This guide shows you how to configure version 2 of
Google Cloud's Agent for SAP to collect the
Workload Manager evaluation metrics from your SAP systems.
If you have installed the agent on a Bare Metal Solution server, then make sure
that you have completed the required prerequisites and set up a service
account. For instructions, see
Configure Google Cloud's Agent for SAP on Linux.
Set IAM roles
To allow Google Cloud's Agent for SAP collect the Workload Manager
evaluation metrics, you must ensure that the service account being used by your
Compute Engine instance or Bare Metal Solution server includes the
following roles:
Identify the service account to which you want to add a role.
If the service account isn't already on the principals list,
then it doesn't have any roles assigned to it. Click Add and enter the
email address of the service account.
If the service account is already on the principals list, then it has existing
roles. Click the Edit button for the service account that you want to
edit.
Select the required role from the list of available roles:
Compute Viewer
Monitoring > Monitoring Metric Writer
Secret Manager > Secret Manager Secret Accessor
Click Add or Save to apply the roles to the service account.
To enable the collection of Workload Manager evaluation metrics
using Google Cloud's Agent for SAP, follow these steps:
Establish an SSH connection with your Compute Engine instance or
Bare Metal Solution server.
Open the agent's configuration file:
/etc/google-cloud-sap-agent/configuration.json
In the collection_configuration section, for the parameter
collect_workload_validation_metrics, set the value true.
To enable the collection of workload.googleapis.com/sap/validation/hanasecurity
metric that enables the security evaluation rules in
Workload Manager,
add the workload_validation_db_metrics_config section
after collect_workload_validation_metrics, and then specify the following
parameters:
hana_db_user: specify the user account that is used to query the SAP HANA
instance.
hana_db_password_secret_name: specify the name of the secret in
Secret Manager
that stores the user account's password.
hostname: specify the identifier for the machine, either local or remote,
that hosts your SAP HANA instance.
port: specify the port on which your SAP HANA instance accepts queries.
Optionally, under the cloud_properties section, you can update the parameter values that
are set automatically. To do so, add the cloud_properties section to your
configuration file, and then specify the required parameters and their values.
Save the configuration file.
Restart the agent for the new settings to take effect:
The following table explains the configuration parameters of
Google Cloud's Agent for SAP that are specific to the collection of the
Workload Manager evaluation metrics.
Parameters
provide_sap_host_agent_metrics
Boolean
To enable the collection of the metrics required by the
SAP Host Agent, specify true.
Default is true.
Don't set provide_sap_host_agent_metrics to false
unless you are directed by Cloud Customer Care or SAP Support.
bare_metal
Boolean
When the agent is installed on a Bare Metal Solution server, specify
true. Default is false.
log_level
String
To set the logging level of the agent, set the required value.
The available log levels are as follows:
DEBUG
INFO
WARNING
ERROR
Default is INFO. Don't change the logging level unless you
are directed by Cloud Customer Care.
log_to_cloud
Boolean
To redirect the agent's logs to
Cloud Logging, specify
true. The default is true.
sap_system_discovery
Boolean
To enable the SAP system discovery, specify true. Default is
true.
cloud_properties.project_id
String
If your SAP system is running on a Bare Metal Solution server, then
specify the project ID of the Google Cloud project that you are
using with Bare Metal Solution.
When the agent runs on a Compute Engine instance, by default,
the agent detects the project ID automatically.
cloud_properties.instance_name
String
If your SAP system is running on a Compute Engine instance,
then specify the name of that compute instance. The agent automatically detects
the compute instance name upon installation.
If your SAP system is running on a Bare Metal Solution server, then
specify the name of that server. In agent version 2.5 or earlier, specify
the Bare Metal Solution server name for the property
instance_id.
cloud_properties.region
String
If your SAP system is running on a Bare Metal Solution server,
then specify the region of the Bare Metal Solution server.
When the agent runs on a compute instance, by default,
the agent uses the region where the compute instance is deployed.
cloud_properties.zone
String
When the agent runs on a compute instance, by default, the agent uses the
zone where the compute instance is deployed.
cloud_properties.image
String
Specify the OS image name of the instance.
