SAP HANA Automated Update Guide

PUBLIC

SAP HANA Appliance Software SPS 05Document Version: 1.0 - 2012-11-29

SAP HANA Automated Update Guide

Table of Contents

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Setting Up SAP HANA Components for Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.1 Starting Modes for Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.2 Configuring HTTPS for SAP HANA Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.3 Setting Up the SAP HANA Studio. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.1 Automated Update UI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.2 Performing an Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.3 Performing Automated Update in a Distributed System and in a Multiple SAP HANA Systems Landscapes. . . . . 153.4 Performing Automated Updates for Application Function Libraries (AFLs). . . . . . . . . . . . . . . . . . . . . . 163.5 Automated Start/Stop of Software Update Manager for SAP HANA via SAP HANA Studio. . . . . . . . . . . 163.6 Deployment of SAP HANA Content using Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . 17

4 Appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.1 More Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.2 Important SAP Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.3 Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.3.1 Configuring HTTPS for the Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . . . . 204.3.2 Configuring HTTPS for the SAP Host Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234.3.3 Configuring HTTPS for SAP HANA Studio. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254.3.4 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

2P U B L I C© 2012 SAP AG. All rights reserved.

SAP HANA Automated Update GuideTable of Contents

1 Introduction

This document explains how to perform an automated update of your SAP HANA system. The automated update is performed with the Software Update Manager (SUM) for SAP HANA. The SUM for SAP HANA supports three major use cases, which are applying Support Package Stacks (SPS) for SAP HANA, applying Single Support Packages for SAP HANA, performing deployment of additional content for SAP HANA. The necessary update content can be provided to SUM for SAP HANA in the following ways:

● If the SAP HANA system has Internet access, SUM for SAP HANA can find and download available updates from SAP Service Marketplace (SMP). In this case you can update your SAP HANA system without leaving the SAP HANA studio. This is described later in section Performing an Automated Update.

● If the SAP HANA system has no Internet access, you can find and download the updates manually from SMP. In this case you have to provide the location of the downloaded content to SUM for SAP HANA. This is described later in section Performing an Automated Update.

● If you have SAP Solution Manager, you can use it to update your SAP HANA system like other SAP systems in your landscape. In this case you have to register your SAP HANA system using System Landscape Directory (SLD). For more information, see SAP HANA Installation Guide, section Configuring a SAP HANA System to Connect to System Landscape Directory (SLD). Once this configuration is performed, SAP HANA database server will update regularly SLD with data about your SAP HANA system. Afterwards, SAP Solution Manager can access this data in order to calculate updates for this system. Then you can use Maintenance Optimizer (MOPZ) in SAP Solution Manager to generate a SPS and download the necessary archives to a specified location. For more initial information, see SAP Solution Manager documentation. Then you can provide the SPS location to SUM for SAP HANA and it will apply it on the system.

For more information, see the picture below:

SAP HANA Automated Update GuideIntroduction

P U B L I C© 2012 SAP AG. All rights reserved. 3

https://service.sap.com/~sapidb/011000358700000604562011

http://help.sap.com/saphelp_sm71_sp05/helpdata/en/af/50658171124b94bfa8afc004ffe693/frameset.htm

Prerequisites for Software Update Manager for SAP HANA System In the SAP HANA system, the following prerequisites have to be fulfilled:

● The SAP HANA system needs access to the SAP Service Marketplace using HTTPS, unless you have already downloaded and copied the target stack to your SAP HANA system. How to use HTTPS to connect to SAP Service Marketplace is described in one of the following topics: Setting Up the SAP HANA Studio.

Caution: S-User is required

How to download the needed content, when you do not use SAP Service Marketplace, is described in step 3 of Performing an Automated Update.

● You have stopped the data replication before you start the automated update.

● You have performed a system backup before you start the automated update. Also note that during the automated update there is a business downtime for your SAP HANA system.

● You need SUMHANA*.SAR archive and the lm_structure present on the system.

● You know the <SID>adm and sapadm passwords.

● You have applied a valid license key is to the SAP HANA system.

● SAP HANA database is up and running



● SAP Host Agent is up and running



2 Setting Up SAP HANA Components for Automated Update

2.1 Starting Modes for Software Update Manager for SAP HANA

Software Update Manager for SAP HANA (SUM for SAP HANA) uses its own keystore to keep certificates for secure communication with SAP HANA studio.

By default, the password for the keystore is not stored anywhere and it has to be provided each time when SUM for SAP HANA is started manually via the startup script. Therefore, in this case it is not possible to start automatically SUM for SAP HANA from SAP HANA studio.

If you trust the file system security and you want to benefit of the automatic start of SUM for SAP HANA, you can store the password in a file, called catalina.properties.

In order to create the catalina.properties file, follow the procedure below:

1. Create a text file and name it catalina.properties.

2. Store the password in there, using the content: keystore.password=****** (where ****** is the key store password).

3. Save the file in directory <SUM_DIR>/config.Make sure that this file is readable only by <SID>adm user.

2.2 Configuring HTTPS for SAP HANA Automated Update

During the SAP HANA update, several components running on different hosts have to communicate with each other. This means that SUM for SAP HANA communicates with SAP Host Agent, SAP HANA studio, and SAP Service Marketplace. Since sensitive data like passwords is exchanged, encrypted communication over HTTPS is used automatically.

The following prerequisites have to be fulfilled:

● The Software Update Manager for SAP HANA is installed in the SAP HANA system in the directory /usr/sap/<SID>/SUM, which is referred to below as <SUM_DIR>.

