the following command:
# saptune solution show SOLUTION
73 Deleting SAP Solution SLES-SAP 15 SP1

9.5.5 Reverting an SAP Solution
To revert an SAP Solution, run the following command:
# saptune solution revert SOLUTION
The SAP Solution must be applied. This reverts all SAP Notes parts of the SAP Solution that
are still applied.
9.5.6 Editing a custom SAP Solution

To edit a custom SAP Solution, run:
# saptune solution edit SOLUTION
9.5.7 Listing enabled/applied SAP Solution

To list enabled SAP Solution, run:
# saptune solution enabled
To list applied SAP Solution, run:
# saptune solution applied
If SAP Notes from an applied SAP Solution have been reverted, the string (partial) has been
added to the solution name.
9.6 Verification and troubleshooting

To see the current status of saptune , run the following command:
# saptune status
The output contains the following:
status of the saptune , sapconf , and tuned service
version of package and running saptune
details about configured SAP Solution and SAP Notes
74 Reverting an SAP Solution SLES-SAP 15 SP1

details about staging
status of systemd system state
virtualization environment (new in saptune version 3.1)
tuning compliance (new in saptune version 3.1)
If a problem occurs, use the saptune_check command (in version 3.1, you can also use the
command saptune check ) that runs checks, reports problems and offers advice on how to
solve them.
9.7 Machine-readable output

Starting with version 3.1, saptune supports machine-readable output (JSON) for the following
commands:
saptune [daemon|service] status
saptune note list|verify|enabled|applied
saptune solution list|verify|enabled|applied
saptune status
saptune version
The machine-readable output makes it possible to integrate saptune into scripts and configu-
ration management solutions.
To generate JSON output, add --format json as the rst option, for example:
> saptune --format json note applied | jq

{
"$schema": "file:///usr/share/saptune/schemas/1.0/saptune_note_applied.schema.json",
"publish time": "2023-08-29 17:05:45.627",
"argv": "saptune --format json note applied",
"pid": 1538,
"command": "note applied",
"exit code": 0,
"result": {
"Notes applied": [
"941735",
"1771258",
75 Machine-readable output SLES-SAP 15 SP1

"1980196",
"2578899",
"2684254",
"2382421",
"2534844",
"2993054",
"1656250"
]
},
"messages": []
}
If a command does not yet support JSON output, the command fails with the result block set
to "implemented": false :
[+]
> saptune --format json staging status | jq
{
"$schema": "file:///usr/share/saptune/schemas/1.0/saptune_staging_status.schema.json",
"publish time": "2023-08-29 17:08:16.708",
"argv": "saptune --format json staging status",
"pid": 1653,
"command": "staging status",
"exit code": 1,
"result": {
"implemented": false
},
"messages": []
}
9.8 Staging
It is possible that a new saptune package can contain both binary changes (for example, bug
fixes) and new or altered SAP Notes and SAP Solutions. In certain situations, it is preferable to
deploy bug fixes and new features while leaving modifications to the system configuration out.
With staging enabled, SAP Note and SAP Solution changes in a package update are not activated
immediately. They are placed in a staging area, which can be reviewed and released later.
Important
With the current implementation, a package update overwrites the staging if staging is
enabled.
76 Staging SLES-SAP 15 SP1

Staging is disabled by default, and it can be enabled with the following command:
# saptune staging enable
From that point, SAP Note and SAP Solution changes shipped by a saptune package are put
in the staging area. To view the staging area, run:
# saptune staging list
You can print a tabular overview of the differences of the SAP Note and SAP Solution in the
staging and working area with the following command:
# saptune staging diff [NOTE...|SOLUTION...|all]
After reviewing the differences, you can perform an analysis to see if a release has potential
issues or requires additional steps. To do this, run the following command:
# saptune staging analysis [NOTE...|SOLUTION...|all]
To release an SAP Note or an SAP Solution from the staging area, use the command as follows:
# saptune staging [--force|--dry-run] [NOTE..|SOLUTION...|all]
The command presents an analysis (see saptune staging analysis ) and carries out the release
after asking for confirmation.
9.9 Tuning kernel parameters manually using sysctl

In addition to or instead of tuning kernel parameters using saptune , you can also use sysctl
to make manual adjustments to kernel parameters. However, such changes using sysctl do
not persist across reboots by default. To make them persist across reboots, add them to one of
the configuration les read by sysctl .
Tip: sysctl and saptune

If you plan to configure sysctl parameters for your SAP system, consider using saptune
as the central tool for managing such configurations.
For more information about sysctl , see the man pages sysctl(8) , sysctl.conf(5) , and
sysctl.d(5) .
77 Tuning kernel parameters manually using sysctl SLES-SAP 15 SP1

9.10 For more information
See the following man pages:
man 8 saptune
man 8 saptune-migrate
man 8 saptune-note
Also see the project home page https://github.com/SUSE/saptune/ .
78 For more information SLES-SAP 15 SP1

10 Tuning Workload Memory Protection
Important
If you have systemd -based SAP instances, read Section 10.9, “Systems running both sys-
temd-based and regular SAP instances” and Section 10.10, “Systems running only systemd-based
instances” before setting up Workload Memory Protection.
Keeping SAP applications in physical memory is essential for their performance. In older product
versions, the Page Cache Limit prevented a swap out to disk by a growing page cache (in SUSE
Linux Enterprise Server for SAP Applications 11 SP1 onwards and in SUSE Linux Enterprise
Server for SAP Applications 12). In SUSE Linux Enterprise Server for SAP Applications 15, the
Page Cache Limit has been replaced by the more advanced Workload Memory Protection.
Workload Memory Protection puts SAP instances into a dedicated cgroup (v2) and tells the
kernel, by the memory.low parameter, the amount of memory to keep in physical memory. This
protects the processes in this cgroup against any form of memory pressure outside that cgroup,
including a growing page cache. Workload Memory Protection cannot protect against memory
pressure inside this cgroup. It covers the memory of all instances together on one host.
The value for memory.low depends on the kind of SAP instance and the workload and needs to
be configured manually. If the system is under extreme pressure, the Linux kernel will ignore
the memory.low value and try to stabilize the whole system, even by swapping or invoking
the OOM killer.
For more information about cgroups, see https://documentation.suse.com/sles-15/html/SLES-all/
cha-tuning-cgroups.html .
10.1 Architecture
WMP relies on three components:
cgroup2 memory controller (Linux kernel)

The cgroup2 memory controller parameter memory.low allows defining an amount of
memory, which the Linux kernel will keep in physical memory. This amount of memory
will be excluded from the reclaiming process unless the entire system is in a critical memory
situation.
79 Architecture SLES-SAP 15 SP1

WMP uses memory.low to prevent memory from SAP processes from being paged or
swapped out to disk. Apart from the memory controller, cgroup1 controllers are still avail-
able, but are not mounted any more.
systemd
systemd provides the infrastructure to create and maintain the cgroup hierarchy and
allows the configuration of cgroup parameters. WMP ships systemd configuration les to
allow easy configuration of memory.low via systemd methods.
SAP start service

The SAP start service manages the starting and stopping of SAP instances. An important
feature for WMP is the configurable execution of programs before the instance itself gets
started in the instance profile. WMP uses this method to call a program to move the sap-
start process into a designated cgroup, so the SAP instance will be started inside that
cgroup.
10.2 Support for Workload Memory Protection

WMP is supported for SUSE Linux Enterprise Server for SAP Applications 15 SP1 on AMD64/
Intel 64 and POWER for one or multiple SAP systems on one host, such as:
App Server (SAP NetWeaver, SAP S/4HANA) or
SAP HANA 1.0/2.0
Workload Memory Protection does not cover databases other than SAP HANA. Depending on
their start method, the processes might run inside or outside the dedicated cgroup. If they run
inside, the memory consumption needs to be taken into account when determining memory.low .
80 Support for Workload Memory Protection SLES-SAP 15 SP1

Important: Restrictions of WMP
Using WMP comes with benefits, but you should be aware of some restrictions:
WMP cannot protect against memory pressure inside the dedicated cgroup.
WMP cannot protect SAP systems or their instances from each other. All SAP
processes share the same memory limit. If you have multiple SAP systems (for ex-
ample, SAP NetWeaver and SAP S/4HANA), WMP cannot shield one SAP applica-
tion from the other.
Support for SUSE’s HA cluster solution is not yet available.
10.3 Setting up Workload Memory Protection
10.3.1 Preparing for Workload Memory Protection
1. Check if your SAP software (SAP HANA, SAP NetWeaver etc) is installed. The group sap-
sys is needed during the package installation of sapwmp later. If you skip that part, you
will get a warning message (see Important: Watch out for order of packages).
2. Stop the SAP system:
# systemctl stop sapinit
The service can be enabled, but all SAP processes need to be terminated.
3. Install the package sapwmp :
> sudo zypper install sapwmp
Important: Watch out for order of packages

The following message should only appear if no SAP software has been installed
on the system:
Warning: sapsys group not found warning: group sapsys does not exist - using
root
81 Setting up Workload Memory Protection SLES-SAP 15 SP1

Remove the package sapwmp and install the SAP software rst before installing
sapwmp again.
As an alternative, you can x ownership and permission after installing the SAP
software with:
> sudo chgrp sapsys /usr/lib/sapwmp/sapwmp-capture && \

chmod +s /usr/lib/sapwmp/sapwmp-capture
The following message can be ignored:
Warning: Found memory controller on v1 hierarchy. Make sure unified hierarchy only
is used.
Switching to unified hierarchy is done in the next step.
4. Add systemd.unified_cgroup_hierarchy=true to the kernel command line by adding

it to GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub like:
GRUB_CMDLINE_LINUX_DEFAULT="... systemd.unified_cgroup_hierarchy=true swapaccount=1"
With this change, only cgroup2 controllers will be mounted on /sys/fs/cgroup . Cgroup1
controllers, except the memory controller, are still available and can be used though. Tools
using cgroup1 might not work out of the box any more and might need reconfiguration.
Also, the required mount structure for cgroup1 needs to be provided.
The parameter swapaccount=1 is not needed for WMP to work, but it aids the analysis
in support cases to show the amount of swapped out memory for each cgroup.
5. Rewrite the GRUB2 configuration:
> sudo grub2-mkconfig -o /boot/grub2/grub.cfg
After reboot (will be done later), the cgroup hierarchy is switched to v2 (unified hierarchy)
only.
6. Configure MemoryLow for the SAP.slice :
> sudo systemctl set-property SAP.slice MemoryLow=...
This command creates a drop-in in /etc/systemd/system.control/SAP.slice.d/ to

set MemoryLow .
82 Preparing for Workload Memory Protection SLES-SAP 15 SP1

The sapwmp package includes the systemd configuration SAP.slice which creates the
cgroup of the same name for the SAP instances. MemoryLow is the systemd equivalent
of the cgroup parameter memory.low mentioned in the introduction. The value for Mem-
oryLow depends on the type of the SAP application and the workload.
For SAP HANA

