Red Hat Enterprise Linux System Roles for SAP
Abstract
Making open source more inclusive
Red Hat is committed to replacing problematic language in our code and documentation. We are beginning with these four terms: master, slave, blacklist, and whitelist. Due to the enormity of this endeavor, these changes will be gradually implemented over upcoming releases. For more details on making our language more inclusive, see our CTO Chris Wright’s message.
Providing feedback on Red Hat documentation
We appreciate your feedback on our documentation. Let us know how we can improve it.
Submitting comments on specific passages
- View the documentation in the Multi-page HTML format and ensure that you see the Feedback button in the upper right corner after the page fully loads.
- Use your cursor to highlight the part of the text that you want to comment on.
- Click the Add Feedback button that appears near the highlighted text.
- Add your feedback and click Submit.
Chapter 1. Overview
Red Hat Enterprise Linux (RHEL) 7 RHEA-2019:3190 introduced RHEL System Roles for SAP to assist with remotely or locally configuring a RHEL system for the installation of SAP HANA or SAP NetWeaver software. RHEL System Roles for SAP development is based on the Linux System Roles upstream project.
RHEL System Roles is a collection of roles executed by Ansible to assist administrators with server configuration right after the servers have been installed. These roles are provided in the RHEL Extras repository. In contrast, RHEL System Roles for SAP is provided in the RHEL for SAP Solutions subscription and can be used by Ansible Engine and Ansible Tower to manage RHEL systems.
The Red Hat Enterprise Linux subscription provides support for RHEL System Roles with Ansible Engine, which is available in the Ansible Engine repository (e.g. ansible-2-for-rhel-8-$(uname -m)-rpms). However, if you require full support for the Ansible Engine itself, a separate Red Hat Ansible Automation Subscription is necessary. Additional information is available at Top Support Policies for Red Hat Ansible Automation.
The following RHEL System Roles for SAP are fully supported on control nodes running RHEL 8.2 and later:
- sap-preconfigure
- sap-netweaver-preconfigure
- sap-hana-preconfigure
The RHEL System Roles for SAP, just like the RHEL System Roles, are installed and run from a central node referred to as the control node (which can be Ansible Tower, Red Hat Satellite, or a RHEL 8 or RHEL 7 host). The control node connects to the local host and/or to one or more remote hosts (called managed nodes in the context of Ansible), and performs installation and configuration steps on them. It is recommended that you use the latest major release of RHEL on the control node (RHEL 8) and use the latest version of the roles either from the rhel-system-roles-sap RPM or from Red Hat Automation Hub. The RHEL System Roles for SAP and Ansible packages do not need to be installed on the systems that are being managed/configured.
See the following table for the support status:
| Control Node | Managed Node | Support Status |
|---|---|---|
| RHEL 8.4 or later | RHEL 8.0 or later | fully supported |
| RHEL 8.4 or later | RHEL 7.6 or later | fully supported |
| RHEL 8.4 or later | RHEL 7.5 or earlier | not supported |
| RHEL 8.3 or earlier | RHEL (any release) | not supported† |
† Note: For control nodes running RHEL 7.8, RHEL 7.9, or RHEL 8.1, you can use the previous versions of rhel-system-roles-sap which are in Tech Preview support status. Please find the instructions for these versions here.
For control nodes running RHEL 8.2 or RHEL 8.3, you can use version 2 of rhel-system-roles-sap which is fully supported. Please find the instructions for this version here.
See the table below for the supported hardware/virtualization/cloud platforms of the managed node:
| Hardware platform | Bare Metal/Virtualization/ Cloud platform | Support Status |
|---|---|---|
| x86_64 | bare metal, Red Hat Virtualization/libvirt, VMware ESX, Red Hat Certified Cloud and Service Providers | fully supported |
| ppc64le | PowerVM LPARs | fully supported |
| s390x | zVM guest | fully supported: sap-preconfigure, sap-netweaver-preconfigure |
The roles are designed to be used right after the initial installation of a managed node. Do not run these roles against a SAP or other production system. The role will enforce a certain configuration on the managed node(s), which might not be intended.
Before applying the roles on a managed node, verify that the RHEL release on the managed node is supported by the SAP software version that you are planning to install.
Chapter 2. Installing the Ansible Engine and RHEL System Roles for SAP
Use the following steps to for installing the Ansible Engine and the RHEL System Roles for SAP
Procedure
Use subscription-manager to list the available Ansible Engine repositories.
# subscription-manager refresh
# subscription-manager repos --list | grep ansible
Enable the Ansible Engine repository and the RHEL for SAP Solutions repository using Red Hat Subscription Manager.
# subscription-manager repos --enable=ansible-2-for-rhel-8-$(uname -m)-rpms --enable=rhel-8-for-$(uname -m)-sap-solutions-rpms
NoteThe generic version "2" of the Ansible Engine repository provides the latest release of the 2.X stream but it is also possible to specify a certain minor Ansible Engine version such as 2.9.
Install Ansible Engine and RHEL System Roles for SAP:
# dnf install ansible rhel-system-roles-sap
The rhel-system-roles-sap package is installed to the following locations where <role> is the name of the individual role; for example, sap-hana-preconfigure. Each role includes a README file that explains all variables and how to use the role.
Documentation: /usr/share/doc/rhel-system-roles-sap/<role>
Ansible Roles: /usr/share/ansible/roles/<role>
Chapter 3. New Features
Version 3.1 has the following new features:
- The three roles now support an assertion run, so they can be used to compare the settings of a managed node to the applicable SAP notes. While Ansible supports setting and verifying any modification made to a managed node by design, it can be useful to report SAP notes compliance of a SAP system from time to time without modifying the system configuration, for example to ensure that system settings are still in place after a manual modification of system parameters. The roles can either fail at each detected violation, or they can report failures but continue running and finally report the number of failures (if any).
-
The roles
sap-preconfigureandsap-hana-preconfigurenow support a reboot of the managed node if there have been software installations which require it. -
Role
sap-preconfigureonly remounts file system/dev/shmif necessary. -
Role
sap-netweaver-preconfigurenow supports the installation of packages which are required for Adobe Document Services. -
The role
sap-hana-preconfigureno longer sets the SELinux state. This is already done in role sap-preconfigure. -
Configuring role
sap-hana-preconfigurefor using tuned and/or modifying the boot command line has been simplified. -
Role
sap-hana-preconfigurenow supports activating tuned profile sap-hana and also modifying the boot command line. This provides greater flexibility when setting latency related parameters. -
Role
sap-hana-preconfigurenow supports checking if the RHEL minor release is supported for SAP HANA. This behavior can be overridden so that any RHEL 7.6 or greater managed node can be prepared for SAP HANA. -
Role
sap-hana-preconfigurenow supports setting kernel parameters for NetApp NFS as per SAP Note 3024346.
Chapter 4. Known Issues
4.1. Roles produce limited output when running in check mode
Running roles in check mode will not show all changes which are performed on a system when running in normal mode, as some Ansible modules have no or just partial support for check mode. For example, tasks will not report the values of kernel parameters. For more information on the Ansible check mode, please refer to Ansible Playbook.
To overcome this restriction, the sap*preconfigure roles can now run in an extended check (=assert) mode
4.2. Extended check (=assert) parameters are not recongnized in previous versions of the roles
The roles can run in an assert mode, in which case they do not modify managed nodes but report the compliance of a node with the applicable SAP notes. When running assert mode playbooks with previous versions (1.x or 2.x) of the roles, assert parameters are ignored, causing the roles to modify the managed nodes instead of only checking them. As roles can also be installed in other than the default locations (e.g. using git), it is recommended that you not only check if version 3 of package rhel-system-roles-sap is installed but also that the playbooks you are using are calling the roles in their correct, default locations, which is under /usr/share/ansible/roles.
4.3. Role sap-preconfigure fails if DNS domain is not set on the managed node
In case there is no DNS domain set on the managed node, which is typically the case on cloud systems, the role sap-preconfigure will fail in task Verify that the DNS domain is set. To avoid this, set variable sap_domain in file /usr/share/ansible/roles/sap-preconfigure/defaults/main.yml or run the ansible-playbook command with line parameter -e "sap_domain=example.com" (with the domain name being example.com in this case - please replace it by your domain name).
(sap-preconfigure issue 32)
4.4. The assertion for getting the current status of the CPU Govenor for performance (x86_64 platform only) fails
When running role sap-hana-preconfigure in assert mode against a x86_64 managed node, it might incorrectly report that the current status of the CPU Governor for performance is not as expected.
(sap-hana-preconfigure issue 180)
Chapter 5. Quick Start Guide to RHEL System Roles for SAP
Use the following procedures for configuring or verifying one or more systems for the installation of SAP NetWeaver or SAP HANA
5.1. Verifying the version of RHEL System Roles for SAP
Use the following steps to display the role path which is used when running the role so that you can verify if it is corresponding to the installed version.
Procedure
Run the command (replace
PLAYBOOK.YMLby the actual name of the playbook andHOSTNAMEby the name of the managed node):# ansible-playbook PLAYBOOK.YML -l HOSTNAME --step -vvAnswer the first question with "N":
Perform task: TASK: Gathering Facts (N)o/(y)es/(c)ontinue:NAnswer the second question with "y":
Perform task: TASK: sap-preconfigure : include os specific vars (N)o/(y)es/(c)ontinue:y
Verification
This will display the absolute path name of file
tasks/main.ymland then abort the play (because the vars file could not be found). Example output:TASK [sap-preconfigure : include os specific vars] **************************************************************************** task path: /usr/share/ansible/roles/sap-preconfigure/tasks/main.yml:3 fatal: [HOSTNAME]: FAILED! => {"msg": "No file was found when using first_found. Use errors='ignore' to allow this task to be skipped if no files are found"}
5.2. Preparing the control node
Use the following steps to display the system messages in English. RHEL System Roles for SAP requires that the Ansible control node uses locale C or en_US.UTF-8
Procedure
Run the command on the local host to check the current setting.
# locale
The output should display either
Coren_US.UTF-8in the line starting withLC_MESSAGES=.If the command does not produce the expected output, run the following command on the local host before executing the
ansible-playbookcommand:# export LC_ALL=C
Or
# export LC_ALL=en_US.UTF-8
5.3. Configuring the local system
Use the following steps for preparing the local system for the installation of SAP NetWeaver
Prerequisites
- No production software running on the system
- A minimum of 20480 MB of swap space is configured on the local system
Procedure
Make a bakckup, if you would like to preserve the original configuration of the server.
NoteThese roles are run after the installation of RHEL, therefore a backup should not be required.
Create a YAML file named
sap-netweaver.ymlwith the following content:- hosts: localhost connection: local roles: - sap-preconfigure - sap-netweaver-preconfigureImportantThe correct indentation of 2 spaces in front of
roles:is essential.Run the RHEL System Roles
sap-preconfigureandsap-netweaver-preconfigureto prepare the managed nodes for the installation of SAP NetWeaver.# ansible-playbook sap-netweaver.yml
At the end of the playbook run, the command will report that a reboot is required because role
sap-preconfigurehas changed the SELinux state fromenabledtodisabled, according to SAP Note 2772999.Reboot the managed nodes so that the new SELinux state will become effective. If you set the role variable
sap_preconfigure_reboot_okto yes, the role will reboot the server as the last step of its execution.NoteBy changing role variable
sap_preconfigure_selinux_statefrom the defaultdisabledtopermissivebefore or at the time of running the playbook, you can have the rolesap-preconfigureset the SELinux state topermissive, which is also allowed for SAP NetWeaver on RHEL 8. See the Examples section in this document for more information on setting role variables.
5.4. Verifying the local system
Use the following steps to verify if the local system is configured correctly for installation of SAP NetWeaver.
RHEL System roles for SAP can also be used to verify that RHEL systems are configured correctly.
Prerequisites
- RHEL System Roles for SAP version 3
Procedure
Create a YAML file named
sap-netweaver.ymlwith the following content:- hosts: localhost connection: local vars: sap_preconfigure_assert: yes sap_preconfigure_assert_ignore_errors: yes sap_netweaver_preconfigure_assert: yes sap_netweaver_preconfigure_assert_ignore_errors: yes roles: - sap-preconfigure - sap-netweaver-preconfigureRun the following command:
# ansible-playbook sap-netweaver.yml
In case you would like to get a more compact output, you can filter the output to just display the essential FAIL or PASS information for each assertion. If you are using a terminal with dark background, replace all occurrences of color code
[30min the following command sequence by[37m. Otherwise, the output of some lines will be unreadable due to dark font on dark background.In case you accidentally ran the above command on a terminal with dark background, you can re-enable the default white font again with the following command:
# awk 'BEGIN{printf ("\033[37mResetting font color\n")}'
5.5. Configuring remote systems
Use the following steps for preparing one or more remote servers (managed nodes) for the installation of SAP HANA.
Prerequisites
- Verify that the managed nodes are correctly set up for installing Red Hat software packages from a Red Hat Satellite server or the Red Hat Customer Portal.
- Access via the ssh command to all managed nodes from the Ansible control node without using a password.
- No production software running on the system
Supported RHEL release for SAP HANA.
- For information on supported RHEL releases for SAP HANA, see SAP Note 2235581
Procedure
Make a backup, if you would like to preserve the original configuration of the server.
NoteThese roles are run after the installation of RHEL, therefore a backup should not be required.
Create an inventory file or modify file
/etc/ansible/hoststhat contains the name of a group of hosts and each host which you intend to configure (=managed node) in a separate line (example for three hosts in a host group namedsap_hana):[sap_hana] host01 host02 host03
Verify that you can log in to all three hosts using ssh without password:
# ssh host01 uname -a # ssh host02 hostname # ssh host03 echo test
Create a YAML file named
sap-hana.ymlwith the following content:- hosts: sap_hana roles: - sap-preconfigure - sap-hana-preconfigureImportantThe correct indentation (e.g. 2 spaces in front of
roles:) is essential.Run the RHEL System Roles
sap-preconfigureandsap-hana-preconfigureto prepare the managed nodes for the installation of SAP HANA.# ansible-playbook sap-hana.yml
NoteDo not run these roles against an SAP or other production system. The role will enforce a certain configuration on the managed node(s), which typically is intended only right after the installation of RHEL and before the initial installation of SAP software.
At the end of the playbook run, the command will report for each managed node that a reboot is required, for example because role sap-preconfigure has changed the SELinux state from
enabledtodisabled(as per requirement in SAP Note 2292690 or SAP Note 2777782).- Reboot the managed nodes
5.6. Verifying a remote system
Use the following steps to verify if a remote system is configured correctly for installation of SAP HANA. It is recommended to verify each host separately
RHEL System roles for SAP can also be used to verify that RHEL systems are configured correctly.
Prerequisites
- RHEL System Roles for SAP version 3
Procedure
- Verify each host
Create a YAML file named
sap-hana.ymlwith the following content:- hosts: all vars: sap_preconfigure_assert: yes sap_preconfigure_assert_ignore_errors: yes sap_hana_preconfigure_assert: yes sap_hana_preconfigure_assert_ignore_errors: yes roles: - sap-preconfigure - sap-hana-preconfigureRun the ansible-playbook command line option -l to specify the name of the remote host to verify.
# ansible-playbook sap-hana.yml -l host01
Chapter 6. RHEL System Roles for SAP Description
This chapter provides a detailed description of RHEL System Roles for SAP.
6.1. System Roles and Purpose
The purpose of the three roles sap-preconfigure, sap-netweaver-preconfigure, and sap-hana-preconfigure is described in the following table:
| System Role | Purpose |
|---|---|
| sap-preconfigure | Install software and perform all configuration steps which are required for the installation of SAP NetWeaver and SAP HANA. |
| sap-netweaver-preconfigure | Install additional software and perform additional configuration steps which are required for SAP NetWeaver only. |
| sap-hana-preconfigure | Install additional software and perform additional configuration steps which are required for SAP HANA only. |
6.2. System Roles and SAP Notes
The following table list the System Role and the corresponding action or SAP Note for the RHEL release of the managed node.
| System Role | SAP Note for RHEL 7 | SAP Note for RHEL 8 |
|---|---|---|
| sap-preconfigure | ||
| SAP Note 0941735 (TMPFS only) | ||
| sap-netweaver-preconfigure | SAP Note 2526952 (Tuned profiles only) | SAP Note 2526952 (Tuned profiles only) |
| sap-hana-preconfigure | Install required packages as per docuements SAP HANA 2.20 running on RHEL7.x and SAP HANA SPS 12 running on RHEL 7.x which are found in SAP Note 2009879 | Install required packages found in SAP Note 2772999 |
| ppc64le only: Install additional required packages located here. | ppc64le Install additional required packages located here | |
| Perform the configuration steps in SAP HANA 2.0 running on RHEL 7.x and SAP HANA SPS 12 running on RHEL 7.x. SAP Note 2009879 | ||
| ppc64le only. SAP Note 2055470 | ppc64le only. SAP Note 2055470 | |
6.3. Implemented SAP Notes
| SAP Note | RHEL 7 | RHEL 8 | Title | Scope |
|---|---|---|---|---|
| X | Red Hat Enterprise Linux 7.x: Installation and Upgrade | General RHEL 7 installation and configuration steps before installing SAP NetWeaver | ||
| X | Linux UUID solutions |
Installation and configuration of | ||
| X | SAP memory management system for 64-bit Linux systems | SAP and Linux kernel parameters and TMPFS for SAP NetWeaver | ||
| X | Red Hat Enterprise Linux 8.x: Installation and Configuration |
General RHEL 8 installation and configuration steps, including | ||
| X | X | Red Hat Enterprise Linux for SAP Solutions | Description of RHEL for SAP Solutions, including tuned-profiles | |
| X | SAP HANA Guidelines for Red Hat Enterprise Linux (RHEL) Operating System | Kernel and OS settings for SAP HANA on RHEL 6.x and RHEL 7.x | ||
| X | X | HANA on POWER Planning and Installation Specifics - Central Note | Specific installation and configuration steps for SAP HANA on POWER | |
| X | SAP HANA DB: Recommended OS settings for RHEL 7 | Specific package requirements, Kernel and OS settings for SAP HANA on RHEL 7.x | ||
| X | SAP HANA DB: Recommended OS settings for RHEL 8 | Specific package requirements, Kernel and OS settings for SAP HANA on RHEL 8.x | ||
| X | X | Optimizing the Network Configuration on HANA and OS-Level | Network-related kernel settings for SAP HANA |
6.4. Role variables
In each role, default variable settings can be modified to change the behavior of the role. The README.md file of each role, located in directory /usr/share/ansible/roles/<role>, describes the purpose of these variables as well as their default settings. The variables are defined and can be changed in each role’s file main.yml in directory /usr/share/ansible/roles/<role>/defaults in an inventory file, in your playbooks, or by using the ansible-playbook command line parameter --extra-vars or -e. See the next section for examples.
Some of the variables are described in more detail below to explain their behavior and dependencies:
Kernel variables can be set either in the kernel command line via grub, or using tuned profile sap-hana. Use the following combinations of these variables in /usr/share/ansible/roles/sap-hana-preconfigure/defaults/main.yml for the cases described below.
6.4.1. Using tuned profile sap-hana only
In case you would like to use tuned profile sap-hana only, leave the default settings in place:
sap_hana_preconfigure_use_tuned: yes
6.4.2. Using tuned profile sap-hana and modify the kernel command line
In case you would like to use tuned and also modify the kernel command line, use following variable setting:
sap_hana_preconfigure_modify_grub_cmdline_linux: yes
6.4.3. Modifying the kernel command line and not using tuned
In case you would like to modify the kernel command line and not switch to tuned profile sap-hana (this will lead to all kernel settings to be configured statically), use the following variable setting:
sap_hana_preconfigure_use_tuned: no
This will modify the grub command line even if variable sap_hana_preconfigure_modify_grub_cmdline_linux is set to no