Version 1: Google Cloud's Agent for SAP troubleshooting guide

This guide shows you how to resolve issues with version 1 of Google Cloud's Agent for SAP.

Logging

Check the logs in the directory that is specific to your operating system.

To view the logs for Google Cloud's Agent for SAP, navigate to the following paths:

Linux

/var/log/google-cloud-sap-agent.log

Windows

C:\Program Files\Google\google-cloud-sap-agent\logs\google-cloud-sap-agent.log

Common issues

Issue: Insufficient IAM permissions

Issue: Google Cloud's Agent for SAP logs show insufficient IAM permissions error.

Cause: The service account does not have the required IAM permissions to access the Cloud Monitoring API.

Resolution: In Google Cloud console, on the VM instance details page, note the name of the VM service account. For example: sap-example@example-project-123456.iam.gserviceaccount.com. On the IAM & Admin home page, ensure that the service account includes the following IAM roles:

Feature	Required IAM roles
SAP Host Agent metrics collection	Compute Viewer (`roles/compute.viewer`) Monitoring Viewer (`roles/monitoring.viewer`)
Process Monitoring metrics collection	Compute Viewer (`roles/compute.viewer`) Monitoring Metric Writer (`roles/monitoring.metricWriter`) Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) (Required when you use Secret Manager to authenticate the database user account for SAP HANA.)
Workload Manager evaluation metrics collection	Compute Viewer (`roles/compute.viewer`) Monitoring Metric Writer (`roles/monitoring.metricWriter`) Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) (Required when you use Secret Manager to authenticate the database user account for SAP HANA.)

For more information about the authentication required for Google Cloud's Agent for SAP, see Authentication and access.

To confirm the permissions that the Cloud Monitoring agent requires, see the following Monitoring documentation:

Issue: Incorrect access scopes for the compute service account

Issue: If you limit the access scopes on your host compute instance, then Google Cloud's Agent for SAP logs might show insufficient IAM permissions error.

Cause: Google Cloud's Agent for SAP requires minimum Cloud API access scopes on the host compute instance. This error occurs when the service account does not have the required access scopes.

Resolution: Access scopes are the legacy method of specifying permissions for your compute instance. Compute Engine recommends configuring your compute instances to allow all access scopes to all Cloud APIs and using only the IAM permissions of the compute service account to control access to Google Cloud resources.

To resolve this issue, as a best practice, set the all cloud-platform access scope on the compute instance, then securely limit the service account's API access with IAM roles. For example:

https://www.googleapis.com/auth/cloud-platform

If you do limit the access scopes of your compute instance, then you must ensure that the host compute instance has the following access scopes:

https://www.googleapis.com/auth/source.read_write
https://www.googleapis.com/auth/compute
https://www.googleapis.com/auth/servicecontrol
https://www.googleapis.com/auth/service.management.readonly
https://www.googleapis.com/auth/logging.admin
https://www.googleapis.com/auth/monitoring
https://www.googleapis.com/auth/trace.append
https://www.googleapis.com/auth/devstorage.full_control

If you've enabled the Process Monitoring metrics collection or the Workload Manager evaluation metrics collection, then the access scopes of the host compute instance must also have write access to publish metric data to your Google Cloud project:

https://www.googleapis.com/auth/monitoring.write

To change the access scopes, you need to stop your compute instance, make the changes, and then restart the compute instance. For instructions, see the Compute Engine documentation. You don't need to make any changes to permissions for IAM roles for this issue.

Issue: Missing or incorrect SAP Host Agent

Issue: Google Cloud's Agent for SAP logs show missing or incorrect SAP Host Agent error.

Cause: SAP Host Agent or the required minimum patch level for the SAP Host Agent is not installed. For Google Cloud's Agent for SAP to work, your SAP system must have the SAP Host Agent installed and the required minimum patch level for the Host Agent is maintained.

Resolution: To resolve this issue, install the required version of the SAP Host Agent. For instructions to install the SAP Host Agent, see the SAP documentation.

For version requirements for the SAP Host Agent, see the following SAP Notes:

Linux: SAP Note 2460297 - SAP on Linux on Google Cloud Platform: Enhanced Monitoring
Windows: SAP Note 1409604 - Virtualization on Windows: Enhanced Monitoring

Issue: Installation of Google Cloud's Agent for SAP failed

Issue: Installation of the agent fails when the package manager install command (yum, zypper, or googet) is executed.

Cause: Installation of the agent fails because the host server that is running the agent has been created without a public or external IP address.

Resolution: To resolve this issue, set up a NAT gateway that gives the host server outbound access to the internet. For information about how to set up a NAT gateway, see the deployment guide for your SAP system. For example, for SAP NetWeaver, see:

Issue: Connection refused error

Issue: SAP Host Agent logs show the connection refused error.

Cause: Google Cloud's Agent for SAP cannot start up because the port 18181 is not available. Google Cloud's Agent for SAP listens for requests on port 18181. This port must be available for the agent to start up.

Resolution: To resolve this issue, make sure that the port 18181 is available for Google Cloud's Agent for SAP. If another service is using port 18181, then you might need to restart that other service or otherwise reconfigure it to use another port.

Getting support for Google Cloud's Agent for SAP

If you need help resolving a problem with Google Cloud's Agent for SAP, then gather the required diagnostic information and contact Cloud Customer Care. For more information, see Google Cloud's Agent for SAP diagnostic information.