Refresh Scenarios With SAP Landscape Management (L...

naeem_maqsud · ‎06-13-2022

This is part 3 of the blog series covering various options available in SAP Landscape Management (LaMa) to perform System/Database Refresh when using HANA as the database.

Part 1: Refresh Scenarios With SAP Landscape Management (LaMa): Across Azure Regions and Subscriptions

Part 2: Refresh Scenarios With SAP Landscape Management (LaMa): Across IaaS with LaMa SP21 (HANA Single Tenant Database Replication)

In this blog the use of Backint to perform HANA refresh will be covered. We will use the services available in AWS (AWS Backint Agent) and GCP (Cloud Storage Backint Agent).

Azure Backup with Backint is not supported by LaMa. See explanation below.

As explained in part 1, LaMa supports refresh of HANA using multiple approaches that fall in 3 categories:

Leveraging storage integration (e.g. with the cloud adapters for AWS, Azure and GCP)

Using HANA replication

Restore based refresh

In the 3rd category of 'Restore based refresh', we already covered using filesystem based backups which rely on the built-in backup/restore capabilities in HANA. Another approach is to use 3rd party backup solutions and this relies on Backint. According to the HANA administration guide:

"A third-party backup tool communicates with an SAP HANA database through the Backint for SAP HANA interface. Backint for SAP HANA uses named pipes to back up the database, and performs all the actions needed to manage external storage."

In order to use Backint, the 3rd party tool must be certified by SAP but this alone is not sufficient for it to be used in LaMa for refresh purposes. Due to the nature of performing a refresh, access to the source database backup is needed from the target system. In Azure such access is currently not possible and therefore Azure Backup can not be used by LaMa via backint and standard processes.

Azure Backint supports cross system restore but only from the Azure console or using Azure API calls. It also supports restore as files to a shared filesystem (by the source database) which the target can then use to perform a database restore. Both of these options require building a custom process in LaMa but is outside the scope of this blog where we cover only built-in functionality. I may write a blog on this custom approach outside of the current blog series.

In addition to the cloud providers' own backup solution, other 3rd party backup solutions can also be used in AWS, GCP or Azure and of course on-premise. Support for LaMa depends on the implementation of backint. In general if the target system can access the backup of source via backint then LaMa will also support it out of the box.

1.0 AWS Backint Agent for SAP HANA

This section will cover the use of the AWS Backint Agent that allows backup of SAP HANA to AWS S3 and is certified by SAP (and validated with LaMa as will be shown below).

1.1 AWS Lab Environment

As shown in the diagram above, I have 2 SAP systems residing in the US East region of AWS and belonging to the same AWS account. A single S3 bucket will be used for backup/restore of both systems but not a requirement. Separate buckets can also be used for each system provided the target has access to the bucket holding backups of the source.

Below table shows some additional info but use of virtual hostnames are not mandatory at least for restore based refresh.

TYPE	SID/HANASID	VM Hostname	Virtual Hostname
ASCS (source)	A4H	a4h-vm1	a4h-ascs
HANA DB (source)	HDB	hdb-vm1	hdb-db
PAS (source)	A4H	a4h-vm2	a4h-app-0
LaMa	J2E	nm-lama	n/a
ASCS (target)	B4H	a4h-vm1-c	a4h-ascs-c
HANA (target)	BDB	hdb-vm1-c	hdb-db-clone
PAS (target)	B4H	a4h-vm2-c	a4h-app-clone

HANA version 2.00.052

Netweaver ABAP Release 7.52

SUSE Linux Enterprise 12 SP3

LaMa 3.0 Enterprise edition SP23

SAP Host Agent Patch 56

SAP Adaptive Extensions 1.0 EXT Patch 69

PCA installed/activated

Ensure ahead of time that release versions match for source and target

- The support package level can differ within the same SAP_BASIS release
- Applicable if following prerequisites are met:
  - Source and target need to be on the same SAP_BASIS release, e.g on 754
  - PCA Task content needs to be on the same build level

1.2 AWS Backint Configuration

Follow the steps in the AWS Document or the summarized ones below:

1.2.1 AWS Authentication Setup

On the HANA server create your AWS credentials (assumes that AWS CLI is already installed)

Login as <sid>adm on the HANA server

aws configure

AWS Access Key ID []: <your access key id>

AWS Secret Access Key []: <your secret key>

Default region name []: us-east-1

Default output format []: json

Above is needed so that CLI can be used for both our commands below as well as by the backint agent later

1.2.2 AWS S3 Setup

If you already have an S3 bucket then skip to preparation.

