Hana Sps5 Sum En

PUBLIC

SAP HANA Appliance Software SPS 05Document Version: 1.0 - 2013-03-01

SAP HANA Automated Update Guide

Table of Contents

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Setting Up SAP HANA Components for Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.1 Starting Modes for Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.2 Configuring HTTPS for SAP HANA Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62.3 Setting Up the SAP HANA Studio. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3 Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.1 Automated Update UI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.2 Performing an Automated Update. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113.3 Performing Automated Update in a Distributed System and in a Multiple SAP HANA Systems Landscapes. . . . . 153.4 Performing Automated Updates for Application Function Libraries (AFLs). . . . . . . . . . . . . . . . . . . . . . 163.5 Performing Automated Update for SAP liveCache Applications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163.6 Automated Start/Stop of Software Update Manager for SAP HANA via SAP HANA Studio. . . . . . . . . . . 173.7 Deployment of SAP HANA Content using Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . 18

4 Appendix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.1 More Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.2 Important SAP Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194.3 Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

4.3.1 Configuring HTTPS for the Software Update Manager for SAP HANA. . . . . . . . . . . . . . . . . . . 204.3.2 Configuring HTTPS for the SAP Host Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234.3.3 Configuring HTTPS for SAP HANA Studio. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

4.4 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

2

P U B L I C© 2013 SAP AG or an SAP affiliate company. All rights reserved.

SAP HANA Automated Update GuideTable of Contents

1 Introduction

This document explains how to perform an automated update of your SAP HANA system. The automated update is performed with the Software Update Manager (SUM) for SAP HANA. The SUM for SAP HANA supports three major use cases, which are applying Support Package Stacks (SPS) for SAP HANA, applying Single Support Packages for SAP HANA, performing deployment of additional content for SAP HANA. The necessary update content can be provided to SUM for SAP HANA in the following ways:

● If the SAP HANA system has Internet access, SUM for SAP HANA can find and download available updates from SAP Service Marketplace (SMP). In this case you can update your SAP HANA system without leaving the SAP HANA studio. This is described later in section Performing an Automated Update.

● If the SAP HANA system has no Internet access, you can find and download the updates manually from SMP. In this case you have to provide the location of the downloaded content to SUM for SAP HANA. This is described later in section Performing an Automated Update.

● If you have SAP Solution Manager, you can use it to update your SAP HANA system like other SAP systems in your landscape. In this case you have to register your SAP HANA system using System Landscape Directory (SLD). For more information, see SAP HANA Installation Guide, section Configuring a SAP HANA System to Connect to System Landscape Directory (SLD). Once this configuration is performed, SAP HANA database server will update regularly SLD with data about your SAP HANA system. Afterwards, SAP Solution Manager can access this data in order to calculate updates for this system. Then you can use Maintenance Optimizer (MOPZ) in SAP Solution Manager to generate a SPS and download the necessary archives to a specified location. For more initial information, see SAP Solution Manager documentation. Then you can provide the SPS location to SUM for SAP HANA and it will apply it on the system.For more information, see the picture below:

SAP HANA Automated Update GuideIntroduction

P U B L I C© 2013 SAP AG or an SAP affiliate company. All

rights reserved. 3

https://service.sap.com/~sapidb/011000358700000604562011

http://help.sap.com/saphelp_sm71_sp05/helpdata/en/af/50658171124b94bfa8afc004ffe693/frameset.htm

Prerequisites for Software Update Manager for SAP HANA System In the SAP HANA system, the following prerequisites have to be fulfilled:

● The SAP HANA system needs access to the SAP Service Marketplace using HTTPS, unless you have already downloaded and copied the target stack to your SAP HANA system. How to use HTTPS to connect to SAP Service Marketplace is described in one of the following topics: Setting Up the SAP HANA Studio.

CautionS-User is required

How to download the needed content, when you do not use SAP Service Marketplace, is described in step 3 of Performing an Automated Update.

● You have stopped the data replication before you start the automated update.● You have performed a system backup before you start the automated update. Also note that during the

automated update there is a business downtime for your SAP HANA system.● You need SUMHANA*.SAR archive and the lm_structure present on the system.● You know the <SID>adm and sapadm passwords.● You have applied a valid license key to the SAP HANA system.● SAP HANA database is up and running.● SAP Host Agent is up and running.

4



● If you use SAP HANA SPS02, keep in mind that there is no SUM for SAP HANA on it. In this case, refer to SAP Note 1793303.



rights reserved. 5

https://service.sap.com/sap/support/notes/1793303

2 Setting Up SAP HANA Components for Automated Update

2.1 Starting Modes for Software Update Manager for SAP HANA

Software Update Manager for SAP HANA (SUM for SAP HANA) uses its own keystore to keep certificates for secure communication with SAP HANA studio.By default, the password for the keystore is not stored anywhere and it has to be provided each time when SUM for SAP HANA is started manually via the startup script. Therefore, in this case it is not possible to start automatically SUM for SAP HANA from SAP HANA studio.If you trust the file system security and you want to benefit of the automatic start of SUM for SAP HANA, you can store the password in a file, called catalina.properties.In order to create the catalina.properties file, follow the procedure below:

1. Create a text file and name it catalina.properties.

2. Store the password in there, using the content: keystore.password=****** (where ****** is the key store password).

3. Save the file in directory <SUM_DIR>/config.Make sure that this file is readable only by <SID>adm user.

2.2 Configuring HTTPS for SAP HANA Automated Update

During the SAP HANA update, several components running on different hosts have to communicate with each other. This means that SUM for SAP HANA communicates with SAP Host Agent, SAP HANA studio, and SAP Service Marketplace. Since sensitive data like passwords is exchanged, encrypted communication over HTTPS is used automatically.The following prerequisites have to be fulfilled:

● The Software Update Manager for SAP HANA is installed in the SAP HANA system in the directory /hana/shared/<SID>/SUM, which is referred to below as <SUM_DIR>.

● The SAP HANA studio is installed on one or more computers.● When you use SPS 04 versions of SAP HANA studio and Software Update Manager for SAP HANA, you do not

need to import any certificates.● To connect the SAP HANA update UI (part of SAP HANA studio) to the SAP HANA server, do the following:

Check your proxy settings in the SAP HANA studio by choosing Window Preferences GeneralNetwork Connections .Change the proxy settings in accordance with your system landscape.If you are connecting using a proxy, you must have enabled HTTPS schema and provided the correct proxy settings. Make sure you configure connection to both domains service.sap.com and *.sap-ag.de.

6


SAP HANA Automated Update GuideSetting Up SAP HANA Components for Automated Update

1. Choose Manual from the Active Provider list.2. Click on HTTPS and choose Edit.

The default ports are 8080 for HTTP and 8443 for HTTPS.If you are not using a proxy, disable the HTTPS schema by choosing Direct as the Active Provider.The other values should be as follows:

Table

Schema Host Port Provider Auth User

HTTP Manual false

HTTPS Manual false

SOCKS Manual false

HTTP proxy 8080 Native false

HTTPS proxy 8443 Native false

Table

Host Provider

Localhost Manual

127.0.0.1 Manual

For more information about how to configure the proxy settings, see the documentation that is integrated into the SAP HANA studio. Choose Help Help Contents Workbench User Guide Reference Preferences

Network Connections .

2.3 Setting Up the SAP HANA Studio

Direct access to Software Update Manager (SUM) for SAP HANA can be done only using SAP HANA studio. The Studio itself uses certain web browser versions.For Windows OS, you need Internet Explorer version 9 or newer. In case you run Internet Explorer version 9, make sure that your browser does not run in compatibility mode with your SAP HANA host. You can check this in your browser under Tools ->Compatibility View settings.For Linux OS, you need XULRunner 1.9.2 or newer. We recommend you to install XULRunner 1.9.2 (or newer) separately but if you have already installed Firefox 3.6 (or newer), it contains XULRunner 1.9.2.The system propertyorg.eclipse.swt.browser.XULRunnerPath should be set in hdbstudio.ini to point to the path of XULRunner, for example:-Dorg.eclipse.swt.browser.XULRunnerPath=/usr/lib64/xulrunner-1.9.2.13.This hdbstudio.ini file is located in the same folder as the executable that is used to start the SAP HANA studio (including the SAP HANA Update UI). For Linux, the default location is /usr/sap/hdbstudio. If the SAP HANA studio is on the SAP HANA appliance, after an update to SPS 05, it will be located in /usr/sap/<SID>/hdbstudio.

Note



rights reserved. 7

SAP HANA studio SPS 03 cannot work with new SUM for SAP HANA SPS 04 (or SPS 05). In order to work in such environment you need to do some steps manually:

1. Start the SUM for SAP HANA server.2. Start the SAP HANA studio as administrator.3. Go to Window -> Preferences -> Install/Update -> Available Software Sites. Add the following site http://

<central hana host>:8080/guirepo4. Go to Help -> Check for Updates. Follow the instructions and restart the SAP HANA studio when update is

finished.

NoteKeep in mind that SUM for SAP HANA updates only the SAP HANA studio repository (update site), not the SAP HANA studio itself. More information about how to update the SAP HANA studio itself, you will find at the end of SAP HANA system update procedure, when you actually do this step.

Prepare the Lifecycle Management Perspective1. Call the SAP HANA studio.

2. Choose Window Preferences Lifecycle Management Service Marketplace .3. Choose Use file location or Use SMP configuration.

Option Decription

Use file location Enter the File Location (file path & file name, max. length 1024) for the XML file that contains the necessary update information. The resulting path must exist in, or must be accessible from, the system where the Software Update Manager (SUM) for SAP HANA is running.Since SPS 04 this parameter is only used for the SUM for SAP HANA self-update, while the path to the actual SAP HANA archives can be selected during the update procedure.

Use SMP configuration ○ The Host Name is set to <service.sap.com>. This is the URL of the SAP Service Marketplace (SMP), where the files that are used for the update are located. It cannot be changed.

○ Enter your SAP Service Marketplace S-User credentials in User Name/Password.

NoteYou can obtain an S-User on the SAP Service Marketplace at https://service.sap.com -> Registration.

○ If you use a proxy choose Use proxy server, and enter Host Name (max. length 64) and Port (port must be a number, max. length 10).

8



https://service.sap.com

Option Decription

○ The check box Use proxy authentication is enabled only if you have selected Use proxy server.

○ If you have selected Use proxy authentication, enter the User Name (max. length 64) and Password (max. length 64).

NoteIf you have not previously entered this information, you need to enter it when you call the SAP HANA Update UI for the first time. This information is stored in the Secure Storage and the Preferences:

○ You can change the information by choosing Windows Preferences Lifecycle Management .

○ You can delete the information by choosing Windows Preferences General Security Secure Storage This would also delete all other (non lm-related) information in the secure storage.

4. Choose Apply.5. Choose OK.

NoteTo reset your entries, choose Restore Defaults.

Changing the HTTPS Port in the Automated Update UI

NoteCompared to previous versions you should use http instead of https, to receive studio updates through the SAP HANA studio repository service.

If you have configured the Software Update Manager for SAP HANA to use an HTTPS port other than the default port (8443), specify the used port number in the file hdbstudio.ini.Ensure that the following two lines are specified in the file:-vmargs-Dupdate.service.port=<port-number>The -Dupdate.service.port=<port-number> line has to be located below the -vmargs line. It is valid if there are lines with other -D options in between.The following example changes the HTTPS port to 9090:-vmargs-Dupdate.service.port=9090

NoteAfter you have changed the configuration, restart the SAP HANA studio.

In order to configure your ports properly during an update, enter the port numbers manually, in the following file /usr/sap/<SID>/SUM/config_master/org.eclipse.gemini.web.tomcat/default-server.xml:<Connector acceptCount="100" connectionTimeout="20000" enableLookups="false" maxThreads="250" port="8080" protocol="HTTP/1.1" redirectPort="8443" server="SAP"/>



rights reserved. 9

….. <Connector SSLEnabled="true" alias="sumforhana" clientAuth="false" keystoreFile="config/keystore.jks" keystorePass="${keystore.password}" keystoreType="JKS" maxThreads="200" port="8443" scheme="https" secure="true" sslProtocol="TLS" truststoreFile="config/keystore.jks" truststorePass="${keystore.password}" truststoreType="JKS"/></Service> Also add a row containing the port number in the file /usr/sap/<SID>/Studio/hdbstudio.ini: -Dupdate.service.port=<port-number>

10



3 Automated Update

3.1 Automated Update UI

The SAP HANA Automated Update is part of the Lifecycle Management perspective.The Lifecycle Management perspective contains:

● System information & Messages Provides information about the system to which you are connected and messages related to that connection

● Installed SoftwareProvides information about the currently-installed version of SAP HANA

● Available Software Provides information about the available software updates for your currently installed software versions

● Update State Provides information about the update process

● Buttons Download, UpdateThe button provides the appropriate action, depending on the current state

3.2 Performing an Automated Update

The automated update of SAP HANA is integrated into and monitored in the SAP HANA studio, as part of the Lifecycle Management perspective. In the following topic we cover the possible scenarios that are applying a Support Package Stack (SPS), and applying a Single Support Package (SP). From SPS 05 version you can also deploy additional SAP HANA content with the tool, but this scenario is described in a separated topic. For more information, see the related links at the bottom of the topic.

1. Start the Software Update Manager for SAP HANA in the SAP HANA systemLog on as <SID>adm, navigate to the directory /usr/sap/<SID>/SUM and execute the command sum.sh.If the system installation is performed by SAP HANA unified installer SPS 04 the key store password is set automatically the same as <SID>adm password. If the password for the key store is not stored in config/catalina.properties, you need to enter it each time the Software Update Manager for SAP HANA is started.For more information about catalina.properties, see Starting Modes for Software Update Manager for SAP HANA.

NoteIf you perform an update from a version older than SPS 04 of your SAP HANA studio, the SUM for SAP HANA will attempt to update itself to a newer version. To do this you will need to run as administrator for Windows, or root user for Linux.

Note

SAP HANA Automated Update GuideAutomated Update


rights reserved. 11

Keep in mind that when performing an SPS update (not relevant for Single SP update) from version older than SPS 04 (to a newer one), we strongly recommend you not to use the SAP HANA studio installed on the SAP HANA appliance, but on any other host (for example, your personal computer), due to some system directory structure changes of the newer versions. Keep in mind that when you apply SPS 05 version, the system directory structure of the SAP HANA system is changed, and SAP HANA client, SAP HANA studio and SAP HANA studio repository are moved under the SID directory. For example:

○ /usr/sap/hdbclient -> /usr/sap/<SID>/hdbclient○ /usr/sap/hdbstudio -> /usr/sap/<SID>/hdbstudio

○ /usr/sap/hdbstudio_update -> /usr/sap/<SID>/hdbstudio_update

SPS 05 version SAP HANA system installations use the above system directory structure, until Single SP 03 for SPS 05. For systems lower the SPS 05 version , SUM for SAP HANA renames (during update) the old directories, and installs the new components on the new locations, without deleting the old ones. This is also done when a certain SPS is applied (SPS 05 or newer version). After the move of SAP HANA studio to the new location, any manual configurations of the SAP HANA studio will not be moved, including hdbstudio.ini

NoteKeep in mind that when you apply Single SP 03 for SPS 05 version, the system directory structure of the SAP HANA system is changed, and SAP HANA client, SAP HANA studio, SAP HANA studio repository, and lm_structure file are moved under the /hana/shared/<SID> directory. For example:

○ /hana/shared/<SID>/hdbclient○ /hana/shared/<SID>/hdbstudio

○ /hana/shared/<SID>/hdbstudio_update○ /hana/shared/<SID>/lm_structure

All new SAP HANA system installations , after the Single SP 03 for SPS 05, use the new system directory structure.

2. If you have not connected a system yet, add the system to which you want to connect (see the administration guide for the SAP HANA studio).

NoteUse the fully qualified host name for all configuration actions (including Add System).

3. In the context menu of the system node in the Navigator view, choose Lifecycle Management.When you start the Lifecycle Management perspective in the SAP HANA studio, the Software Update Manager for SAP HANA performs a self-update. The Software Update Manager for SAP HANA SPS 04 and newer executes automatic update of Lifecycle Management view as part of the self-update.The UI for the automated update will provide information about the installed components' version, and the newest (target) ones that are available for downloading and installing.You also need to set up user credentials. The following users and settings are needed for the SAP HANA Automated Update:

○ User <SID>adm

○ User and password have to be entered when entering the SAP HANA Update UI for the first time.○ User and password are not stored in the Secure Storage.

12



○ User and password can be changed in the context menu for the added system under Properties Authentification SAP System Logon .

○ User and password can be deleted under Windows Preferences General Security Secure Storage .

○ User sapadm

○ User and password have to be entered when entering the SAP HANA Update UI for the first time.○ User and password can be stored in the Secure Storage.

○ User and password can be deleted under Windows Preferences General Security Secure Storage .

NoteIf you have not previously defined them, you need to enter the user credentials for <SID>adm and sapadm when you call the SAP HANA Update UI for a specific SAP HANA system for the first time.

In the UI, the Select to: field presents you two scenarios:

○ Apply Support Package Stack (SPS - recommended scenario)You can update all software components of SAP products that are deployed on the system by applying a support package stack. Support package stacks are defined by SAP collections of support packages for software components that work best together.With this scenario you can execute an update to a defined, by the SPS, set of SAP HANA components. This scenario ensures smooth and consistent update. For more information, see SAP Note 884537.

○ Apply Single Support Packages (Single SP)If you want to update only particular software components that are deployed on the system and do not want to apply complete support package stacks, you can apply single support packages.The UI for automated update will provide information about installed components’ version, as well the newer (target) ones that are available. You can select which component version you want to update to. If you have selected SAP Service Marketplace as an update source, then the following restrictions apply:

○ SUM for SAP HANA offers updates only for components that are part of SAP HANA product○ For these components we offer only newer SPs but not newer patches.

In the UI, the Update from: field presents you two options:

○ SAP Service Marketplace In this case the content is automatically downloaded from SAP Service Marketplace.

○ Downloaded Content on SAP HANA SystemIn this case you need to have the content manually downloaded for both: tool sel-update and for the system update.You should first perform a self-update of SUM for SAP HANA tool using the SUMHANA*.SAR , which is the newest archive available, in order to perform self-update, before going to the real update of the system.SUMHANA*.SAR is not part of the HANA stack, therefore you have to download it separately using the following link in the SAP Service Marketplace: http://service.sap.com/swdc -> Support Packages and Patches-> Search for Support Packages and Patches where you need to search for <SUM FOR SAP HANA 1.0>.Note that you need to provide the full path to the file, not the containing directory.Before you start the system update procedure for a downloaded content scenario, make sure you also download the following files to any directory accessible by the <SID>adm user in the SAP HANA system:



rights reserved. 13


http://service.sap.com/swdc

○ Stack.xml file – xml file containing model of SAP HANA in the form of product instances, components and their versions.

○ IMDB_SERVER*.SAR, IMDB_CLIENT*.SAR, IMC_STUDIO*.SAR, HANALDCTR*.SAR, SAPHOSTAGENT*.SAR – archives containing new content needed for the update of the SAP HANA instances.

To update to a SPS, you can download the files listed above from the SAP Service Marketplace at:http://service.sap.com/swdc -> Support Packages and Patches-> Browse our Download Catalog -> SAP NetWeaver and complementary products -> SAP HANA -> SAP HANA (Enterprise or Platform )Edition ->Support Package Stack Download.To update to a Single SP (this means different components' version) use:http://service.sap.com/swdc -> Support Packages and Patches-> Search for Support Packages and Patches Browse ->Search for IMDB Server for example. Make sure you do the same for the needed archives, depending on the component you want to update (IMDB_SERVER*.SAR, IMDB_CLIENT*.SAR, IMC_STUDIO*.SAR, HANALDCTR*.SAR, SAPHOSTAGENT*.SAR). While downloading the preferable version, make sure that the selected archive is suitable for your operating system.All archives including SUMHANA*.SAR must be located in the same directory as the stack.xml file.After the tool self-update you have the options to choose again between the SMP system update or system update using manually downloaded content.To use Maintenance Optimizer (MOPZ) in SAP Solution Manager to generate a SPS and download the necessary archives, see SAP Solution Manager documentation.

4. During the update, If you are prompted for them, enter the user name and password for the <SID>adm.You can save user name and password in the “Secure Storage”. If you do so, you will not be asked for them again.

5. Select the proposed software releases.6. Choose Download.

This step is not executed if you have manually downloaded the software updates from the SMP, copied them to the download directory, and specified Use file location instead of Use SMP configuration.

NoteOnce you have started the download process, it cannot be stopped.

7. Choose Update.The system now performs the automated update.The system stops the SAP HANA database during the automated update and starts it again once it is complete. The SAP HANA Load Controller is not started as a background program and therefore does not need to be stopped and restarted.The SUM for SAP HANA updates only your SAP HANA studio repository.

NoteOnce you have started the update process, it cannot be stopped.

8. In order to update your SAP HANA studio to be the same version as your SAP HANA system, you need to perform an additional step as follows:Add the URL for the automated update of the SAP HANA studio under Window Preferences Install/Update Available Software Sites . The URL is http://<host>:8080/studio_repository/. You can also select the Automatically find new updated and notify me option in the Automatic Updates section. You need to restart the SAP HANA studio, and if new updates are available a pop-up appears to notify you, you need to click on it to allow updates. You need to restart SAP HANA studio again.

14





http://help.sap.com/saphelp_sm71_sp05/helpdata/en/af/50658171124b94bfa8afc004ffe693/frameset.htm

The update of the SAP HANA studio only works if SUM for SAP HANA is started beforehand and keeps running all time in background.For more information, see SAP HANA Database - Studio Installation and Update Guide.Make sure your SAP HANA studio contains the Lifecycle Management perspective (see the SAP HANA System Prerequisites in the Introduction).

NoteIf you have SAP HANA studio SPS 02 or older, and then you update it using the functionality described above to SPS03, the Lifecycle Management perspective disappears. This is due to a studio model changes between SPS 02 and SPS 03 for the Lifecycle Management perspective.After an update to SAP HANA studio SPS 03, you have to call Install New Software and select the LCM feature to install it again.

Related LinksDeployment of SAP HANA Content using Software Update Manager for SAP HANA [page 18]

3.3 Performing Automated Update in a Distributed System and in a Multiple SAP HANA Systems Landscapes

PrerequisitesSoftware Update Manager (SUM) for SAP HANA can be used to update distributed system (one SID on multiple hosts). In this case you need to have SAP Host Agent manually installed on all secondary hosts, on the primary one it is automatically installed by the SAP HANA Unified Installer.For more information how to install distributed system, see SAP HANA Installation Guide, section Performing Distributed System Installation.This topic provides additional details when you have a distributed SAP HANA landscape. In such a landscape you have one primary SAP HANA host and several secondary SAP HANA hosts. The Software Update Manager (SUM) for SAP HANA is installed only on the primary host.For each host of the distributed system you need to enter the SAP sapadm password, in the SUM user interface.

NoteFor security reasons, SUM for SAP HANA does not save these passwords, therefore you need to enter them each time when you start SUM for SAP HANA.For each host in the distributed system you need to watch carefully the selected versions of the components when using the Apply Single Support Packages option as this may lead to inconsistencies.

SUM for SAP HANA can also be used in the case of additionally added SAP HANA systems on a single SAP HANA appliance (multiple SIDs on one host). In this case the tool updates only one SID. For more information how to create such system, see SAP HANA Installation Guide, section Add Additional SAP HANA Systems on a Single SAP HANA Appliance.



rights reserved. 15




3.4 Performing Automated Updates for Application Function Libraries (AFLs)

AFLs are not installed by default on your SAP HANA system. They can be installed only with the SAP HANA On-Site Configuration tool. For more information about how to install them, see section Installing Application Functional Libraries (AFLs) on a SAP HANA System in the SAP HANA Installation Guide with Unified Installer.This also means that when you perform an automated update of your SAP HANA system to a higher Support Package Stack (SPS) or Single Support Package you do not receive AFLs either. You need to have them installed with SAP HANA On-Site Configuration tool, and then you can update them following the general Software Update Manager for SAP HANA options, either using SPS, or Single Support Package.For more information about these options, see Performing an Automated Update [page 11].

NoteAFL component should be on the same SP (revision) as SAP HANA DATABASE component. This leads to the following possible variants:

● Patch AFL to higher patch number within the same SP (revision)● Update both AFL and SAP HANA DATABASE to higher SP (revision)

SUM for SAP HANA will not allow you to update AFL and SAP HANA DATABASE to different SP (revision) numbers.

In order to perform an update of AFLs, follow the procedure below:

1. Follow the procedure till step 5 in Performing an Automated Update [page 11].2. When you reach <Updating from >section, in the field <Path of source direct> , enter the path to the

AFL location.3. Once you have the components' version displayed, including the one of the AFl, choose the <Update> button.

For some of the components you have the option to skip the update.4. Follow the instructions of the wizard.

NoteKeep in mind that after the update of AFLs, the SAP HANA database server will be restarted.

3.5 Performing Automated Update for SAP liveCache Applications

SAP liveCache applications (SAP LCA) are not installed by default on your SAP HANA system. They can be installed only with the SAP HANA On-Site Configuration tool. For more information about how to install them, see section Installing SAP liveCache Applications on a SAP HANA System in the SAP HANA Installation Guide with Unified Installer.This also means that when you perform an automated update of your SAP HANA system to a higher Support Package Stack (SPS) or Single Support Package, you do not receive SAP LCA either. You need to have them

16






installed with SAP HANA On-Site Configuration tool, and then you can update them following the general Software Update Manager for SAP HANA options, either using SPS, or Single Support Package.For more information about these options, see Performing an Automated Update [page 11].

NoteSAP HANA LCAPPS component should be on the same SP (revision) as SAP HANA DATABASE component. This leads to the following possible variants:

● Patch SAP HANA LCAPPS to higher patch number within the same SP (revision)● Update both SAP HANA LCAPPS and SAP HANA DATABASE to higher SP (revision)

SUM for SAP HANA will not allow you to update SAP HANA LCAPPS and SAP HANA DATABASE to different SP (revision) numbers.

In order to perform an update of SAP LCA, follow the procedure below:

1. Follow the procedure till step 5 in Performing an Automated Update [page 11].2. When you reach <Updating from >section, in the field <Path of source direct> , enter the path to the

SAP LCA location.3. Once you have the components' version displayed, including the one of the SAP LCA, choose the <Update>

button. For some of the components you have the option to skip the update.4. Follow the instructions of the wizard.

NoteKeep in mind that after the update of SAP LCA, the SAP HANA database server will be restarted.

3.6 Automated Start/Stop of Software Update Manager for SAP HANA via SAP HANA Studio

You can perform automated start/stop of Software Update Manager for SAP HANA (SUM for SAP HANA) via the SAP HANA studio SPS 05 version only. For older versions this functionality is not present. When the Lifecycle Management (LM) editor of SAP HANA studio is started, it attempts to start SUM for SAP HANA remotely. The procedure below covers the available cases.

NoteThe level of your security during components communication (such SAP HANA studio, SUM for SAP HANA server, and the SAP Host Agent) depends on your previous selection (namely whether you have selected the HTTPS option) once you have added the SUM for HANA server to your SAP HANA system. This action can be performed by the Add System wizard. If you have not selected the HTTPS option, the communication (including passwords) would be exchanged unencrypted.

NoteThe automated start requires running SAP Host Agent on the SAP HANA system.



rights reserved. 17

In order to start the SUM for SAP HANA automatically, without the need to run the script <sum.sh> in your console of SAP HANA system, follow the procedure below:

1. From the Navigator view of the SAP HANA studio, select the system you want to automatically start (meaning the SUM for SAP HANA server).

2. From the context menu of the selected system, choose Lifecycle Management and the SUM for SAP HANA starts automatically.Depending on whether you have catalina.properties file with stored passwords in it, the tool will proceed as follows:

○ In case you have such catalina.properties file, the SUM for SAP HANA starts automatically.○ In case you do not have catalina.properties file the SUM for SAP HANA requests the needed

passwords.3. (In case of a multiple SAP HANA systems landscape) Make sure you have not started SUM for SAP HANA on

any other system (SID), because you will receive an error message for the current system.4. When you try to stop your SUM for SAP HANA, by simply closing the LM editor, there will be three options

(buttons) available. The Cancel button does not close the LM editor, and does not stop the tool. The Close button closes the LM editor, but does not stop the tool. The Shutdown button stops the tool.

3.7 Deployment of SAP HANA Content using Software Update Manager for SAP HANA

● SAP HANA database should be started● Make sure you do not update (deploy) content older than SPS 05.● Make sure you do not have inactive objects in your database, before you deploy the content. You need to

activate or delete such objects.

From SPS 05 version of Software Update Manager for SAP HANA (SUM for SAP HANA) provides the possibility to deploy additional content to your SAP HANA system.The following procedure describes the general way of content deployment. This functionality can be used to deploy content such as Business Suite New Analytics applications.

1. Follow steps 1 and 2 in Performing an Automated Update.2. When you reach Select to section (described in step 3), select the Deploy of HANA Content radio button. This

radio button is located in the LM UI, next to the SPS and Single SP radio buttons.3. In the field Location of DVD zip file on local file system, browse to the location of the needed archives (.zip

files) locally, where SAP HANA studio is running.4. Choose the Next button. With this step the product archive is transferred to the SUM for SAP HANA server.5. Choose the Deploy button.

SUM for SAP HANA attemps to activate and deploy the corresponding HANA content. You will receive a notification in the summary page, even in case of activation issues.

18



4 Appendix

4.1 More Information

For more information about SAP HANA landscape, security, installation, and administration, see the resources listed in the table below.

Topic Guide/Tool Quick Link

SAP HANA Landscape Deployment & Installation

SAP HANA Knowledge Center on SAP Service Marketplace

SAP Service Marketplace

● SAP HANA Installation Guide● SAP HANA Master Guide

SAP HANA Administration & Security

SAP HANA Knowledge Center on SAP Help Portal

http://help.sap.com/hana

● SAP HANA Technical Operations Manual

● SAP HANA Security Guide

4.2 Important SAP Notes

Caution: Check regularly to see which SAP Notes are available for the SAP HANA Automated Update.

SAP Note Number Title

1545815 SAP Release Note for SUM for SAP HANA

Check the current SAP Notes for SAP HANA Automated Update by searching for the following CSS/CSN components:BC-HAN-UPD HANA update tool.

4.3 Security

User CredentialsTo perform its task the Software Update Manager for SAP HANA needs credentials for the following users:

● sapadm – used to authenticate to SAP Host Agent● <SID>adm – required by NewDB server update● SAP Service Marketplace user – used to authenticate to SAP Service Marketplace

SAP HANA Automated Update GuideAppendix


rights reserved. 19

https://websmp103.sap-ag.de/swdc



http://help.sap.com/hana


You can enter these credentials in SAP HANA Studio and you have the option to persist them in the Secure Storage. For more information, you can refer to the SAP HANA Studio help. To do this, navigate to Workbench User Guide > Reference > Secure Storage.The Software Update Manager for SAP HANA does not persist these credentials. These credentials are sent only via encrypted communication channels using HTTPS.As described in section Configuring HTTPS for the Software Update Manager for SAP HANA a server certificate is stored in config/keystore.jks under the Software Update Manager installation directory. This file is protected by a password which can be stored in a text file config/catalina.properties. The Software Update Manager needs this password to access its certificate in the key store. Since catalina.properties is not encrypted it should be protected by file system access restrictions. Make sure this file is accessible only by <SID>adm user.If the password for the key store is not stored in config/catalina.properties, you need to enter it each time the Software Update Manager for SAP HANA is started.For more information about catalina.properties, seeStarting Modes for Software Update Manager for SAP HANA.If you suspect that the key store password or server certificate are compromised, you have to generate a new server certificate by repeating the procedure described in section Configuring HTTPS for the Software Update Manager for SAP HANA.Communication ChannelsThe Software Update Manager for SAP HANA communicates with the following components:

● SAP HANA studio● SAP Host Agent● SAP Service Marketplace

All these channels use encryption via HTTPS. The Software Update Manager for SAP HANA opens server ports 8080 (for HTTP) and 8443 (for HTTPS) for communication with SAP HANA studio.

NoteIf you use SAP HANA system SPS 03 or newer, the configuration in the following two sections Configuring HTTPS for the Software Update Manager for SAP HANA [page 20] and Configuring HTTPS for the SAP Host Agent [page 23] is done automatically. Otherwise, you have to do them manually.

4.3.1 Configuring HTTPS for the Software Update Manager for SAP HANASince SPS 04 version of SAP HANA all certificates relevant for SUM for SAP HANA communication with the necessary components are created automatically by SAP HANA unified installer. The following options are only left for reference for any potential older versions than SPS 04.You can create a server certificate for the Software Update Manager for SAP HANA in one of the following ways:

● Using a self-signed server certificateYou need to import the server certificate on all systems where the SAP HANA Update UI is used.

● Using a server certificate signed by a trusted certification authorityThis costs additional time and money but you will not need to import it in all systems where the SAP HANA Update UI is used.

Using a self-signed server certificateStarting from SPS 03 the generation of SSL Server Certificates is done automatically from SAP HANA unified installer. Such manual generation is only required if Software Update Manager for SAP HANA is installed manually on SAP HANA SPS 02 system.

20



1. Generate a new server key pair for the Software Update Manager for SAP HANA.In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the following command as <SID>adm user:keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA -dname "CN=<FULL_HOST_NAME>" -validity <days>

Note<FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from other hosts.<days> is the number of days for which the certificate should be considered valid. The certificate will expire after this period and will be no longer usable. You then need to generate a new certificate by repeating this procedure.You will be asked to set key store and key passwords. We recommend that you keep them the same. Make sure you remember the password you have entered here.You can create a text file catalina.properties to store these passwords in case you want to avoid entering them each time when you start the Software Update Manager for SAP HANA.

Create the text file catalina.properties in directory <SUM_DIR>/config with the following content:keystore.password=******

Note****** is the key store password.

Make sure that this file is readable only by <SID>adm user.

CautionRestart the Software Update Manager for SAP HANA.

2. Export a self-signed server certificate.Execute the following command from the same location:keytool -exportcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer

NoteYou will be asked for the key-store password.

Using a server certificate signed by a trusted certification authority1. Generate a new server key pair for the Software Update Manager for SAP HANA.

In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the following command as <SID>adm user:keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA -dname "CN=<FULL_HOST_NAME>" -validity <days>

Note<FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from other hosts.<days> is the number of days for which the certificate should be considered valid. The certificate will expire after this period and will be no longer usable. You then need to generate a new certificate by repeating this procedure.



rights reserved. 21

You will be asked to set key store and key passwords. We recommend that you keep them the same. Make sure you remember the password you have entered here.

2. Generate a request to sign the server certificateExecute the following command on the SAP HANA system from the directory <SUM_DIR>/config:keytool -certreq -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.csrYou will be asked for the key-store password.The certificate signing request will be stored in sumforhana.csr in the current directory.

3. Send the request to sign the server certificate to a trusted certification authority.Java comes with a number of certificates from well known trusted certification authorities. To see them on a particular system, execute the following command:keytool -list -v -keystore "<JRE_DIR>\lib\security\cacerts"You will be asked for the key-store password. Note that this is different from the password for the server key store. The default password for the cacerts key-store is changeit, but if it has been changed you have to find out what it is and provide it here.Select a trusted certification authority for which a certificate is present in the SAP HANA system and all SAP HANA studio systems. The list of trusted certification authorities can be different for different Java versions.Send the signing request for the server certificate (sumforhana.csr) to the selected certification authority.

NoteTC TrustCenter is one of the trusted certification authorities present in cacerts. You can place an order on the SAP Service Marketplace your server certificate to be signed by TC TrustCenter. For more information, see http://service.sap.com/tcs -> SSL Server Certificates.

4. Import the signed server certificate into the SAP HANA system.The certification authority should return the signed server certificate. Store it in <SUM_DIR>/config/sumforhana.cer in the SAP HANA system.Execute the following command from directory <SUM_DIR>/config:keytool -importcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer -trustcacertsYou will be asked for the key-store password.

5. You can create a text file catalina.properties to store these passwords in case you want to avoid entering them each time when you start the Software Update Manager for SAP HANA. To do this, in the SAP HANA system, go to the directory <SUM_DIR>/config and create the text file catalina.properties with the following content:keystore.password=******

Note****** is the key store password.

Make sure that this file is readable only by <SID>adm user.

CautionRestart the Software Update Manager for SAP HANA.

22



http://service.sap.com/tcs

4.3.2 Configuring HTTPS for the SAP Host AgentObtain and install the SAP Cryptographic Library1. Obtain the SAP Cryptographic Library.

1. Extract SAPCRYPTO.SAR to a temporary directory.2. Copy the file sapgenpse from the temporary directory to the /usr/sap/hostctrl/exe directory.

For more information about the SAP Cryptographic Library, see SAP Note 397175.2. Prepare the SAP Host Agent.

By default the <SAP-SSL> library searches for the certificate to be used in the sub-directory/usr/sap/hostctrl/exe/sec.

a. Create the directory manually. Make sure that sapadm is able to access it.b. Set the SECUDIR environment variable to refer to the sec directory.

To do this, perform the following commands:mkdir sec export SECUDIR=/usr/sap/hostctrl/exe/sec (<set> for Windows, instead of <export >- for Linux)export LD_LIBRARY_PATH=/usr/sap/hostctrl/exe/

Using a self-signed server certificate1. Generate a new server key pair for the SAP Host Agent.

a. Create the server PSE, the server certificate therein, and the certificate signing request (CSR).In the SAP HANA system, go to the directory /usr/sap/hostctrl/exe and execute the following command:./sapgenpse gen_pse -p SAPSSLS.pse -x passwd1This command creates a PSE file named SAPSSLS.pse (this name is fixed), which can be used to authenticate the SAP HANA system for incoming SSL connections. Access to the PSE file is protected with passwd1.

b. Grant the server PSE access to the SAP Host Agent.Log on as sapadm and execute the following command:./sapgenpse seclogin -p SAPSSLS.pse -x passwd1 -O sapadm

c. Restart the SAP Host AgentTo restart the SAP Host Agent, execute the following command:./saphostexec -restart Port 1129 should now also be used for SSL-based communication. You can use the command netstat to check this.

d. Verify the server certificate chain.Execute the following command:./sapgenpse get_my_name -p SAPSSLS.pse -x passwd1 -v Detailed information about the created certificate is displayed.

2. Export a self-signed SAP Host Agent certificateThe SAP Host Agent sends its server certificate to the Software Update Manager for SAP HANA during the SSL handshake. The update tool validates the host agent certificate and verifies that the name in the certificate matches the name of the host to which it is connected. For the update tool to validate the



rights reserved. 23


certificate, the public key of the server certificate has to be present in the keystore of the Software Update Manager for SAP HANA. To export the SAP Host Agent public key, execute the following:./sapgenpse export_own_cert -v -p SAPSSLS.pse -o SAPSSLS.crt

3. Provide the SAP Host Agent certificate to the Software Update Manager for SAP HANA.

a. Go to the Java Security key store directory:cd <JAVA_HOME>/jre/lib/security

b. Execute the following command:<JAVA_HOME/bin/keytool -importcert -keystore cacerts -alias saphostagent -trustcacerts -file /usr/sap/hostctrl/exe/SAPSSLS.crt

The password of the cacerts keystore should be changeit.

4.3.3 Configuring HTTPS for SAP HANA StudioYou need to perform the following steps only if you are using Software Update Manager for SAP HANA (SUM for SAP HANA) and SAP HANA studio older than SPS 04 version.You need the location of the Java runtime used in the involved systems. This location is referred to below as <JRE_DIR>. To find this location for the SAP HANA studio, choose Help About SAP HANA Studio Installation Details Configuration and check the value of the java.home property.If you use self-signed server certificate, make sure you provide it for the SAP HANA Update UI.Do this for each SAP HANA studio installation where the SAP HANA Update UI will be used.Copy the server certificate sumforhana.cer from /usr/sap/<SID>/SUM/config/sumforhana.cer to the machine where the SAP HANA studio is installed.Run the following command from the directory where you have copied sumforhana.cer:keytool -importcert -keystore "<JRE_DIR>\lib\security\cacerts" -alias sumforhana_$<hostname>_$<SID> -file sumforhana.cer

Note<JRE_DIR> is the path to the Java runtime used by the SAP HANA studio. To find this location for the SAP HANA studio, choose <Help > About SAP HANA Studio > Installation Details > Configuration> and check the value of the java.home property.If the SAP HANA studio is installed on a UNIX/LINUX system, use forward slashes / in the command above.You will be asked for the key store password. Note that this is different from the password for the server key store. The default password for the cacerts key store is changeit, but if it has been changed you have to find out what it is and provide it here.

CautionRestart the SAP HANA studio.

4.4 Troubleshooting

Important Notes

Note

24



SAP HANA database versions before revision 20 do not support direct update to the latest revision. In such cases first update your SAP HANA database to revision 20.

NoteIf you apply a Single Support Package for SPS 02 or SPS 03 versions from SAP Service Marketplace, using the automatic download option, add a new row manually systemno=<SYSTEM_NUMBER> in the file /usr/sap/<SID>/global/hdb/metadata/installation.properties. After server restart this file will be regenerated and all manual changes will be lost.

NoteIf SUM fort SAP HANA is not installed on the SAP HANA system, apply SAP Note 1793303.

Main Log File for Software Update Manager for SAP HANA The main log file, in which issues are stored is /usr/sap/<sid>/SUM/log/lmtp.log.The log file with more technical information is /usr/sap/<sid>/SUM/log/ljs_trace.log.

Main Log File for SAP HANA StudioThe SAP HANA studio has a dedicated view for errors - <Error Log> view. You can find the same information in the following link:<user_home_dir>/hdbstudio/.metadata/.log.

Central SAP NoteYou can also have a look at the following SAP note 1768366.

Problems with Self Update1. If after a tool (SUM for SAP HANA) self update from SPS 03 patch 2 to SPS 04 you get the following error in the console, you have to restart SUM for HANA and the LCM perspective.Exception in thread "Thread-6" java.lang.IllegalStateException: Condition failed at com.sap.lm.hana.updateui.util.ensure.Ensure.checkAndFailCondition(E nsure.java:602) at com.sap.lm.hana.updateui.util.ensure.Ensure.condition(Ensure.java:553) at com.sap.lm.hana.updateprocessmanager.impl.ThreadTask.run(ThreadTask .java:83) at java.lang.Thread.run(Thread.java:679)2. If you receive the message below, and if you have checked that SUM for SAP HANA service runs and the network connection is available, refer to SAP Note 1751736.Could not connect to the Update Server.Possible reason: network error occurred or Update server is not running. Try to reconnect.If you get in the SAP HANA studio error log the message No Content-type in the header!, you can read the first note in the section Setting Up the SAP HANA Studio.3. Keep in mind that an automated self-update from SUM for SAP HANA (lower than SPS 04) to SUM for SAP HANA (higher than SPS 05) is not possible, so if you receive the message below, refer to SAP Note :1748630.сap.lm.hana.application.zip!/. com.sap.lm.lmtp.selfupdate.SelfUpdateException: org.eclipse.equinox.p2.core.ProvisionException: No repository found at jar:......./repository/com.sap.lm.hana.application.zip!/. 4. In case you do not use catalina.properties during self-update of SUM for SAP HANA to Single SP 03 for SPS05 or higher, you can get the following error when the tool starts:<host>:/usr/sap/<SID>/SUM> ./sum.sh -sh: ./sum.sh: No such file or directory.



rights reserved. 25





You have to execute command cd /usr/sap/<SID>/SUM .

How to deal with CertificateException: No name matching localhost foundWhen using a self-signed certificate the following exception occurs in the SAP HANA Update UI when you try to access the Software Update Manager for SAP HANA over HTTPS: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching localhost foundWhen generating the server certificate, specify the fully qualified name of the host where the Software Update Manager for SAP HANA is running. Also, make sure that you have specified exactly the same host name in the SAP HANA Update UI as the host name you entered when creating the system.

Problems with connection from SAP HANA studio to SUM for SAP HANAIf you receive a message saying that you are unable to connect to SUM for SAP HANA, make sure you add the HANA system using its fully qualified name.

Changes to keystore do not take effectYou have updated the keystore file but the changes do not affect the Software Update Manager for SAP HANA or the SAP HANA Update UI.Restart the Software Update Manager for SAP HANA and the SAP HANA studio and try again.

How to refresh the Lifecycle Management perspectiveTo refresh the Lifecycle Management perspective, close it and start it again. We recommend that you restart the perspective in situations where the update UI does not react as expected.Or in case you see a blank screen in the place of the update UI, from its context menu choose Refresh. The system reloads the update UI.In situations where you get a system message like “Cannot start new operation. Operation 'XXX' is already running.”, you will only be able to restart and reconnect to the Software Update Manager for SAP HANA once the specified operation has ended.

Problems starting our SAP HANA StudioIf your SAP HANA studio does not start check the version of installed XULRunner.If you have a version lower than 1.9.2, you have to set the correct version:Open hdbstudio.ini file and add the following row:-Dorg.eclipse.swt.browser.XULRunnerPath=<xulrunner path>/<xulrunner version>

26



www.sap.com/contactsap

© 2013 SAP AG or an SAP affiliate company. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary.These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.Please see http://www.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.

http://www.sap.com/contactsap

http://www.sap.com/corporate-en/legal/copyright/index.epx

http://www.sap.com/corporate-en/legal/copyright/index.epx

Hana Sps5 Sum En

Documents

Transcript of Hana Sps5 Sum En