● The SAP HANA studio is installed on one or more computers.● When you use SPS 04 versions of SAP HANA studio and Software Update Manager for SAP HANA, you do not

need to import any certificates.● To connect the SAP HANA update UI (part of SAP HANA studio) to the SAP HANA server, do the following:


SAP HANA Automated Update GuideSetting Up SAP HANA Components for Automated Update

Check your proxy settings in the SAP HANA studio by choosing Window Preferences GeneralNetwork Connections .

Change the proxy settings in accordance with your system landscape.

If you are connecting using a proxy, you must have enabled HTTPS schema and provided the correct proxy settings.

1. Choose Manual from the Active Provider list.2. Click on HTTPS and choose Edit.

The default ports are 8080 for HTTP and 8443 for HTTPS.

If you are not using a proxy, disable the HTTPS schema by choosing Direct as the Active Provider.

The other values should be as follows:

Table 1: Proxy entries

Schema Host Port Provider Auth User

HTTP Manual false

HTTPS Manual false

SOCKS Manual false

HTTP proxy 8080 Native false

HTTPS proxy 8443 Native false

Table 2: Proxy bypass

Host Provider

Localhost Manual

127.0.0.1 Manual

For more information about how to configure the proxy settings, see the documentation that is integrated into the SAP HANA studio. Choose Help Help Contents Workbench User Guide Reference Preferences

Network Connections .

2.3 Setting Up the SAP HANA Studio

Direct access to Software Update Manager (SUM) for SAP HANA can be done only using SAP HANA studio. The Studio itself uses certain web browser versions.

For Windows OS, you need Internet Explorer version 9 or newer. In case you run Internet Explorer version 9, make sure that your browser does not run in compatibility mode with your SAP HANA host. You can check this in your browser under Tools ->Compatibility View settings.

For Linux OS, you need XULRunner 1.9.2 or newer. We recommend you to install XULRunner 1.9.2 (or newer) separately but if you have already installed Firefox 3.6 (or newer), it contains XULRunner 1.9.2.



The system propertyorg.eclipse.swt.browser.XULRunnerPath should be set in hdbstudio.ini to point to the path of XULRunner, for example:

-Dorg.eclipse.swt.browser.XULRunnerPath=/usr/lib64/xulrunner-1.9.2.13.

This hdbstudio.ini file is located in the same folder as the executable that is used to start the SAP HANA studio (including the SAP HANA Update UI). For Linux, the default location is /usr/sap/hdbstudio. If the SAP HANA studio is on the SAP HANA appliance, after an update to SPS 05, it will be located in /usr/sap/<SID>/hdbstudio.

Note: SAP HANA studio SPS 03 cannot work with new SUM for SAP HANA SPS 04 (or SPS 05). In order to work in such environment you need to do some steps manually:

1. Start the SUM for SAP HANA server.2. Start the SAP HANA studio as administrator.3. Go to Window -> Preferences -> Install/Update -> Available Software Sites. Add the following site

http://<central hana host>:8080/guirepo4. Go to Help -> Check for Updates. Follow the instructions and restart the SAP HANA studio when

update is finished.

Note: Keep in mind that SUM for SAP HANA updates only the SAP HANA studio repository (update site), not the SAP HANA studio itself. More information about how to update the SAP HANA studio itself, you will find at the end of SAP HANA system update procedure, when you actually do this step.

Prepare the Lifecycle Management Perspective1. Call the SAP HANA studio.

2. Choose Window Preferences Lifecycle Management Service Marketplace .

3. Choose Use file location or Use SMP configuration.

Option Decription

Use file location Enter the File Location (file path & file name, max. length 1024) for the XML file that contains the necessary update information. The resulting path must exist in, or must be accessible from, the system where the Software Update Manager (SUM) for SAP HANA is running.

Since SPS 04 this parameter is only used for the SUM for SAP HANA self-update, while the path to the actual SAP HANA archives can be selected during the update procedure.

Use SMP configuration ○ The Host Name is set to <service.sap.com>.

This is the URL of the SAP Service Marketplace (SMP), where the files that are used for the update are located. It cannot be changed.



Option Decription

○ Enter your SAP Service Marketplace S-User credentials in User Name/Password.

Note: You can obtain an S-User on the SAP Service Marketplace at https://service.sap.com -> Registration.

○ If you use a proxy choose Use proxy server, and enter Host Name (max. length 64) and Port (port must be a number, max. length 10).

○ The check box Use proxy authentication is enabled only if you have selected Use proxy server.

○ If you have selected Use proxy authentication, enter the User Name (max. length 64) and Password (max. length 64).

Note: If you have not previously entered this information, you need to enter it when you call the SAP HANA Update UI for the first time. This information is stored in the Secure Storage and the Preferences:

○ You can change the information by choosing Windows Preferences Lifecycle Management

.

○ You can delete the information by choosing Windows Preferences General Security

Secure Storage This would also delete all other (non lm-related) information in the secure storage.

4. Choose Apply.

5. Choose OK.

Note: To reset your entries, choose Restore Defaults.

Changing the HTTPS Port in the Automated Update UI Note: Compared to previous versions you should use http instead of https, to receive studio updates through the SAP HANA studio repository service.

If you have configured the Software Update Manager for SAP HANA to use an HTTPS port other than the default port (8443), specify the used port number in the file hdbstudio.ini.