Since SAP HANA has a Global Allocation Limit, its value can be used directly.
SAP Application Server (SAP NetWeaver, SAP S/4HANA)

For the Application Server, the sizing for the workload should indicate the value for
MemoryLow . The sapwmp package contains a monitoring part which might be useful
to determine MemoryLow . See Section 10.6, “Monitoring memory usage”.
Keep in mind:
All SAP instances on one host are inside the SAP.slice . MemoryLow must cover the
amount of memory of all instances together on that host. You cannot protect SAP
systems or their instances from each other.
If you are using a database other than SAP HANA, some database processes might
be part of SAP.slice . Their memory consumption needs to be taken into account
when determining the MemoryLow value.
Never choose a value for MemoryLow very close to or larger than your physical mem-
ory. System services and additional installed software require memory too. If they
are forced to use swap too extensively, at the expense of the SAP application, your
system can become unresponsive.
Note: Correctly calculate MemoryLow value

MemoryLow takes the memory size in bytes. If the value is suffixed with K, M,
G, or T, the specified memory size is parsed as Kibibytes, Mebibytes, Gibibytes,
or Tebibytes (with the base 1024 instead of 1000, see https://en.wikipedia.org/wi-
ki/Binary_prefix ), respectively. Alternatively, a percentage value may be specified,
which is taken relative to the installed physical memory on the system.
The underlying cgroup memory controller will round up the value to a multiple
of the page size. To avoid confusion, set the value for MemoryLow to a multiple of
the page size.
83 Preparing for Workload Memory Protection SLES-SAP 15 SP1

7. Create a backup of each SAP instance profile. Errors in a profile can prevent a SAP system
from starting.
8. For each SAP instance, add the following line to the instance profile (usually located in /
usr/sap/SID/SYS/profile/ ) after the last Execute_ line:
Execute_20 = local /usr/lib/sapwmp/sapwmp-capture -a
If necessary, increase the number of the Execute statement so that it is the highest one,
which means that that line is executed last.
Important: Editing instance profiles

Edit the instance profiles directly only if you do not have the profiles imported
into the database to manage them via the SAP GUI (transaction RZ11). If you have
imported them, use the SAP GUI to add the lines. Profile les located in the le
system are overwritten and any manual changes would be lost!
Now the system is ready for a reboot.
10.3.2 Reboot and verification
1. Reboot the system.
2. After rebooting, verify that cgroups v2 has indeed been used:
# grep cgroup /proc/mounts

cgroup /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime 0 0
3. Verify that the cgroup was created successfully and the low memory value has been set:
> systemctl show -p MemoryLow SAP.slice

MemoryLow=18487889920 <- Should be your chosen value (always in bytes)!
# cat /sys/fs/cgroup/SAP.slice/memory.low
18487889920 <- Should be your chosen value!
The variable MemoryLow can be set to any value, but the content of the variable is always
a multiple of the page size. Keep this in mind if you notice a slight difference between
the values.
84 Reboot and verification SLES-SAP 15 SP1

4. Check that all SAP instance processes are in the correct system slices/cgroup.
If you have not enabled sapinit.service start the service now. If autostart is not enabled
in the instance profiles, start the instances before you check.
Example:
# systemd-cgls -a /sys/fs/cgroup/SAP.slice
Directory /sys/fs/cgroup/SAP.slice:
|-wmp-rd91fd6b3ca0d4c1183659ef4f9a092fa.scope
| |-3349 sapstart pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
| `-3375 er.sapHA0_ERS10 pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er N...
|-wmp-r360ebfe09bcd4df4873ef69898576199.scope
| |-3572 sapstart pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
| |-3624 dw.sapHA0_D01 pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
...
The sapstartsrv process of an instance always remains in the user slice of SIDadm . Only
the sapstart process and its children will be moved to the target cgroup.
For each instance, a directory wmp-rSCOPEID.scope exists with all processes of this in-
stance. The SCOPEID is a random 128-bit value in hexadecimal.
The SAP HostAgent is not covered by WMP and remains partly in sapinit.slice and
partly in the user slice of sapadm .
5. If the processes are not in the cgroup, check if the Execute lines in the instance profiles
are correct. Also each instance start should now be logged in the system log /var/log/
messages :
...
2020-06-16T18:41:28.317233+02:00 server-03 sapwmp-capture: Found PIDs:
2020-06-16T18:41:28.317624+02:00 server-03 sapwmp-capture: 17001
2020-06-16T18:41:28.319423+02:00 server-03 sapwmp-capture: Successful capture into
SAP.slice/wmp-r07a27e12d7f2491f8ccb9aeb0e080aaa.scope
2020-06-16T18:41:28.319672+02:00 server-03 systemd[1]: Started wmp-
r07a27e12d7f2491f8ccb9aeb0e080aaa.scope.
...
To verify the correct setup, run wmp-check . The script checks the setup of Workload Memory
Protection:
Correct setup of cgroup2.
Ownership and permission of the capture program.
85 Reboot and verification SLES-SAP 15 SP1

WMP entries of SAP instance profiles.
Correct cgrop of running SAP instance processes.
Correct setup of SAP.slice .
Sane configuration of MemoryLow. However, it cannot determine if the MemoryLow value

has been chosen wisely.
Setup of the optional memory sampler.
Setup of optional swap accounting.
It assumes SAP instances profiles can be found beneath /usr/sap/SID/SYS/profile/ .
10.4 Configuring Workload Memory Protection

To configure WMP, edit /etc/sapwmp.conf :
# NOTE: Local changes may be reverted after update of WMP package. Check for
# .rpmsave file to restore & merge changes.
## Description: Slice unit name where workload is put into

## Type: string
## Default: "SAP.slice"
DEFAULT_SLICE="SAP.slice"
## Description: Comma-separated list of command names to which capture is

## applied (matching against /proc/$PID/stat)
## Type: string
## Default: sapstart
PARENT_COMMANDS=sapstart
After any change, restart all SAP instances.
Warning
Altering /etc/sapwmp.conf should not be necessary. Do not do it until you know exactly
what you are doing!
86 Configuring Workload Memory Protection SLES-SAP 15 SP1

10.5 Changing the value of MemoryLow
To change the value of MemoryLow run:
# systemctl set-property SAP.slice MemoryLow=...
The changes will take effect immediately.

The underlying cgroup memory controller will round up the value to a multiple of the page size.
To avoid confusion, set the value of MemoryLow to a multiple of the page size.
Important: Value of MemoryLow

Never set MemoryLow to a value lower than the memory already accounted in SAP.s-
lice . To check, run:
# systemctl show -p MemoryCurrent SAP.slice
10.6 Monitoring memory usage

Logging the memory usage can be necessary not only to determine the value for memory.low ,
but also for monitoring the correct operation of WMP.
To enable monitoring, activate the shipped timer unit:
# systemctl enable --now wmp-sample-memory.timer
Now the timer should be listed by systemctl list-timers :
# systemctl list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
...
Tue... 9min left Tue... 4s ago wmp-sample-memory.timer wmp-sample-memory.service
...
If you check the current configuration, you can see that memory data is collected every 10 min-
utes with a randomized delay of three minutes:
# systemctl cat wmp-sample-memory.timer

# /usr/lib/systemd/system/wmp-sample-memory.timer
[Unit]
87 Changing the value of MemoryLow SLES-SAP 15 SP1

Description=WMP periodic log of memory consumption
[Timer]
OnCalendar=*:0/10
RandomizedDelaySec=180
AccuracySec=60
[Install]
WantedBy=timers.target
To change this, create a drop-in le and reload systemd (for example, by increasing the interval
to 30 minutes):
# mkdir /etc/systemd/system/wmp-sample-memory.timer.d
# cat <<EOF >/etc/systemd/system/wmp-sample-memory.timer.d/override.conf

[Timer]
OnCalendar=
OnCalendar=*:0/30
EOF
# systemctl daemon-reload
(The rst OnCalendar= line is important for deleting previously defined OnCalendar= settings.)
To see the memory consumption, check the system log for lines written by wmp_memory_cur-
rent :
# grep wmp_memory_current /var/log/messages

...
2020-09-14T12:02:40.337266+02:00 server-03 wmp_memory_current: SAP.slice :

memory.low=21474836480 memory.current=2294059008 memory.swap.current=0 , user.slice :
memory.low=0 memory.current=5499219968 memory.swap.current=0 , init.scope :
memory.low=0 memory.current=8364032 memory.swap.current=0 , system.slice : memory.low=0
memory.current=1863335936 memory.swap.current=0
88 Monitoring memory usage SLES-SAP 15 SP1

...
Here is a reformatted log line to get a better impression:
2020-09-14T12:02:40.337266+02:00 server-03 wmp_memory_current:

SAP.slice : memory.low=21474836480 memory.current=2294059008 memory.swap.current=0 ,
user.slice : memory.low=0 memory.current=5499219968 memory.swap.current=0 ,
init.scope : memory.low=0 memory.current=8364032 memory.swap.current=0 ,
system.slice : memory.low=0 memory.current=1863335936 memory.swap.current=0
For each cgroup directly below /sys/fs/cgroup/ one comma-separated block exists. On a
normal system, you should nd at least user.slice , system.slice , and init.scope . WMP
adds SAP.slice .
Each block contains the information about the current value of memory.low and memory.cur-
rent , and the currently allocated amount of physical memory of processes in this cgroup.
If you enabled swap accounting ( swapaccount=1 ) during setup, you also have memo-
ry.swap.current , the amount of swapped-out memory of the cgroup.
All values are in bytes. See Step 6 in Section 10.3.1, “Preparing for Workload Memory Protection”.
Tip: Script for printing

You can nd a script to print the information as table or CSV here: https://github.com/
scmschmidt/wmp_log_extract
10.7 Verifying correct operation

Besides monitoring memory consumption and swapping (see Section 10.6, “Monitoring memory
usage”), you should also regularly check that all SAP instance processes are in their scopes below
SAP.slice .
To do so, run systemd-cgls and check each instance process.