When the agent runs on a compute instance, by default, the agent
automatically detects the OS image used by the compute instance.
cloud_properties.numeric_project_id
String
Specify the numeric ID of the Google Cloud project where the SAP system
is running.
When the agent runs on a compute instance, by default, the agent
automatically detects project number.
To enable Workload Manager evaluation metrics collection,
specify true. From version 3.2, the default value is
true.
This parameter is applicable only for Linux.
The collection frequency of the Workload Manager
evaluation metrics in seconds. The default value is 300
seconds.
If you need to modify the collection frequency of the
Workload Manager metrics, then add the
workload_validation_metrics_frequency
parameter under the collection_configuration section and
provide the required value.
Specify the port on which your SAP HANA instance accepts queries. For
the first or only tenant database instance, the port is
3NN15, where NN is the
instance number of the SAP HANA instance.
The collection frequency of the SAP HANA database metrics, in seconds,
for Workload Manager evaluation.
Default is 3600 seconds.
Although you can update the collection frequency of the
SAP HANA database metrics, we recommend that you use
the default value. If you need to modify the default value, then add the
workload_validation_db_metrics_frequency parameter under
the collection_configuration section and provide the required
value. Make sure that you don't set a collection frequency greater
than 3600 seconds.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,["# Version 2: Configure Workload Manager evaluation metrics collection\n\n\u003cbr /\u003e\n\n\n| **Warning:** Support for version 2 of Google Cloud's Agent for SAP ended on July 31, 2025.\n|\n| If you're using version 2 of Google Cloud's Agent for SAP, then we recommend that you switch to the\n| latest version of the agent as soon as possible. For information about how to update\n| Google Cloud's Agent for SAP, see\n| [Update\n| Google Cloud's Agent for SAP](/sap/docs/agent-for-sap/latest/operations#agent4sap-update).\n\n\u003cbr /\u003e\n\nThis guide shows you how to configure version 2 of\nGoogle Cloud's Agent for SAP to collect the\nWorkload Manager evaluation metrics from your SAP systems.\n\nFor information about this feature, see\n[Workload Manager evaluation using Google Cloud's Agent for SAP](/sap/docs/agent-for-sap/2.0/workload-manager-evaluation).\n| **Note:** The collection of Workload Manager evaluation metrics is supported only on Linux. It is not supported on Windows.\n\nBefore you begin\n----------------\n\n- Validate your installation of Google Cloud's Agent for SAP. For instructions, see the [installation guide for your scenario](/sap/docs/agent-for-sap/2.0/install-config).\n- If you have installed the agent on a Bare Metal Solution server, then make sure that you have completed the required prerequisites and set up a service account. For instructions, see [Configure Google Cloud's Agent for SAP on Linux](/sap/docs/agent-for-sap/2.0/install-config-on-bms#configure_agent4sap).\n\nSet IAM roles\n-------------\n\nTo allow Google Cloud's Agent for SAP collect the Workload Manager\nevaluation metrics, you must ensure that the service account being used by your\nCompute Engine instance or Bare Metal Solution server includes the\nfollowing roles:\n\n- [Compute Viewer (`roles/compute.viewer`)](/compute/docs/access/iam#compute.viewer)\n- [Monitoring Metric Writer (`roles/monitoring.metricWriter`)](/monitoring/access-control#mon_roles_desc)\n- [Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`)](/secret-manager/docs/access-control#secretmanager.secretAccessor), if you use Secret Manager for storing SAP HANA database password.\n\nTo add these required roles to your service account, follow these steps:\n\n1. In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/project/_/iam-admin/iam)\n2. Select your Google Cloud project.\n\n3. Identify the service account to which you want to add a role.\n\n - If the service account isn't already on the principals list, then it doesn't have any roles assigned to it. Click **Add** and enter the email address of the service account.\n - If the service account is already on the principals list, then it has existing roles. Click the **Edit** button for the service account that you want to edit.