Ensure that the following two lines are specified in the file:



https://service.sap.com

https://service.sap.com

-vmargs

-Dupdate.service.port=<port-number>

The -Dupdate.service.port=<port-number> line has to be located below the -vmargs line. It is valid if there

are lines with other -D options in between.

The following example changes the HTTPS port to 9090:

-vmargs

-Dupdate.service.port=9090

Note: After you have changed the configuration, restart the SAP HANA studio.

In order to configure your ports properly during an update, enter the port numbers manually, in the following file /usr/sap/<SID>/SUM/config_master/org.eclipse.gemini.web.tomcat/default-server.xml:

<Connector acceptCount="100" connectionTimeout="20000" enableLookups="false" maxThreads="250" port="8080" protocol="HTTP/1.1" redirectPort="8443" server="SAP"/> ….. <Connector SSLEnabled="true" alias="sumforhana" clientAuth="false" keystoreFile="config/keystore.jks" keystorePass="${keystore.password}" keystoreType="JKS" maxThreads="200" port="8443" scheme="https" secure="true" sslProtocol="TLS" truststoreFile="config/keystore.jks" truststorePass="${keystore.password}" truststoreType="JKS"/></Service>

Also add a row containing the port number in the file /usr/sap/<SID>/Studio/hdbstudio.ini: -Dupdate.service.port=<port-number>



3 Automated Update

3.1 Automated Update UI

The SAP HANA Automated Update is part of the Lifecycle Management perspective.

The Lifecycle Management perspective contains:

● System information & Messages

Provides information about the system to which you are connected and messages related to that connection● Installed Software

Provides information about the currently-installed version of SAP HANA● Available Software

Provides information about the available software updates for your currently installed software versions● Update State

Provides information about the update process● Buttons Download, Update

The button provides the appropriate action, depending on the current state

3.2 Performing an Automated Update

The automated update of SAP HANA is integrated into and monitored in the SAP HANA studio, as part of the Lifecycle Management perspective. In the following topic we cover the possible scenarios that are applying a Support Package Stack (SPS), and applying a Single Support Package (SP). From SPS 05 version you can also deploy additional SAP HANA content with the tool, but this scenario is described in a separated topic. For more information, see the related links at the bottom of the topic.

1. Start the Software Update Manager for SAP HANA in the SAP HANA systemLog on as <SID>adm, navigate to the directory /usr/sap/<SID>/SUM and execute the command sum.sh.

If the system installation is performed by SAP HANA unified installer SPS 04 the key store password is set automatically the same as <SID>adm password. If the password for the key store is not stored in config/catalina.properties, you need to enter it each time the Software Update Manager for SAP HANA is started.

For more information about catalina.properties, see Starting Modes for Software Update Manager for SAP HANA.

SAP HANA Automated Update GuideAutomated Update


Note: If you perform an update from a version older than SPS 04 of your SAP HANA studio, the SUM for SAP HANA will attempt to update itself to a newer version. To do this you will need to run as administrator for Windows, or root user for Linux.

Note: Keep in mind that when performing an update from version older than SPS 04 (to a newer one), we strongly recommend you not to use the SAP HANA studio installed on the SAP HANA appliance, due to some system directory structure changes of the newer versions. From SPS 05 version, the system directory structure of the SAP HANA system is changed, and SAP HANA client, SAP HANA studio and SAP HANA studio repository are moved under the SID directory. For example:

○ /usr/sap/hdbclient -> /usr/sap/<SID>/hdbclient○ /usr/sap/hdbstudio -> /usr/sap/<SID>/hdbstudio

○ /usr/sap/hdbstudio_update -> /usr/sap/<SID>/hdbstudio_update

All new SPS 05 version SAP HANA system installations use the new system directory structure. For systems lower the SPS 05 version , SUM for SAP HANA renames (during update) the old directories, and installs the new components on the new locations, without deleting the old ones. This is also done when a certain SPS is applied (SPS 05 or newer version). After the move of SAP HANA studio to the new location, any manual configurations of the SAP HANA studio will not be moved, including hdbstudio.ini.

2. If you have not connected a system yet, add the system to which you want to connect (see the administration guide for the SAP HANA studio).

Note: Use the fully qualified host name for all configuration actions (including Add System).3. In the context menu of the system node in the Navigator view, choose Lifecycle Management.

When you start the Lifecycle Management perspective in the SAP HANA studio, the Software Update Manager for SAP HANA performs a self-update. The Software Update Manager for SAP HANA SPS 04 and newer executes automatic update of Lifecycle Management view as part of the self-update.

The UI for the automated update will provide information about the installed components' version, and the newest (target) ones that are available for downloading and installing.

You also need to set up user credentials. The following users and settings are needed for the SAP HANA Automated Update:

○ User <SID>adm

○ User and password have to be entered when entering the SAP HANA Update UI for the first time.○ User and password are not stored in the Secure Storage.

○ User and password can be changed in the context menu for the added system under Properties Authentification SAP System Logon .

○ User and password can be deleted under Windows Preferences General Security Secure Storage .

○ User sapadm

○ User and password have to be entered when entering the SAP HANA Update UI for the first time.○ User and password can be stored in the Secure Storage.

○ User and password can be deleted under Windows Preferences General Security Secure Storage .



Note: If you have not previously defined them, you need to enter the user credentials for <SID>adm and sapadm when you call the SAP HANA Update UI for a specific SAP HANA system for the first time.

In the UI, the Select to: field presents you two scenarios:

○ Apply Support Package Stack (SPS - recommended scenario)

You can update all software components of SAP products that are deployed on the system by applying a support package stack. Support package stacks are defined by SAP collections of support packages for software components that work best together.

With this scenario you can execute an update to a defined, by the SPS, set of SAP HANA components. This scenario ensures smooth and consistent update. For more information, see SAP Note 884537.

○ Apply Single Support Packages (Single SP)

If you want to update only particular software components that are deployed on the system and do not want to apply complete support package stacks, you can apply single support packages.

The UI for automated update will provide information about installed components’ version, as well the newer (target) ones that are available. You can select which component version you want to update to. If you have selected SAP Service Marketplace as an update source, then the following restrictions apply:

○ SUM for SAP HANA offers updates only for components that are part of SAP HANA product○ For these components we offer only newer SPs but not newer patches.

In the UI, the Update from: field presents you two options:

○ SAP Service Marketplace

In this case the content is automatically downloaded from SAP Service Marketplace.○ Downloaded Content on SAP HANA System

In this case you need to have the content manually downloaded for both: tool sel-update and for the system update.

You should first perform a self-update of SUM for SAP HANA tool using the SUMHANA*.SAR , which is the newest archive available, in order to perform self-update, before going to the real update of the system.

SUMHANA*.SAR is not part of the HANA stack, therefore you have to download it separately using the following link in the SAP Service Marketplace: http://service.sap.com/swdc -> Support Packages and Patches-> Search for Support Packages and Patches where you need to search for <SUM FOR SAP HANA 1.0>.

Note that you need to provide the full path to the file, not the containing directory.

Before you start the system update procedure for a downloaded content scenario, make sure you also download the following files to any directory accessible by the <SID>adm user in the SAP HANA system:

○ Stack.xml file – xml file containing model of SAP HANA in the form of product instances, components and their versions.

○ IMDB_SERVER*.SAR, IMDB_CLIENT*.SAR, IMC_STUDIO*.SAR, HANALDCTR*.SAR, SAPHOSTAGENT*.SAR – archives containing new content needed for the update of the SAP HANA instances.

To update to a SPS, you can download the files listed above from the SAP Service Marketplace at:



https://service.sap.com/sap/support/notes/884537

http://service.sap.com/swdc

http://service.sap.com/swdc -> Support Packages and Patches-> Browse our Download Catalog -> SAP NetWeaver and complementary products -> SAP HANA -> SAP HANA (Enterprise or Platform )Edition ->Support Package Stack Download.

To update to a Single SP (this means different components' version) use:

http://service.sap.com/swdc -> Support Packages and Patches-> Search for Support Packages and Patches Browse ->Search for IMDB Server for example. Make sure you do the same for the needed archives, depending on the component you want to update (IMDB_SERVER*.SAR, IMDB_CLIENT*.SAR, IMC_STUDIO*.SAR, HANALDCTR*.SAR, SAPHOSTAGENT*.SAR). While downloading the preferable version, make sure that the selected archive is suitable for your operating system.

All archives including SUMHANA*.SAR must be located in the same directory as the stack.xml file.

After the tool self-update you have the options to choose again between the SMP system update or system update using manually downloaded content.

To use Maintenance Optimizer (MOPZ) in SAP Solution Manager to generate a SPS and download the necessary archives, see SAP Solution Manager documentation.

4. During the update, If you are prompted for them, enter the user name and password for the <SID>adm.You can save user name and password in the “Secure Storage”. If you do so, you will not be asked for them again.

5. Select the proposed software releases.6. Choose Download.

This step is not executed if you have manually downloaded the software updates from the SMP, copied them to the download directory, and specified Use file location instead of Use SMP configuration.

Note: Once you have started the download process, it cannot be stopped.7. Choose Update.

The system now performs the automated update.

The system stops the SAP HANA database during the automated update and starts it again once it is complete. The SAP HANA Load Controller is not started as a background program and therefore does not need to be stopped and restarted.

The SUM for SAP HANA updates only your SAP HANA studio repository.

Note: Once you have started the update process, it cannot be stopped.8. In order to update your SAP HANA studio to be the same version as your SAP HANA system, you need to

perform an additional step as follows:Add the URL for the automated update of the SAP HANA studio under Window Preferences Install/Update Available Software Sites . The URL is http://<host>:<port>/studio_repository/. You can also select the Automatically find new updated and notify me option in the Automatic Updates section. You need to restart the SAP HANA studio, and if new updates are available a pop-up appears to notify you, you need to click on it to allow updates. You need to restart SAP HANA studio again.

The update of the SAP HANA studio only works if SUM for SAP HANA is started beforehand and keeps running all time in background.

For more information, see SAP HANA Database - Studio Installation and Update Guide.





http://help.sap.com/saphelp_sm71_sp05/helpdata/en/af/50658171124b94bfa8afc004ffe693/frameset.htm


Make sure your SAP HANA studio contains the Lifecycle Management perspective (see the SAP HANA System Prerequisites in the Introduction).

Note:

If you have SAP HANA studio SPS 02 or older, and then you update it using the functionality described above to SPS03, the Lifecycle Management perspective disappears. This is due to a studio model changes between SPS 02 and SPS 03 for the Lifecycle Management perspective.

After an update to SAP HANA studio SPS 03, you have to call Install New Software and select the LCM feature to install it again.

Related LinksDeployment of SAP HANA Content using Software Update Manager for SAP HANA [page 17]

3.3 Performing Automated Update in a Distributed System and in a Multiple SAP HANA Systems Landscapes

Prerequisites

Software Update Manager (SUM) for SAP HANA can be used to update distributed system (one SID on multiple hosts). In this case you need to have SAP Host Agent manually installed on all secondary hosts, on the primary one it is automatically installed by the SAP HANA Unified Installer.

For more information how to install distributed system, see SAP HANA Installation Guide, section Performing Distributed System Installation.

This topic provides additional details when you have a distributed SAP HANA landscape. In such a landscape you have one primary SAP HANA host and several secondary SAP HANA hosts. The Software Update Manager (SUM) for SAP HANA is installed only on the primary host.

For each host of the distributed system you need to enter the SAP sapadm password, in the SUM user interface.

Note:

For security reasons, SUM for SAP HANA does not save these passwords, therefore you need to enter them each time when you start SUM for SAP HANA.

For each host in the distributed system you need to watch carefully the selected versions of the components when using the Apply Single Support Packages option as this may lead to inconsistencies.

SUM for SAP HANA can also be used in the case of additionally added SAP HANA systems on a single SAP HANA appliance (multiple SIDs on one host). In this case the tool updates only one SID. For more information how to create such system, see SAP HANA Installation Guide, section Add Additional SAP HANA Systems on a Single SAP HANA Appliance.





3.4 Performing Automated Updates for Application Function Libraries (AFLs)

AFLs are not installed by default on your SAP HANA system. They can be installed only with the SAP HANA On-Site Configuration tool. For more information about how to install them, see section "Installing Application Functional Libraries (AFLs) on a SAP HANA System" in the "SAP HANA Installation Guide with Unified Installer".

This also mean that when you perform an automated update of you SAP HANA system to a higher Support Package Stack (SPS) or Single Support Package you do not received AFLs either. You need to have them installed with SAP HANA On-Site Configuration tool, and then you can update them following the general Software Update Manager for SAP HANA options, either using SPS, or Single Support Package.

For more information about these options, see Performing an Automated Update [page 11].

Note:

For the Single Support Package option, the AFLs (SPS) version should be compliant (the same) as the SAP HANA database server (SPS) version. This leads to the following possible variants:

● AFLs update to a newer Single Support Package of the current SPS.● AFLs update and SAP HANA database server update to a newer SPS (equal to both components).

In order to perform an update of AFLs, follow the procedure below:

1. Follow the procedure till step 5 in Performing an Automated Update [page 11].2. When you reach <Updating from >section, in the field <Path of source direct> , enter the path to the

AFL location.3. Once you have the components' version displayed, including the one of the AFl, choose the <Update> button.

For some of the components you have the option to skip the update.4. Follow the instructions of the wizard.

Note:

Keep in mind that after the update of AFLs, the SAP HANA database server will be restarted.

3.5 Automated Start/Stop of Software Update Manager for SAP HANA via SAP HANA Studio

You can perform automated start/stop of Software Update Manager for SAP HANA (SUM for SAP HANA) via the SAP HANA studio SPS 05 version only. For older versions this functionality is not present. When the Lifecycle Management (LM) editor of SAP HANA studio is started, it attempts to start SUM for SAP HANA remotely. The procedure below covers the available cases.

Note: The level of your security during components communication (such SAP HANA studio, SUM for SAP HANA server, and the SAP Host Agent) depends on your previous selection (namely whether you have



selected the HTTPS option) once you have added the SUM for HANA server to your SAP HANA system. This action can be performed by the Add System wizard. If you have not selected the HTTPS option, the communication (including passwords) would be exchanged unencrypted.

Note: The automated start requires running SAP Host Agent on the SAP HANA system.

In order to start the SUM for SAP HANA automatically, without the need to run the script <sum.sh> in

your console of SAP HANA system, follow the procedure below:

1. From the Navigator view of the SAP HANA studio, select the system you want to automatically start (meaning the SUM for SAP HANA server).

2. From the context menu of the selected system, choose Lifecycle Management and the SUM for SAP HANA starts automatically.Depending on whether you have catalina.properties file with stored passwords in it, the tool will proceed as follows:

○ In case you have such catalina.properties file, the SUM for SAP HANA starts automatically.○ In case you do not have catalina.properties file the SUM for SAP HANA requests the needed

passwords.3. (In case of a multiple SAP HANA systems landscape) Make sure you have not started SUM for SAP HANA on

any other system (SID), because you will receive an error message for the current system.4. When you try to stop your SUM for SAP HANA, by simply closing the LM editor, there will be three options

(buttons) available. The Cancel button does not close the LM editor, and does not stop the tool. The Close button closes the LM editor, but does not stop the tool. The Shutdown button stops the tool.

3.6 Deployment of SAP HANA Content using Software Update Manager for SAP HANA

● SAP HANA database should be started

● Make sure you do not update (deploy) content older than SPS 05.

From SPS 05 version of Software Update Manager for SAP HANA (SUM for SAP HANA) provides the possibility to deploy additional content to your SAP HANA system.

The following procedure describes the general way of content deployment. This functionality can be used to deploy content such as Business Suite New Analytics applications.

1. Follow steps 1 and 2 in Performing an Automated Update.2. When you reach Select to section (described in step 3), select the Deploy of HANA Content radio button. This

radio button is located in the LM UI, next to the SPS and Single SP radio buttons.3. In the field Location of DVD zip file on local file system, browse to the location of the needed archives (.zip

files) locally, where SAP HANA studio is running.4. Choose the Next button. With this step the product archive is transferred to the SUM for SAP HANA server.5. Choose the Deploy button.



You will receive a notification in the summary page.



4 Appendix

4.1 More Information

For more information about SAP HANA landscape, security, installation, and administration, see the resources listed in the table below.

Topic Guide/Tool Quick Link

SAP HANA Landscape Deployment & Installation

SAP HANA Knowledge Center on SAP Service Marketplace

SAP Service Marketplace

● SAP HANA Installation Guide● SAP HANA Master Guide

SAP HANA Administration & Security

SAP HANA Knowledge Center on SAP Help Portal

http://help.sap.com/hana

● SAP HANA Technical Operations Manual

● SAP HANA Security Guide

4.2 Important SAP Notes

Caution: Check regularly to see which SAP Notes are available for the SAP HANA Automated Update.

SAP Note Number Title

1545815 SAP Release Note for SUM for SAP HANA

Check the current SAP Notes for SAP HANA Automated Update by searching for the following CSS/CSN components:

BC-HAN-UPD HANA update tool.

4.3 Security

User Credentials

To perform its task the Software Update Manager for SAP HANA needs credentials for the following users:

● sapadm – used to authenticate to SAP Host Agent● <SID>adm – required by NewDB server update

SAP HANA Automated Update GuideAppendix


https://websmp103.sap-ag.de/swdc



http://help.sap.com/hana


● SAP Service Marketplace user – used to authenticate to SAP Service Marketplace

You can enter these credentials in SAP HANA Studio and you have the option to persist them in the Secure Storage. For more information, you can refer to the SAP HANA Studio help. To do this, navigate to Workbench User Guide > Reference > Secure Storage.

The Software Update Manager for SAP HANA does not persist these credentials. These credentials are sent only via encrypted communication channels using HTTPS.

As described in section Configuring HTTPS for the Software Update Manager for SAP HANA a server certificate is stored in config/keystore.jks under the Software Update Manager installation directory. This file is protected by a password which can be stored in a text file config/catalina.properties. The Software Update Manager needs this password to access its certificate in the key store. Since catalina.properties is not encrypted it should be protected by file system access restrictions. Make sure this file is accessible only by <SID>adm user.

If the password for the key store is not stored in config/catalina.properties, you need to enter it each time the Software Update Manager for SAP HANA is started.

For more information about catalina.properties, seeStarting Modes for Software Update Manager for SAP HANA.

If you suspect that the key store password or server certificate are compromised, you have to generate a new server certificate by repeating the procedure described in section Configuring HTTPS for the Software Update Manager for SAP HANA.

Communication Channels

The Software Update Manager for SAP HANA communicates with the following components:

● SAP HANA studio● SAP Host Agent● SAP Service Marketplace

All these channels use encryption via HTTPS. The Software Update Manager for SAP HANA opens server ports 8080 (for HTTP) and 8443 (for HTTPS) for communication with SAP HANA studio.

Note: If you use SAP HANA system SPS 03 or newer, the configuration in the following two sections Configuring HTTPS for the Software Update Manager for SAP HANA [page 20] and Configuring HTTPS for the SAP Host Agent [page 23] is done automatically. Otherwise, you have to do them manually.

4.3.1 Configuring HTTPS for the Software Update Manager for SAP HANASince SPS 04 version of SAP HANA all certificates relevant for SUM for SAP HANA communication with the necessary components are created automatically by SAP HANA unified installer. The following options are only left for reference for any potential older versions than SPS 04.

You can create a server certificate for the Software Update Manager for SAP HANA in one of the following ways:

● Using a self-signed server certificate

You need to import the server certificate on all systems where the SAP HANA Update UI is used.● Using a server certificate signed by a trusted certification authority

This costs additional time and money but you will not need to import it in all systems where the SAP HANA Update UI is used.



Using a self-signed server certificateStarting from SPS 03 the generation of SSL Server Certificates is done automatically from SAP HANA unified installer. Such manual generation is only required if Software Update Manager for SAP HANA is installed manually on SAP HANA SPS 02 system.

1. Generate a new server key pair for the Software Update Manager for SAP HANA.

In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the following command as

<SID>adm user:

keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA -dname "CN=<FULL_HOST_NAME>" -validity <days>

Note: <FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from other

hosts.

<days> is the number of days for which the certificate should be considered valid. The certificate will

expire after this period and will be no longer usable. You then need to generate a new certificate by repeating this procedure.

You will be asked to set key store and key passwords. We recommend that you keep them the same. Make sure you remember the password you have entered here.

You can create a text file catalina.properties to store these passwords in case you want to avoid

entering them each time when you start the Software Update Manager for SAP HANA.

Create the text file catalina.properties in directory <SUM_DIR>/config with the following content:

keystore.password=******

Note: ****** is the key store password.

Make sure that this file is readable only by <SID>adm user.

Caution: Restart the Software Update Manager for SAP HANA.

2. Export a self-signed server certificate.

Execute the following command from the same location:

keytool -exportcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer

Note: You will be asked for the key-store password.

Using a server certificate signed by a trusted certification authority1. Generate a new server key pair for the Software Update Manager for SAP HANA.



In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the following command as

<SID>adm user:

keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA -dname "CN=<FULL_HOST_NAME>" -validity <days>

Note: <FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from other

hosts.

<days> is the number of days for which the certificate should be considered valid. The certificate will

expire after this period and will be no longer usable. You then need to generate a new certificate by repeating this procedure.