Example:
# systemd-cgls -a /sys/fs/cgroup/SAP.slice
Directory /sys/fs/cgroup/SAP.slice:
|-wmp-rd91fd6b3ca0d4c1183659ef4f9a092fa.scope
| |-3349 sapstart pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
| `-3375 er.sapHA0_ERS10 pf=/usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er N...
|-wmp-r360ebfe09bcd4df4873ef69898576199.scope
89 Verifying correct operation SLES-SAP 15 SP1

| |-3572 sapstart pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
| |-3624 dw.sapHA0_D01 pf=/usr/sap/HA0/SYS/profile/HA0_D01_sapha0ci
...
A simpler test would be to list all processes, including cgroups, for all SID s used on the system.
Example:
> ps -eo user,pid,cgroup:60,args | grep -e [h]a0adm

ha0adm 2062 0::/user.slice/user-1001.slice/user@1001.service/init.scope /usr/lib/
systemd/systemd --user
ha0adm 2065 0::/user.slice/user-1001.slice/user@1001.service/init.scope (sd-pam)
ha0adm 3081 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope sapstart pf=/
usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3133 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope
ms.sapHA0_ASCS00 pf=/usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3134 0::/SAP.slice/wmp-r73c594e050904c9c922a312dd9a28fd4.scope
en.sapHA0_ASCS00 pf=/usr/sap/HA0/SYS/profile/HA0_ASCS00_sapha0as
ha0adm 3327 0::/SAP.slice/wmp-ra42489517eb846c282c57681e627a496.scope sapstart pf=/
usr/sap/HA0/ERS10/profile/HA0_ERS10_sapha0er
...
All instance processes except sapstartsrv need to be in a scope below 0::/SAP.slice/ .

To verify the correct setup, use the wmp-check tool. See Section 10.3.2, “Reboot and verification”
for more details.
10.8 Uninstalling Workload Memory Protection

1. Stop the SAP system completely. The sapinit.service has to be stopped, but can stay
enabled. All SAP processes have to be terminated.
2. Remove any changes made to SAP.slice , such as setting MemoryLow :
# systemctl revert SAP.slice
3. (Optional) Remove the package sapwmp :
# zypper remove sapwmp
This step is optional. The package can stay on the system without having an influence.
4. (Optional) Remove systemd.unified_cgroup_hierarchy=true from

GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub .
90 Uninstalling Workload Memory Protection SLES-SAP 15 SP1

This step is optional. You can keep cgroup2 without using WMP.
5. Rewrite the GRUB2 configuration:
# grub2-mkconfig -o /boot/grub2/grub.cfg
After the next boot, the system is switched back to the hybrid cgroup hierarchy.
6. Remove the line to call sapwmp-capture from each SAP instance profile (usually located
in /usr/sap/SID/SYS/profile/ ):
Execute_20 = local /usr/lib/sapwmp/sapwmp-capture -a
Important: Backup is necessary

Before editing an instance profile, create a backup! Errors in a profile can prevent
an SAP system from starting!
Important: About editing profiles directly

Edit the instance profiles directly only if you have not imported the profiles into the
database to manage them via the SAP GUI (transaction RZ11). If you have imported
them, use the SAP GUI to add the lines. Profile les located in the le system are
overwritten, and any manual changes will be lost!
7. Reboot the system and verify that your SAP system has been started successfully.
91 Uninstalling Workload Memory Protection SLES-SAP 15 SP1

10.9 Systems running both systemd-based and
regular SAP instances
With SAP kernel version 788 and certain specified patch levels of older kernel releases (722,
753, 777, 781, 785), the SAP Start Service supports systemd . Such a systemd -based instance
comes with its own systemd service that the SAP Start Service places into its own cgroup
( SAPSID_NR.service ) under SAP.slice . This affects the Workload Memory Protection setup.
For systemd -based SAP instances, the following instructions apply:
Skip the step that adds the capture program to the instance profile. If you are migrating
an instance to support systemd , remove this entry from the profile. Keep in mind that
systemd -based instances are always put into a cgroup under SAP.slice and therefore
become part of Workload Memory Protection protection.
Set MemoryLow=infinity for the SAPSID_NR.service to make the protection work cor-
rectly. Example for SAPNW1_01.service :
sudo systemctl set-property SAPNW1_01.service MemoryLow=infinity
Set MemoryLow=infinity for the saphostagent.service to make the protection work

correctly
sudo systemctl set-property saphostagent.service MemoryLow=infinity
The following example demonstrates a mixed environment. The SAP Host Agent and instance
01 are systemd -based, instance 00 is not. Both instances are under SAP.slice either in the
cgroup managed by the SAP Start Service ( SAPNW1_01.service ) or Workload Memory Protec-
tion ( wmp-rece5b7fa372e4619a9623e120aa23a23.scope ). MemoryLow= for SAP.slice has
been set as well as MemoryLow=infinity for all the cgroups below.
> systemd-cgls
Control group /:
-.slice
├─SAP.slice
│ ├─SAPNW1_01.service
│ │ ├─ 887 /usr/sap/NW1/ASCS01/exe/sapstartsrv pf=/usr/sap/NW1/SYS/profile/
NW1_ASCS01_systemdproj
│ │ ├─2838 sapstart pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ │ ├─2895 ms.sapNW1_ASCS01 pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ │ └─2896 en.sapNW1_ASCS01 pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ ├─saphostagent.service
92 Systems running both systemd-based and regular SAP instances SLES-SAP 15 SP1
│ │ ├─ 900 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile -
nodaemon -trace
│ │ ├─ 984 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile
│ │ └─2428 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile
│ └─wmp-rece5b7fa372e4619a9623e120aa23a23.scope
│ ├─5522 sapstart pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
│ ├─7824 dw.sapNW1_D00 pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
│ ├─7825 ig.sapNW1_D00 -mode=profile pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
...

MemoryLow=24584065024
> systemctl show -p MemoryLow wmp-rece5b7fa372e4619a9623e120aa23a23.scope

MemoryLow=infinity
> systemctl show -p MemoryLow SAPNW1_01.service

MemoryLow=infinity
> systemctl show -p MemoryLow saphostagent.service

MemoryLow=infinity
Further information about the systemd integration is available at SAP Note 139184 - Linux:
systemd integration for sapstartsrv and SAP Host Agent (https://launchpad.support.sap.com/#/
notes/3139184) .
10.10 Systems running only systemd-based

instances
Note
SUSE's HA cluster solutions are supported for fully systemd -based SAP systems.
A SAP system consisting of systemd -based instances can only rely on cgroup2 for memory
protection.
The instances are placed into a dedicated cgroup (default is SAP.slice ) by the SAP Start Ser-
vice. Therefore it is only necessary to switch to the unified cgroup2 hierarchy and set Memory-
Low= correctly.
93 Systems running only systemd-based instances SLES-SAP 15 SP1

If Workload Memory Protection is already configured, follow the instructions in Section 10.9,
“Systems running both systemd-based and regular SAP instances”. Afterwards, you can remove the
package sapwmp from the system, unless you want to use the wmp-sample-memory.timer and
wmp-sample-memory.service to monitor memory usage.
To configure the memory protection for a system consisting of only systemd -based SAP in-
stances, perform the following steps:
Stop all SAP instances and the SAP Host Agent.
Switch to the unified cgroup hierarchy, rewrite the boot loader (step 4 and 5 in Sec-
tion 10.3.1, “Preparing for Workload Memory Protection”).
Set MemoryLow= for SAP.slice (step 6 in Section 10.3.1, “Preparing for Workload Memory
Protection”).
Set MemoryLow=infinity for saphostagent.service and for the services of all SAP
instances.
Reboot the system.
The following example demonstrates a systemd -based environment. The SAP Host Agent and
all instances are in their cgroups under SAP.slice . MemoryLow= for SAP.slice has been set
as well as MemoryLow=infinity for all the cgroups below.
> systemd-cgls
Control group /:
-.slice
├─SAP.slice
│ │ ├─5522 sapstart pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
│ │ ├─7824 dw.sapNW1_D00 pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
│ │ ├─7825 ig.sapNW1_D00 -mode=profile pf=/usr/sap/NW1/SYS/profile/NW1_D00_systemdproj
...
│ │ ├─ 887 /usr/sap/NW1/ASCS01/exe/sapstartsrv pf=/usr/sap/NW1/SYS/profile/
NW1_ASCS01_systemdproj
│ │ ├─2838 sapstart pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ │ ├─2895 ms.sapNW1_ASCS01 pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ │ └─2896 en.sapNW1_ASCS01 pf=/usr/sap/NW1/SYS/profile/NW1_ASCS01_systemdproj
│ └─saphostagent.service
│ ├─ 900 /usr/sap/hostctrl/exe/saphostexec pf=/usr/sap/hostctrl/exe/host_profile -
nodaemon -trace
│ ├─ 984 /usr/sap/hostctrl/exe/sapstartsrv pf=/usr/sap/hostctrl/exe/host_profile
│ └─2428 /usr/sap/hostctrl/exe/saposcol -l -w60 pf=/usr/sap/hostctrl/exe/host_profile

...

MemoryLow=24584065024
> systemctl show -p MemoryLow wmp-rece5b7fa372e4619a9623e120aa23a23.scope

MemoryLow=infinity
> systemctl show -p MemoryLow SAPNW1_01.service

MemoryLow=infinity
> systemctl show -p MemoryLow saphostagent.service

MemoryLow=infinity

11 Firewalling
This chapter presents information about restricting access to the system using firewalling and
encryption and gives information about connecting to the system remotely.
11.1 Configuring firewalld

By default, the installation workflow of SUSE Linux Enterprise Server for SAP Applications en-
ables firewalld .
Note: firewalld Replaces SuSEfirewall2

SUSE Linux Enterprise Server for SAP Applications 15 GA introduces firewalld as the
new default software firewall, replacing SuSEfirewall2. SuSEfirewall2 has not been re-
moved from SUSE Linux Enterprise Server for SAP Applications 15 GA and is still part of
the main repository, though not installed by default. If you are upgrading from a release
older than SUSE Linux Enterprise Server for SAP Applications 15 GA, SuSEfirewall2 will
be unchanged and you must manually upgrade to firewalld (see Security and Harden-
ing Guide).
The firewall needs to be manually configured to allow network access for the following:
SAP application
Database (see the documentation of your database vendor; for SAP HANA, see Section 11.2,
“Configuring HANA-Firewall”)
Additionally, open the ports 1128 (TCP) and 1129 (UDP).