\n4. Select the required role from the list of available roles:\n\n - **Compute Viewer**\n - **Monitoring \\\u003e Monitoring Metric Writer**\n - **Secret Manager \\\u003e Secret Manager Secret Accessor**\n5. Click **Add** or **Save** to apply the roles to the service account.\n\nEnable Workload Manager evaluation metrics collection\n-----------------------------------------------------\n\nTo enable the collection of Workload Manager evaluation metrics\nusing Google Cloud's Agent for SAP, follow these steps:\n\n1. Establish an SSH connection with your Compute Engine instance or\n Bare Metal Solution server.\n\n2. Open the agent's configuration file:\n\n ```\n /etc/google-cloud-sap-agent/configuration.json\n ```\n3. In the `collection_configuration` section, for the parameter\n `collect_workload_validation_metrics`, set the value `true`.\n\n4. To enable the collection of `workload.googleapis.com/sap/validation/hanasecurity`\n metric that enables the security evaluation rules in\n Workload Manager,\n add the `workload_validation_db_metrics_config` section\n after `collect_workload_validation_metrics`, and then specify the following\n parameters:\n\n - `hana_db_user`: specify the user account that is used to query the SAP HANA instance.\n - `hana_db_password_secret_name`: specify the name of the secret in [Secret Manager](/secret-manager/docs/overview) that stores the user account's password.\n - `hostname`: specify the identifier for the machine, either local or remote, that hosts your SAP HANA instance.\n - `port`: specify the port on which your SAP HANA instance accepts queries.\n\n For information about these\n parameters, see [Configuration parameters](#configuration_parameters).\n5. Optionally, under the `cloud_properties` section, you can update the parameter values that\n are set automatically. To do so, add the `cloud_properties` section to your\n configuration file, and then specify the required parameters and their values.\n\n6. Save the configuration file.\n\n7. Restart the agent for the new settings to take effect:\n\n ```\n sudo systemctl restart google-cloud-sap-agent\n ```\n\nExample configuration files\n---------------------------\n\n### Compute Engine instance\n\nThe following example is a completed configuration file of version 2 of Google Cloud's Agent for SAP running on a Compute Engine instance, where the collection of Workload Manager evaluation metrics is enabled:\n\n\u003cbr /\u003e\n\n```json\n{\n \"provide_sap_host_agent_metrics\": true,\n \"bare_metal\": false,\n \"log_level\": \"INFO\",\n \"log_to_cloud\": true,\n \"collection_configuration\": {\n \"collect_workload_validation_metrics\": true,\n \"workload_validation_db_metrics_frequency\": 3600,\n \"workload_validation_db_metrics_config\": {\n \"hana_db_user\": \"system\",\n \"sid\": \"DEH\",\n \"hana_db_password_secret_name\": \"instance-id-hana-db-password-secret\",\n \"hostname\": \"localhost\",\n \"port\": \"30015\"\n },\n \"collect_process_metrics\": false,\n \"sap_system_discovery\": true\n },\n \"hana_monitoring_configuration\": {\n \"enabled\": false\n }\n}\n```\n\n### Bare Metal Solution server\n\nThe following example is a completed configuration file of version 2 of Google Cloud's Agent for SAP running on a Bare Metal Solution server, where the collection of Workload Manager evaluation metrics is enabled:\n\n\u003cbr /\u003e\n\n```json\n{\n \"provide_sap_host_agent_metrics\": true,\n \"bare_metal\": true,\n \"log_level\": \"INFO\",\n \"log_to_cloud\": true,\n \"collection_configuration\": {\n \"collect_workload_validation_metrics\": true,\n \"workload_validation_db_metrics_frequency\": 3600,\n \"workload_validation_db_metrics_config\": {\n \"hana_db_user\": \"system\",\n \"sid\": \"DEH\",\n \"hana_db_password_secret_name\": \"instance-id-hana-db-password-secret\",\n \"hostname\": \"localhost\",\n \"port\": \"30015\"\n },\n \"collect_process_metrics\": false,\n \"sap_system_discovery\": true\n },\n \"cloud_properties\": {\n \"project_id\": \"my-project\",\n \"instance_name\": \"bms-machine-1\",\n \"region\": \"us-central1\"\n \"image\": \"rhel-8\"\n },\n \"hana_monitoring_configuration\": {\n \"enabled\": false\n }\n}\n```\n\nConfiguration parameters\n------------------------\n\nThe following table explains the configuration parameters of\nGoogle Cloud's Agent for SAP that are specific to the collection of the\nWorkload Manager evaluation metrics."]]