HANA Automated Update Guide

SAP HANA Automated Update Guide■ SAP HANA Appliance Software SPS 03

2011-11-04

© 2011 SAP AG. All rights reserved.SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAPBusinessObjects Explorer, StreamWork, and other SAP products and services mentioned herein as

Copyright

well as their respective logos are trademarks or registered trademarks of SAP AG in Germany andother countries.Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports,Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and servicesmentioned herein as well as their respective logos are trademarks or registered trademarks of BusinessObjects Software Ltd. Business Objects is an SAP company.Sybase and Adaptive Server, iAnywhere,Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well astheir respective logos are trademarks or registered trademarks of Sybase, Inc. Sybase is an SAPcompany. All other product and service names mentioned are the trademarks of their respectivecompanies. Data contained in this document serves informational purposes only. National productspecifications may vary.These materials are subject to change without notice. These materials areprovided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only,without representation or warranty of any kind, and SAP Group shall not be liable for errors oromissions with respect to the materials. The only warranties for SAP Group products and servicesare those that are set forth in the express warranty statements accompanying such products andservices, if any. Nothing herein should be construed as constituting an additional warranty.

2011-11-04

Contents

Introduction.............................................................................................................................5Chapter 1

Setting Up SAP HANA Components for Automated Update...................................................7Chapter 2

Installing and Updating SAP HANA Components for Automated Update..................................72.1Configuring HTTPS for SAP HANA Automated Update............................................................82.2Configuring HTTPS for the Software Update Manager for SAP HANA.....................................82.2.1Configuring of HTTPS for the SAP Host Agent.......................................................................112.2.2Troubleshooting.....................................................................................................................122.2.3Setting Up the SAP HANA Studio..........................................................................................132.3

Automated Update................................................................................................................19Chapter 3

Automated Update UI............................................................................................................193.1Performing an Automated Update..........................................................................................203.2

Appendix...............................................................................................................................23Chapter 4

More Information....................................................................................................................234.1Important SAP Notes.............................................................................................................234.2Security.................................................................................................................................244.3

2011-11-043

2011-11-044

Contents

Introduction

This document explains how to perform an automated update of your SAPHANA system. The automatedupdate is performed with the Software Update Manager (SUM) for SAP HANA, which is part of theSoftware Logistics Toolset (SL Toolset). The Software Update Manager for SAP HANA downloads newSupport Package Stacks (SPS) for SAP HANA from the SAP Service Marketplace (SMP) and updatesthe components in your SAP HANA system.

SAP HANA System PrerequisitesIn the SAP HANA system, the following prerequisites have to be fulfilled:• You need to have SAP Host Agent 7.20 SPS77 installed in the SAP HANA system. The SAP Host

Agent must be configured to use SSL.• You need to download and install SAPCAR (kernel release 720, update level 0, source ID 0.087,

including signature enablement) in the SAP HANA system in directory /usr/sap/tools/bin.Make sure only this SAPCAR location is in the path of <SID>adm user. For more information, seeSAP Note212876

Note:If your SAP HANA system is installed from the official installation DVD, this prerequisite is notrequired.

• You need to install and maintain the SAP HANA Landscape description(/usr/sap/<SID>/lm_structure). This installation is part of the SAPHANA database installation.

Note:If your SAP HANA system is installed from the official installation DVD, this prerequisite is notrequired.

Note that If SAP HANA appliance is not installed with SAP HANA Unified Installer the proper lmstructure file is generated.

Before starting the update make sure you check the version of lm_structure in/usr/sap/<SID>/lm_structure/manifest.

If it is older than patch 17, download patch 17 of component LM STRUCTURE INST HANA 1.0 fromService Marketplace and apply it on the system.

To edit the lm structure file, you can use the above mentioned tool. The correct tool location is:service sap.com/swdc -> Support Packages and Patches -> Download Catalog-> SAP Technology Components -> SAP HANA Installation & Update.

Log on to your host as a root user and copy and unpack the downloaded tool. From the extractedsub-directory execute as root user the following command: hdbinst -a lm -T <type> .

Keep in mind that <type> depends of the components installed on the SAP HANA appliance.

2011-11-045

Introduction

https://service.sap.com/sap/support/notes/212876

So after you enter the <SID> of the appliance, execute one of the commands below, depending onthe installed components:

• hdbinst -a lm -T HANA_Platform (If you use SAP HANA Platform).

• hdbinst -a lm -T HANA_Enterprise (If you use SAP HANA Enterprise Extended)

• hdbinst -a lm -T HANA_EnterpriseEdit (If you use SAP HANA Enterprise)

The result is generated lm structure file under folder /usr/sap/<SID>/lm_structure.

• You need SAP HANA studio SPS03.• The automated update for SAP HANA is provided for the following components, as of the versions

specified below:• SAP In-Memory Database 1.0 SP02• SAP In-Memory Computing repository• SAP In-Memory Computing client 1.0 SP02• SAP HANA Load Controller 1.00 SP00• SAP Host Agent 7.20 SP77

Note:Make sure you have the above mentioned SAP Host Agent, if not update it manually from SAPService Marketplace.

• The specified versions of the following components are required. They are not handled by the SAPHANA Automated Update:• Sybase Replication Server 15• Sybase Replication Agent 15

• The SAP HANA system needs access to the SAP Service Marketplace using HTTPS, unless youhave already downloaded and copied the target stack to your SAP HANA system.

Caution:S-User is required

Automated Update Prerequisites

For the automated update, the following prerequisites have to be fulfilled:• You have stopped the data replication before you start the automated update.• You have performed a system backup before you start the automated update.• During the automated update there is a business downtime for your SAP HANA system.

2011-11-046

Introduction

Setting Up SAP HANA Components for Automated Update

2.1 Installing and Updating SAP HANA Components for Automated Update

Note:Check if you already have Software Update Manager installed. To do this, check whether you have/usr/sap/<SID>/SUM directory and whether it is empty. If you do not have such directory make sureyou execute sections Installing the Software Update Manager for SAP HANA and 2.2Configuring HTTPS for SAP HANA Automated Update.

Installing the Software Update Manager for SAP HANA1. Download the Software Update Manager for SAP HANA archive from SAP Service Marketplace at

http://service.sap.com/swdc.2. Unzip the archive to the directory /usr/sap/<SID>/SUM.

Note:Make sure you have the required SAPCAR version (see the SAP HANA System Prerequisites in theIntroduction). If your SAPCAR version is too old, the SIGNATURE.MF file has a size of 0 bytes.

Updating the Software Update Manager for SAP HANAWhen you start the Lifecycle Management perspective in the SAP HANA studio, the Software UpdateManager for SAP HANA performs a self-update.

The Software Update Manager for SAP HANA SPS 03 executes automatic update of LifecycleManagement perspective as part of self-update, only if SAP HANA Studio is SPS 03. You can updateyour SAP HANA Studio manually from SAP Service Marketplace.

Updating the SAP HANA StudioThe Lifecycle Management perspective of the SAP HANA studio is updated when you update the SAPHANA studio. To update the SAP HANA studio, choose Help > Check for Updates .

You can enter the settings for the automated update of the SAP HANA studio underWindow >Preferences > Install/Update .

Make sure your SAP HANA studio contains the Lifecycle Management perspective (see the SAP HANASystem Prerequisites in the Introduction).

2011-11-047


http://service.sap.com/swdc

Note:

If you have SAP HANA studio SPS 02 or older, and then you update it using the functionality describedabove to SPS03, the Lifecycle Management perspective disappears. This is due to a studio modelchanges between SPS 02 and SPS 03 for the Lifecycle Management perspective.

After an update to SAP HANA Studio SPS 03, you have to call Install New Software and selectthe LCM feature to install it again.

2.2 Configuring HTTPS for SAP HANA Automated Update

During the SAP HANA update, several components running on different hosts have to communicatewith each other. Since sensitive data like passwords is exchanged, encrypted communication overHTTPS should be used.

The following prerequisites have to be fulfilled:• The Software Update Manager for SAP HANA is installed in the SAP HANA system in the directory

/usr/sap/<SID>/SUM, which is referred to below as <SUM_DIR>.• The SAP HANA studio is installed on one or more computers.• You need the location of the Java runtime used in the involved systems. This location is referred to

below as <JRE_DIR>. To find this location for the SAP HANA studio, choose Help > About SAPHANA Studio > Installation Details > Configuration and check the value of the java.homeproperty.

2.2.1 Configuring HTTPS for the Software Update Manager for SAP HANA

You can create a server certificate for the Software Update Manager for SAP HANA in one of thefollowing ways:• Using a self-signed server certificate

You need to import the server certificate on all systems where the SAP HANA Update UI is used.

• Using a server certificate signed by a trusted certification authority

This costs additional time and money but you will not need to import it in all systems where the SAPHANA Update UI is used.

Using a self-signed server certificate1. Generate a new server key pair for the Software Update Manager for SAP HANA.

In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the followingcommand as <SID>adm user:

2011-11-048


keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA-dname "CN=<FULL_HOST_NAME>" -validity <days>

Note:<FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from otherhosts.

<days> is the number of days for which the certificate should be considered valid. The certificatewill expire after this period and will be no longer usable. You then need to generate a new certificateby repeating this procedure.

You will be asked to set key store and key passwords. We recommend that you keep them thesame. Make sure you remember the password you have entered here.

Create the text file catalina.properties in directory <SUM_DIR>/config with the followingcontent:

keystore.password=******

Note:****** is the key store password.

Make sure that this file is readable only by <SID>adm user.

Caution:Restart the Software Update Manager for SAP HANA.

2. Export a self-signed server certificate.

Execute the following command from the same location:

keytool -exportcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -filesumforhana.cer

Note:You will be asked for the key-store password.

Using a server certificate signed by a trusted certification authority1. Generate a new server key pair for the Software Update Manager for SAP HANA.

In the SAP HANA system, go to the directory <SUM_DIR>/config and execute the followingcommand as <SID>adm user:

keytool -genkeypair -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -keyalg RSA-dname "CN=<FULL_HOST_NAME>" -validity <days>

Note:<FULL_HOST_NAME> is the fully qualified name of this host since it will be accessed from otherhosts.

<days> is the number of days for which the certificate should be considered valid. The certificatewill expire after this period and will be no longer usable. You then need to generate a new certificateby repeating this procedure.

2011-11-049


You will be asked to set key store and key passwords. We recommend that you keep them thesame. Make sure you remember the password you have entered here.

2. Generate a request to sign the server certificate

Execute the following command on the SAP HANA system from the directory <SUM_DIR>/config:

keytool -certreq -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -file sumforhana.csr

You will be asked for the key-store password.

The certificate signing request will be stored in sumforhana.csr in the current directory.

3. Send the request to sign the server certificate to a trusted certification authority.

Java comes with a number of certificates from well known trusted certification authorities. To seethem on a particular system, execute the following command:

keytool -list -v -keystore "<JRE_DIR>\lib\security\cacerts"

You will be asked for the key-store password. Note that this is different from the password for theserver key store. The default password for the cacerts key-store is changeit, but if it has beenchanged you have to find out what it is and provide it here.

Select a trusted certification authority for which a certificate is present in the SAP HANA system andall SAP HANA studio systems. The list of trusted certification authorities can be different for differentJava versions.

Send the signing request for the server certificate (sumforhana.csr) to the selected certificationauthority.

Note:TC TrustCenter is one of the trusted certification authorities present in cacerts. You can place anorder on the SAP Service Marketplace your server certificate to be signed by TC TrustCenter. Formore information, see http://service.sap.com/tcs -> SSL Server Certificates.

4. Import the signed server certificate into the SAP HANA system.

The certification authority should return the signed server certificate. Store it in <SUM_DIR>/config/sumforhana.cer in the SAP HANA system.

Execute the following command from directory <SUM_DIR>/config:

keytool -importcert -keystore keystore.jks -alias sumforhana_$<hostname>_$<SID> -filesumforhana.cer -trustcacerts

You will be asked for the key-store password.

5. In the SAP HANA system, go to the directory <SUM_DIR>/config and create the text filecatalina.properties with the following content:

keystore.password=******

Note:****** is the key store password.

2011-11-0410


http://service.sap.com/tcs

Make sure that this file is readable only by <SID>adm user.

Caution:Restart the Software Update Manager for SAP HANA.

2.2.2 Configuring of HTTPS for the SAP Host Agent

Obtain and install the SAP Cryptographic Library1. Obtain the SAP Cryptographic Library.

a. Extract SAPCRYPTO.SAR to a temporary directory.b. Copy the file sapgenpse from the temporary directory to the /usr/sap/hostctrl/exe

directory.

For more information about the SAP Cryptographic Library, see SAP Note397175.

2. Prepare the SAP Host Agent.

By default the SAP-SSL library searches for the certificate to be used in thesub-directory/usr/sap/hostctrl/exe/sec.a. Create the directory manually. Make sure that sapadm is able to access it.b. Set the SECUDIR environment variable to refer to the sec directory.

To do this, perform the following commands:

mkdir sec

export SECUDIR=/usr/sap/hostctrl/exe/sec

(set for Windows, instead of export - for Linux)

export LD_LIBRARY_PATH=/usr/sap/hostctrl/exe/

Using a self-signed server certificate1. Generate a new server key pair for the SAP Host Agent.

a. Create the server PSE, the server certificate therein, and the certificate signing request (CSR).

In the SAP HANA system, go to the directory /usr/sap/hostctrl/exe and execute thefollowing command:

./sapgenpse gen_pse -p SAPSSLS.pse -x passwd1

This command creates a PSE file named SAPSSLS.pse (this name is fixed), which can be usedto authenticate the SAP HANA system for incoming SSL connections. Access to the PSE file isprotected with passwd1.

b. Grant the server PSE access to the SAP Host Agent.

Log on as sapadm and execute the following command:

2011-11-0411



./sapgenpse seclogin -p SAPSSLS.pse -x passwd1 -O sapadm

c. Restart the SAP Host Agent

To restart the SAP Host Agent, execute the following command:

./saphostexec -restart

Port 1129 should now also be used for SSL-based communication. You can use the commandnetstat to check this.

d. Verify the server certificate chain.

Execute the following command:

./sapgenpse get_my_name -p SAPSSLS.pse -x passwd1 -v

Detailed information about the created certificate is displayed.

2. Export a self-signed SAP Host Agent certificate

The SAP Host Agent sends its server certificate to the Software Update Manager for SAP HANAduring the SSL handshake. The update tool validates the host agent certificate and verifies that thename in the certificate matches the name of the host to which it is connected. For the update toolto validate the certificate, the public key of the server certificate has to be present in the keystore ofthe Software Update Manager for SAP HANA. To export the SAP Host Agent public key, executethe following:

./sapgenpse export_own_cert -v -p SAPSSLS.pse -o SAPSSLS.crt

3. Provide the SAP Host Agent certificate to the Software Update Manager for SAP HANA.a. Go to the Java Security key store directory:

cd <JAVA_HOME>/jre/lib/security

b. Execute the following command:

<JAVA_HOME/bin/keytool -importcert -keystore cacerts -alias saphostagent -trustcacerts -file/usr/sap/hostctrl/exe/SAPSSLS.crt

2.2.3 Troubleshooting

How to deal with CertificateException: No name matching localhost foundWhen using a self-signed certificate the following exception occurs in the SAP HANA Update UI whenyou try to access the Software Update Manager for SAP HANA over HTTPS:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matchinglocalhost found

2011-11-0412


When generating the server certificate, specify the fully qualified name of the host where the SoftwareUpdate Manager for SAP HANA is running. Also, make sure that you have specified exactly the samehost name in the SAP HANA Update UI as the host name you entered when creating the system.

Changes to keystore do not take effectYou have updated the keystore file but the changes do not affect the Software Update Manager forSAP HANA or the SAP HANA Update UI.

Restart the Software Update Manager for SAP HANA and the SAP HANA studio and try again.

SAP HANA Update UI cannot connect to the serverCheck your proxy settings in the SAP HANA studio by choosingWindow > Preferences > General >Network Connections.

If you are connecting using a proxy, you must have enabled HTTPS schema and provided the correctproxy settings.1. Choose Manual from the Active Provider list.2. Click on HTTPS and choose Edit.

If you are not using a proxy, disable the HTTPS schema by choosing Direct as the Active Provider.

For more information about how to configure the proxy settings, see the documentation that is integratedinto the SAP HANA studio. Choose Help > Help Contents >Workbench User Guide > Reference> Preferences > Network Connections .

2.3 Setting Up the SAP HANA Studio

If you use self-signed server certificate, make sure you provide it for the SAP HANA Update UI.

Do this for each SAP HANA studio installation where the SAP HANA Update UI will be used.

Copy the server certificate sumforhana.cer generated on the previous step to the machine wherethe SAP HANA studio is installed.

Run the following command from the directory where you have copied sumforhana.cer:

keytool -importcert -keystore "<JRE_DIR>\lib\security\cacerts" -alias sumforhana_$<hostname>_$<SID>-file sumforhana.cer

Note:<JRE_DIR> is the path to the Java runtime used by the SAP HANA studio. To find this location for theSAP HANA studio, choose Help > About SAP HANA Studio > Installation Details >Configuration and check the value of the java.home property.

If the SAP HANA studio is installed on a UNIX/LINUX system, use forward slashes / in the commandabove.

2011-11-0413


You will be asked for the key store password. Note that this is different from the password for the serverkey store. The default password for the cacerts key store is changeit, but if it has been changed youhave to find out what it is and provide it here.

Caution:Restart the SAP HANA studio.

Setting up the Lifecycle Management Perspective1. Call the SAP HANA studio.2. ChooseWindow > Preferences > Lifecycle Management > Service Marketplace .3. Choose Use file location or Use SMP configuration.

DecriptionOption

Enter the File Location (file path & file name,max. length 1024) for the XML file that containsthe necessary update information. The resultingpath must exist in, or must be accessible from,the systemwhere the Software UpdateManagerfor SAP HANA is running.

Use file location

• The Host Name is set to service.sap.com. It cannot be changed. Thisis the URL of the SAP Service Marketplace(SMP), where the files that are used for theupdate are located.

• Enter your SAP Service Marketplace S-Usercredentials in User Name/Password.

Note:You can obtain an S-User on the SAP Ser-vice Marketplace at "service.sap.com" ->Registration.

• If you use a proxy chooseUse proxy server,and enter Host Name (max. length 64) andPort (port must be a number, max. length10).

• The check box Use proxy authenticationis enabled only if you have selected Useproxy server.

• If you have selectedUse proxy authentica-tion, enter the User Name (max. length 64)and Password (max. length 64).

Use SMP configuration

Note:If you have not previously entered this information, you need to enter it when you call the SAP HANAUpdate UI for the first time. This information is stored in the Secure Storage and the Preferences:

2011-11-0414


• You can change the information by choosingWindows >Preferences > LifecycleManagement.

• You can delete the information by choosingWindows > Preferences > General > Security> Secure Storage .

4. Choose Apply.5. Choose OK.

Note:

• To reset your entries, choose Restore Defaults.• If you cannot provide Internet access to the SAP Service Marketplace, you need to use the

manually-downloaded content scenario. Before you start the update procedure, make sure youdownload the following files to any directory accessible by the <SID>adm user in the SAP HANAsystem:• Stack.xml file – xml file containing model of SAP HANA in the form of product instances,

components and their versions.• IMCE_SERVER*.SAR, IMCE_CLIENT*.SAR, IMC_STUDIO*.SAR, HANALDCTR*.SAR,

SAPHOSTAGENT*.SAR – archives containing new content needed for the update of the SAPHANA instances.

• SUMHANA*.SAR - Newest SUMFORHANA archive needed for the tool self-update. It must belocated in the same directory in which the stack.xml is located. “*” stands for any combinationof numbers which depends on the version of the archives you are downloading.

Note:SUMFORHANA is not part of the HANA stack, so you have to download it separately.

You can download the files listed above from the SAP Service Marketplace at:

http://service.sap.com/swdc -> Support Packages and Patches-> Browse our Download Catalog ->SAP NetWeaver and complementary products -> SAP HANA Enterprise

To use the manually downloaded content scenario, chooseWindow > Preferences > LifecycleManagement > Service Marketplace and select Use File location as described above. Enter thepath to the stack.xml file.