SAP applications require many open ports and port ranges in the firewall. The exact numbers
depend on the selected instance. For more information, see the documentation provided to you
by SAP.
11.2 Configuring HANA-Firewall

To simplify setting up a firewall for SAP HANA, install the package HANA-Firewall . HANA-
Firewall adds rule sets to your existing SuSEfirewall2 configuration.
96 Configuring firewalld SLES-SAP 15 SP1

HANA-Firewall consists of the following parts:
YaST Module SAP HANA Firewall. Allows configuring, applying, and reverting firewall rules
for SAP HANA from a graphical user interface.
Command-Line Utility hana-firewall . Creates XML les containing firewall rules for SAP
HANA.
If you prefer, you can configure the rule sets using the configuration le at /etc/syscon-
fig/hana-firewall instead of using YaST.
Important: SAP HANA MDC Databases

For multi-tenant SAP HANA (MDC) databases, determining the port numbers that need
to be opened is not yet possible automatically. If you are working with a multi-tenant
SAP HANA database system, before you use YaST, run a script on the command line to
create a new service definition:
# cd /etc/hana-firewall.d
# hana-firewall define-new-hana-service
You need to switch to the directory /etc/hana-firewall.d , otherwise the rule le for
the new service will be created in a place where it cannot be used.
The script will ask several questions: Importantly, it will ask for TCP and UDP port ranges
that need to be opened.
Note: Install HANA-Firewall Packages

Before continuing, make sure that the packages HANA-Firewall and yast2-hana-fire-
wall are installed.
PROCEDURE 11.1: USING HANA-FIREWALL
1. Make sure the SAP HANA databases for which you want to configure the firewall are
correctly installed.
2. To open the appropriate YaST module, select Applications YaST, Security and Users SAP
HANA Firewall.
3. Under Global Options, activate Enable Firewall. Additionally, decide whether to Allow Re-
mote Shell Access (SSH).
97 Configuring HANA-Firewall SLES-SAP 15 SP1

4. Choose a network interface under Allowed Services on Network Interface.
5. Allow network services by selecting them in the list box on the left and clicking →. Remove
services by selecting them in the list box on the right and clicking ←.
To add services other than the preconfigured ones, use the following notation:
SERVICE_NAME:CIDR_NOTATION
For more information about the CIDR notation, see https://en.wikipedia.org/wiki/Class-

less_Inter-Domain_Routing . To nd out which services are available on your system, use
getent services .
6. Repeat from Step 4 for all network interfaces.
7. When you are done, click OK.

The firewall rules from HANA-Firewall will now be compiled and applied. Then, the ser-
vice hana-firewall will be restarted.
8. Finally, check whether HANA-Firewall was enabled correctly:
# hana-firewall status
HANA firewall is active. Everything is OK.
For more information, see the man page of hana-firewall .
98 Configuring HANA-Firewall SLES-SAP 15 SP1

11.3 SAProuter Integration
The SAProuter software from SAP allows proxying network traffic between different SAP sys-
tems or between an SAP system and outside networks. SUSE Linux Enterprise Server for SAP
Applications now provides integration for SAProuter into systemd . This means that SAProuter
will be started and stopped properly with the operating system and can be controlled using
systemctl .
Before you can use this functionality, make sure the following has been installed, in this order:
An SAP application that includes SAProuter
The SAProuter systemd integration, packaged as saprouter-systemd
If you got the order of applications to install wrong initially, reinstall saprouter-systemd .
To control SAProuter with systemctl , use:
Enabling the SAProuter service: systemctl enable saprouter
Starting the SAProuter service: systemctl start saprouter
Showing the Status of SAProuter service: systemctl status saprouter
Stopping the SAProuter service: systemctl stop saprouter
Disabling the SAProuter service: systemctl disable saprouter
99 SAProuter Integration SLES-SAP 15 SP1

12 Encrypting Directories Using cryptctl
cryptctl consists of two components:
A client is a machine that has one or more encrypted partitions but does not permanently
store the necessary key to decrypt those partitions. For example, clients can be cloud or
otherwise hosted machines.
The server holds encryption keys that can be requested by clients to unlock encrypted
partitions.
You can also set up the cryptctl server to store encryption keys on a KMIP 1.3-compatible
(Key Management Interoperability Protocol) server. In that case, the cryptctl server will
not store the encryption keys of clients and is dependent upon the KMIP-compatible server
to provide these.
Warning: cryptctl Server Maintenance

Since the cryptctl server manages timeouts for the encrypted disks and, depending on
the configuration, can also hold encryption keys, it should be under your direct control
and managed only by trusted personnel.
Additionally, it should be backed up regularly. Losing the server's data means losing
access to encrypted partitions on the clients.
To handle encryption, cryptctl uses LUKS with aes-xts-256 encryption and 512-bit keys. En-
cryption keys are transferred using TLS with certificate verification.
100 SLES-SAP 15 SP1

cryptctl Client cryptctl Server
Waits for kernel notification that

a disk was attached
Sends RPC request to retrieve Listens for RPC requests

encryption key over TCP
Records request in
system journal
Responds to RPC request

with partition key
Uses key to mount partition
FIGURE 12.1: KEY RETRIEVAL WITH cryptctl (MODEL WITHOUT CONNECTION TO KMIP SERVER)
Note: Install cryptctl

Before continuing, make sure the package cryptctl is installed on all machines you
intend to set up as servers or clients.
12.1 Setting Up a cryptctl Server

Before you can define a machine as a cryptctl client, you need to set up a machine as a
cryptctl server.
Before beginning, choose whether to use a self-signed certificate to secure communication be-
tween the server and clients. If not, generate a TLS certificate for the server and have it signed
by a certificate authority.
Additionally, you can have clients authenticate to the server using certificates signed by a cer-
tificate authority. To use this extra security measure, make sure to have a CA certificate at hand
before starting this procedure.
1. As root , run:
# cryptctl init-server
2. Answer each of the following prompts and press Enter after every answer. If there is a
default answer, it is shown in square brackets at the end of the prompt.
101 Setting Up a cryptctl Server SLES-SAP 15 SP1

a. Choose a password with at least 10 characters and confirm it. This password assumes
the role of a master password, able to unlock all partitions that are registered on
the server.
b. Specify the path to a PEM-encoded TLS certificate or certificate chain le or leave the
eld empty to create a self-signed certificate. If you specify a path, use an absolute
path.
c. If you want the server to be identified by a host name other than the default shown,
specify a host name. cryptctl will then generate certificates which include the
host name.
d. Specify the IP address that belongs to the network interface that you want to listen
on for decryption requests from the clients, then set a port number (the default is
port 3737).
The default IP address setting, 0.0.0.0 means that cryptctl will listen on all
network interfaces for client requests using IPv4.
e. Specify a directory on the server that will hold the decryption keys for clients.
f. Specify whether clients need to authenticate to the server using a TLS certificate. If
you choose No, this means that clients authenticate using disk UUIDs only. (However,
communication will be encrypted using the server certificate in any case.)
If you choose Yes, pick a PEM-encoded certificate authority to use for signing client
certificates.
g. Specify whether to use a KMIP 1.3-compatible server (or multiple such servers) to
store encryption keys of clients. If you choose this option, provide the host names
and ports for one or multiple KMIP-compatible servers.
Additionally, provide a user name, password, a CA certificate for the KMIP server,
and a client identity certificate for the cryptctl server.
Important: No Easy Reconfiguration of KMIP Setting

The setting to use a KMIP server cannot easily be changed later. To change this
setting, both the cryptctl server and its clients need to be configured afresh.
h. Finally, configure an SMTP server for e-mail notifications for encryption and decryp-
tion requests or leave the prompt empty to skip setting up e-mail notifications.
102 Setting Up a cryptctl Server SLES-SAP 15 SP1

Note: Password-Protected Servers
cryptctl currently cannot send e-mail using authentication-protected SMTP
servers. If that is necessary, set up a local SMTP proxy.
i. When asked whether to start the cryptctl server, enter y .
3. To check the status of the service cryptctl-server , use:
# systemctl status cryptctl-server
To reconfigure the server later, do either of the following:
Run the command cryptctl init-server again. cryptctl will then propose the exist-
ing settings as the defaults, so that you only need to the specify the values that you want
to change.
Make changes directly in the configuration le /etc/sysconfig/cryptctl-server .

However, to avoid issues, do not change the settings AUTH_PASSWORD_HASH and
AUTH_PASSWORD_SALT manually. The values of these options need to be calculated cor-
rectly.
12.2 Setting Up a cryptctl Client

The following interactive setup of cryptctl is currently the only setup method.
Make sure the following preconditions are fulfilled:
A cryptctl server is available over the network.
There is a directory to encrypt.
The client machine has an empty partition available that is large enough to t the directory
to encrypt.
When using a self-signed certificate, the certificate ( *.crt le) generated on the server is
available locally on the client. Otherwise, the certificate authority of the server certificate
must be trusted by the client.
If you set up the server to require clients to authenticate using a client certificate, prepare a
TLS certificate for the client which is signed by the CA certificate you chose for the server.
103 Setting Up a cryptctl Client SLES-SAP 15 SP1

1. As root , run:
# cryptctl encrypt
2. Answer each of the following prompts and press Enter after every answer. If there is a
default answer, it is shown in square brackets at the end of the prompt.
a. Specify the host name and port to connect to on the cryptctl server.
b. If you configured the server to have clients authenticate to it using a TLS certificate,
specify a certificate and a key le for the client. The client certificate must be signed
by the certificate authority chosen when setting up the server.
c. Specify the absolute path to the server certificate (the *.crt le).
d. Enter the encryption password that you specified when setting up the server.
e. Specify the path to the directory to encrypt. Specify the path to the empty partition
that will contain the encrypted content of the directory.
f. Specify the number of machines that are allowed to decrypt the partition simulta-
neously.
Then specify the timeout in seconds before additional machines are allowed to de-
crypt the partition after the last vital sign was received from the client or clients.
When a machine unexpectedly stops working and then reboots, it needs to be able to
unlock its partitions again. That means this timeout should be set to a time slightly
shorter than the reboot time of the client.
Important: Timeout Length

If the time is set too long, the machine cannot decrypt encrypted partitions on
the rst try. cryptctl will then continue to periodically check whether the
encryption key has become available. However, this will introduce a delay.
If the timeout is set too short, machines with a copy of the encrypted partition
have an increased chance of unlocking the partition rst.
3. To start encryption, enter yes .

cryptctl will now encrypt the specified directory to the previously empty partition and
then mount the newly encrypted partition. The le system type will be of the same type
as the original unencrypted le system.

Before creating the encrypted partition, cryptctl moves the unencrypted content of the
original directory to a location prefixed with cryptctl-moved- .
4. To check that the directory is indeed mounted correctly, use:
> lsblk -o NAME,MOUNTPOINT,UUID

NAME MOUNTPOINT UUID
[...]
sdc
└─sdc1 PARTITION_UUID
└─cryptctl-unlocked-sdc1 /secret-partition UNLOCKED_UUID
cryptctl identifies the encrypted partition by its UUID. For the previous example, that
is the UUID displayed next to sdc1 .
On the server, you can check whether the directory was decrypted using cryptctl .
# cryptctl list-keys
For a successfully decrypted partition, you will see output like:
2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records

Total: 1 records (date and time are in zone EDT)
Used By When UUID Max.Users Num.Users Mount Point
IP_ADDRESS 2019-06-06 15:00:50 UUID 1 1 /secret-partition
For a partition not decrypted successfully, you will see output like:
2019/06/06 15:50:00 ReloadDB: successfully loaded database of 1 records

Total: 1 records (date and time are in zone EDT)
Used By When UUID Max.Users Num.Users Mount Point
2019-06-06 15:00:50 UUID 1 1 /secret-partition
See the difference in the empty Used by column.