Create an S3 bucket for the HANA backups and configure for secure access

This example shows the AWS CLI but you can also use the console

Step 1: Initial create. Note that the bucket name needs to be unique. If you get an error about the name then try a different name

aws s3api create-bucket --bucket MyBucket --region us-east-1

Step 2: Block public access

aws s3api put-public-access-block \

--bucket MyBucket \

--public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

Step 3: Enable default encryption. Replace <account id> with actual value

aws s3api put-bucket-encryption --bucket MyBucket --server-side-encryption-configuration '{

    "Rules": [

            {

                "ApplyServerSideEncryptionByDefault": {

                    "SSEAlgorithm": "aws:kms",

                    "KMSMasterKeyID": "arn:aws:kms:us-east-1:<account id>:alias/aws/s3"

                }

            }

        ]

    }'

Step 4: Add policy to use only https

Create a file e.g. policy.json with below content:

{

    "Version": "2012-10-17",

    "Statement": [

        {

            "Effect": "Deny",

            "Principal": "*",

            "Action": "s3:*",

            "Resource": "arn:aws:s3:::MyBucket/*",

            "Condition": {

                "Bool": {

                    "aws:SecureTransport": "false"

                }

            }

        }

    ]

}



Now run the command below:



aws s3api put-bucket-policy --bucket MyBucket --policy file://policy.json

1.2.3 Preparation of backint installer script

The initial backint configuration is done via a script provided by AWS. We need a few parameters before we run the script.

Step 1: Obtain S3 master key id

aws s3api get-bucket-encryption --bucket MyBucket



--> Note down the master key id

Step 2: Obtain S3 KMS ARN and the AWS Account ID

aws kms describe-key --key-id <above key id>



--> Note down the "Arn" and "AWSAccountId" (we will need it later)

--> Example: "Arn": "aws:kms:us-east-1:xxxxxxxxxx:key/yyyyyy"

             "AWSAccountId": "xxxxxxxxxxxx"

1.2.4 Execute the AWS Backint Agent configuration script

Use the interactive installer approach as described here or follow the steps below. Perform on the source HANA server.

Step 1: Download and run the script

cd /tmp

sudo aws s3 cp s3://awssap-backint-agent/binary/latest/install-aws-backint-agent /tmp/

sudo python install-aws-backint-agent

Step 2: Enter the information requested as below:

Location of Install	/hana/shared
Account ID	Enter AWS account ID as noted earlier above
Region	Same region where your bucket is located
Bucket Name	The name given when creating S3
Folder in S3	Enter SID name or other identifier for source. This will put the backup in the folder with this name
Encryption	Enter the ARN noted earlier above
SAP HANA system ID	Enter the HANA SID (e.g. HDB)
HANA opt directory	Default
Modify global.ini	Enter modify to let script edit it
HANA SYSTEM db global.ini file	Check if location is correct
Verify signature of the agent binary tar file	y or n
Save responses for future use	y

Step 3: Verify that directory '/hana/shared/aws-backint-agent' is created

Step 4: Configure parameter files

On the source HANA server go into the directory /hana/shared/aws-backint-agent. Here you will find the aws-backint-agent-config.yaml file that was created by the installation script.

We need to create symbolic links to the above file in the directory /usr/sap/<hana sid>/SYS/global/hdb/opt/hdbconfig

cd /usr/sap/HDB/SYS/global/hdb/opt/hdbconfig

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config.yaml

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config_HDB.yaml

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config_HDB_HDB.yaml

Note that we created versions that include "_HDB" and "_HDB_HDB". We do this because LaMa will use the variables $(SAPSYSTEMNAME) and $(DBNAME). In my case both values equate to HDB but your scenarios maybe different so use your corresponding values.

Step 5: Modify global.ini with HANA Studio

catalog_backup_parameter_file: use aws-backint-agent-config_$(SAPSYSTEMNAME).yaml for system database

data_backup_parameter_file: use aws-backint-agent-config_$(SAPSYSTEMNAME)_$(DBNAME).yaml for tenant database

log_backup_parameter_file: use aws-backint-agent-config_$(SAPSYSTEMNAME)_$(DBNAME).yaml for tenant database

Verify that catalog_backup_using_backint is set to true for both databases

Verify that log_backup_using_backint is set to true for both databases

1.2.6 Verify backup via HANA Studio

We will check that backup is successful via HANA Studio and uses the destination type as Backint

1.2.7 Backint installation step on the target system

All the steps are identical to that performed on the source HANA server except the following.

Step 1: Download and run - same as steps for source

Step 2: Same as source except the folder name for the target server will be different:

Folder in S3

Enter SID name or other identifier for target

Step 3: Verify as in source

Step 4: Configure parameters -- slight variation

Create the symbolic links using corresponding values of SAPSYSTEMNAME and DBNAME of the target

cd /usr/sap/HDB/SYS/global/hdb/opt/hdbconfig

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config.yaml

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config_BDB.yaml

ln -s /hana/shared/aws-backint-agent/aws-backint-agent-config.yaml aws-backint-agent-config_BDB_BDB.yaml

Copy the parameter files of the source to the target.

copy source:/usr/sap/HDB/SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config_HDB.yaml to target:/usr/sap/BDB/SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config_HDB.yaml



copy source:/usr/sap/HDB/SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config_HDB_HDB.yaml to target:/usr/sap/BDB/SYS/global/hdb/opt/hdbconfig/aws-backint-agent-config_HDB_HDB.yaml

You should now see the following in the directory where HDB refers to source and BDB refers to target:

cd /usr/sap/BDB/SYS/global/hdb/opt/hdbconfig



ls -1



aws-backint-agent-config.yaml

aws-backint-agent-config_BDB.yaml

aws-backint-agent-config_BDB_BDB.yaml

aws-backint-agent-config_HDB.yaml

aws-backint-agent-config_HDB_HDB.yaml

Step 5: Modify global.ini -- Same steps as source but this time for the target database

1.3 LaMa Setup

Ensure that your two systems are configured in LaMa. Refer to part 1 of the blog series. Especially make sure that the "System Provisioning & RFC" of B4H specifies A4H as source.

Do not configure HANA backup share as it is needed only for file based restore and will interfere with backint option. If already configured then remove this. Source system configuration for HANA backups showing empty table:

View of the source and target in LaMa:

Retrieve profile in LaMa for both source and target database instances by clicking on "Retrieve from Instance Agent" and then save. This is a crucial step as LaMa will use these values to use backint for the refresh.

1.4 Perform Refresh in LaMa

Provisioning View -> B4H -> Provisioning -> Refresh Processes -> Restore-based Refresh

Since there is no HANA share configured, LaMa now defaults to Backint.

Basic screen: Enter master password

Hosts screen: Verify and accept defaults

Host Names screen: Verify host names and IP addresses

User screen: Accept default as we have pre-existing account

Database Restore screen: Select the backup you want to use
- LaMa used the parameter file to retrieve the backup list from the catalog of the source database

You will get a warning which you can ignore (but take note of it)

On the Rename screen, either accept defaults or if passwords differ from the Master then change them accordingly.

In the isolation screen, select the default network access control list. During the initial configuration in LaMa these default rules are defined.

Select “Unfence target system without confirmation”. You may also select the other two options based on your scenario. For unfencing without prompt users take full responsibility for unfencing the target.

For PCA, you can add any task list variant that you may have created as well as any other task list you would like to execute, for example the BDLS task list with its improvements. In this example we kept the default.

The activity should now run and progress bar will eventually reach 100%

2.0 GCP - Cloud Storage Backint Agent for SAP HANA

In this section we will cover the use of Google's Cloud Storage Backint Agent that allows backup of SAP HANA to Google Cloud Storage bucket and is certified by SAP (and validated with LaMa). The procedure is very similar to that covered in the AWS section so most of the steps will be abbreviated.

2.1 GCP Lab Environment

As in the case of my AWS lab environment, here also I have 2 SAP systems. Region for GCP is US West and belonging to the same GCP account. A single Cloud Storage bucket will be used for backup/restore of both systems but you can use different ones for source and target.

My environment was installed identical to that in AWS so SIDs are similar. A different instance of LaMa was used.

TYPE	SID/HANASID	VM Hostname	Virtual Hostname
ASCS (source)	A4H	a4h-vm1	a4h-ascs
HANA DB (source)	HDB	hdb-vm1	hdb-db
PAS (source)	A4H	a4h-vm2	a4h-app-0
LaMa	J2E	nm-lama	n/a
ASCS (target)	B4H	a4h-vm1-c	a4h-ascs-c
HANA (target)	BDB	hdb-vm1-c	hdb-db-clone
PAS (target)	B4H	a4h-vm2-c	a4h-app-clone

HANA version 2.00.052

Netweaver ABAP Release 7.52

SUSE Linux Enterprise 12 SP3

LaMa 3.0 Enterprise edition SP23

SAP Host Agent Patch 56

SAP Adaptive Extensions 1.0 EXT Patch 69

2.2 GCP Backint Configuration

Follow the steps in the GCP Document or the summarized steps below.

2.2.1 GCP Authorization Setup

When using a Compute Engine instance, you're not required to authorize the gcloud or gsutil CLI.

In our setup the source HANA and the target HANA are all compute engines and thus already able to use the CLI

If the following command (executed as <sid>adm) returns your GCP project id correctly then you are all set and can move to the next section.

gcloud config list core/project

If for some reason the authentication is missing or has been removed, then follow these steps to re-authorize.

gcloud init --console-only

Open a browser on your laptop and paste the URL from above command output to complete the authorization process.

Repeat on other HANA server.

2.2.2 Cloud Storage Bucket Setup

If you already have a bucket then skip to next section.

The below command creates a bucket with name "xx-bucket", storage class of "nearline", region us-west1, access control "uniform" (-b flag), public access blocked (--pap flag)

gsutil mb -p <project id> -c nearline -l us-west1 -b on --pap "enforced" gs://xx-bucket

2.2.3 Execute the GCP Backint configuration script

Download and execute the install script

Login as <sid>adm then issue below commands:

curl -O https://storage.googleapis.com/cloudsapdeploy/backint-gcs/install.sh



chmod +x install.sh



./install.sh

Configure parameter files

Edit the file /usr/sap/<SID>/SYS/global/hdb/opt/backint/backint-gcs/parameters.txt and add the bucket name.

NOTE: Do not remove the "#" in front of BUCKET

#BUCKET xx-bucket

#DISABLE_COMPRESSION

Create versions of the parameter files using the SAPSYSTEMNAME and SAPSYSTEMNAME_DBNAME values.

cd /usr/sap/HDB/SYS/global/hdb/opt/backint

cp -p parameters.txt parameters_HDB.txt

cp -p parameters.txt parameters_HDB_HDB.txt

2.2.4 Configure global.ini via HANA Studio

The steps here are identical to the AWS section. Only difference is the name of the parameter files.

2.2.5 Verify backup via HANA Studio

Perform a backup using backint as shown in section 1.2.6

2.2.6 Backint installation step on the target system

All the steps are identical to that performed on the source HANA server except the following.

Create versions of the parameter files (target system SAPSYSTEMNAME and SAPSYSTEMNAME_DBNAME)

cd /usr/sap/HDB/SYS/global/hdb/opt/backint

cp -p parameters.txt parameters_BDB.txt

cp -p parameters.txt parameters_BDB_BDB.txt

Copy the parameter files of the source to the target.

copy source:/usr/sap/HDB/SYS/global/hdb/opt/hdbconfig/parameters.txt to target:/usr/sap/BDB/SYS/global/hdb/opt/hdbconfig/parameters_HDB.txt



copy source:/usr/sap/HDB/SYS/global/hdb/opt/hdbconfig/parameters_HDB_HDB.txt to target:/usr/sap/BDB/SYS/global/hdb/opt/hdbconfig/parameters_HDB_HDB.txt

You should now see the following in the directory where HDB refers to source and BDB refers to target:

cd /usr/sap/BDB/SYS/global/hdb/opt/hdbconfig



ls -1



parameters.txt

parameters_BDB.txt

parameters_BDB_BDB.txt

parameters_HDB.txt

parameters_HDB_HDB.txt

Modify global.ini of target database with HANA Studio as done on the source database

2.3 LaMa Setup

Follow the same steps as in the AWS section

2.4 Perform Refresh in LaMa

Follow the same steps as in the AWS section

References

List of SAP certified 3rd party Backint Providers

LaMa Documentation on Refresh with Backint

SAP Note 2877917 - SAP Landscape Management - Prerequisites for third-party tool parameter files' na...

SAP Note 2905510 - SAP HANA system configuration for Copying a Database Using Third-Party Backup Too...

SAP Note 3010872 - SAP Landscape Management - An Empty List of Backups at Restore Refresh via Backin...

AWS Backint Agent Guide

Cloud Storage Backint Agent for SAP HANA