Set up Google Cloud's Agent for SAP

Workload Manager for SAP solutions uses Google Cloud's Agent for SAP to detect and collect metadata for evaluating your SAP system configurations. The Agent for SAP, along with the SAP Host Agent, are required on all VM instances that run SAP systems for support and monitoring of your SAP systems running on Google Cloud, including SAP NetWeaver, SAP HANA, SAP ASE, and SAP MaxDB.

This document shows how to install, configure, and verify Google Cloud's Agent for SAP.

Required IAM roles

Google Cloud's Agent for SAP requires an Identity and Access Management (IAM) service account for authentication with Google Cloud and for permission to access Google Cloud resources. For the Workload Manager validation metrics, whether you use a new, existing, or default service account, the service account must include the following IAM roles:

For more information about the required IAM roles for installing Google Cloud's Agent for SAP, see Prerequisites for the agent.

For more information about the required IAM roles for Workload Manager validation metrics collection, see Configure Google Cloud's Agent for SAP on Linux.

Install the agent

If not already done, then install Google Cloud's Agent for SAP on your SAP system.

For example, here is how the agent is installed on RHEL:

sudo tee /etc/yum.repos.d/google-cloud-sap-agent.repo << EOM
[google-cloud-sap-agent]
name=Google Cloud Agent for SAP
baseurl=https://packages.cloud.google.com/yum/repos/google-cloud-sap-agent-el$(cat /etc/redhat-release | cut -d . -f 1 | tr -d -c 0-9)-\$basearch
enabled=1
gpgcheck=0
repo_gpgcheck=1
gpgkey=https://packages.cloud.google.com/yum/doc/yum-key.gpg https://packages.cloud.google.com/yum/doc/rpm-package-key.gpg
EOM
sudo yum install google-cloud-sap-agent

After the installation is complete, proceed to enable the collection of Workload Manager validation metrics.

Enable the collection of Workload Manager validation metrics

Configure the agent to enable the collection of Workload Manager validation metrics.

To configure the agent, complete the following steps:

  1. Enable the collection of Workload Manager validation metrics using one of the following methods:

    • Run the following command: 

      sudo sed -i 's/"collect_workload_validation_metrics": false/"collect_workload_validation_metrics": true/' /etc/google-cloud-sap-agent/configuration.json

    • Or, in the agent's configuration file, set the property collect_workload_validation_metrics to true. For more information about the configuration steps, see Configure the agent on Linux.

  2. Optional: To enable the security validation rules in Workload Manager, add the workload_validation_db_metrics_config section after collect_workload_validation_metrics in the agent's configuration file, and then specify the following properties:

    • hana_db_user: specify the user account that is used to query the SAP HANA instance.
    • hana_db_password_secret_name: specify the name of the secret in Secret Manager that stores the user account's password.
    • hostname: specify the identifier for the machine, either local or remote, that hosts your SAP HANA instance.
    • port: specify the port on which your SAP HANA instance accepts queries.

    For information about these properties, see Configuration properties.

  3. Restart the agent for the new settings to take effect: 

    sudo systemctl restart google-cloud-sap-agent

    After the agent successfully restarts, the agent starts sending the Workload Manager validation metrics to Workload Manager.

Verify agent installation and metrics collection

To verify that the agent is installed and running on your SAP system, run the following command:

systemctl status google-cloud-sap-agent

If the agent is functioning properly, then the output contains active (running).

Once you have verified that the agent is functioning properly, verify that the agent collects Workload Manager metrics by searching for the following log statement in the agent's log file:

[INFO] Collecting workload metrics...

The log file is available at the following location:

/var/log/google-cloud-sap-agent.log

What's next