Verify that the UUID shown is that of the previously encrypted partition.
5. After verifying that the encrypted partition works, delete the unencrypted content from
the client. For example, use rm . For more safety, overwrite the content of the les before
deleting them, for example, using shred -u .

Important: shred Does Not Guarantee That Data Is
Completely Erased
Depending on the type of storage media, using shred is not a guarantee that all data
is completely removed. In particular, SSDs usually employ wear leveling strategies
that render shred ineffective.
The configuration for the connection from client to server is stored in /etc/syscon-
fig/cryptctl-client and can be edited manually.
The server stores an encryption key for the client partition in /var/lib/cryptctl/key-
db/PARTITION_UUID .
12.3 Checking Partition Unlock Status Using Server-

side Commands
When a cryptctl client is active, it will send a “heartbeat” to the cryptctl server every 10
seconds. If the server does not receive a heartbeat from the client for the length of the timeout
configured during the client setup, the server will assume that the client is offline. It will then
allow another client to connect (or allow the same client to reconnect after a reboot).
To see the usage status of all keys, use:
# cryptctl list-keys
The information under Num. Users shows whether the key is currently in use. To see more
detail on a single key, use:
# cryptctl show-key UUID
This command will show information about mount point, mount options, usage options, the last
retrieval of the key and the last three heartbeats from clients.
Additionally, you can use journalctl to nd logs of when keys were retrieved.
106 Checking Partition Unlock Status Using Server-side Commands SLES-SAP 15 SP1
12.4 Unlocking Encrypted Partitions Manually
There are two ways of unlocking a partition manually, both of which are run on a client:
Online Unlocking. Online unlocking allows circumventing timeout or user limitations.

This method can be used when there is a network connection between client and server
but the client could not (yet) unlock the partition automatically. This method will unlock
all encrypted partitions on a machine.
To use it, run cryptctl online-unlock . Be prepared to enter the password specified
when setting up the server.
Offline Unlocking. This method can be used when a client cannot or must not be brought
online to communicate with its server. The encryption key from the server must still be
available. This method is meant as a last resort only and can only unlock a single partition
at a time.
To use it, run cryptctl offline-unlock . The server's key le for the requisite partition
( /var/lib/cryptctl/keydb/PARTITION_UUID ) needs to be available on the client.
12.5 Maintenance Downtime Procedure

To ensure that partitions cannot be decrypted during a maintenance downtime, turn o the
client and disable the cryptctl server. You can do so by either:
Stopping the service cryptctl-server :
# systemctl stop cryptctl-server
Unplugging the cryptctl server from the network.

For more information, also see the project home page https://github.com/HouzuoGuo/cryptctl/ .
107 Unlocking Encrypted Partitions Manually SLES-SAP 15 SP1

13 Protecting Against Malware with ClamSAP
ClamSAP integrates the ClamAV anti-malware toolkit into SAP NetWeaver and SAP Mobile
Platform applications. ClamSAP is a shared library that links between ClamAV and the SAP
NetWeaver Virus Scan Interface (NW-VSI). The version of ClamSAP shipped with SUSE Linux
Enterprise Server for SAP Applications 15 SP1 supports NW-VSI version 2.0.
Important: Avoid false positive reports for large files exeeding

maximum file size
By default, ClamAV is not scanning les exeeding various limits like le sizes, nesting
level, or scan time. Such les are reported as "OK". The current default settings for the
ClamAV virus scan engine in the clamscan commandline tool and the clamd scan dae-
mon are set in a way that:
Files and archives are scanned, but only up to the configured or default limits for
size, nesting level, scan time, etc.
The scan engine reports these les as being "OK".
This could potentially allow attackers to bypass the virus scanning.
Alerts can be enabled to set the --alert-exceeds-max=yes option on the clamscan

commandline or via AlertExceedsMax TRUE in clamd.conf for daemon based scans.
Settings these options will cause a "FOUND" report of status type Heuristics.Limit-
s.Exceeded . You need to handle such les differently in front-ends or processing of re-
ports.
Before enabling the alert, ensure that front-ends will not suddenly quarantine or remove
those les.
13.1 Installing ClamSAP

1. On the application host, install the packages for ClamAV and ClamSAP. To do so, use the
command:
> sudo zypper install clamav clamsap
108 Installing ClamSAP SLES-SAP 15 SP1

2. Before you can enable the daemon clamd , initialize the malware database:
> sudo freshclam
3. Start the service clamd :
> sudo systemctl start clamd
4. Check the status of the service clamd with:
> systemctl status clamd

● clamd.service - ClamAV Antivirus Daemon
Loaded: loaded (/usr/lib/systemd/system/clamd.service; enabled; vendor preset:
disabled)
Active: active (running) since Tue 2017-04-11 10:33:03 UTC; 24h ago
[...]
13.2 Creating a Virus Scanner Group in SAP

NetWeaver
1. Log in to the SAP NetWeaver installation through the GUI. Do not log in as a DDIC or
SAP* user, because the virus scanner needs to be configured cross-client.
2. Create a Virus Scanner Group using the transaction VSCANGROUP.
3. To switch from view mode to change mode, click the button Change View ( ).
Confirm the message This table is cross-client by clicking the check mark. The table is now
editable.
4. Select the rst empty row. In the text box Scanner Group, specify CLAMSAPVSI . Under
Group Text, specify CLAMSAP .
Make sure that Business Add-in is not checked.
109 Creating a Virus Scanner Group in SAP NetWeaver SLES-SAP 15 SP1

5. To save the form, click the button Save ( ).
13.3 Setting Up the ClamSAP Library in SAP

NetWeaver
1. In the SAP NetWeaver GUI, call the transaction VSCAN.
editable.
3. Click New entries.
4. Fill in the form accordingly:
Provider Type: Adapter (Virus Scan Adapter)
Provider Name: VSA_HOSTNAME (for example: VSA_SAPSERVER )
Scanner Group : The name of the scanner group that you set up in Section 13.2,
“Creating a Virus Scanner Group in SAP NetWeaver” (for example: CLAMSAPVSI )
Server: HOSTNAME_SID_INSTANCE_NUMBER (for example: SAPSERVER_P04_00 )
Adapter Path: libclamdsap.so
110 Setting Up the ClamSAP Library in SAP NetWeaver SLES-SAP 15 SP1

5. To save the form, click the button .
13.4 Configuring the default location of virus

definitions
By default, ClamAV expects the virus definitions to be located in /var/lib/clamsap . To change
this default location, proceed as follows:
1. Log in to the SAP NetWeaver installation through the GUI. Do not log in as a DDIC or
SAP* user, because the virus scanner needs to be configured cross-client.
2. Select the CLAMSAPVSI group.
3. In the left navigation pane, click Configuration Parameters.
editable.
111 Configuring the default location of virus definitions SLES-SAP 15 SP1

FIGURE 13.1:
5. Click New Entries and select INITDRIVERDIRECTORY .
FIGURE 13.2:
6. Enter the path to a different virus scanner location.
7. To save the form, click the button Save ( ).
13.5 Engaging ClamSAP

To run ClamSAP, go to the transaction VSCAN. Then click Start.
112 Engaging ClamSAP SLES-SAP 15 SP1

FIGURE 13.3: CHANGE VIEW “VIRUS SCAN PROVIDER DEFINITION”
Afterward, a summary will be displayed, including details of the ClamSAP and ClamAV (shown
in Figure 13.4, “Summary of ClamSAP Data”).
113 Engaging ClamSAP SLES-SAP 15 SP1

FIGURE 13.4: SUMMARY OF CLAMSAP DATA

For more information, also see the project home page https://sourceforge.net/projects/clam-
sap/ .
114 For More Information SLES-SAP 15 SP1

14 Connecting via RDP
If you installed SLES-SAP with the RDP option activated or if you installed from a KIWI NG
image, RDP is enabled on the machine via the service xrdp . Alternatively, you can enable RDP
later as described at the end of this section.
You can connect using any software that supports RDP, such as:
Linux: Vinagre (available in SUSE Linux Enterprise Desktop/SLE-WE and openSUSE) or

Remmina (available in openSUSE)
Windows: Remote Desktop Connection
Important: Connection Parameters

Make sure to set up the connection with the following parameters:
Port: 3389
Color Depth: 16-bit or 24-bit only
PROCEDURE 14.1: SETTING UP RDP
If you have not set up an RDP connection during the installation, you can also do so later
using the following instructions.
1. First, create the necessary exception for your firewall, opening port TCP 3389 in all rel-
evant zones. For example, if your internal network uses the internal zone, use the fol-
lowing command:
# firewall-cmd --zone=internal --add-port=3389/tcp
This is a temporary assignment for testing the new setting. If you need to change more
than one zone, change and test each zone one at a time.
2. When you are satisfied that new configuration is correct, make it permanent:
# firewall-cmd --runtime-to-permanent
# firewall-cmd --reload
Find more information on using firewalld in https://docs.suse.com/sles/15/html/SLES-all/cha-se-

curity-firewall.html#sec-security-firewall-firewalld .
115 SLES-SAP 15 SP1

15 Creating Operating System Images
There are multiple ways to create custom operating system images from SUSE Linux Enterprise
Server for SAP Applications. The preferred way is generally to use KIWI NG, which ingests an
XML configuration le and then runs fully automatically.
Alternatively, you can also create an image from an existing installation that is cleaned up before
re-use.
15.1 Creating Images with KIWI NG

KIWI NG is a tool to create operating system images that can be easily copied to new physical
or virtual machines. This section will present information on creating SLES-SAP images with
KIWI NG.
SUSE Linux Enterprise Server for SAP Applications now supports creating images with KIWI NG
using the template from the package kiwi-template-sap . However, there are certain restric-
tions in the current implementation:
Only building VMX disk images is supported. Building other image types is not supported.
You must provide an ISO image of SUSE Linux Enterprise Server for SAP Applications at
/tmp/SLES4SAP.iso , as the Open Build Service does not contain all necessary packages.
To build a basic image, use the following two commands:
1. Build the root le system:
# kiwi -p SLES4SAP --root fsroot
2. Build the VMX image:
# kiwi --create fsroot --type vmx -d build
To enable running graphical installations using SAPinst, the default settings of the image enable
the following:
Installation of an IceWM desktop
The service xrdp is started automatically, so you can connect to the machine via RDP.
For more information, see Chapter 14, Connecting via RDP.
116 Creating Images with KIWI NG SLES-SAP 15 SP1

For more information about KIWI NG and SLES-SAP:
On the KIWI NG configuration for SLES-SAP, see /usr/share/kiwi/image/SLES4SAP/

README .
On KIWI NG in general, see the openSUSE-KIWI Image System Cookbook (https://doc.open-

suse.org/projects/kiwi/doc/ ).
15.2 Cleaning Up an Instance Before Using It as a

Master Image
In some cases, it makes sense to use an image of an already-configured master instance on multi-
ple systems instead of generating a KIWI NG image from scratch. For example, when your image
needs to contain additional software or configuration that cannot be installed using KIWI NG.
However, normally such an image would contain certain configuration data that should not be
copied along with the rest of the system.
To avoid needing to clean up manually, use the script clone-master-clean-up (available from
the package of the same name).
It deletes the following data automatically:
Swap device (zero-wiped, then re-enabled)
SUSE registration information and repositories from SUSE, and the Zypper ID
User and host SSH keys and domain and host names
The generated HANA-Firewall script (but not the configuration itself)
Shell history, mails, cron jobs, temporary les ( /tmp , /var/tmp ), log les ( /var/log ),
random seeds, systemd journal, collectd statistics, postfix configuration, parts of /
root
/var/cache , /var/crash , /var/lib/systemd/coredump
Additionally, the following configuration is restored to defaults:
Network interfaces that do not use DHCP and network configuration ( /etc/hostname , /
etc/hosts , and /etc/resolv.conf )
sudo settings
117 Cleaning Up an Instance Before Using It as a Master Image SLES-SAP 15 SP1

Additionally, you can choose to set up a new root password. UUID-based entries in /etc/
fstab are replaced by device strings. This script also ensures that if the rst-boot section of the
installation workflow was used for the original installation, it is run again on the next boot.
15.2.1 Configuring clone-master-clean-up

Before running clone-master-clean-up , the script can be configured in the following ways:
To configure the script to not clean up certain data, use the configuration le /etc/
sysconfig/clone-master-clean-up .
This le also gives short explanations of the available options.
To configure the script to clean up additional directories or les, create a list with the
absolute paths of such directories and les:
/additional/file/to/delete.now
/additional/directory/to/remove
Save this list as /var/adm/clone-master-clean-up/custom_remove .
15.2.2 Using clone-master-clean-up

To use the script, do:
# clone-master-clean-up
Then follow the instructions.
15.2.3 For More Information

The following sources provide additional information about clone-master-clean-up :
For general information, see the man page clone-master-clean-up .
For information on which les and directories might additionally be useful to delete, see
/var/adm/clone-master-clean-up/custom_remove.template .
118 Configuring clone-master-clean-up SLES-SAP 15 SP1

16 Important Log Files
The most important log les for this product can be found as follows:
The SAP Installation Wizard is a YaST module. You can nd its log entries in /var/log/
YaST/y2log .
All SAP knowledge is bundled in a library. You can nd its log entries in /var/log/
SAPmedia.log .
You can nd log les related to auto-installation in /var/adm/autoinstall/logs .
119 SLES-SAP 15 SP1

A Additional Software for SLES-SAP
SUSE Linux Enterprise Server for SAP Applications makes it easy to install software that is not
included with your subscription:
Extensions and modules allow installing additional software created and supported by
SUSE. For more information about extensions and modules, see Deployment Guide, Part
“Initial System Configuration”, Chapter “Installing Modules, Extensions, and Third Party Add-
On Products” at https://documentation.suse.com/sles-15 .
SUSE Connect Program allows installing packages created and supported by third parties,
specifically for SLES-SAP. It also gives easy access to third-party trainings and support. See
Section A.2, “SUSE Connect Program”.
SUSE Package Hub allows installation of packages created by the SUSE Linux Enterprise
community without support. See Section A.3, “SUSE Package Hub”.
A.1 Identifying a Base Product for SUSE Linux

Enterprise Server for SAP Applications
To identify and distinguish SUSE products, use one of the following les:
/etc/os-release
A text le with key-value pairs, similar to shell-compatible variable assignments. Each key
is on a separate line.
You can search for the CPE_NAME key; however, between different releases and service
packs, the value may have been changed. If you need further details, refer to the article
at https://www.suse.com/support/kb/doc/?id=7023490 .
/etc/product.d/baseproduct
A link to an XML le. The /etc/product.d/ directory contains different .prod les.
Depending on which products you have purchased and how you installed your system,
the link /etc/product.d/baseproduct can point to a different .prod le, for example,
sle-module-sap-applications.prod . The same information as CPE_NAME is stored in
the tag <cpeid> .
Identifying a Base Product for SUSE Linux Enterprise Server for SAP Applications SLES-SAP
120 15 SP1
Among other information, both les contain the operating system and base product. The base
product (key CPE_NAME and tag <cpeid> ) follow the Common Platform Enumeration Specifica-
tion (http://scap.nist.gov/specifications/cpe/) .
Basically, you can extract any information from the le /etc/product.d/baseproduct either
with the commands grep or xmlstarlet (both are available for your products). As XML is
also text, use grep for “simple searches” when the format of the output does not matter much.
However, if your search is more advanced, you need the output in another script, or your would
like to avoid the XML tags in the output, use the xmlstarlet command instead.
For example, to get your base product, use grep like this:
> grep cpeid /etc/products.d/baseproduct

<cpeid>cpe:/o:suse:sle-module-sap-applications:RELEASE:spSP_NUMBER</cpeid>
The RELEASE and SP_NUMBER are placeholders and describe your product release number and
service pack.
The same can be achieved with xmlstarlet . You need an XPath (the steps that lead you to
your information). With the appropriate options, you can avoid the <cpeid> / </cpeid> tags:
> xmlstarlet sel -T -t -v "/product/cpeid" /etc/products.d/baseproduct

cpe:/o:suse:sle-module-sap-applications:RELEASE:spSP_NUMBER
A more advanced search (which would be difficult for grep ) would be to list all required de-
pendencies to other products. Assuming that basename points to sle-module-sap-applica-
tions.prod , the following command will output all product dependencies which are required
for SUSE Linux Enterprise Server for SAP Applications:
>> xmlstarlet sel -T -t -v "/product/productdependency[@relationship='requires']/@name" /

etc/products.d/baseproduct
SUSE_SLE
sle-ha
A.2 SUSE Connect Program

Start SUSE Connect Program from the YaST control center using SUSE Connect Program. Choose
from the available options. To enable a software repository, click Add repository.
All software enabled by SUSE Connect Program originates from third parties. For support, con-
tact the vendor in question. SUSE does not provide support for these offerings.
121 SUSE Connect Program SLES-SAP 15 SP1

Note: SUSEConnect command-line tool
The SUSEConnect command-line tool is a separate tool with a different purpose: It allows
you to register installations of SUSE products.
A.3 SUSE Package Hub

SUSE Package Hub provides many packages for SLE that were previously only available on
openSUSE. Packages from SUSE Package Hub are created by the community and come without
support. The selection includes, for example:
The R programming language
The Haskell programming language
The KDE 5 desktop
To enable SUSE Package Hub, add the repository as described at https://package-

hub.suse.com/how-to-use/ .
For more information, see the SUSE Package Hub Web site at https://packagehub.suse.com .
122 SUSE Package Hub SLES-SAP 15 SP1

B Partitioning for the SAP System Using AutoYaST
Partitioning for the SAP system is controlled by the les from the directory /usr/share/YaST2/
include/sap-installation-wizard/ . The following les can be used:
SAP NetWeaver or SAP S/4HANA Application Server Installation. base_partition-

ing.xml
SAP HANA or SAP S/4HANA Database Server Installation. hana_partitioning.xml
SAP HANA or SAP S/4HANA Database Server Installation on SAP BusinessOne-Certified

Hardware. hardware-specific partitioning le
The les will be chosen as defined in /etc/sap-installation-wizard.xml . Here, the content

of the element partitioning is decisive.
If the installation is, for example, based on HA or a distributed database, no partitioning is
needed. In this case, partitioning is set to NO and the le base_partitioning.xml is used.
Note: autoinst.xml Cannot Be Used Here

autoinst.xml is only used for the installation of the operating system. It cannot control
the partitioning for the SAP system.
The les that control partitioning are AutoYaST control les that contain a partitioning
section only. However, these les allow using several extensions to the AutoYaST format:
If the partitioning_defined tag is set to true , the partitioning will be performed with-
out any user interaction.
By default, this is only used when creating SAP HANA le systems on systems certified for
SAP HANA (such as from Dell, Fujitsu, HP, IBM, or Lenovo).
For every partition, you can specify the size_min tag. The size value can be given as a
string in the format of RAM*N . This way you can specify how large the partition should
minimally be ( N times the size of the available memory ( RAM )).
PROCEDURE B.1: CREATING A CUSTOM SAP PARTITIONING SETUP
The steps below illustrate how to create a partitioning setup for TREX. However, creating
a partitioning setup for other applications works analogously.
123 SLES-SAP 15 SP1

1. In /usr/share/YaST2/include/sap-installation-wizard/ , create a new XML le.
Name it TREX_partitioning.xml , for example.
2. Copy the content of base_partitioning.xml to your new le and adapt the new le
to your needs.
3. Finally, adapt /etc/sap-installation-wizard.xml to include your custom le. In the

listitem for TREX , insert the following line:
<partitioning>TREX_partitioning</partitioning>
Important: Do Not Edit base_partitioning.xml

Do not edit base_partitioning.xml directly. With the next update, this le will be
overwritten.
For more information about partitioning with AutoYaST, see AutoYaST Guide, Chapter “Parti-
tioning” (https://documentation.suse.com/sles-15 ).
124 SLES-SAP 15 SP1

C Supplementary Media
Supplementary Media allow partners or customers to add their own tasks or workflows to the
Installation Wizard.
This is done by adding an XML le which will be part of an AutoYaST XML le. To be included
in the workflow, this le must be called product.xml .
This can be used for various types of additions, such as adding your own RPMs, running your
own scripts, setting up a cluster le system or creating your own dialogs and scripts.
C.1 product.xml
The product.xml le looks like a normal AutoYaST XML le, but with some restrictions.
The restrictions exist because only the parts of the XML that are related to the second stage of
the installation are run, as the rst stage was executed before.
The two XML les ( autoyast.xml and product.xml ) will be merged after the media is read
and a “new” AutoYaST XML le is generated on the y for the additional workflow.
The following areas or sections will be merged:
<general>
<ask-list> 1
...
<software> 2
<post-packages>
...
<scripts>
<chroot-scripts> 3
<post-scripts> 4
<init-scripts> 5
...
1 see Section C.2, “Own AutoYaST Ask Dialogs”

2 see Section C.3, “Installing Additional Packages”
3 after the package installation, before the rst boot
4 during the rst boot of the installed system, no services running
5 during the rst boot of the installed system, all services up and running
All other sections will be replaced.
125 product.xml SLES-SAP 15 SP1

For more information about customization options, see AutoYaST Guide, Chapter “Con-
figuration and Installation Options”, Section “Custom User Scripts” (https://documenta-
C.2 Own AutoYaST Ask Dialogs

For more information about the “Ask” feature of AutoYaST, see AutoYaST Guide, Chapter “Con-
figuration and Installation Options”, Section “Ask the User for Values During Installation” (https://
documentation.suse.com/sles-15 ).
For the Supplementary Media, you can only use dialogs within the cont stage ( <stage>con-
t</stage> ), which means they are executed after the rst reboot.
Your le with the dialogs will be merged with the base AutoYaST XML le.
As a best practice, your dialog should have a dialog number and an element number, best with
steps of 10. This helps to include later additions and could be used as targets for jumping over
a dialog or element dependent on decisions. We also use this in our base dialogs and if you
provide the right dialog number and element number, you can place your dialog between our
base dialogs.
You can store the answer to a question in a le, to use it in one of your scripts later. Be aware
that you must use the prefix /tmp/ay for this, because the Installation Wizard will copy such
les from the /tmp directory to the directory where your media data also will be copied. This
is done because the next Supplementary Media could have the same dialogs or same answer le
names and would overwrite the values saved here.
Here is an example with several options:
<?xml version="1.0"?>
<!DOCTYPE profile>
<profile xmlns="http://www.suse.com/1.0/yast2ns"
xmlns:config="http://www.suse.com/1.0/configns">
<general>
<ask-list config:type="list">
<ask>
<stage>cont</stage>
<dialog config:type="integer">20</dialog>
<element config:type="integer">10</element>
<question>What is your name?</question>
<default>Enter your name here</default>
<help>Please enter your full name within the field</help>
<file>/tmp/ay_q_my_name</file>
126 Own AutoYaST Ask Dialogs SLES-SAP 15 SP1

<script>
<filename>my_name.sh</filename>
<rerun_on_error config:type="boolean">true</rerun_on_error>
<environment config:type="boolean">true</environment>
<source><![CDATA[
function check_name() {
local name=$1
LC_ALL=POSIX
[ -z "$name" ] && echo "You need to provide a name." && return 1
return 0
}
check_name "$VAL"
]]>
</source>
<debug config:type="boolean">false</debug>
<feedback config:type="boolean">true</feedback>
</script>
</ask>
</ask-list>
</general>
</profile>
C.3 Installing Additional Packages

You can also install RPM packages within the product.xml le. To do this, you can use the
<post-packages> element for installation in stage 2.
For more information, see AutoYaST Guide, Chapter “Configuration and Installation Options”,
Section “Installing Packages in Stage 2” (https://documentation.suse.com/sles-15 ). An example
looks as follows:
...
<software>
<post-packages config:type="list">
<package>yast2-cim</package>
</post-packages>
</software>
...
127 Installing Additional Packages SLES-SAP 15 SP1

C.4 Example Directory for Supplementary Media
A minimal example for the Supplementary Media directory contains only a le called produc-
t.xml .
128 Example Directory for Supplementary Media SLES-SAP 15 SP1

D GNU Licenses
formats that can be read and edited only by proprietary word processors, SGML or XML for
This appendix contains the GNU Free Docu- which the DTD and/or processing tools are not generally available, and the machine-generat-
ed HTML, PostScript or PDF produced by some word processors for output purposes only.
mentation License version 1.2. The "Title Page" means, for a printed book, the title page itself, plus such following pages as
are needed to hold, legibly, the material this License requires to appear in the title page. For
works in formats which do not have any title page as such, "Title Page" means the text near the
GNU Free Documentation License most prominent appearance of the work's title, preceding the beginning of the body of the text.
A section "Entitled XYZ" means a named subunit of the Document whose title either is precisely
Copyright (C) 2000, 2001, 2002 Free Software Foundation, Inc. 51 Franklin St, Fifth Floor, XYZ or contains XYZ in parentheses following text that translates XYZ in another language.
Boston, MA 02110-1301 USA. Everyone is permitted to copy and distribute verbatim copies (Here XYZ stands for a specific section name mentioned below, such as "Acknowledgements",
of this license document, but changing it is not allowed. "Dedications", "Endorsements", or "History".) To "Preserve the Title" of such a section when
you modify the Document means that it remains a section "Entitled XYZ" according to this
definition.
0. PREAMBLE
The Document may include Warranty Disclaimers next to the notice which states that this
The purpose of this License is to make a manual, textbook, or other functional and useful License applies to the Document. These Warranty Disclaimers are considered to be included
document "free" in the sense of freedom: to assure everyone the effective freedom to copy by reference in this License, but only as regards disclaiming warranties: any other implication
and redistribute it, with or without modifying it, either commercially or non-commercially. that these Warranty Disclaimers may have is void and has no effect on the meaning of this
Secondarily, this License preserves for the author and publisher a way to get credit for their License.
work, while not being considered responsible for modifications made by others.
This License is a kind of "copyleft", which means that derivative works of the document must 2. VERBATIM COPYING
themselves be free in the same sense. It complements the GNU General Public License, which
is a copyleft license designed for free software. You may copy and distribute the Document in any medium, either commercially or non-
We have designed this License to use it for manuals for free software, because free software commercially, provided that this License, the copyright notices, and the license notice saying
needs free documentation: a free program should come with manuals providing the same this License applies to the Document are reproduced in all copies, and that you add no other
freedoms that the software does. But this License is not limited to software manuals; it can conditions whatsoever to those of this License. You may not use technical measures to obstruct
be used for any textual work, regardless of subject matter or whether it is published as a or control the reading or further copying of the copies you make or distribute. However, you
printed book. We recommend this License principally for works whose purpose is instruction may accept compensation in exchange for copies. If you distribute a large enough number of
or reference. copies you must also follow the conditions in section 3.
You may also lend copies, under the same conditions stated above, and you may publicly
display copies.
1. APPLICABILITY AND DEFINITIONS
This License applies to any manual or other work, in any medium, that contains a notice placed 3. COPYING IN QUANTITY
by the copyright holder saying it can be distributed under the terms of this License. Such a
notice grants a world-wide, royalty-free license, unlimited in duration, to use that work under If you publish printed copies (or copies in media that commonly have printed covers) of the
the conditions stated herein. The "Document", below, refers to any such manual or work. Any Document, numbering more than 100, and the Document's license notice requires Cover Texts,
member of the public is a licensee, and is addressed as "you". You accept the license if you you must enclose the copies in covers that carry, clearly and legibly, all these Cover Texts:
copy, modify or distribute the work in a way requiring permission under copyright law. Front-Cover Texts on the front cover, and Back-Cover Texts on the back cover. Both covers
A "Modified Version" of the Document means any work containing the Document or a portion must also clearly and legibly identify you as the publisher of these copies. The front cover
of it, either copied verbatim, or with modifications and/or translated into another language. must present the full title with all words of the title equally prominent and visible. You may
add other material on the covers in addition. Copying with changes limited to the covers, as
A "Secondary Section" is a named appendix or a front-matter section of the Document that
long as they preserve the title of the Document and satisfy these conditions, can be treated
deals exclusively with the relationship of the publishers or authors of the Document to the
as verbatim copying in other respects.
Document's overall subject (or to related matters) and contains nothing that could fall directly
within that overall subject. (Thus, if the Document is in part a textbook of mathematics, a If the required texts for either cover are too voluminous to t legibly, you should put the
Secondary Section may not explain any mathematics.) The relationship could be a matter rst ones listed (as many as t reasonably) on the actual cover, and continue the rest onto
of historical connection with the subject or with related matters, or of legal, commercial, adjacent pages.
philosophical, ethical or political position regarding them. If you publish or distribute Opaque copies of the Document numbering more than 100, you
The "Invariant Sections" are certain Secondary Sections whose titles are designated, as being must either include a machine-readable Transparent copy along with each Opaque copy, or
those of Invariant Sections, in the notice that says that the Document is released under this state in or with each Opaque copy a computer-network location from which the general net-
License. If a section does not t the above definition of Secondary then it is not allowed to be work-using public has access to download using public-standard network protocols a complete
designated as Invariant. The Document may contain zero Invariant Sections. If the Document Transparent copy of the Document, free of added material. If you use the latter option, you
does not identify any Invariant Sections then there are none. must take reasonably prudent steps, when you begin distribution of Opaque copies in quanti-
ty, to ensure that this Transparent copy will remain thus accessible at the stated location until
The "Cover Texts" are certain short passages of text that are listed, as Front-Cover Texts or
at least one year after the last time you distribute an Opaque copy (directly or through your
Back-Cover Texts, in the notice that says that the Document is released under this License. A
agents or retailers) of that edition to the public.
Front-Cover Text may be at most 5 words, and a Back-Cover Text may be at most 25 words.
It is requested, but not required, that you contact the authors of the Document well before
A "Transparent" copy of the Document means a machine-readable copy, represented in a for-
redistributing any large number of copies, to give them a chance to provide you with an
mat whose specification is available to the general public, that is suitable for revising the doc-
updated version of the Document.
ument straightforwardly with generic text editors or (for images composed of pixels) generic
paint programs or (for drawings) some widely available drawing editor, and that is suitable
for input to text formatters or for automatic translation to a variety of formats suitable for
input to text formatters. A copy made in an otherwise Transparent le format whose markup,
or absence of markup, has been arranged to thwart or discourage subsequent modification
by readers is not Transparent. An image format is not Transparent if used for any substantial
amount of text. A copy that is not "Transparent" is called "Opaque".
Examples of suitable formats for Transparent copies include plain ASCII without markup, Tex-
info input format, LaTeX input format, SGML or XML using a publicly available DTD, and stan-
dard-conforming simple HTML, PostScript or PDF designed for human modification. Examples
of transparent image formats include PNG, XCF and JPG. Opaque formats include proprietary
129 SLES-SAP 15 SP1

The author(s) and publisher(s) of the Document do not by this License give permission to use
4. MODIFICATIONS
their names for publicity for or to assert or imply endorsement of any Modified Version.
You may copy and distribute a Modified Version of the Document under the conditions of
sections 2 and 3 above, provided that you release the Modified Version under precisely this 5. COMBINING DOCUMENTS
License, with the Modified Version filling the role of the Document, thus licensing distribution
and modification of the Modified Version to whoever possesses a copy of it. In addition, you You may combine the Document with other documents released under this License, under
must do these things in the Modified Version: the terms defined in section 4 above for modified versions, provided that you include in the
combination all of the Invariant Sections of all of the original documents, unmodified, and
A. Use in the Title Page (and on the covers, if any) a title distinct from that of the
list them all as Invariant Sections of your combined work in its license notice, and that you
Document, and from those of previous versions (which should, if there were any,
preserve all their Warranty Disclaimers.
be listed in the History section of the Document). You may use the same title as a
previous version if the original publisher of that version gives permission. The combined work need only contain one copy of this License, and multiple identical Invari-
ant Sections may be replaced with a single copy. If there are multiple Invariant Sections with
B. List on the Title Page, as authors, one or more persons or entities responsible for the same name but different contents, make the title of each such section unique by adding
authorship of the modifications in the Modified Version, together with at least ve at the end of it, in parentheses, the name of the original author or publisher of that section if
of the principal authors of the Document (all of its principal authors, if it has fewer known, or else a unique number. Make the same adjustment to the section titles in the list of
than ve), unless they release you from this requirement. Invariant Sections in the license notice of the combined work.
C. State on the Title page the name of the publisher of the Modified Version, as the In the combination, you must combine any sections Entitled "History" in the various original
publisher. documents, forming one section Entitled "History"; likewise combine any sections Entitled
"Acknowledgements", and any sections Entitled "Dedications". You must delete all sections
D. Preserve all the copyright notices of the Document.
Entitled "Endorsements".
E. Add an appropriate copyright notice for your modifications adjacent to the other
copyright notices.
6. COLLECTIONS OF DOCUMENTS
F. Include, immediately after the copyright notices, a license notice giving the public
permission to use the Modified Version under the terms of this License, in the form You may make a collection consisting of the Document and other documents released under
shown in the Addendum below. this License, and replace the individual copies of this License in the various documents with a
single copy that is included in the collection, provided that you follow the rules of this License
G. Preserve in that license notice the full lists of Invariant Sections and required Cover
for verbatim copying of each of the documents in all other respects.
Texts given in the Document's license notice.
You may extract a single document from such a collection, and distribute it individually under
H. Include an unaltered copy of this License. this License, provided you insert a copy of this License into the extracted document, and follow
this License in all other respects regarding verbatim copying of that document.
I. Preserve the section Entitled "History", Preserve its Title, and add to it an item
stating at least the title, year, new authors, and publisher of the Modified Version
as given on the Title Page. If there is no section Entitled "History" in the Document, 7. AGGREGATION WITH INDEPENDENT WORKS
create one stating the title, year, authors, and publisher of the Document as given
on its Title Page, then add an item describing the Modified Version as stated in A compilation of the Document or its derivatives with other separate and independent docu-
the previous sentence. ments or works, in or on a volume of a storage or distribution medium, is called an "aggregate"
if the copyright resulting from the compilation is not used to limit the legal rights of the com-
J. Preserve the network location, if any, given in the Document for public access to
pilation's users beyond what the individual works permit. When the Document is included in
a Transparent copy of the Document, and likewise the network locations given in
an aggregate, this License does not apply to the other works in the aggregate which are not
the Document for previous versions it was based on. These may be placed in the
themselves derivative works of the Document.
"History" section. You may omit a network location for a work that was published
at least four years before the Document itself, or if the original publisher of the If the Cover Text requirement of section 3 is applicable to these copies of the Document, then
version it refers to gives permission. if the Document is less than one half of the entire aggregate, the Document's Cover Texts
may be placed on covers that bracket the Document within the aggregate, or the electronic
K. For any section Entitled "Acknowledgements" or "Dedications", Preserve the Title equivalent of covers if the Document is in electronic form. Otherwise they must appear on
of the section, and preserve in the section all the substance and tone of each of the printed covers that bracket the whole aggregate.
contributor acknowledgements and/or dedications given therein.
L. Preserve all the Invariant Sections of the Document, unaltered in their text and 8. TRANSLATION
in their titles. Section numbers or the equivalent are not considered part of the
section titles. Translation is considered a kind of modification, so you may distribute translations of the
M. Delete any section Entitled "Endorsements". Such a section may not be included Document under the terms of section 4. Replacing Invariant Sections with translations requires
in the Modified Version. special permission from their copyright holders, but you may include translations of some
or all Invariant Sections in addition to the original versions of these Invariant Sections. You
N. Do not retitle any existing section to be Entitled "Endorsements" or to conflict in may include a translation of this License, and all the license notices in the Document, and
title with any Invariant Section. any Warranty Disclaimers, provided that you also include the original English version of this
O. Preserve any Warranty Disclaimers. License and the original versions of those notices and disclaimers. In case of a disagreement
between the translation and the original version of this License or a notice or disclaimer, the
If the Modified Version includes new front-matter sections or appendices that qualify as Se- original version will prevail.
condary Sections and contain no material copied from the Document, you may at your option
If a section in the Document is Entitled "Acknowledgements", "Dedications", or "History", the
designate some or all of these sections as invariant. To do this, add their titles to the list of
requirement (section 4) to Preserve its Title (section 1) will typically require changing the
Invariant Sections in the Modified Version's license notice. These titles must be distinct from
actual title.
any other section titles.
You may add a section Entitled "Endorsements", provided it contains nothing but endorse-
ments of your Modified Version by various parties--for example, statements of peer review
9. TERMINATION
or that the text has been approved by an organization as the authoritative definition of a
You may not copy, modify, sublicense, or distribute the Document except as expressly pro-
standard.
vided for under this License. Any other attempt to copy, modify, sublicense or distribute the
You may add a passage of up to ve words as a Front-Cover Text, and a passage of up to 25
Document is void, and will automatically terminate your rights under this License. However,
words as a Back-Cover Text, to the end of the list of Cover Texts in the Modified Version. Only
parties who have received copies, or rights, from you under this License will not have their
one passage of Front-Cover Text and one of Back-Cover Text may be added by (or through
licenses terminated so long as such parties remain in full compliance.
arrangements made by) any one entity. If the Document already includes a cover text for the
same cover, previously added by you or by arrangement made by the same entity you are
acting on behalf of, you may not add another; but you may replace the old one, on explicit
permission from the previous publisher that added the old one.
130 SLES-SAP 15 SP1

10. FUTURE REVISIONS OF THIS LICENSE
The Free Software Foundation may publish new, revised versions of the GNU Free Documen-
tation License from time to time. Such new versions will be similar in spirit to the present
version, but may differ in detail to address new problems or concerns. See http://www.gnu.org/
copyleft/ .
Each version of the License is given a distinguishing version number. If the Document specifies
that a particular numbered version of this License "or any later version" applies to it, you have
the option of following the terms and conditions either of that specified version or of any
later version that has been published (not as a draft) by the Free Software Foundation. If the
Document does not specify a version number of this License, you may choose any version ever
published (not as a draft) by the Free Software Foundation.
ADDENDUM: How to use this License for your documents
Copyright (c) YEAR YOUR NAME.

Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.2
or any later version published by the Free Software Foundation;
with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts.
A copy of the license is included in the section entitled “GNU
Free Documentation License”.
If you have Invariant Sections, Front-Cover Texts and Back-Cover Texts, replace the
“with...Texts.” line with this:
with the Invariant Sections being LIST THEIR TITLES, with the
Front-Cover Texts being LIST, and with the Back-Cover Texts being LIST.
If you have Invariant Sections without Cover Texts, or some other combination of the three,
merge those two alternatives to suit the situation.
If your document contains nontrivial examples of program code, we recommend releasing
these examples in parallel under your choice of free software license, such as the GNU General
Public License, to permit their use in free software.
131 SLES-SAP 15 SP1

SLES4SAP-guide_SUSE_en

Uploaded by

Copyright:

Available Formats

SLES4SAP-guide_SUSE_en

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SLES4SAP-guide_SUSE_en

Uploaded by

Copyright:

Available Formats

SUSE Linux Enterprise Server for SAP Applications

Publication Date: September 14, 2023

Copyright © 2010–2023 SUSE LLC and contributors. All rights reserved.

About This Guide x

2 Available Documentation and Resources x

3 Improving the documentation xi

4 Documentation conventions xii

1 What Is SUSE Linux Enterprise Server for SAP

1.2 Software Repository Setup 8

1.3 Included Services 9

2 Planning the Installation 12

2.2 Installation Image 13

2.3 Oﬄine Migration 13

2.4 Installation Methods 14

2.5 Overview of the Installation Workﬂow 14

3 Installing the Operating System 17

3.2 Using SLES-SAP media from the network 25

3.3 Using an External AutoYaST Proﬁle 26

3.4 Converting an SLES Installation to an SLES-SAP Installation 26

4 Installing SAP Applications 28

4.2 First Steps 29

4.3 Using the SAP Installation Wizard 30

4.4 Continuing an Installation Using an Installation Proﬁle 40

4.5 Partitioning for an SAP Application without the SAP Installation

4.6 Automated Installation of SAP Applications with AutoYaST 41

5 Upgrading an SAP HANA Cluster 46

5.2 Upgrading your SAP HANA Cluster 47

5.3 Finishing the Upgrade Task 48

7 Setting Up an SAP HANA Cluster 51

7.3 Unattended Setup Using SAP HANA-SR Wizard 59

7.4 Using Hawk 59

7.5 For More Information 60

8 Tuning systems with sapconf5 61

8.2 Verifying sapconf setup 62

8.3 Enabling and disabling sapconf and viewing its status 63

8.4 Conﬁguring sapconf5 64

8.5 Removing sapconf 65

8.6 Using tuned together with sapconf 65

8.7 For more information 66

9 Tuning systems with saptune 67

9.2 Disabling saptune 69

9.3 Updating saptune 69

9.4 Managing SAP Notes 69

9.5 Managing SAP Solutions 72

9.6 Veriﬁcation and troubleshooting 74

9.7 Machine-readable output 75

9.9 Tuning kernel parameters manually using sysctl 77

9.10 For more information 78

10 Tuning Workload Memory Protection 79

10.2 Support for Workload Memory Protection 80

10.3 Setting up Workload Memory Protection 81

10.4 Conﬁguring Workload Memory Protection 86

10.5 Changing the value of MemoryLow 87

10.6 Monitoring memory usage 87

10.7 Verifying correct operation 89

10.8 Uninstalling Workload Memory Protection 90

10.9 Systems running both systemd-based and regular SAP instances 92

10.10 Systems running only systemd-based instances 93

11.2 Conﬁguring HANA-Firewall 96

11.3 SAProuter Integration 99