sap host agent 20122012

SAP Library

SAP Host Agent 206 1

HELPX.HOST_AGENT

SAP Host Agent

PUBLIC | CUSTOMER | INTERNAL | CONFIDENTIAL | STRICTLY CONFIDENTIALDocument Version: 206 – <Date>

SAP Library


Copyright© Copyright 2012 SAP AG. All rights reserved.

SAP Library document classification: PUBLICNo part of this publication may be reproduced or transmitted in any form or for any purposewithout the express permission of SAP AG. The information contained herein may bechanged without prior notice.No part of this publication may be reproduced or transmitted in any form or for any purposewithout the express permission of SAP AG. The information contained herein may bechanged without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietarysoftware components of other software vendors.

Microsoft, Windows, Excel, Outlook, PowerPoint, Silverlight, and Visual Studio are registeredtrademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x,System z, System z10, z10, z/VM, z/OS, OS/390, zEnterprise, PowerVM, Power Architecture,Power Systems, POWER7, POWER6+, POWER6, POWER, PowerHA, pureScale, PowerPC,BladeCenter, System Storage, Storwize, XIV, GPFS, HACMP, RETAIN, DB2 Connect, RACF,Redbooks, OS/2, AIX, Intelligent Miner, WebSphere, Tivoli, Informix, and Smarter Planet aretrademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the United States and other countries.Adobe, the Adobe logo, Acrobat, PostScript, and Reader are trademarks or registeredtrademarks of Adobe Systems Incorporated in the United States and other countries.

Oracle and Java are registered trademarks of Oracle and its affiliates.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin aretrademarks or registered trademarks of Citrix Systems Inc.

HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C®, WorldWide Web Consortium, Massachusetts Institute of Technology.

Apple, App Store, iBooks, iPad, iPhone, iPhoto, iPod, iTunes, Multi-Touch, Objective-C,Retina, Safari, Siri, and Xcode are trademarks or registered trademarks of Apple Inc.

IOS is a registered trademark of Cisco Systems Inc.

RIM, BlackBerry, BBM, BlackBerry Curve, BlackBerry Bold, BlackBerry Pearl, BlackBerryTorch, BlackBerry Storm, BlackBerry Storm2, BlackBerry PlayBook, and BlackBerry AppWorld are trademarks or registered trademarks of Research in Motion Limited.

Google App Engine, Google Apps, Google Checkout, Google Data API, Google Maps,Google Mobile Ads, Google Mobile Updater, Google Mobile, Google Store, Google Sync,Google Updater, Google Voice, Google Mail, Gmail, YouTube, Dalvik and Android aretrademarks or registered trademarks of Google Inc.

INTERMEC is a registered trademark of Intermec Technologies Corporation.

Wi-Fi is a registered trademark of Wi-Fi Alliance.

Bluetooth is a registered trademark of Bluetooth SIG Inc.

Motorola is a registered trademark of Motorola Trademark Holdings LLC.

SAP Library


Computop is a registered trademark of Computop Wirtschaftsinformatik GmbH.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer,StreamWork, SAP HANA, and other SAP products and services mentioned herein as well astheir respective logos are trademarks or registered trademarks of SAP AG in Germany andother countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, CrystalDecisions, Web Intelligence, Xcelsius, and other Business Objects products and servicesmentioned herein as well as their respective logos are trademarks or registered trademarks ofBusiness Objects Software Ltd. Business Objects is an SAP company.

Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybaseproducts and services mentioned herein as well as their respective logos are trademarks orregistered trademarks of Sybase Inc. Sybase is an SAP company.

Crossgate, m@gic EDDY, B2B 360°, and B2B 360° Services are registered trademarks ofCrossgate AG in Germany and other countries. Crossgate is an SAP company.

All other product and service names mentioned are the trademarks of their respectivecompanies. Data contained in this document serves informational purposes only. Nationalproduct specifications may vary.

These materials are subject to change without notice. These materials are provided by SAPAG and its affiliated companies ("SAP Group") for informational purposes only, withoutrepresentation or warranty of any kind, and SAP Group shall not be liable for errors oromissions with respect to the materials. The only warranties for SAP Group products andservices are those that are set forth in the express warranty statements accompanying suchproducts and services, if any. Nothing herein should be construed as constituting anadditional warranty.

SAP Library


Icons in Body TextIcon Meaning

Caution

Example

Note

Recommendation

Syntax

Additional icons are used in SAP Library documentation to help you identify different types ofinformation at a glance. For more information, see Help on Help General InformationClasses and Information Classes for Business Information Warehouse on the first page of anyversion of SAP Library.

Typographic ConventionsType Style DescriptionExample text Words or characters quoted from the screen. These include field names, screen

titles, pushbuttons labels, menu names, menu paths, and menu options.Cross-references to other documentation.

Example text Emphasized words or phrases in body text, graphic titles, and table titles.EXAMPLE TEXT Technical names of system objects. These include report names, program

names, transaction codes, table names, and key concepts of a programminglanguage when they are surrounded by body text, for example, SELECT andINCLUDE.

Example text Output on the screen. This includes file and directory names and their paths,messages, names of variables and parameters, source text, and names ofinstallation, upgrade and database tools.

Example text Exact user entry. These are words or characters that you enter in the systemexactly as they appear in the documentation.

<Example text> Variable user entry. Angle brackets indicate that you replace these words andcharacters with appropriate entries to make entries in the system.

EXAMPLE TEXT Keys on the keyboard, for example, F2 or ENTER.

SAP Library


SAP Host Agent .................................................................................................................... 61 Architectural Overview of SAP Host Agent ...................................................................... 72 SAP Host Agent Change Log ........................................................................................ 103 Downloading the SAPHOSTAGENT Archive ................................................................. 104 SAP Host Agent Installation .......................................................................................... 11

4.1 Manual Installation of SAP Host Agent .................................................................... 124.1.1 Manually Installing SAP Host Agent on Windows .............................................. 124.1.2 Manually Installing SAP Host Agent on UNIX ................................................... 134.1.3 Manually Installing SAP Host Agent on IBM i .................................................... 15

4.2 Installing SAP Host Agent Using Software Provisioning Manager 1.0 ...................... 174.3 Uninstalling SAP Host Agent ................................................................................... 17

5 SAP Host Agent Upgrade.............................................................................................. 185.1 Automated Upgrade of SAP Host Agent .................................................................. 18

5.1.1 Configuring the Automated Upgrade Behavior of SAP Host Agent .................... 195.1.2 Avoiding Incomplete Upgrade of SAP Host Agent ............................................. 205.1.3 Configuring Delayed Auto-Upgrade of SAP Host Agent to Avoid NetworkBottlenecks ............................................................................................................... 20

5.2 Manual Upgrade of SAP Host Agent ....................................................................... 215.2.1 Manually Upgrading SAP Host Agent on Windows ........................................... 225.2.2 Manually Upgrading SAP Host Agent on UNIX ................................................. 235.2.3 Manually Upgrading SAP Host Agent on IBM i.................................................. 25

6 SAP Host Agent Configuration ...................................................................................... 276.1 Registering Hosts with the SLD Using sldreg .......................................................... 276.2 SSL Configuration for the SAP Host Agent.............................................................. 29

6.2.1 Configuring SSL for SAP Host Agent on Windows ............................................ 296.2.2 Configuring SSL for SAP Host Agent on UNIX .................................................. 316.2.3 Configuring SSL for SAP Host Agent on IBM i .................................................. 34

6.3 Configuring SAP Host Ageht User sapadm as a Domain User ................................ 377 SAP Host Agent Reference ........................................................................................... 38

7.1 SAP Host Agent Reference – Command Line Options of the saphostexec Executable .................................................................................................................................... 387.2 SAP Host Agent Reference – Command Line Options of the hostexecstartExecutable ................................................................................................................... 39

SAP Library


SAP Host Agent

SAP Host Agent is installed automatically during the installation of new SAP instances basedon SAP NetWeaver 7.0 Enhancement Package 2 or higher. SAP Host Agent is upgradedautomatically as part of the SAP instance, when you patch or upgrade the SAP kernel.However, you can also install and upgrade SAP Host Agent independently from an SAPinstance.

You only need to install SAP Host Agent separately in the following cases:

There is no SAP system or instance on the host.

The SAP system running on the host is based on a release lower than SAPNetWeaver 7.0 including Enhancement Package 2 or SAP NetWeaver 7.2 and thehost does not yet have an SAP Host Agent.

You have upgraded your SAP system to a release higher than SAP NetWeaver 7.0including Enhancement Package 2 or SAP NetWeaver 7.2 and the upgraded systemdoes not yet have an SAP Host Agent.

FeaturesSAP Host Agent provides you with the following features:

SAP instance discovery and inventory

SAP instance control

Database monitoring and management

System or instance provisioning:

o Hosting the infrastructure of SAP NetWeaver Landscape VirtualizationManagement (LVM), formerly known as SAP NetWeaver AdaptiveComputing Controller (ACC)

o Hosting software lifecycle (SL) tools interfaces

Operating system monitoring:

o Using saposcol

o Using Common Information Model (CIM) based infrastructures

IBM i-specific features:

o Dynamically adopted authorization for SAP kernel 7.20 and higher

o SAP ILE daemon (SAPILED)

o SAP Database Performance Collector for IBM i

More InformationArchitectural Overview of SAP Host Agent [Page 7]

SAP Host Agent Change Log [Page 10]

SAP Host Agent Installation [Page 11]

SAP Library


SAP Host Agent Upgrade [Page 18]

SAP Host Agent Configuration [Page 27]

1 Architectural Overview of SAP Host Agent

The following graphics provide an overview about SAP Host Agent and its components.

Hosthost_profile

UserSAPadm

LocalSocket saposcol

sapacosprep

controlsSAPHostExec

SAP Host Agent Architecture

UNIX: Userroot

or LocalSystem Account

SAPHostControl(sapstartrsv in host mode)

WebService

Clients

IBM i: User with*SECADM and *ALLOBJ

authorizarions( for example QSECOFR )

Windows:Local

Administrator DB4STATS (IBM i)

SAPILED (IBM i)

Overview of the Architecture of SAP Host Agent

Executables and ServicesThe executable directory of SAP Host Agent is in the following location:

UNIX:

/usr/sap/hostctrl/exe

Windows:

%ProgramFiles%\SAP\hostctrl\exe

IBM i:

/usr/sap/hostctrl/exe and objects in library R3SAP400

SAP Host Agent has the following executable programs and services:

The control program saphostexec

saphostexec is an executable program that runs under root (UNIX) or theLocalSystem account (Windows). It controls all of the functions for which a specialuser of this type is required, such as the operating system collector saposcol and

SAP Library


sapacosprep. It is connected to sapstartsrv in host mode (see below) using alocal socket, which ensures quick and secure communication and is also startedduring the startup of the host.

The operating system collector saposcol

The SAP NetWeaver management agent saphostcontrol (sapstartsrv in hostmode)

saphostcontrol is the executable sapstartsrv running in host mode under usersapadm. It is therefore not responsible for an SAP instance, but for any monitoringjobs on the host that is to be monitored centrally.

The profile that is used when the executable is started determines whethersapstartsrv runs in host or in instance mode. In instance mode, it runs with theinstance profile of the corresponding instance, in host mode with its own host profile.

SAPHostControl contains the functionality of the previous CCMS agentSAPCCMSR, that is, the agent that monitors hosts. For more information, seeCentral Monitoring with SAP NetWeaver Management Agents in the SAPNetWeaver Application Server ABAP (AS ABAP) documentation.

sapacosprep

sapacosprep is an executable program of the Adaptive Computing Infrastructurethat, for example, mounts the file systems and activates the IP addresses.

DB4STATS program and command (IBM i only )

The DB4STATS program and command are partly contained in the R3SAP400 library.They provide the SAP Database Performance Collector for IBM i. You can find adetailed description of this collector in SAP Note 1622665 and in the documentationattached to this SAP Note.

SAPILED (IBM i only )

The SAP ILE daemon is needed to update ILE components (objects in libraries) fromthe patch archive after installing a SAP kernel patch. You can find a detaileddescription of the SAP ILE daemon in SAP Note 1637588.

The installed programs are started automatically when the host is booted.

On Windows hosts, this is done by the services SAPHostControl andSAPHostExec.

On UNIX hosts the automatic start is ensured by the startup script sapinit thatstarts the required executables.

On IBM i, the programs are started by the auto-start job entry SAPINIT in subsystemQUSRWRK, which was created during the installation.

http://service.sap.com/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=1622665&_NLANG=en&_NVERS=0


SAP Library


Profile FileThe profile parameters of SAP Host Agent are stored in the host_profile file. This file islocated in the executable directory of SAP Host Agent (see Executables and Services above).

Working DirectoryThe working directory of SAP Host Agent is in the following location:

UNIX and IBM i: /usr/sap/hostctrl/work

Windows: %ProgramFiles%\SAP\hostctrl\work

The working directory contains, among other things, the following configuration files:

CSMCONF

Start file for the agents that contains connection data for the central monitoringsystem

SAPCCMSR.INI

Contains information about the extent to which plug-ins, log files, and SAPOSCOLinformation should be considered; this file is read when the agent is started. For moreinformation, see Parameters of the SAPCCMSR.INI Configuration File in the SAPNetWeaver Application Server ABAP (AS ABAP) documentation.

In an ABAP system, you can display all files in the working directory of SAP Host Agent in thecentral monitoring system. You can use transaction RZ21 to do this. In the Topology groupbox, select one of the Agents for… radio buttons. The Monitoring: Display Technical Topologyscreen appears. Now select SAP Host Agent and then choose Working Directory of theAgent. The system displays the files of the directory. To display the contents of a file, choosethe file by double-clicking it.

Log FilesThe following log files are created during runtime for SAP Host Agent. They are available inthe working directory of SAP Host Agent:

sapstartsrv_ccms.log

This log file is for central monitoring. It is stored in subdirectory sapccmsr of theworking directory.

sapstartsrv.log

Contains the developer trace for sapstartsrv

dev_saphostexec.log

Contains the developer trace for saphostexec.

A log file is also created during runtime for SAP Host Agent with the namesapstartsrv_ccms.log, and log files are created for RFC communication. The log file isstored in subfolder sapccmsr of the working directory.

AL FilesFor system instances, the AL* files (ALMTTREE, ALPERFHI, and ALALERTS) are in the$DIR_LOGGING directory. These files contain the monitoring segment data. This data issaved every 30 minutes during running operation and when the instance is shutdown, and isread again when the instance is started.

SAP Library


SAP Host Agent has its own monitoring segment, for which the AL* files are in the directory/usr/sap/tmp (on UNIX and IBM i) or \\<host>\usr\sap\PRFCLOG (on Windows).

More InformationSAP Host Agent Installation [Page 11]



2 SAP Host Agent Change Log

Some features are only available as of a certain SP version of the SAP Host Agent archive.SAP recommends that you use the highest SP version, even if you want to monitor acomponent of SAP NetWeaver with a lower release.

Feature Description Availableas of

Automated upgrade SAP Host Agent is enabled to check forupdates automatically and get upgradedif a version of the SAP Host Agentexecutable is found that is higher thanthe existing one.

For more information, see AutomatedUpgrade of SAP Host Agent [Page 18].

SAPHOSTAGENT7.20SP45

sapcrypto library and commandline tool sapgenpse alreadycontained in theSAPHOSTAGENT<version>.SARarchive

The sapcrypto library and thecommand line tool sapgenpse arealready contained in theSAPHOSTAGENT<version>.SARarchive.

For more information, see SSLConfiguration for the SAP Host Agent[Page 29].


Command line option -archive With the –archive option you can usethe saphostexec executable programof the existing SAP Host Agent for theupgrade while providing the direct path tothe SAPHOSTAGENTSP-<targetversion>.SAR archive. You then do notneed to manually decompress thearchive before.

For more information, see ManualUpgrade of SAP Host Agent [Page 21].


3 Downloading the SAPHOSTAGENT Archive

SAP Library


The SAPHOSTAGENT<SP-version>.SAR archive contains all of the required elements forcentrally monitoring any host. It is automatically installed during the installation of SAPsystems, instances, or components based on SAP NetWeaver 7.0 EHP 2 and higher. Youonly need to download SAPHOSTAGENT<SP-version>.SAR separately in the followingcases:

You want to install or upgrade SAP Host Agent on a host without an SAP system,instance, or component.

You want to install or upgrade SAP Host Agent on a host with SAP systems,instances, or components that are based on SAP R/3 or on an SAP NetWeaverrelease lower than SAP NetWeaver 7.0 EHP 2 or SAP NetWeaver 7.2.

Procedure1. Go to the SAP Software Distribution Center of the SAP Service Marketplace at

http://service.sap.com/swdc.

2. Log on with your SAP Service Marketplace ID.

3. In the navigation bar, choose SAP Software Download Center Support Packagesand Patches Browse our Download Catalog SAP Technology Components SAPHOST AGENT SAP HOST AGENT 7.20 <operating system> .

4. Select the appropriate SAPHOSTAGENT <SP-version>.SAR archive from theDownload tab.

Always select the highest SP version of the SAPHOSTAGENT<SP-version>.SAR archive, even if you want to monitor a component of SAPNetWeaver with a lower release.

5. Make sure that the SAPCAR tool is available on the host where you want to installSAP Host Agent.

You need the SAPCAR tool in order to be able to decompress theSAPHOSTAGENT<SP-version>.SAR archive. For more information about SAPCARand how to get it, see SAP Note 212876.

More InformationManual Installation of SAP Host Agent [Page 12]

Manual Upgrade of SAP Host Agent [Page 21]

4 SAP Host Agent Installation

SAP Host Agent is installed automatically during the installation of all new SAP systeminstances based on SAP NetWeaver 7.0 including Enhancement Package 2 or higher.

You only need to install SAP Host Agent separately in the following cases:

There is no SAP system or instance on the host.

The SAP system running on the host is based on SAP NetWeaver 7.0 includingEHP1 or lower.

http://service.sap.com/swdc


SAP Library


You have upgraded your SAP system to SAP NetWeaver 7.0 including EnhancementPackage 2 or higher and the upgraded system does not yet have an SAP Host Agent.

More InformationManual Installation of SAP Host Agent []

Installing SAP Host Agent Using Software Provisioning Manager [Page 17]

4.1 Manual Installation of SAP Host Agent

You can install SAP Host Agent manually by executing the saphostexec executable withoption –install from the decompressed SAPHOSTAGENT<SP-version>.SAR archive.

More InformationManually Installing SAP Host Agent on Windows [Page 22]

Manually Installing SAP Host Agent on UNIX [Page 13]

Manually Installing SAP Host Agent on IBM i [Page 15]

4.1.1 Manually Installing SAP Host Agent onWindows


Prerequisites You are logged on as a member of the local Administrator group.

You have downloaded the SAPHOSTAGENT<SP-version>.SAR archive.

You have installed the specified Microsoft security patch in accordance with theinstructions in SAP Note 1375494. You also need to install the latest version of theMicrosoft Runtime used by SAP as described in SAP Note 684106.

Procedure1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archive to a temporary

directory, for example c:\temp\hostagent.

2. Decompress the SAPHOSTAGENT<SP-version>.SAR archive with the SAPCAR toolto this directory. Take SAP Note 212876 into account when doing so. You normallyuse the following command for decompression, and execute it in the directory of thearchive:

sapcar.exe -xvf SAPHOSTAGENT<SP-version>.SAR

sapcar.exe -xvf SAPHOSTAGENT126_126-20005735.SARc:\temp\hostagent




SAP Library


Among others, the archive contains the saphostexec.exe program.

3. Change to the directory to which you have decompressed SAPHOSTAGENT<SP-version>.SAR.

cd \temp\hostagent

4. Start the installation by entering the following command:

saphostexec.exe -install

The progress of the installation is displayed on the command line.

5. When you are prompted, enter the password for the sapadm user.

o If user sapadm does not yet exist, it is automatically created as a local userand you are prompted to enter a password for this user to be created.

o If user sapadm already exists, you are prompted for the password of thisexisting user, regardless of whether sapadm is available as a local user or asa domain user.

6. After the installation you can delete the temporary directory with all its content:

del /s "C:\temp"

Result After the installation has finished successfully, SAP Host Agent is up and running.

