SAP HANA on Bare Metal Solution deployment guide

This guide covers the aspects of setting up a Bare Metal Solution environment that are unique or relevant to SAP HANA.

In a Bare Metal Solution environment, you install SAP HANA and other SAP software yourself by following the SAP documentation.

This guide also describes the Google Cloud foundational services for SAP that are required or optional for SAP HANA in a Bare Metal Solution environment.

For an overview of SAP HANA on Bare Metal Solution to help you plan for your deployment, see SAP HANA on Bare Metal Solution planning guide.

High-level steps

The following list shows the high-level steps that you need to complete to deploy SAP HANA on Bare Metal Solution after Google Cloud notifies you that your machines are ready.

  1. Complete the connection to your new machines by following the Bare Metal Solution documentation. For the set up procedures, see Setting up the Bare Metal Solution environment in the Bare Metal Solution documentation.
  2. Validate the machine configuration for SAP HANA.
  3. Create IAM service accounts for the applications that need to access Google Cloud resources. See Set up your service accounts.
  4. Establish a connection to the internet for software updates. See Accessing the internet in the Bare Metal Solution documentation.
  5. Establish connection to Google Cloud APIs. See Setting up access to Google Cloud APIs and services in the Bare Metal Solution documentation.
  6. Set up access to an Network Time Protocol (NTP) server, which is not covered in this guide.
  7. Set up a Domain Name System (DNS) server, which is not covered in this guide.
  8. Installing the Cloud Storage Backint agent for SAP HANA, which is optional.
  9. Installing the Google Cloud monitoring agent for SAP HANA, which is optional.

Validating the machine configuration for SAP HANA

When you log into your machines for the first time, you need to confirm that the machines, operating systems, and storage that you received are what you ordered and that everything is configured correctly.

In addition to the general validation checks that are listed in the Bare Metal Solution documentation, validate the following items that are specific to SAP HANA:

  • That your operating system is the correct, SAP-specific version
  • That the SAP HANA volumes and file system mounts are mapped correctly
  • That the storage is configured correctly
  • That the time is synchronized between the servers

For information about Bare Metal Solution machine validation, see Logging in to a Bare Metal Solution machine for the first time.

Set up application service accounts

Any application program, agent, or process that accesses Google Cloud resources from a Bare Metal Solution environment needs an IAM service account for authentication and authorization.

To create a service account:

  1. Open the IAM & admin Service accounts page in Google Cloud Console.

    Go to the Service Accounts page

  2. Click + CREATE SERVICE ACCOUNT.

  3. Specify a name for the service account and, optionally, a description.

  4. Click CREATE.

  5. On the Grant this service account access to project panel, select the roles that contain the permissions that your application needs.

    For example, the fence_gce agent that is used in high-availability clusters needs the baremetalsolution.service.resetInstance permission, which is included in the IAM roles roles/baremetalsolution.editor and roles/baremetalsolution.admin.

  6. Click Continue.

  7. On the Service accounts page in the Cloud Console, click on the service account that you just created.

  8. On the Service account details page under Keys, click on ADD KEY > Create new key to create a service account key.

  9. Accept JSON as the key type and click CREATE. A private key is saved to your computer.

  10. Upload the JSON key file to a secure location on the Bare Metal Solution servers that is accessible to the applications that require it.

  11. Configure your applications to access the JSON key file.

    For example, when you create the high-availability cluster resource that uses the fence_gce agent, you specify the path and file name of the JSON key file in the fence_gce configuration properties.

For more information about IAM service accounts, see:

Confirming connectivity to the application servers

Confirm that you have network connectivity between the SAP HANA servers and the application servers.

Make sure that your Google Cloud and guest operating system firewall rules allow traffic between the servers.

Configuring your storage

You need to scan your LUNs and map your storage volumes and mount points for SAP HANA.

The Google Cloud representative that helps you with your order and the provisioning of your Bare Metal Solution machines can help you do this.

