The BASIS of SAP

Critical security flaw in SAP GUI

An ActiveX vulnerability detected in the SAP GUI may possibly be exploited by an attacker to gain access to critical files and sensitive data. According to an advisory issued by the United States Computer Emergency Readiness Team (US-CERT), the vulnerability can be exploited remotely by an unauthenticated hacker. The flaw is in the ActiveX control, MDrmSap, which could crash Internet Explorer when handling malicious code, US-CERT said. The advisory also states that the vulnerable ActiveX control can be disabled in Internet Explorer by setting the appropriate kill bit, or by disabling ActiveX in the Internet Zone,

The Danish vulnerability clearinghouse Secunia gave the flaw a highly critical rating. To exploit the flaw, an attacker must trick a user into viewing a malicious website or email message, Secunia said.

SAP issued an update correcting the flaw. If you don’t have an OSS ID, you can view a PDF copy of the note – However, the one on the SAP site is guaranteed to be up to date, whereas the one here may not be.

How to determine SAP Table Buffer Requirements

I had one of those ‘doh’ moments during a recent SAP performance performance tuning workshop. The instructor, Tim Bohlsen, pointed out a remarkably easy way to discover how large a table buffer that a running ABAP WAS system instance requires to reduce buffer swaps to zero.

This is important because the easiest way to reduce your database I/O in ANY application, SAP or not, is to reduce the need to go to disk. Keeping data in the Application buffer improves response time by reducing the time (both the CPU time and the I/O time) requiried by the DBMS to continually retrieve that data.

In the case of an ABAP engine, you use transaction ST02 to determine if there is any swapping going on in the first place. In the case shown below, both table buffers have some swapping – it is a relatively well tuned HR/PY system, so there isn’t much table buffer swapping despite the sytem being up for two months. Oh, and there isn’t much point in doing this on any other system except the one you wish to tune as it will be extremely difficult to replicate the load of the target system.

Select the images to open larger versions in another window or tab

In this case, we will look at the Generic Key Buffer, since it is the the worst of the two Table Buffers. Selecting the buffer in question, by double cliking on the line, results in a screen showing a little bit more detail. This has some usefull navigation features. As shown below, we are looking at the current status of the buffer, but we have the option to look at the history of the buffer. This can give us an idea of when the swaps occurred, which we can then track back to certain workloads. Moe importantly, we can look at the current status of the individual objects in the buffer.

Now we have the statistics for individual tables (or parts thereof ) that are currently loaded into this Buffer. This data is usefull in and of itself, which I will touch on in a later post, but first, select the Next View button.

The value highlighted below is the total value for Size maximum [bytes]. This is the sum of the highwater mark for each table that has been loaded into the buffer so far. In other words, the amount of storage required to accept all data requests that should be buffered, without swapping, since the instance was started.

Now, you could put this value straight in to the appropriate profile parameter and restart your system, but there are a couple of caveats.

1. If a table is marked to be buffered, but has not been read yet, it will not be included in the buffer or, therefore, the buffer size yet,
2. You need to examine the detail of both the snapshot and the history to determine if the correct tables are buffered or if they are correctly buffered (the Invalidations total suggests that there is some work to do in this area), and, most importantly,
3. This does not tell you if you have sufficient storage available to fulfill any increase in the buffer size without causing problems elsewhere

So, make sure your system has been through a pay run, or a month-end (or whatever the appropriate business cycle is) before you use this method to measure the requirement,
use sappfpar to validate the storage requirements of your new profile parameters, and
be aware that this is only the first step towards efficient use of all of the available resources.

This won’t fix all your performance problems. However, it is an important first step. Your database vendor may make the most efficient database engine there is, but calling any DBMS to get data will always be slower than getting that data from memory.

2 ways to Measure Exact Throughput of a TCP IP network

One of the sizing issues with an SAP system that doesn’t receive due consideration is the network capability; not just speed, but throughput. It’s always usefull to know what your Network is capable of, especially if you have lots of data to move (Support Packs / Support Stacks and so on). But how do we find out?

NetCPS (a single executable file) is rather simplistic, with no fancy features as the author (credits to Jarle Aase) says. It pumps 100MB of generated data (without accessing the HDD which could mess with the final result) and then displays the result in form of average speed stated in both KB/s and MB/s. You can also get source code if you’d like to do some further tinkering with it, or port it. Everything you need to know is on the webpage or available by using -help switch.

Another, more sophisticated, tool (without being too big) is Iperf (a single executable, with source available on the same page). Settings are changed by use of various switches.

For example, the image above shows the port used is changed to 1234, amount of sent data set to 200 MB, interval of reports set to 2 seconds for better accuracy and report format set to MBytes. The usual -help switch brings up further instructions for changing the many additional switches and settings available with this tool

Network tools for BASIS Administrators

Depending on how advanced the rest of your IT organisation is, you may need to be the jack of all trades. In fact, sometimes it feels as if anything that a Developer or End User doesn’t understand automatically becomes the property of the BASIS Administrator. Typicaly, these can include anything to do with the infrastructure between the users desktop and the SAP application.

An example I’ve been currently working on is a network issue where a user can access the Portal from one machine but not another. I used to use separate tools to do my network monitoring and debugging (yes, there are people responsible for this, but I have won a lot of good will by providing as much data as possible), but these days ….

Net Tools 2008 has been described as The Swiss army tool for network administrators everywhere. It is a very versatile tool, and
just like any tool it can be used for good or evil. What this means is that you may find the site blocked at work.

Available functions, usefull for both the desktop and Windows Servers, include

An FTP Client for quick file transfers,
Monitor system up status with Monitor Host IP,
Mass file renamer, to rename a whole bunch of log files,
Bandwidth Monitor.

Another tool that I’ve feard of is eToolz which is a collection of network and Internet tools that provides a graphical interface for several common commands. This includes ping, tracert, DNS lookups, http headers, default ports, etcetera. This seems more directedt to someone who who supports web sites, but after all thats what the Portal is …

SAP Event Processing

An SAP event is a “flag” that is created by using transaction SM62 View and Maintain Background Events. The commonest use of Events is to trigger jobs. Events can be triggered from the Operating System or from within SAP – either within ABAP programs and Function modules or from Transaction SM64.

Create an Event in transaction SM62. Select the Maintain radio button next to User Event Names and execute. This will present tyou with the Edit User Events screen. You can add change or delete user events from here.

To use this Event as a trigger, create a job via transaction SM36. You specify the Event that will trigger this job using the Start Condition button. On the Start Condition screen, select option AFTER EVENT. The After Event fields will open for input. Fill these in and Save.

You can see which jobs are waiting for events by looking at table BTCEVTJOB (via transaction SE16). This is the system’s way of keeping track of which jobs are in the queue waiting for an event to occur. The EVENTID column contains those Events that will submit a Job. You should see several System Events here.

Now, once the event is triggered this newly created job will execute. The event can be triggered via transaction SM64 or from the Operating System (see below).

To get the event triggered from the Operating System, log into the <sid>adm user id (at the Operating System level) level and go to directory /usr/sap/<sid>/SYS/exe/run. Note that in the Unix / Linux implementations, there is an alias ‘cdexe’ that will get you there as well. Run the SAPEVT executable as follows :

sapevt <event_name> -t pf=<instance_profile_directory_and_name> nr=<sys_number>

Example:

sapevt roberts_test -t pf=/usr/sap/DEV/SYS/profile/DEV_DVEBMGS00_server001 nr=00

This will raise the event, and cause the job scheduled within SAP to execute. Once the job has executed the SAP event that was in the table BTCEVTJOB will disappear.

Every time a Background Job is run, an entry is created in table TBTCO. This contains entries such as JOBNAME, EVENTID, EVENTPARM, JOBCLASS etc. This means that once you’ve found your job name in this table (using SE16) you can double click on its entry and see that it was executed via an event.

Operating System TP / TMS / CTS unconditional modes

The TMS / CTS functions are  a front end to the TP commands at the operating system level. If you use the operating system commands, you face the challenge of replicating the options available via the SAP GUI front end.  These options are controlled by using the Unconditional mode. An example of how to use these is shown below. 

host:prdadm 2> tp import L6BK162625 PA1  U client=100
This is tp version 340.16.38 (release 640)
This is R3trans version 6.13 (release 640 – 07.01.08 – 14:25:00).
2EETW000 T5QTM table class is ‘C’. Entries are only imported to client ’000′.
2EETW000 T5QTX table class is ‘C’. Entries are only imported to client ’000′.
R3trans finished (0008).
tp finished with return code: 8
meaning:
  A tool used by tp produced errors
host:prdadm 3> tp addtobuffer  L6BK162625 PA1
This is tp version 340.16.38 (release 640)
Addtobuffer successful for L6BK162625
tp finished with return code: 0
meaning:
  Everything OK
host:prdadm 4> tp import L6BK162625 PA1  U128 client=100
This is tp version 340.16.38 (release 640)
This is R3trans version 6.13 (release 640 – 07.01.08 – 14:25:00).
R3trans finished (0000).
tp finished with return code: 0
meaning:
  Everything OK
host:prdadm 5>

The U stands for unconditional force, similar to the options that you can select when importing via the SAP GUI.

0: Overtaker – change requests can be imported without deleting it from the buffer. Usually, this is followed sooner or later by an import using unconditional mode 1 to import another transport in the correct sequence.

1: Import the transport again.

2: Allow transport to overwrite SAP or System originals.

3: Allow transport to overwrite system-dependant objects.

5: Allow transport to contain source systems other than the integration system (usually used only when importing into Development or Consolidation system).

6: Allow transport to overwrite objects in unconfirmed repairs.

8: Allow transport to ignore limitations caused by the table classification (see the example above).

9: Allow transport to ignore that the system is locked for this kind of transport.

Remember that the location to run the tp addtobuffer and / or tp import from is operating system dependent:
(Windows): \\$(SAPTRANSHOST)\sapmnt\trans\bin
(UNIX): /usr/sap/trans/bin

Generate SAP Installation Key

For any SAP install except the Trial Editions available from SDN (and Solution Manager itself), you need to obtain a Installation/Upgrade Key (sometimes known as the ‘magic number’) from a Solution Manager system.  Usually, you should get this from the Solution Manager system that will be used for managing changes, software diagnostics etc for you installation.  However, note that you do not have to use any particular Solution Manager system, to get the the installation up and running.

Procedure

On the SAP Solution Manager System :

1. Call the System Landscape Maintenance (transaction SMSY) in your Solution Manager system.

2. Create your SAP System in the system landschape:

a. Select the landscape component Systems, and choose Create New System, in the context menu.

b. Enter the system ID as the system, in the following dialog box.

c. Choose the product (i.e. SAP ECC), and the product version (i.e. SAP ECC 5.0 or higher), from the possible entries help, and Save.

d. Complete the system data, as far as possible.

e. Save your entries.

3. Generate the key:

a. Choose System Landscape ® Other Object….

b. Set the System flag, and choose the system which is to be installed or upgraded, from the possible entries help. If you have created a system in the SAP Solution Manager, in the previous step, choose it.

c. Choose Generate Installation/Upgrade Key.

d. Enter the required data and choose Generate Key.

The system displays the key.

Installation/upgrade tool

Specify this key in the installation or upgrade tool when requested.  This is (usually) the last step of the ‘Check Parameters phase’, immediately prior to the start of the ‘Execute Service’ phase.

UPDATE:
Please do not request that I supply Installation keys.

They are available from sap.com/solutions/netweaver/minisap.asp (for the trial and developer editions) and service.sap.com/LICENSEKEY.