Note that you need to provide the full path to the file, not the containing directory. All archives includingSUMFORHANA must be located in the same directory as the stack.xml file.

Setting Up User CredentialsThe following users and settings are needed for the SAP HANA Automated Update:• User <SID>adm

• User and password have to be entered when entering the SAP HANA Update UI for the first time.• User and password can be stored in the Secure Storage.• User and password can be changed in the context menu for the added system under Properties

> Authentification > SAP System Logon .• User and password can be deleted underWindows > Preferences > General > Security >

Secure Storage .

• User sapadm

2011-11-0415


http://service.sap.com/swdc

• User and password have to be entered when entering the SAP HANA Update UI for the first time.• User and password can be stored in the Secure Storage.• User and password can be deleted underWindows > Preferences > General > Security >

Secure Storage .

Note:If you have not previously defined them, you need to enter the user credentials for <SID>adm andsapadm when you call the SAP HANA Update UI for a specific SAP HANA system for the first time.

Changing the HTTPS Port in the Automated Update UIIf you have configured the Software Update Manager for SAP HANA to use an HTTPS port other thanthe default port (8443), specify the used port number in the file hdbstudio.ini. This file is locatedin the same folder as the executable that is used to start the SAP HANA studio (including the SAPHANA Update UI). For Linux, the default location is /usr/sap/hdbstudio.

Ensure that the following two lines are specified in the file:

-vmargs

-Dupdate.service.port=<port-number>

The -Dupdate.service.port=<port-number> line has to be located below the -vmargs line. Itis valid if there are lines with other -D options in between.

The following example changes the HTTPS port to 9090:

-vmargs

-Dupdate.service.port=9090

Note:After you have changed the configuration, restart the SAP HANA studio.

Checking the proxy setting for SAP HANA studioTo check the proxy settings for the SAP HANA studio, chooseWindow > Preferences > General> Network Connections. Change the proxy settings in accordance with your system landscape.

If you do not have a proxy between the SAP HANA studio and the Software Update Manager for SAPHANA, choose Active Provider Direct. The other values should be as follows:

Table 2-2: Proxy entries

UserAuthProviderPortHostSchema

falseManualHTTP

falseManualHTTPS

falseManualSOCKS

falseNative8080proxyHTTP

2011-11-0416


UserAuthProviderPortHostSchema

falseNative8080proxyHTTPS

Table 2-3: Proxy bypass

ProviderHost

ManualLocalhost

Manual127.0.0.1

Nativewdf.sap.corp

Nativesap.corp

Nativewdf.sap-ag.de

Nativesag-ag.de

Nativels0110.wdf.sqp.corp

2011-11-0417


2011-11-0418


Automated Update

3.1 Automated Update UI

The SAP HANA Automated Update is part of the Lifecycle Management perspective.

The Lifecycle Management perspective contains:

2011-11-0419

Automated Update

• System information & Messages

Provides information about the system to which you are connected and messages related to thatconnection

• Installed Software

Provides information about the currently-installed version of SAP HANA

• Available Software

Provides information about the available software updates for your currently installed softwareversions

• Update State

Provides information about the update process

• Buttons Download, Update, OK

The button provides the appropriate action, depending on the current state

• Properties, Error Log, Progress

Standard Eclipse tabs containing information about the actions performed in the LifecycleManagementperspective.

Progress bars are displayed for the self-update, download, and update. These bars have cancelbuttons that currently do not work.

3.2 Performing an Automated Update

The automated update of SAP HANA is integrated into and monitored in the SAP HANA studio, as partof the Lifecycle Management perspective.1. Start the Software Update Manager for SAP HANA in the SAP HANA system

Log on as <SID>adm, navigate to the directory /usr/sap/<SID>/SUM and execute the commandsum.sh.

2. Start the SAP HANA studio as root user if you use Linux, or as an administrator (run asadministrator) if you use Windows.

3. If you have not connected a system yet, add the system to which you want to connect (see theadministration guide for the SAP HANA studio).

Note:Use the fully qualified host name for all configuration actions (including Add System).

4. To open the Lifecycle Management perspective, chooseWindows >Open Perspective > LifecycleManagement .

5. In the context menu of the system node in the Navigator panel, choose Lifecycle Management.The UI for the automated update contains information about the installed software releases, andthe newest SP that is available for downloading and installing.

2011-11-0420

Automated Update

6. If you are prompted for them, enter the user name and password for sapadm.

You can save the user name and password in “Secure Storage”. If you do so, you will not be askedfor them again.

7. If you are prompted for them, enter the user name and password for the <SID>adm.You can save user name and password in the “Secure Storage”. If you do so, you will not be askedfor them again.

8. Select the proposed software releases.9. Choose Download.

This step is not executed if you have manually downloaded the software updates from the SMP,copied them to the download directory, and specified Use file location instead of Use SMPconfiguration.

Note:Once you have started the download process, it cannot be stopped.

10. Choose Update.

The system now performs the automated update.

The automated update for SAP HANA stops the SAP HANA database during the automated updateand starts it again once it is complete. The SAP HANA Load Controller is not started as a backgroundprogram and therefore does not need to be stopped and restarted.

Note:Once you have started the update process, it cannot be stopped.

Note:To refresh the Lifecycle Management perspective, close it and start it again. We recommend that yourestart the perspective in situations where the UI for the SAP HANA automated update does not reactas expected. In situations where you get a systemmessage like “Cannot start new operation. Operation'XXX' is already running.”, you will only be able to restart and reconnect to the Software Update Managerfor SAP HANA once the specified operation has ended.

2011-11-0421

Automated Update

2011-11-0422

Automated Update

Appendix

4.1 More Information

For more information about SAP HANA landscape, security, installation, and administration, see theresources listed in the table below.

Quick LinkGuide/ToolTopic

http://help.sap.com/hana• SAP HANA Master Guide• SAP HANA Installation

Guide

SAP HANA Knowledge Centeron SAP Service Marketplace

SAP HANA Landscape Deploy-ment & Installation

http://help.sap.com/hana• SAPHANATechnical Opera-

tions Manual• SAP HANA Security Guide

SAP HANA Knowledge Centeron SAP Help Portal

SAP HANA Administration &Security

4.2 Important SAP Notes

Caution: Check regularly to see which SAP Notes are available for the SAP HANA Automated Update.

TitleSAP Note Number

SAP Release Note for SUM for SAP HANA1545815

Check the current SAPNotes for SAPHANAAutomated Update by searching for the following CSS/CSNcomponents:

BC-HAN-UPD HANA update tool.

2011-11-0423

Appendix

http://help.sap.com/hana

https://websmp101.sap-ag.de/~sapidb/011000358700000604552011D



http://help.sap.com/hana


4.3 Security

User Credentials

To perform its task the Software Update Manager for SAP HANA needs credentials for the followingusers:• sapadm – used to authenticate to SAP Host Agent• <SID>adm – required by NewDB serve update• SAP Service Marketplace user – used to authenticate to SAP Service Marketplace

You can enter these credentials in SAP HANA Studio and you have the option to persist them in theSecure Storage. For more information, you can refer to the SAP HANA Studio help. To do this, navigatetoWorkbench User Guide > Reference > Secure Storage.

The Software Update Manager for SAP HANA does not persist these credentials. These credentialsare sent only via encrypted communication channels using HTTPS.

As described in section 2.2.1 Configuring HTTPS for the Software Update Managerfor SAP HANA a server certificate is stored in config/keystore.jks under the Software UpdateManager installation directory. This file is protected by a password which is stored in a text file config/catalina.properties . This is necessary so that the Software Update Manager can accessits certificate in the key store. Sincecatalina.properties is not encypted it should be protected byfile system access restrictions. Make sure this file is accessible only by <SID>adm user.

If you suspect that the key store password or server certificate are compromised, you have to generatea new server certificate by repeating the procedure described in section 2.2.1.

Communication Channels

The Software Update Manager for SAP HANA communicates with the following components:• SAP HANA Studio• SAP Host Agent• SAP Service Marketplace

All these channels use encryption via HTTPS. The Software Update Manager for SAP HANA opensserver ports 8080 and 8443 for communication with SAP HANA Studio.

2011-11-0424

Appendix

HANA Automated Update Guide

Documents

Transcript of HANA Automated Update Guide