With 48 TB of storage, use the following volume layout for SAP HANA on a Bare Metal Solution server:

  • /hana/log: Four 768 GB LUNS, striped with LVM by using a 64 K block size
  • /hana/data: Four 10.5 TB LUNS, striped with LVM by using a 64 K block size
  • /hana/shared: A 3 TB volume
  • /usr/sap: A 200 GB volume shared with the operating system

The following table describes the configuration of the volume groups and logical volumes. You can use your own naming convention for the volume group and logical volume names.

Volume group Logical volume Configuration
hanadatavg data Striped across 4 devices of at least 10 TiB each, with a block size of 64 KB
hanalogvg log Striped across 4 devices of at least 768 GiB each, with a block size of 64 KB
hanasharedvg shared Linear (not striped) on a 3 TiB device

Installing SAP HANA on Bare Metal Solution

To install SAP HANA on a Bare Metal Solution host machine, you need to follow the SAP installation documentation for your version of SAP HANA.

To find the installation documentation for your version of SAP HANA, see the SAP Help Portal.

Configuring high-availability clusters

Configure clustering or a suitable high availability solution for your business critical workloads. We recommend Pacemaker clustering.

With the exception of a few requirements and recommendations, configure high-availability clusters on Bare Metal Solution machines by following the clustering instructions that your operating system vendor provides.

For more information about the Google Cloud requirements and recommendations for configuring a highly available SAP HANA system on Bare Metal Solution, see Configuring high-availability clusters.

Floating IP address

A high-availability custer uses a floating or virtual IP address (VIP) to direct network communication to the active SAP HANA system. When configuring your VIP, use the standard IPaddr2 Pacemaker resource. The following example shows an IPaddr2 resource definition on SUSE:

crm configure primitive rsc_ip_HA1_HDB10 IPaddr2 \
    params ip=10.0.0.79 \
    op monitor interval=10 timeout=20

Configure the IPaddr2 resource with a colocation relationship with the HANA database so that it moves with the active database on a failover. For example:

colocation col_saphana_ip_HA1_HDB10 2000: rsc_ip_HA1_HDB10:Started \
   msl_SAPHana_HA1_HDB10:Master

Configure the fencing device

The following high-level steps help you configure a fencing resource for your high availability cluster that uses the fence_gce agent that is included with your Linux operating system.

  1. In your Google Cloud project, assign an IAM role that includes the baremetalsolution.service.resetInstance permission to a new or existing IAM service account for which you have the JSON key file.

    The predefined role roles/baremetalsolution.editor includes the required permission or you can create a custom role for more granular control over the permissions that the role includes.

    For more information, see:

  2. Upload the service account JSON key file to all Bare Metal Solution servers in the high-availability cluster.

  3. Confirm that your version of the fence_gce agent supports Bare Metal Solution.

    1. SSH into your Bare Metal Solution server

    2. Display the fence_gce agent help:

      $ sudo fence_gce --help
    3. In the fence_gce help, look for the following properties:

      --baremetalsolution            Enable on bare metal
      ...
      --serviceaccount=[filename]    Service account json file location e.g.
                                         serviceaccount=/somedir/service_account.json
      

      If you do not see both the --baremetalsolution and --serviceaccount=[filename] properties, you need to update the agent. Contact Google Cloud Support for patching instructions. The patching procedure differs depending on which Linux version you are using.

  4. Specify the fence_gce agent as your fencing device on each cluster node when you configure the cluster resources according to the clustering instructions that are provided by your operating system vendor.

    When you define the resource, specify the following fence_gce parameters to enable the agent for the Bare Metal Solution environment:

    • baremetalsolution="true"
    • serviceaccount="file_path/key_file.json"

    The following example shows a fence_gce fencing device resource that is defined on SUSE:

    crm configure primitive STONITH-"server_name" stonith:fence_gce \
     op monitor interval="300s" timeout="60s" on-fail="restart" \
     op start interval="0" timeout="60s" onfail="restart" \
     params port="server_name" zone="Google_Cloud_zone" project="Google_Cloud_project_ID" \
       baremetalsolution="true" method="cycle" \
       serviceaccount="file_path/key_file.json"

    The fencing resource example uses the following definitions:

    Definition Explanation
    baremetalsolution=true Configures the fencing agent for operation in the Bare Metal Solution environment.
    serviceaccount=file_path/key_file.json The file path to the JSON key file that contains the key for the service account that the fencing agent uses to access the Google Cloud APIs.
    port=server_name The original host name of the Bare Metal Solution server that the fencing device can reset.
    method=cycle Defines the method to use for resetting the failed server.
  5. After you define each fencing resource, set the location of the fencing device to a server other than the server that you intend it to reset:

    crm configure location LOC_STONITH_server_name STONITH-server_name -inf: server_name

Installing the Backint agent

If you choose to use the Backint agent, install it on the SAP HANA host machine the same way that you would in an on-premises environment.

As described in the Backint agent installation guide, you need to create a service account on Google Cloud and provide the service account key to the Backint agent on the SAP HANA host machine.

For installations instructions, see Cloud Storage Backint agent for SAP HANA installation guide.

Installing the monitoring agent for SAP HANA

To install the monitoring agent for SAP HANA, install the agent on the SAP HANA host machine the same way that you would in an on-premises environment.

As described in the monitoring agent for SAP HANA installation guide, you need to create a service account on Google Cloud and provide the service account key to the monitoring agent for SAP HANA on the SAP HANA host machine.

For installations instructions, see monitoring agent for SAP HANA installation and operation guide.

Restarting your Bare Metal Solution server

You can restart your Bare Metal Solution server by issuing the resetInstance API call, which initiates an ungraceful, hard reset of the server.

Before restarting a server, stop all applications and databases that are running on the server.

For instructions on enabling the Bare Metal Solution API and issuing the resetInstance API call, see Restarting a Bare Metal Solution machine.

Troubleshooting

If you experience problems with the Bare Metal Solution machine, storage, or network, capture and collect the following information and contact Google Cloud support:

  • The exact time that the issue occurred
  • What you expected to happen and what actually happened
  • All relevant logs, traces, and other diagnostic information that might be relevant, such as an extract from /var/log/messages

If the issue is related to a high-availability configuration, gather information relevant to your clustering software, such as:

  • Logs such as pacemaker.log and corosync.log
  • The date and the approximate time that the issue occurred.
  • A full system dump of the SYSTEM and tenant databases.
  • A fail count for all resources on each Pacemaker node.

If you are having issues with a RHEL HA cluster, gather the following information from both cluster nodes and contact support:

  • List the running Pacemaker processes:

    ps axf | grep pacemaker

  • Install the sos tool and generate an sosreport. For more information, see What is an sosreport and how to create one in Red Hat Enterprise Linux?:

    • Install the sos tool
      yum install -y sos
    • Run the sos tool on all nodes:
      sosreport -o logs, corosync, pacemaker -k pacemaker.crm_from="yyyy-mm-dd hh:mm:ss"
  • If you are unable to install the sos tool, provide a copy of /etc/corosync/corosync.conf, the Corosync configuration file, from all systems.

If you are having issues with a SLES HA cluster, gather the following information from both cluster nodes and contact support:

  • Run the following commands and include the results:
    ps axf | grep pacemaker
    supportconfig -l
    hb_report -f "yyyy/mm/dd hh:mm" -v
    crm config show | grep primitive | awk '{print $2}' | xargs -L 1 -I "{}" crm resource failcount {} show node-name

Support

For issues with Google Cloud infrastructure or services, contact Google Cloud Support. You can find contact information on the Support Overview page in the Google Cloud Console. If Google Cloud Support determines that a problem resides in your SAP systems, you are referred to SAP Support.

For SAP product-related issues, log your support request with SAP support. SAP evaluates the support ticket and, if it appears to be a Google Cloud infrastructure issue, transfers the ticket to the Google Cloud component BC-OP-LNX-GOOGLE or BC-OP-NT-GOOGLE.

Support requirements

Before you can receive support for SAP systems and the Google Cloud infrastructure and services that they use, you must meet the minimum support plan requirements.

For more information about the minimum support requirements for SAP on Google Cloud, see: