Hana Sps12 SUSE Linux Enterprise Server 11 x for SAP Applications Configuration Guide for SAP HANA En

(1)

PUBLIC

SAP HANA Platform SPS 12

Document Version: 1.1 – 2016-05-18

SUSE Linux Enterprise Server 11.x for SAP

Applications Configuration Guide for SAP HANA

(2)

Content

1 About this Document. . . .4

2 Prerequisites. . . .5

2.1 Hardware. . . .5

2.2 Storage. . . .6

2.3 Software. . . .7

2.4 Further Information. . . 7

3 Sample Installation of SUSE Linux Enterprise Server for SAP Applications. . . .8

3.1 Partition Layout. . . .9

3.2 Adapt the Software Selection. . . .12

3.3 Configure Basic SUSE Settings. . . 16

3.4 Setup NTP Service. . . .23

3.5 Create the SAP HANA Partitions. . . 23

Multipath Disk Attachment. . . .24

Internal Disks. . . 28

Create File Systems. . . .30

Create Mount Points. . . 30

3.6 Tweak Default System Settings for SAP HANA. . . 31

Intel-Based Hardware Platforms. . . .32

All Hardware Platforms. . . 35

4 SAP HANA Installation. . . .37

5 Special Installation Option for SAP BusinessOne on SAP HANA. . . . 38

6 Operating System Maintenance. . . .39

6.1 System Registration. . . .39

6.2 Update Recommendations for SLES Versions. . . .39

6.3 Changes to OS Configuration. . . 40

6.4 Maintenance / Patching. . . 41

6.5 Support. . . .41

7 Installation of Additional Software on SAP HANA Systems. . . .43

7.1 High Availability Software. . . .43

7.2 SAP LVM. . . .43

7.3 Backup Solutions. . . .43

7.4 Security. . . .44

(3)

9 Tips for Remote Installation. . . .47

10 Appendix. . . . 48

10.1 Networking Ports. . . .48

10.2 Package List for SAP HANA. . . .48

10.3 Tuning Parameters. . . .50

10.4 Configure a PXE Server. . . .51

10.5 Installation in a Virtual Machine Using VMware. . . 52

(4)

1 About this Document

This guide serves as a supplement to the existing documentation of SAP and the hardware vendors to provide specific guidance on how to configure SUSE Linux Enterprise Server for SAP Applications (SLES-for-SAP Applications) or SUSE Linux Enterprise Server to be used with SAP HANA. Contact your hardware vendor which of the two versions are allowed to be operated for your particular deployment.

This guide does not replace existing SAP HANA documentation and sizing guides. Furthermore, it does not replace any SAP HANA hardware vendor documentation.

Note

For SAP HANA Platform SPS 12 the minimum version is SLES for SAP Applications 11 SP3. For more information, see SAP Note 2235581 - SAP HANA: Supported Operating Systems.

Note

The following are registered trademarks of SUSE LLC in the United States and other countries: ● SLES

● SUSE ● SUSE Logo ● YAST

Note

The following are registered trademarks of IBM in the United States and other countries: ● IBM

● POWER

● Power Architecture ● PowerVM

Related Information

(5)

2 Prerequisites

Before performing the actual installation of SAP HANA, ensure that you have fulfilled the prerequisites listed in the following sections.

SAP HANA offers two distinct deployment models, a complete pre-installed and pre-configured (so called “Appliance”) model from the hardware vendors or the tailored datacenter integration (TDI) where the customers take responsibility for the construction and validation of their SAP HANA environment but by that providing a better integration into their IT infrastructures.

This guide does not describe all variants resulting in a valid deployment. It describes the base configurations along with the minimum requirements. The topics are discussed based on a sample SUSE OS installation for SAP HANA.

2.1 Hardware

Your hardware platform must be validated for SAP HANA independent which delivery approach you may use. For a list of validated Intel hardware platforms, see SAP Certified and Supported SAP HANA Hardware and SAP

HANA TDI - Overview.

For a list of valid partition sizes inside IBM Power Servers, see SAP Certified and Supported SAP HANA

Hardware and SAP Note 2188482 - SAP HANA on IBM Power Systems: Allowed Hardware.

Note

Note for SAP HANA on IBM Power

With SAP HANA, version for IBM Power Systems architecture and starting with SAP HANA SPS 11 the SAP HANA Platform Edition SAP is extending the support of already supported hardware platforms to include also the IBM Power Systems family. SAP HANA on POWER follows a two folded hardware deployment model:

● The solution follows a tailored datacenter integration (TDI) approach.

● The server selection is done based on a SAP sizing and an IBM hardware mapping.

Related Information

SAP Certified and Supported SAP HANA Hardware SAP HANA TDI - Overview

(6)

2.2 Storage

The appliance hardware vendors provide storage within their pre-build SAP HANA systems.

If you use the TDI approach, SAP HANA requires a SAP HANA TDI certified storage subsystem. You need to apply the file system layout / partitioning which is outlined in the SAP HANA Server Installation and Update

Guide and the SAP HANA – Storage Requirements Guide. Also download the storage vendors' TDI

documentation.

Ensure to pick the right chapters and clearly distinguish between shared file system based installations and shared disc based installation.

The main volumes and sizes used in this document are based on the initial SAP HANA disc volume sizing which in the meantime is much lower.

The here given mount points do apply for scale-up deployments or for shared file system deployments. Mount points for shared disc deployments can be either retrieved from the SAP HANA Server Installation and Update

Guide or to some extend from the hardware vendor’s documentation.

For more information about file system layout, the partitioning, and the sizing, see Recommended File System

Layout in the SAP HANA Server Installation and Update Guide and the SAP HANA TDI - Storage Requirements.

These are the sample installation mount points used in this document: Table 1:

Mount Point Description Size

/ Root 10 - 50 GiB

/usr/sap System Instances 50 GiB

/hana/shared Installation Path

/hana/data Data volume

/hana/log Log volume

Related Information

SAP HANA Server Installation and Update Guide SAP HANA TDI - Storage Requirements

SAP Certified Enterprise Storage Hardware for SAP HANA SAP Certified and Supported SAP HANA Hardware SAP HANA TDI - Overview

SAP Note 2188482 - SAP HANA on IBM Power Systems: Allowed Hardware

IBM Planning Guide (attached to SAP Note 2055470 - SAP HANA on POWER Planning and Installation Specifics - Central Note)

(7)

2.3 Software

The following software was used for the sample installation:

● SUSE Linux Enterprise Server for SAP Applications 11 media with a supported Service Pack ● Registration key for the SUSE subscriptions in order to get SUSE maintenance updates ● SAP HANA media and license in order to install SAP HANA

● The minimum Version of the SUSE Linux Enterprise Server for SAP Applications software is linked to the SAP HANA software version. Verify the minimum requirement based on the SAP HANA documentation.

Related Information

SAP Note 2055470 - SAP HANA on POWER Planning and Installation Specifics - Central Note SAP Note 2235581 - SAP HANA: Supported Operating Systems

SAP Product Availability Matrix (SAP PAM)

2.4 Further Information

You need to have the following information about the host on which you intend to perform the installation: ● IP address of the host

● IP alias for SAP HANA (optional) ● Host name of the host

● Subnet mask ● Domain name

● IP address of the name servers ● Address of a time server (ntp) ● Gateway IP address

● Password for the root user

● SAP master password (<sid>adm password) ● SID and instance for the SAP HANA installation

(8)

3 Sample Installation of SUSE Linux

Enterprise Server for SAP Applications

SUSE Linux comes per default with the YaST2 installation tool. YaST2 can run in a graphical environment as well in a text based (ncurses) environment.

1. Download the DVD ISO image of SUSE® Linux Enterprise Server for SAP Applications 11 (electronic media kit).

2. Burn the image onto a physical DVD and ensure that it is bootable. Alternatively, you might use a virtual CD-ROM device for the installation.

3. Boot from the media, select SLES for SAP Applications — Installation and choose Enter.

This loads the SUSE Linux Enterprise Server installation program and starts the installation in normal mode.

For more information about the other choices, see the SUSE Linux Enterprise Server for SAP Applications

documentation.

4. Select the language and keyboard layout to be used during the installation and for the installed system. Read the License Agreement and select the checkbox I Agree to the License Agreement. Proceed with

Next.

5. Choose New Installation and proceed with Next.

6. Select the clock and time zone to use in your system and proceed with Next. 7. Select install on a Physical Machine and proceed with Next.

8. On the screen Installation Settings you see the default proposal for the installation and partitioning. You need to change the Partitioning and Software sections as described in the next sections of this guide.

(9)

Related Information

SUSE Linux Enterprise Server for SAP Applications documentation

3.1 Partition Layout

Independently from the disk space type (attached by a TDI approach, internal Disks or shared file system) this section summarizes the requirements for the partition layout.

The reality could be different, depending on your hardware vendor, the SAP HANA installation (up, scale-out, Host-Auto-Failover, SAP HANA System Replication, …), SLAs and what you have ordered and configured.

Note

All disks should be backed by enterprise storage.

Partition Layout for the OS root file system

The OS partition should have a minimal size of 10 GiB. If your system provides more space you may create it bigger (e.g. 50 GiB or more) in order to have enough space for log files during the lifetime of the system and additional software like backup solutions. Best is to choose the automatic default file systems (SLES 11: ext3) or choose XFS.

In contrast to SAP Note 1597355 you may not dedicate 2x RAM as swap space, but configure to less extended, for example 2 GB.

Partition layout for the SAP HANA application

For a scale-up SAP HANA single-host system three file systems are required, one for the SAP HANA executables, one for the SAP HANA data and one for the SAP HANA log which need to be reflected in the partition layout.

These disks should be backed by enterprise storage. For SAP HANA data and log the file system must meet the performance KPIs for SAP HANA HWCCT tool (see SAP Note 1943937).

At least 50 GiB must be provided for the /usr/sap location in the system, because this is the place where SAP HANA and other SAP software that supports SAP HANA will be installed in this sample installation. In scale-out installations the SAP HANA software will be installed into a shared file system mounted on /hana/ shared. It is possible to join this location with the SUSE Linux installation.

(10)

Sample partitioning

In this example the OS file system is combined with /usr/sap executables. This means we need minimal 62 GiB (10+50+2 GiB ) for the OS drive without SLA considerations such as mirroring. For SAP HANA data and SAP HANA log separate disks will be used.

1. You are on the screen Installation Settings:

2. Choose Partitioning. This will bring you to the following screen:

The screen shows you all available devices for the system. Within our example the drive has enough space (160 GiB) so we can simply let YaST2 do the work for us.

(11)

3. Select the disk you will use for the operating system (for example 1. Disk) and choose Next. This will bring you to the following screen:

At this screen you are preparing the hard disk. 4. Select Create LVM Based Proposal and choose Next.

This will create a volume group “system” where the OS will be placed into. YaST2 creates a boot volume, a volume group system and two logical volumes for the root file system, tmp and the swap.

(12)

Related Information

SAP Note 1943937 - Hardware Configuration Check Tool - Central Note SAP Note 1597355 - Swap-space recommendation for Linux

Create the SAP HANA Partitions [page 23]

3.2 Adapt the Software Selection

You need to adapt the software selection to your needs.

Reducing the number of installed RPM packages to a minimum, lowers the amount potentially vulnerable files on the system and therefore significantly improves the overall security of a system. Furthermore, a low number of installed packages reduces the number of required (security) updates and patches that have to be applied to the system on a regular basis.

The SAP Note 1855805 - Recommended SLES 11 packages for HANA support on OS level lists the

recommended SLES 11 packages for SAP HANA. For IBM Power Server based SAP HANA deployments also apply SAP Note 2055470 - HANA on POWER Planning and Installation Specifics - Central Note.

SUSE provides function groups of packages called pattern to simplify the selection of packages within YaST2 (GUI) or zypper (cmdline). With SUSE Linux Enterprise Server for SAP Applications there is an additional pattern for SAP HANA available (SAP HANA Server Base).

Note

In case of conflicting recommendations take the highest documented package version.

(13)

1. You are on the screen Installation Settings:

2. Choose Software. This will bring you to the following screen:

You will see here the pre-selected patterns. 3. Deselect all and select only what is needed.

With a right click on the check-boxes we will get a menu. For All in This List choose Do Not Install (similar to deselect all).

(14)

Now all check marks should be gone and we can change the software selection simply to your needs. 4. Select pattern Base System and Minimal System and SAP HANA Server Base.

Double check the list of needed packages within the appendix to be sure to have the actually needed packages. It is possible that the list of required packages will grow or change over time and the pattern does not reflect the most current needs as it is bound to the media.

5. Choose OK.

(15)

All necessary software packages and volumes for the OS are defined.

Until now, nothing has changed on the system and the steps could be reverted. 6. If you choose Install all settings will be written to the system.

Note

After completing the basic system setup and the installation of all selected software packages, the SUSE

(16)

Note

Depending if X-Windows is configured or not, YaST2 will start in a graphical mode (as before) or with a NCUSRES interface. Both could be used and have identical usage.

Related Information

SAP Note 1855805 - Recommended SLES 11 packages for HANA support on OS level

SAP Note 2055470 - SAP HANA on POWER Planning and Installation Specifics - Central Note

3.3 Configure Basic SUSE Settings

You need to configure basic SUSE settings.

1. After the reboot the following screen is displayed:

2. Enter a password for the system administrator account (called the root user) and proceed with Next

Note

You should never forget the root password! After you entered it here, the password cannot be retrieved. It can only be reset with administrative assistance.

(17)

You will see the following screen:

3. Enter a Hostname for this computer and the DNS Domain Name to which it belongs. Uncheck the Change Hostname via DHCP.

Proceed with Next.

4. In the Network Configuration screen, view or change the network connections of your system.

If you have network devices, it is a good idea to configure them now, because then an internet connection or a SMT Server allows SUSE Linux Enterprise Server to retrieve any available updates and include them in the installation.

(18)

5. Test your Internet connection with Yes, Test Connection to the Internet. This option also checks for the latest SUSE Linux Enterprise Server release notes.

View the results of the test on the Running Internet Connection Test screen. Proceed with Next.

6. Enable the system for online updates on the Customer Center Configuration screen with Configure Now Next Continue . We strongly recommend to do this now.

(19)

Note

Optionally you can choose Configure Later Next to skip this step and continue the installation. You need to configure this option after the product has been installed.

7. By default, SUSE Linux Enterprise Server creates a certificate for the system.

Note

To disable this, choose Skip Configuration Next Proceed with Next.

(20)

8. Select Local (/etc/passwd) in the User Authentication Method screen, unless instructed otherwise by your system administrator.

Proceed close the Next.

(21)

Note

For security reasons, the password should be at least eight characters long and should contain both uppercase and lowercase letters and numbers. The maximum length for passwords is 72 characters, and passwords are case-sensitive.

10. View the Release Notes after the system configuration has completed. Proceed with Next.

(22)

11. Use the Hardware Configuration screen to view or configure your graphics cards and other hardware devices.

12. On the Installation Completed screen, choose Finish to close the SUSE Linux Enterprise Server installation and continue to the login screen.

(23)

Note

Log in to the system as root user to configure further settings like ntp server and the partitions used by SAP HANA.

3.4 Setup NTP Service

SAP recommends to run NTP for SAP instances to ensure time synchronization. To enable NTP the following steps need to be performed.

1. Use one of the following ways to start the NTP Configuration: ○ Use the command line with:

# yast2 ntp-client

○ Start YaST2 and choose NTP Configuration from the Network Services group. 2. Select radio button Now and on Boot to enable the services.

3. Choose Add to add a new server. 4. Select type Server.

5. Choose Next.

6. Enter the IP address or the name of you ntp server.

Note

If you do not know the address or name, open the Select dropdown. Choose Local NTP Server or Public

NTP server and select a server.

7. Choose OK to confirm all entries.

Note

For a more secure service select the tab Security Settings and select the checkbox Run NTP Daemon in

Chroot Jail. Choose OK to confirm the entry.

3.5 Create the SAP HANA Partitions

You need to look at the disks and partitions of the SAP HANA itself, where the size of the partitions depend on the amount of main memory (SAP Sizing) and desired SLAs.

In the SAP HANA Storage Requirements document you will find the following statements:

● The performance requirements that have to be fulfilled by the storage subsystem mainly rely on the scenario that is driven by the SAP HANA database.

● Storage systems used for SAP HANA must fulfill a certain set of KPIs for minimum data throughput and maximum latency time. In the course of both the SAP HANA appliance and the SAP HANA Enterprise

(24)

Storage certification the fulfillment of those KPIs is checked using the SAP HANA Hardware Configuration Check Tool (HWCCT). All KPIs must be met for each SAP HANA compute node connected to a given

storage system.

Therefore we cannot provide a detailed setup of a production system within this document, but we will show the general way and what to do for two scenarios, a multipath example with SAN attached storage and a scenario with local disks.

To have flexibility to change the size and number of drives these volumes should be created as logical volumes using the logical volume manager (LVM).

An LVM volume group organizes the Linux LVM partitions into a logical pool of space. You can carve out logical volumes from the available space in the group. The Linux LVM partitions in a group can be on the same or different disks. You can add LVM partitions from the same or different disks to expand the size of the group. You can use the YaST2 Partitioner to create and manage file systems and RAID devices. For more information, see Advanced Disk Setup in the SUSE Linux Enterprise Server 11 Deployment Guide for the used service pack. Depending on the disk attachment and storage solution the preparation involves different tasks. The following section multipath and internal disk options are described. The mount point and file system creation is then again the same for both. Depending on the server vendor different file systems are eligible to operate SAP HANA. The example in the following sections is focusing on XFS only.

Related Information

SAP HANA – Storage Requirements Guide

SAP Note 1943937 - Hardware Configuration Check Tool - Central Note SAP Certified Enterprise Storage Hardware for SAP HANA

3.5.1 Multipath Disk Attachment

To create an XFS file system in a multipath environment the following tasks have to be performed. Ensure to match sizes, names etc. to the individual SAP HANA deployment.

Tuning for Multipathing

Depending on the chosen storage subsystem, the configured policy, and features, the service time and/or I/O protection can be positively or negatively affected.

To optimize performance and protect the I/Os from a path loss, apply the following settings:

1. Configure the /etc/multipath.conf file according to the requirements of the storage vendor. Example for an IBM San Volume Controller:

# cat /etc/multipath.conf defaults {

(25)

user_friendly_names yes no_path_retry fail rr_min_io_rq 32 path_checker tur } devices { device { vendor "IBM" product "2145" path_grouping_policy group_by_prio prio "alua" path_checker "tur" failback "immediate" no_path_retry "fail" rr_min_io_rq 32 dev_loss_tmo 120 } }

2. If you plan to use the SAP HANA fcClient or a cluster solution the following recommendations should be applied to avoid hangs in the takeover (The # cat /etc/multipath.conf defaults { user_friendly_names yes no_path_retry fail rr_min_io_rq 32 path_checker tur } devices { device { vendor "IBM" product "2145" path_grouping_policy group_by_prio prio "alua" path_checker "tur" failback "immediate" no_path_retry "fail" rr_min_io_rq 32 dev_loss_tmo 120 } }Storage Documentation will overrule these recommendations when explicit optimizations for HA setups are described):

○ no_path_retry = fail

We recommend a retry setting of fail or 0 in the /etc/multipath.conf file when working in a cluster. This causes the resources to fail over when the connection to the storage is lost. Otherwise, the messages queue and the resource failover cannot occur.

○ fast_io_fail_tmo <= 5

The fast_io_fail_tmo parameter sets the length of time to wait before failing I/O when a link problem is detected. I/O that reaches the driver fails.

The fast_io_fail_tmo is related to the following two tunables:

○ If I/O is in a blocked queue, the I/O does not fail until the dev_loss_tmo time elapses and the queue is unblocked.

○ Also ensure to disable queue_if_no_path. ○ path_selector: service time 0

# cat /etc/multipath.confA service-time oriented load balancer that balances I/O on paths according to the latency. This optimizes the SAP HANA Log I/O which is latency sensitive. This setting should be chosen for all disks as this is the SUSE default.

Optional the following tunable parameters can be considered in case I/O performance issues have been detected. Do not change these in advance. Consult a performance specialist to find a vital combination:

● Increase /sys/block/<device>/queue/nr_requests if the default (128) results in blocked I/O submission. This will indirectly help to optimize the blocking inside SAP HANA.

● Increase rr_min_io_rq 32 in multipath.conf

● Increase the queue depth of devices/ (e.g. echo 64 > cat /sys/bus/scsi/devices/<device>/ queue_depth)

(26)

Tuning LVM File System settings and Disk Layout for Multipathing

Using XFS with multipathing and LVM striping provides options to optimize the I/O performance. This section explains how fiber channel connectivity, zoning and multipathing have an effect on the LUN layout planning. To optimize the usage of all available I/O paths for better performance, we recommend that the logical volumes of the SAP HANA log, data, and shared file systems should be striped over a number of LUNs that are a multiple of the active paths (e.g. 4 active paths, logical volumes should be striped over a minimum of 4 LUNs).

Note

The minimum number of paths, volumes and disks determined in the sizing process is the absolute minimum, even if in the following planning process less might be sufficient.

Verify if the storage can provide data redundancy. If you do not plan to implement an LVM Mirror or RAID copy on a second storage server’s device.

LVM striping is used to optimize the I/O performance to SAP HANA file systems. The following considerations should be taken into account:

● When increasing the number of ports, the minimum number of LUNs should be equal or a multiple of the number of active paths.

● When increasing the number of LUNs, they should be a multiple of the number of active paths. ● The number of lv stripes should match the number of LUNs.

● We recommend a stripe size of 256 K.

● Create the required LUNs on the storage subsystem and map them to the server partition. This also assumes that the appropriate SAN zoning in the SAN switches has been performed.

● Use the rescan-scsi-bus.sh to scan and detect the new storage LUNs without rebooting the system: # rescan-scsi-bus.sh

Scanning SCSI subsystem for new devices

Scanning host 0 for SCSI target IDs 0 1 2 3 4 5 6 7, all LUNs [ ….]

● The multipath -ll command can be used to display the new devices and check the available paths. The following command shows the sample output for a single LUN of a SAN Volume Controller storage

subsystem using 4 active and 4 passive paths (passive paths are paths with a lower priority and only used if the corresponding higher priority paths fails, for example if one of the SVC nodes is rebooted):

# multipath -ll 3600507680185000d38000000000004b9 3600507680185000d38000000000004b9 dm-1 IBM,2145

size=64G features='1 queue_if_no_path' hwhandler='0' wp=rw |-+- policy='service-time 0' prio=50 status=active

`-+- policy='service-time 0' prio=10 status=enabled |- 1:0:0:0 sda 8:0 active ready running

|- 2:0:0:0 sdb 8:16 active ready running |- 3:0:0:0 sdd 8:48 active ready running `- 4:0:0:0 sdg 8:96 active ready running

(27)

The next step is to initialize the new volumes for use by LVM:

# pvcreate /dev/mapper/3600507680185000d38000000000004b9

Physical volume "/dev/mapper/3600507680185000d38000000000004b9" successfully created

Assuming you have created four active paths to the storage subsystem and you have created four physical volumes for use with LVM, you can now create a volume group for the SAP HANA log files (make sure that you use the /dev/mapper/wwid device names (or use an alternative method) and not any other device names if available):

# vgcreate hn1ogvg /dev/mapper/3600507680185000d38000000000004df /dev/mapper/3600507680185000d38000000000004e0

/dev/mapper/3600507680185000d38000000000004e1 /dev/mapper/3600507680185000d38000000000004e2 Volume group "hn1logvg" successfully created

Create the physical volumes and volume groups for the other SAP HANA file systems as well. The following shows a sample configuration for a small test system:

# pvs

PV VG Fmt Attr PSize PFree

/dev/mapper/3600507680185000d38000000000004de hn1sharedvg lvm2 a-- 128,00g 0 /dev/mapper/3600507680185000d38000000000004df hn1logvg lvm2 a-- 16,00g 0 /dev/mapper/3600507680185000d38000000000004e0 hn1logvg lvm2 a-- 16,00g 0 /dev/mapper/3600507680185000d38000000000004e1 hn1logvg lvm2 a-- 16,00g 0 /dev/mapper/3600507680185000d38000000000004e2 hn1logvg lvm2 a-- 16,00g 0 /dev/mapper/3600507680185000d38000000000004e3 hn1datavg lvm2 a-- 64,00g 0 /dev/mapper/3600507680185000d38000000000004e4 hn1datavg lvm2 a-- 64,00g 0 /dev/mapper/3600507680185000d38000000000004e5 hn1datavg lvm2 a-- 64,00g 0 /dev/mapper/3600507680185000d38000000000004e6 hn1datavg lvm2 a-- 64,00g 0 /dev/mapper/3600507680185000d38000000000004e7 hn1bkupvg lvm2 a-- 192,00g 0

/dev/mapper/3600507680185000d380000000000053e_part2 system lvm2 a-- 63,80g 15,80g Next step is to create the striped logical volumes that will be used for the SAP HANA file system. In this sample you create a log volume with 64 GB space striped over four disks (-i 4) with a stripe size of 256 K. Once again make sure that you use the /dev/mapper/wwid designation for the physical volumes.

The LVM uses “-“ to separate the logical volume name from the volume group name. It is best practice to not use this separator inside names:

# lvcreate -i 4 -I 256 -L 64G hn1logvg -n hn1log /dev/mapper/3600507680185000d38000000000004df /dev/mapper/3600507680185000d38000000000004e0 /dev/mapper/3600507680185000d38000000000004e1 /dev/mapper/3600507680185000d38000000000004e1 Logical volume "hn1log" created

Use lvcreate command to create the other required logical volumes. The following shows the list of logical volumes on the sample test system:

# lvs

LV VG Attr LSize Pool Origin Data% Move Log Copy% Convert

hn1bkup hn1bkupvg -wi-ao--- 192,00g hn1data hn1datavg -wi-ao--- 255,98g hn1log hn1logvg -wi-ao--- 63,98g hn1shared hn1sharedvg -wi-ao--- 64,00g usr_sap hn1sharedvg -wi-ao--- 64,00g home system -wi-ao--- 16,00g

(28)

swap system -wi-ao--- 16,00g

3.5.2 Internal Disks

In the following section the possibilities using the command-line interface are shown. You can also perform these tasks using YaST2.

Our example with internal disks, should be backed by a RAID 5 array which provides 3 disks to the OS. The RAID setup depends on the hardware vendor machine type and disk drives been used and should provide enough spindles to fulfill the SAP HANA requirements.

Check for Empty Devices

Enter the following command: # lsblk -f

In our example we have these drives: /dev/sda 160 GiB

/dev/sdb 300 GiB /dev/sdc 100 GiB

In this case /dev/sda is used for the OS.

Create a Disk Partition

The disks /dev/sdb and /dev/sdc are the free devices for the SAP HANA data volumes and SAP HANA log volumes.

If you have less than 2 TB free space on the disk, use fdisk: # fdisk /dev/sdb

If you have 2 TB or more free space, use the command parted and the GPT label: # parted /dev/sdb

Perform the same tasks for /dev/sdc.

Create the Volume Group

(29)

If the physical device was not previously configured for LVM with pvcreate, the device will be initialized with the same default values used for pvcreate:

# vgcreate vg00 /dev/sdb

Add an additional volume group for the different SAP HANA volumes: # vgcreate vg01 /dev/sdc

Check the new volume groups with help of the following commands: ● The actual physical volumes can be displayed with:

# pvs

● Information about volume groups can be displayed with: # vgs

Create Logical Volumes for the SAP HANA Instance According to Your

Sizing

lvcreate creates a new logical volume in an existing volume group.

The values used here are examples for the logical volumes you need to create for a SAP HANA host with 96 GiB of memory.

As the directory /usr/sap could be shared with the operating system and we have enough disk space here, we create the responsible logical volume within the volume group system which was created through YaST2 during the installation:

# lvcreate -L50G -n lv_usr_sap system

Because we have three drives in our example, we can distribute the volumes SAP HANA data and SAP HANA log into different volume groups and logical volumes. The SAP HANA shared volume is added to the system volume group.

# lvcreate -L96G -n lv_hana_shared system # lvcreate -L288G -n lv_hana_data vg00 # lvcreate -L96G -n lv_hana_log vg01

For more information about sizing SAP HANA, see the SAP HANA Master Guide.

Related Information

(30)

3.5.3 Create File Systems

To create a XFS file system use the mkfs command. The difference between multipath environments and local discs is the default path:

● As local disc we have typically:

# mkfs -t xfs /dev/vg01/lv_hana_log

● For the multipath example the command would look as follows: # mkfs –t xfs /dev/mapper/hn1logvg-hn1log ● Create for all logical volumes the file system.

● Edit /etc/fstab to add the mount commands or append it from the cmd-line to the file. # echo “/dev/system/lv_usr_sap /usr/sap xfs defaults 1 2” >> /etc/fstab

# echo “/dev/system/lv_hana_shared /hana/shared xfs defaults 1 2”>> /etc/fstab # echo “/dev/vg00/lv_hana_data /hana/data xfs defaults 1 2” >> /etc/fstab # echo “/dev/vg01/lv_hana_log /hana/log xfs defaults 1 2” >> /etc/fstab For the multipath example adapt the names.

● Mount all file systems from /etc/fstab # mount -av

3.5.4 Create Mount Points

In order to use our logical volumes (independent if they were created based on internal discs or on multipath devices), we need to create mount points within the root file system and create a file system on the volumes. This step is the same for multipath devices and internal discs. The mount points will differ for scale-out deployments. For more information, see the SAP HANA documentation.

Create the mount points:

# mkdir -p /hana/{shared,data,log} # mkdir -p /usr/sap

SUSE Linux Enterprise Server offers a variety of file systems from which to choose for different workloads. SAP

HANA needs certain criteria (files bigger than 2 GiB, fast file system with large files) so you choose XFS for the file system.

The idea behind XFS was to create a high-performance 64-bit journaling file system to meet extreme computing challenges. XFS is very good at manipulating large files and performs well on high-end hardware. SUSE supports and includes XFS since SLES 8.

More details are discussed in the SUSE Linux Enterprise Server Documentation – Storage administration. Many XFS tuning guides are outdated and designed for benchmarks rather than actual workloads. XFS can determine the underlying geometry, it auto-tunes itself automatically. Linux MD, and most RAID controllers, provide the proper information.

(31)

In the table below are examples of a file system layout for a scale-up test system: Table 2:

Mount Point Description Size

/usr/sap System Instances 50 GiB (in our sample sandbox deploy

ment included into the root file system)

/hana/shared Installation Path

/hana/data Data volume

/hana/log Log volume

Note

Only if you have hardware RAID controllers that do not export this information you need to change the parameters, for example at creation time with mkfs.xfs. The su value should be set to the RAID chunk size (most common is 64 k, but check the manual) and the sw value should be equal to the number of data disks in your array. With actual XFS implementation both values could be set as mount option (sunit=value and swidth=value) The sunit and swidth mount options are in units of 512-sectors, while su is specified in bytes and sw is the number of stripe members.

Related Information

SUSE Linux Enterprise Server Documentation – Storage administration

3.6 Tweak Default System Settings for SAP HANA

SAP HANA needs some special configuration settings in order to use all the performance the hardware offers. The SUSE default configuration settings are not set for a SAP HANA workload, therefore you need to adapt some of the settings. The relevant SAP Notes are:

● SAP Note 1310037 - SUSE LINUX Enterprise Server 11: Installation notes ● SAP Note 1056161 - SUSE Priority Support for SAP applications

● SAP Note 1944799 - SAP HANA Guidelines for SLES Operating System Installation ● SAP Note 2235581 - SAP HANA: Supported Operating Systems

● SAP Note 2240716 - SAP HANA DB: Recommended OS settings for SLES 11 / SLES for SAP Applications 11 SP4

(32)

● SAP Note 2228351 - Linux: SAP HANA Database SPS 11 revision 110 (or higher) on RHEL 6 or SLES 11 ● SAP Note 2001528 - Linux: SAP HANA Database SPS 08 revision 80 (or higher) on RHEL 6 or SLES 11 ● SAP Note 52505 - Support after end of mainstream/extended maintenance

● SAP Note 2055470 - HANA on POWER Planning and Installation Specifics - Central Note The recommended settings are split into two parts

● Intel-based hardware platforms ● All hardware platforms

Related Information

SAP Note 1310037 - SUSE LINUX Enterprise Server 11: Installation notes SAP Note 1056161 - SUSE Priority Support for SAP applications

SAP Note 1944799 - SAP HANA Guidelines for SLES Operating System Installation SAP Note 2235581 - SAP HANA: Supported Operating Systems

SAP Note 2240716 - SAP HANA DB: Recommended OS settings for SLES 11 / SLES for SAP Applications 11 SP4

SAP Note 2228351 - Linux: SAP HANA Database SPS 11 revision 110 (or higher) on RHEL 6 or SLES 11 SAP Note 2001528 - Linux: SAP HANA Database SPS 08 revision 80 (or higher) on RHEL 6 or SLES 11 SAP Note 52505 - Support after end of mainstream/extended maintenance

SAP Note 2055470 - HANA on POWER Planning and Installation Specifics - Central Note

3.6.1 Intel-Based Hardware Platforms

Perform settings for Intel-based hardware platforms.

Disable Transparent Hugepages

With SUSE Linux Enterprise Server 11 SP2 and SP3 the usage of transparent hugepages is generally activated for the Linux kernel. The THP allows the handling of multiple pages as hugepages reducing the translation look aside buffer (TLB) footprint, in situations where it might be useful.

Due to the special manner of SAP HANA's memory management, the usage of THP may lead to hanging situations and performance degradations.

To disable the usage of transparent hugepages set the kernel settings at runtime with # echo never > /sys/kernel/mm/transparent_hugepage/enabled

(33)

There is no need to shut down the database to apply this configuration. This setting is then valid until the next system start. To persist this option, integrate this command line within your system boot scripts (for

example /etc/init.d/boot.local).

# echo 'echo never > /sys/kernel/mm/transparent_hugepage/enabled' >> /etc/init.d/ boot.local

Note

Be aware that in a scale-out environment this has to be done on every server in the landscape.

Configure C-States for Lower Latency in Linux

The Linux kernel 3.0 includes a new cpuidle driver for recent Intel CPUs: intel_idle. This driver leads to a different behavior in C-states switching. The normal operating state is C0, when the processor is put to a higher C-state, it will save power. But for low latency applications, the additional time needed to start the execution of the code again will cause performance degradations.

To see if the recommended driver is enabled, execute:

# cat /sys/devices/system/cpu/cpuidle/current_driver The correct value should be acpi_idle.

If this is not the case, it is possible to fall back on the recommended driver by disabling the intel_idle driver in the kernel command line.

Therefore it is necessary to edit the boot-loader configuration. The location of the boot-loader configuration file is:

/etc/sysconfig/bootloader

Edit this file and append the following value to the "DEFAULT_APPEND" parameter value: intel_idle.max_cstate=0

With this a persistent change has been done for potential kernel upgrades and boot-loader upgrades.

For an immediate configuration change, it is also necessary to append this parameter in the kernel command line of your current active boot-loader located in file:

/boot/grub/menu.lst

Append the intel_idle value mentioned above only to the operational kernel's parameter line.

If C-states are enabled in BIOS you might still see performance degradations. In this case either disable them in the BIOS or set the following parameter in addition to the previous one:

processor.max_cstate=0

(34)

With these settings, the system will fall back to the performance behavior known from SUSE Linux Enterprise Server 11 SP1.

In a scale-out environment, those changes have to be done on every server of the landscape. In case you already have a running SAP HANA instance, rebooting the server should only be done when a standby server is configured. Do not reboot all servers at once. For a single-host system a downtime has to be considered. For more information, see SUSE knowledgeable article Performance issues after upgrade from SLES11 SP1 to

SP2 or SP3.

CPU Governors

Linux is using a technology for power saving called CPU governors to control CPU throttling and power

consumption. By default Linux uses the governor ondemand which will dynamically throttle CPUs up and down depending on CPU load. SAP advised to use the governor performance as the ondemand governor will impact SAP HANA performance due to too slow CPU up-scaling by this governor.

On all hosts append the following lines (after and before --snip--) to the file /etc/rc.d/boot.local.

--snip--bios_vendor=$(/usr/sbin/dmidecode -s bios-vendor)

#Phoenix Technologies LTD means we are running in a VM and governors are not available

if [ $? -eq 0 -a ! -z "${bios_vendor}" -a "${bios_vendor}" != "Phoenix Technologies LTD" ]; then /sbin/modprobe acpi_cpufreq for i in /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor do echo performance > $i done fi

--snip--The setting will change on the next reboot. You can also change safely the governor settings immediately by executing the same lines at the shell. Copy and paste all the lines at once, or type them one by one.

Related Information

Performance issues after upgrade from SLES11 SP1 to SP2 or SP3

(35)

3.6.2 All Hardware Platforms

Perform settings for all hardware platforms.

Patch for XFS lost write in last block

If you are using XFS for the SAP HANA data-, log- or backup volume, a Linux kernel update is needed in order to avoid possible corruptions on file system level.

Therefore please update your system, at least to Linux kernel version 3.0.101-0.47.71. For more background information about the problem, see SAP Note 2246163 - Indexserver crashes in the onLoad method.

Ulimit Package

If installed, the ulimit.rpm sets system-wide resource limits on SUSE Linux Enterprise Server 11 systems. For example also max_address_space limits the available memory for the <sid>adm user.

Since those limits can cause problems when operating SAP HANA or other applications, remove it by calling # zypper remove ulimit

Afterwards reboot your server to enable the changes. Note, that this ulimit.rpm package does not provide the bash-built-in ulimit, which is used to set resource limits on user-level, and can therefore be uninstalled without causing further problems.

ONLY FOR OLDER VERSIONS of SUSE Linux Enterprise Server (11 SP2, 11

SP3)

Caution

The following recommendations are only relevant, if you do not have updated your system or did not registered it during installation.

Patch for XFS lost write in last block - 11 SP3

If you are using XFS for the SAP HANA data-, log- or backup volume, a Linux kernel update is needed in order to avoid possible corruptions on file system level.

Therefore please update your system, at least to Linux kernel version 3.0.101-0.47.71. For more background information about the problem, see SAP Note 2246163 - Indexserver crashes in the onLoad method.

(36)

glibc Update to Avoid Potential Problem in the Index Server

To avoid crashes of the SAP HANA index server, update your glibc at least to the version mentioned in SAP

Note 1888072 - SAP HANA DB: Index server crash in __strcmp_sse42.

GCC 4.8 Runtime Environment (SUSE Linux Enterprise Server 11 SP2 & 11 SP3)

In order to run revision 110 or higher of SAP HANA, an additional runtime environment for GCC 4.8 needs to be installed in advance before running such a database revision. For more information, see SAP Note 2228351 -

Linux: SAP HANA Database SPS 11 revision 110 (or higher) on RHEL 6 or SLES 11.

GCC 4.7 Runtime Environment (SUSE Linux Enterprise Server 11 SP2 & 11 SP3)

In order to run any revision from revision 80 to the last maintenance revision of SAP HANA SPS 10, an

additional runtime environment for GCC 4.7 needs to be installed before running such a database revision. For more information, see SAP Note 2001528 - Linux: SAP HANA Database SPS 08 revision 80 (or higher) on RHEL

6 or SLES 11.

Patch for XFS locking problem on SUSE Linux Enterprise Server 11 SP2

If you are using XFS as file system for the SAP HANA data, log or backup volume, see SAP Note 1867783 - XFS

Data Inconsistency Bug with SLES 11 SP2 to avoid possible data inconsistencies.

Write Performance Patch for File Growing IO Operations on XFS on SLES 11 SP2

If you encounter performance problems when using XFS as file system, please consider using the following

kernel 3.0.101-0.7.15.1 from SUSE at http://download.novell.com/Download?buildid=3S93fzkVnNw%7E

The throughput benefit with this patch depends on the underlying storage infrastructure.

Related Information

SAP Note 2228351 - Linux: SAP HANA Database SPS 11 revision 110 (or higher) on RHEL 6 or SLES 11 SAP Note 2001528 - Linux: SAP HANA Database SPS 08 revision 80 (or higher) on RHEL 6 or SLES 11 SAP Note 1867783 - XFS Data Inconsistency Bug with SLES 11 SP2

SAP Note 1888072 - SAP HANA DB: Index server crash in __strcmp_sse42 SAP Note 2246163 - Indexserver crashes in the onLoad method

(37)

4 SAP HANA Installation

This section provides a short overview of the installation of a SAP HANA system.

SAP HANA can be installed in several ways on different architectures. The SAP Server Installation and Update

Guide along with the guides provided by the server vendor reflect these options. Below the installation of a

single-host system is shown.

Note

For more information, see the SAP HANA Server Installation and Update Guide before you begin.

Note

Substitute the parameters shown in <square brackets>.

1. First download the SAP HANA installation media and the SAP archive tool (sapcar) from the SAP Service Marketplace.

2. Create a directory which should hold the SAP HANA installation media, for example: # mkdir /install

3. To have sapcar within the path to easily execute it, copy the SAP archiver (sapcar) to the personal bin directory of the root user for example:

# cp <path_to_the_downloaded_installer>/SAPCAR_<xxxxxxxxx> ~/bin 4. Extract the SAP HANA installation media into the created /install directory, for example:

# cd /install

# SAPCAR_<xxxxxxxxx> -xvsf <path_to_the_media_archive>/<yyyyy>.sar

5. Based on the SID to be selected for the SAP HANA system, create the needed directories with the SID name, for example:

mkdir -p /hana/data/<your_SID> mkdir -p /hana/log/<your_SID>

chmod 777 /hana/data/<your_SID> /hana/log/<your_SID>

6. Change to the directory where the SAP HANA installation media are located to start the installation. 7. Install the SAP HANA system by running the SAP HANA lifecycle management tool (hdblcmgui with

graphical interface, hdblcm as command line tool).

Related Information

(38)

5 Special Installation Option for SAP

BusinessOne on SAP HANA

For SAP BusinessOne on SAP HANA, SUSE and SAP created a special image which helps to automate the installation of SUSE Linux Enterprise Server, SAP HANA and SAP BusinessOne.

Note

For more information, see SAP Note 1944415 - Hardware Configuration Guide and Software Installation

Guide for SUSE Linux Enterprise Server with SAP HANA and SAP Business One.

This SUSE Linux Enterprise Server image is specially designed for SAP Business One and caters to SAP Business One-specific needs and requirements. You can download the image (see Related Information), which directs to the newest image for download.

Within this image, you can also find an SAP Product Installer, which enables smooth installation of SAP HANA and SAP Business One products and requires as little user input as possible during the installation.

Note

You must follow the instructions in the guide attached to SAP Note 1944415 ("How to Install SUSE Linux

Enterprise Server for SAP Business One Products on SAP HANA", split into 3 volumes) to perform the

installation. There are certain restrictions with this special image and the SAP Product Installer; review carefully these restrictions (Page 4) before you decide to use the image or the Installer.

Related Information

SAP Note 1944415 - Hardware Configuration Guide and Software Installation Guide for SUSE Linux Enterprise Server with SAP HANA and SAP Business One

(39)

6 Operating System Maintenance

Regarding the operating system maintenance several aspects have to be taken into account.

6.1 System Registration

If you register your system you will see the following update channel structure: ● SLES for SAP Applications

○ SLES Channel (Pool & Update) ○ SLE HA Channel (Pool & Update) ○ SLES for SAP Channel (Pool & Update)

For SLES for SAP Applications the regular channels are used for the basics. In the SLES for SAP Channel the SAP specifics are contained. By that it is ensured that all SLES certified kernels contain the required packages. Registering your system is very important to get security updates and to get support.

6.2 Update Recommendations for SLES Versions

Regarding SLES security patches, ServicePacks (SP) and major releases, we recommend the following update strategy:

● ServicePack releases are verified by SAP to check the performance and functionality. We support minor OS releases that have been verified by SAP.

● OS security patches that are released between ServicePack releases are not verified by SAP, but may be deployed, if the customer chooses to do so.

● OS major releases (for example SLES 12) that have been verified by SAP may be deployed at any time. Observe the following update recommendations:

● All security related fixes can be applied.

● Within the given SUSE SLES SP “zypper patch” can be performed.

● Changing the SUSE SLES SP level must be verified against the SAP HANA Release note.

zypper patch Examples

(40)

Check how many patches are available (parameter phck or patch-check). #zypper pchk

Loading repository data... Reading installed packages...

46 patches needed (33 security patches) List available patches (list-patches or lp).

#zypper lp

Install patch fixing a Bugzilla issue specified by number (--bugzilla or -–cve ). #zypper patch -–bugzilla 4711

#zypper patch –-cve 4711

Install all patches in the specified category (e.g. security or recommended).

6.3 Changes to OS Configuration

To guarantee optimal performance and the highest stability, SAP appliance hardware and technology partners may deliver SAP HANA systems with operating system settings that deviate from the standard as outlined in the SAP HANA Master Guide and SAP HANA Server Installation Guide.

Also customers may want to change the configuration of the operating system of the SAP HANA appliance, for example, in order to apply additional customer-specific security hardening settings.

SAP permits such changes to configuration parameters of the SLES operating system that deviate from the patterns described in the attached document unless these changes are listed in SAP Note 1731000 –

Unrecommended configuration changes. The changes described in this note have caused problems in

customer environments or in the laboratories of SAP or SAP HANA appliance hardware and technology partners.

Changes to operating system parameters are permitted only with the agreement of the corresponding hardware and operating system suppliers of your SAP HANA appliance. Customers and partners are advised to document all changes to the standard patterns so that SAP support can more efficiently identify the root cause of problems. In case administration was outsourced to 3rd party service provider, the provider should first consult with the hardware support provider before changing any settings in the operating system. For the latest information, see SAP Note 1730999 - Configuration changes to SAP HANA system and the SAP Notes referenced in it.

Related Information

SAP Note 1731000 - Unrecommended configuration changes SAP Note 1730999 - Configuration changes to SAP HANA system

(41)

6.4 Maintenance / Patching

The customer is generally responsible for implementing operating system patches. If the customer has a special agreement with the hardware or technology partner, support for operating system patching may be the responsibility of the corresponding partner.

The initially delivered configuration of the appliance's operating system should persist. If configuration settings are subsequently changed, problems may occur, for example in regards to performance. The

customer can request a validation of configuration changes for the operating system and for the installation of additional operating system components by the hardware partner depending on the service contract between the hardware partner and the customer. The hardware partner then supports these changes and additional components in accordance with the existing service contract with the customer. No modified Linux version can be used.

OS security patches may be installed immediately after they are available. However, the original packages of the distributors must be used, that a customer is entitled to within the framework of a valid support contract with the distributor or an authorized OEM.

For all other operating system patches, the customer should wait until they are released as part of SLES Support Package Stacks (SPS). These SPS shall be downloaded and applied to the SAP HANA system only according to agreements with SAP and the respective hardware partner. In particular, any updates related to kernel or runtime libraries (glibc) need to be validated and approved by SAP beforehand.

On rare occasions, SAP might require a certain operating system patch to be implemented. In this case SAP strongly recommends to not change configuration settings unless explicitly stated in the corresponding SAP release note. SAP will state any dependencies in the relevant SAP Note published when a revision is released which requires such modifications.

6.5 Support

If errors occur in any software component of SAP HANA, SAP is the main point of contact.

SAP distributes all issues within the support organization by default, as is the case for other SAP applications. To investigate SAP HANA related problems, SAP support requires a support connection to all servers in the SAP HANA landscape. For more information about how to establish a service connection for SAP HANA, see

SAP Note 1635304 - Central note for HANA support connections.

SUSE offers enhanced support for SUSE Linux in collaboration with SAP Linux Lab ('SUSE Priority Support for SAP'). This support offer facilitates communication and ensures high quality. For more information on SUSE Priority Support for SAP applications, see SAP Note 1056161 - SUSE Priority Support for SAP applications. If the customer has defined special support agreements with the hardware or technology partner (such as special Service Level Agreements), the customer should contact the corresponding partner directly in the case of obvious hardware or operating system issues.

(42)

Related Information

SAP Note 1635304 - Central note for HANA support connections SAP Note 1056161 - SUSE Priority Support for SAP applications

(43)

7 Installation of Additional Software on

SAP HANA Systems

This section describes the installation of additional software on SAP HANA systems.

7.1 High Availability Software

As more and more SAP HANA instances are used in production, cluster vendors have developed together with SAP cluster solutions for SAP applications to automate the SAP HANA system replication failover.

For information about high availability for SAP HANA, see the guide SAP HANA Introduction to High Availability

for SAP HANA on SCN.

As of today there is no certification of high availability for SAP HANA, the high availability vendor and the hardware vendor need to support the solution.

Related Information

Introduction to High Availability for SAP HANA

Automate your SAP HANA System Replication Failover IBM SA MP

7.2 SAP LVM

To be able to handle SAP HANA in SAP LVM and also for most cluster solutions install SAP HANA with a virtual IP.

7.3 Backup Solutions

SAP HANA provides an API (“Backint for SAP HANA”) via which 3rd party backup tools can be connected. A list of BACKINT certified solutions can be found on SCN.

(44)

Besides BACKINT, SAP HANA allows other mechanisms to be used. They are typically file system or storage based features such as FlashCopy/snapshot technology or backup tools performing a file system backup of the relevant data.

Related Information

“Backint for SAP HANA” Certification

Find Application Development Partners Easily - Search for HANA-BRINT SAP Note 1730932 - Using backup tools with Backint for HANA

SAP Note 1642148 - FAQ: SAP HANA Database Backup and Recovery

SAP Note 2031547 - Overview of SAP-certified 3rd party backup tools and associated support process

7.4 Security

SAP pays high attention on the security topic.

There are several guides regarding the security of SAP HANA.

SAP HANA Security –An Overview

For SAP HANA, there is a comprehensive security guide available, that describes in detail how to protect SAP HANA from a database perspective (SAP HANA Security –An Overview on SCN). The guide also refers to security concepts for other connecting layers that are separate from the SAP HANA database. This is for example the network and storage layer. However, these topics are described very generic and there is no specific guidance on how to apply these recommendations i.e. on the Operating System level.

Operating System Security Hardening Guide for SAP HANA

At least as important as the security of the SAP HANA database is the security of the underlying Operating System. Many hacker attacks are targeted on the Operating System and not directly on the database. Once a hacker gained access and sufficient privileges, he can continue to attack the running database application. In order to further improve the security standard specifically for SAP HANA, SUSE has developed a guide, dedicated for the security hardening of SUSE Linux Enterprise Server for SAP Applications 11 running SAP HANA databases.

It is meant to fill the gap between the generic SUSE Linux Enterprise Server security guide and the SAP HANA security guide. SUSE has worked together with a large pilot customer in order to identify all relevant security settings and avoid problems in real world scenarios.

(45)

The guide will provide detailed descriptions on the following topics: ● SUSE Linux Enterprise hardening settings for SAP HANA

A Linux Operating System provides many tweaks and settings to further improve the OS security and the security for the hosted applications. In order to be able to fit for certain application workloads, the default settings are not tuned for maximum security. This guide will describe how to tune the OS for maximum security when running specifically SAP HANA. It will also describe possible impacts, for example on system administration and give a prioritization of each setting.

● Local firewall for SAP HANA systems

A local running firewall further improves the network security of a SAP HANA database, even if the network, a SAP HANA database is connected to, is already behind a firewall. Network-local attacks (for example inside of a DMZ) and also the opening of additional ports on already infiltrated systems can thus be minimized. The OS security hardening guide will describe how to configure a local firewall dedicated for SAP HANA database systems.

● Minimal package selection

The fewer OS packages an SAP HANA system has installed, the less possible security holes it might have. According to that principle, the hardening guide will describe which packages are absolutely necessary and which packages can be safely discarded. As a nice side effect, a minimized amount of packages also reduces the number updates and patches that have to be applied to a system.

All in all, this guide covers all important topics in detail for the OS hardening of a SAP HANA system. Together with the other security features of SUSE Linux Enterprise Server 11, like the security certifications (CGL, FIPS, EAL4+) and the constantly provided security updates and patches, SAP HANA can run in a very secure environment, meeting highest security standards and being able to fit in corporate security concepts of organizations of all sizes.

SAP HANA Security Guide

For more information, see the SAP HANA Security Guide.

Related Information

SAP HANA Security - An Overview

Operating System Security Hardening Guide for SAP HANA SAP HANA Security Guide

(46)

8 Autoinstall with Help of AutoYaST2

AutoYaST2 is used to automatically install SUSE Linux Enterprise Server.

Configuration information is stored in an XML configuration file called an Autoyast profile. The installer reads the profile and installs the system based on the options given. Using AutoYaST2, multiple systems sharing the same environment and similar but not necessarily identical hardware and performing similar tasks, can easily be installed in parallel and quickly. A configuration file, referred to as AutoYaST profile, is created using existing configuration resources. The profile file can be easily tailored for any specific environment.

The smallest and simplest Autoyast file would be this: <?xml version="1.0"?>

<!DOCTYPE profile>

<profile xmlns="http://www.suse.com/1.0/yast2ns" xmlns:config="http:// www.suse.com/1.0/configns"> <users config:type="list"> <user> <encrypted config:type="boolean">false</encrypted> <user_password>myrootpassword</user_password> <username>root</username> </user> </users> </profile>

In order to create the control file for one or more hosts, a YaST2 module is provided. This system depends on the existing YaST2 modules which are usually used to configure a host in regular operation mode.

For more information, see the SUSE Linux Enterprise Server Deployment Guide and AutoYast2 description.

Note

If you do multipath with SLES 11.3, see Novell Knowledgebase document Enabling multipathing in autoyast

Installations (ID 7009981). With SLES 11.4 this issue is corrected (see release notes).

Related Information

SUSE Linux Enterprise Server Deployment Guide Enabling multipathing in autoyast Installations

(47)

9 Tips for Remote Installation

SUSE Linux Enterprise Server can be installed in several different ways.

As well as the usual media installation through DVD or USB, you can choose from various network-based approaches like NFS, FTP, HTTP, CIFS/SMB together with VNC or SSH or even take a completely hands-off approach (AutoYaST2) to the installation of SUSE Linux Enterprise.

For more information, see the SUSE Linux Enterprise Server Deployment Guide.

Related Information

SUSE Linux Enterprise Server Deployment Guide Booting the Target System for Installation

(48)

10 Appendix

The appendix provides additional information.

10.1 Networking Ports

For information about networking ports, see the SAP HANA Security Guide.

Related Information

SAP HANA Security Guide

10.2 Package List for SAP HANA

Check the recommended package list for SAP HANA.

SAP recommends the installation of the SLES 11 base pattern as the basis to run an SAP HANA system on. To guarantee optimal performance and the highest stability, SAP appliance hardware and technology partners may deliver SAP HANA systems with settings that deviate from that standard. Customers and partners are advised to document all changes to the standard pattern so that SAP support can more efficiently identify the root cause of problems, however.

Required packages, not included in SLES 11 Base System pattern: ● libuuid1

● gtk2 (use the version provided with the operating system distribution)

● java-1_6_0-ibm (use the version provided with the operating system distribution, necessary for the SAP HANA studio on the SAP HANA system)

● libicu (use the version provided with the operating system distribution)

● mozilla-xulrunner192-1.9.2.xx-x.x.x (use the version provided with the operating system, but at the given minimum version)

● ntp ● sudo

● syslog-ng (use the version provided with the operating system distribution) ● tcsh

● libssh2-1 ● expect

(49)

● autoyast2-installation ● yast2-ncurses

● bing (a point-to-point bandwidth measurement tool, needed for supportability) ● bonnie (file system benchmark, needed for supportability)

● cairo (vector graphics library, needed for supportability) ● findutils-locate (tool for locating files, needed for supportability) ● graphviz (graph visualization tools, needed for supportability) ● iptraf (TCP/IP network monitor, needed for supportability)

● krb5-32bit (MIT Kerberos5 implementation-libraries, needed for supportability) ● krb5-client (MIT Kerberos5 implementation-client programs, needed for supportability) ● nfs-client (support utilities for NFS, needed for supportability)

● sensors (hardware health monitoring for Linux, needed for supportability) ● xfsprogs

● libnuma1 ● libgcc_s1 ● libstdc++6

● multipath-tools (if you will use multipath) ● libaio ● libopenssl ● glibc ● audit-libs ● cyrus-sasl ● keyutils-libs ● krb5 ● libcom_err2 ● libevent ● libldap ● libltdl7 ● libopenssl0_9_8 ● pam ● zlib

Note

Note for SAP HANA on IBM Power

For IBM POWER please check if you need additional packages or other versions as documented in multipath-tools (if you will use multipath) SAP Note 2055470 - HANA on POWER Planning and Installation

Specifics - Central Note.

For some SAP HANA options or SAP HANA capabilities you need to download and install the IBM XL C/C++