You will be asked to set key store and key passwords. We recommend that you keep them the same. Make sure you remember the password you have entered here.

2. Generate a request to sign the server certificate

Execute the following command on the SAP HANA system from the directory <SUM_DIR>/config:

keytool -certreq -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.csr

You will be asked for the key-store password.

The certificate signing request will be stored in sumforhana.csr in the current directory.

3. Send the request to sign the server certificate to a trusted certification authority.

Java comes with a number of certificates from well known trusted certification authorities. To see them on a particular system, execute the following command:

keytool -list -v -keystore "<JRE_DIR>\lib\security\cacerts"

You will be asked for the key-store password. Note that this is different from the password for the server key store. The default password for the cacerts key-store is changeit, but if it has been changed you have to find out what it is and provide it here.

Select a trusted certification authority for which a certificate is present in the SAP HANA system and all SAP HANA studio systems. The list of trusted certification authorities can be different for different Java versions.

Send the signing request for the server certificate (sumforhana.csr) to the selected certification authority.

Note: TC TrustCenter is one of the trusted certification authorities present in cacerts. You can place an order on the SAP Service Marketplace your server certificate to be signed by TC TrustCenter. For more information, see http://service.sap.com/tcs -> SSL Server Certificates.

4. Import the signed server certificate into the SAP HANA system.



http://service.sap.com/tcs

The certification authority should return the signed server certificate. Store it in <SUM_DIR>/config/sumforhana.cer in the SAP HANA system.

Execute the following command from directory <SUM_DIR>/config:

keytool -importcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer -trustcacerts

You will be asked for the key-store password.

5. You can create a text file catalina.properties to store these passwords in case you want to avoid

entering them each time when you start the Software Update Manager for SAP HANA. To do this, in the SAP HANA system, go to the directory <SUM_DIR>/config and create the text file catalina.properties with

the following content:

keystore.password=******

Note: ****** is the key store password.

Make sure that this file is readable only by <SID>adm user.

Caution: Restart the Software Update Manager for SAP HANA.

4.3.2 Configuring HTTPS for the SAP Host AgentObtain and install the SAP Cryptographic Library1. Obtain the SAP Cryptographic Library.

1. Extract SAPCRYPTO.SAR to a temporary directory.

2. Copy the file sapgenpse from the temporary directory to the /usr/sap/hostctrl/exe directory.

For more information about the SAP Cryptographic Library, see SAP Note 397175.

2. Prepare the SAP Host Agent.

By default the <SAP-SSL> library searches for the certificate to be used in the sub-directory/usr/sap/hostctrl/exe/sec.

a. Create the directory manually. Make sure that sapadm is able to access it.

b. Set the SECUDIR environment variable to refer to the sec directory.

To do this, perform the following commands:

mkdir sec

export SECUDIR=/usr/sap/hostctrl/exe/sec

(<set> for Windows, instead of <export >- for Linux)

export LD_LIBRARY_PATH=/usr/sap/hostctrl/exe/




Using a self-signed server certificate1. Generate a new server key pair for the SAP Host Agent.

a. Create the server PSE, the server certificate therein, and the certificate signing request (CSR).

In the SAP HANA system, go to the directory /usr/sap/hostctrl/exe and execute the following

command:

./sapgenpse gen_pse -p SAPSSLS.pse -x passwd1

This command creates a PSE file named SAPSSLS.pse (this name is fixed), which can be used to

authenticate the SAP HANA system for incoming SSL connections. Access to the PSE file is protected with passwd1.

b. Grant the server PSE access to the SAP Host Agent.

Log on as sapadm and execute the following command:

./sapgenpse seclogin -p SAPSSLS.pse -x passwd1 -O sapadmc. Restart the SAP Host Agent

To restart the SAP Host Agent, execute the following command:

./saphostexec -restart

Port 1129 should now also be used for SSL-based communication. You can use the command netstat to

check this.

d. Verify the server certificate chain.

Execute the following command:

./sapgenpse get_my_name -p SAPSSLS.pse -x passwd1 -v

Detailed information about the created certificate is displayed.

2. Export a self-signed SAP Host Agent certificate

The SAP Host Agent sends its server certificate to the Software Update Manager for SAP HANA during the SSL handshake. The update tool validates the host agent certificate and verifies that the name in the certificate matches the name of the host to which it is connected. For the update tool to validate the certificate, the public key of the server certificate has to be present in the keystore of the Software Update Manager for SAP HANA. To export the SAP Host Agent public key, execute the following:

./sapgenpse export_own_cert -v -p SAPSSLS.pse -o SAPSSLS.crt 3. Provide the SAP Host Agent certificate to the Software Update Manager for SAP HANA.

a. Go to the Java Security key store directory:

cd <JAVA_HOME>/jre/lib/security b. Execute the following command:



<JAVA_HOME/bin/keytool -importcert -keystore cacerts -alias saphostagent -trustcacerts -file /usr/sap/hostctrl/exe/SAPSSLS.crt

The password of the cacerts keystore should be changeit.

4.3.3 Configuring HTTPS for SAP HANA StudioYou need to perform the following steps only if you are using Software Update Manager for SAP HANA (SUM for SAP HANA) and SAP HANA studio older than SPS 04 version.

You need the location of the Java runtime used in the involved systems. This location is referred to below as <JRE_DIR>. To find this location for the SAP HANA studio, choose Help About SAP HANA Studio Installation Details Configuration and check the value of the java.home property.

If you use self-signed server certificate, make sure you provide it for the SAP HANA Update UI.

Do this for each SAP HANA studio installation where the SAP HANA Update UI will be used.

Copy the server certificate sumforhana.cer from /usr/sap/<SID>/SUM/config/sumforhana.cer to the machine where the SAP HANA studio is installed.

Run the following command from the directory where you have copied sumforhana.cer:

keytool -importcert -keystore "<JRE_DIR>\lib\security\cacerts" -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer

Note: <JRE_DIR> is the path to the Java runtime used by the SAP HANA studio. To find this location for the SAP HANA studio, choose <Help > About SAP HANA Studio > Installation Details > Configuration> and check the value of the java.home property.

If the SAP HANA studio is installed on a UNIX/LINUX system, use forward slashes / in the command above.

You will be asked for the key store password. Note that this is different from the password for the server key store. The default password for the cacerts key store is changeit, but if it has been changed you have to find out what it is and provide it here.

Caution: Restart the SAP HANA studio.

4.3.4 TroubleshootingImportant Notes

Note: A direct update of SAP HANA SPS 02 system to SAP HANA SPS 05 system is not supported.

Note: If you apply a Single Support Package for SPS 02 or SPS 03 versions from SAP Service Marketplace, using the automatic download option, add a new row manually systemno=<SYSTEM_NUMBER> in the file /usr/sap/<SID>/global/hdb/metadata/installation.properties. After server restart this file will be regenerated and all manual changes

will be lost.



Main Log File for Software Update Manager for SAP HANA The main log file, in which issues are stored is /usr/sap/<sid>/SUM/log/lmtp.log.

The log file with more technical information is /usr/sap/<sid>/SUM/log/ljs_trace.log.

Main Log File for SAP HANA StudioThe SAP HANA studio has a dedicated view for errors - <Error Log> view. You can find the same information in

the following link:

<user_home_dir>/hdbstudio/.metadata/.log.

Central SAP NotesYou can also have a look at the following notes 1768366

Problems with Self Update

1. If after a tool (SUM for SAP HANA) self update from SPS 03 patch 2 to SPS 04 you get the following error in the console, you have to restart SUM for HANA and the LCM perspective.

Exception in thread "Thread-6" java.lang.IllegalStateException: Condition failed at com.sap.lm.hana.updateui.util.ensure.Ensure.checkAndFailCondition(E nsure.java:602) at com.sap.lm.hana.updateui.util.ensure.Ensure.condition(Ensure.java:553) at com.sap.lm.hana.updateprocessmanager.impl.ThreadTask.run(ThreadTask .java:83) at java.lang.Thread.run(Thread.java:679)

2. If you receive the message below, and if you have checked that SUM for SAP HANA service runs and the network connection is available, refer to SAP Note 1751736.

Could not connect to the Update Server.Possible reason: network error occurred or Update server is not running. Try to reconnect.

If you get in the SAP HANA studio error log the message No Content-type in the header!, you can read the

first note in the section Setting Up the SAP HANA Studio.

3. Keep in mind that an automated self-update from SUM for SAP HANA (lower than SPS 04) to SUM for SAP HANA (higher than SPS 05) is not possible, so if you receive the message below, refer to SAP Note :1748630.

сap.lm.hana.application.zip!/. com.sap.lm.lmtp.selfupdate.SelfUpdateException: org.eclipse.equinox.p2.core.ProvisionException: No repository found at jar:......./repository/com.sap.lm.hana.application.zip!/.

How to deal with CertificateException: No name matching localhost foundWhen using a self-signed certificate the following exception occurs in the SAP HANA Update UI when you try to access the Software Update Manager for SAP HANA over HTTPS: javax.net.ssl.SSLHandshakeException:




java.security.cert.CertificateException: No name matching localhost foundWhen generating

the server certificate, specify the fully qualified name of the host where the Software Update Manager for SAP HANA is running. Also, make sure that you have specified exactly the same host name in the SAP HANA Update UI as the host name you entered when creating the system.

Changes to keystore do not take effectYou have updated the keystore file but the changes do not affect the Software Update Manager for SAP HANA or the SAP HANA Update UI.

Restart the Software Update Manager for SAP HANA and the SAP HANA studio and try again.

How to refresh the Lifecycle Management perspectiveTo refresh the Lifecycle Management perspective, close it and start it again. We recommend that you restart the perspective in situations where the UI for the SAP HANA automated update does not react as expected. In situations where you get a system message like “Cannot start new operation. Operation 'XXX' is already running.”, you will only be able to restart and reconnect to the Software Update Manager for SAP

HANA once the specified operation has ended.

Problems starting Your SAP HANA StudioIf your SAP HANA studio does not start check the version of installed XULRunner.

If you have a version lower than 1.9.2, you have to set the correct version:

Open hdbstudio.ini file and add the following row:

-Dorg.eclipse.swt.browser.XULRunnerPath=<xulrunner path>/<xulrunner version>



www.sap.com/contactsap

© 2012 SAP AG. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG.The information contained herein may be changed without prior notice.Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.IBM, DB2, DB2 Universal Database, System ads, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iSeries, pSeries, xSeries, zSeries, eServer, z/VM, z/OS, i5/OS, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation.Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries.Oracle is a registered trademark of Oracle Corporation.UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc.HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.Java is a registered trademark of Sun Microsystems, Inc.JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape.SAP, R/3, xApps, xApp, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

http://www.sap.com/contactsap

SAP HANA Automated Update Guide

Documents

Transcript of SAP HANA Automated Update Guide