You have installed and started the following units on your host:

o The control program saphostexec

o The operating system collector saposcol

o The SAP NetWeaver Management agent SAPHostControl (sapstartsrvin host mode)

If you use System Landscape Directory (SLD), register the host with the SLD afterinstalling SAP Host Agent. You need this data in the SLD, for example, for using theAdaptive Computing Infrastructure.

More InformationDownloading the SAPHOSTAGENT Archive [Page 10]

4.1.2 Manually Installing SAP Host Agent on UNIX

SAP Library



Prerequisites You are logged on as a user with root authorization.


Procedure1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archive to a temporary

directory, for example /tmp/hostagent.

2. Decompress the SAPHOSTAGENT<SP-version>.SAR archive with the SAPCAR toolto this directory. Take SAP Note 212876 into account when doing so. Normally, youuse the following command for decompression, and execute it in the directory of thearchive:

./sapcar -xvf SAPHOSTAGENT<SP-version>.SAR

./sapcar -xvf SAPHOSTAGENT126_126-20005735.SAR/tmp/hostagent

The archive also contains the saphostexec program.

3. Change to the directory to which you have decompressed SAPHOSTAGENT<SP-version>.SAR.

cd /tmp/hostagent

4. Start the installation by entering the following command:

./saphostexec -install

The progress of the installation is displayed on the command line.

5. After the installation you can delete the temporary directory.

rm -rf /tmp/hostagent

6. The administrator user sapadm of the SAP Host Agent was created during theinstallation, but it did not get assigned a password. You can assign a password touser sapadm by entering the following command:

passwd sapadm

Result After the installation has successfully finished, SAP Host Agent is up and running.


SAP Library






If you use System Landscape Directory (SLD), register the host with the SLD afterinstalling SAP Host Agent (see Registering Hosts with the SLD Using sldreg [Page27]). You need this data in the SLD, for example, for using the Adaptive ComputingInfrastructure.


4.1.3 Manually Installing SAP Host Agent on IBM i


Prerequisites You must be logged on as a user profile with special authorities *SECADM and

*ALLOBJ, for example as user profile QSECOFR.


Option 33 of the operating system must be installed. Use menu GO LICPGM to checkwhether the option is installed and install it if required.

If option 33 of the operating system was installed during this step, we recommendthat you install the latest PTFs for your operating system release according to SAPNote 83292.

The system startup program (specified in system value QSTRUPPGM) must contain theSTRBS command to start subsystem QSYS/QUSRWRK. This is needed becauseSAPHOSTAGENT will be started as an auto-start job in subsystem QSYS/QUSRWRK.

If user profile R3GROUP does not exist on your server, it will be created during theinstallation of the SAPHOSTAGENT<SP-version>.SAR archive. If you have alreadyinstalled SAP systems on other servers, we recommend that you use the same groupID (GID) for all sapsys and R3GROUP groups in the system landscape. To obtain thegroup ID (GID) for R3GROUP on another IBM i server in your landscape, enter thecommand DSPUSRPRF USRPRF(R3GROUP) and scroll down until you see the valuefor Group ID number.

Procedure1. If it does not exist on your server, create the directory /tmp/hostctrl and then

copy or move the downloaded archive SAPHOSTAGENT<SP-version>.SAR andSAPCAR to the directory /tmp/hostctrl.


SAP Library


This documentation refers to the directory /tmp/hostctrl in some of thesteps below. If you want to use a different directory, you have to adjust thecommands appropriately.

2. Enter the command CALL PGM(QP2TERM) to start a PASE interactive terminalsession.

3. Make the directory that contains SAPCAR and the archive SAPHOSTAGENT<SP-version>.SAR your current directory using the following command:

cd /tmp/hostctrl

4. Decompress the archive SAPHOSTAGENT<SP-version>.SAR with the SAPCAR toolusing the following command:

./SAPCAR -xvf SAPHOSTAGENT<SP-version>.SAR

./SAPCAR -xvf SAPHOSTAGENT126_126-20005735.SAR/tmp/hostctrl

Among others, the archive contains the saphostexec program.

5. To install saphostcontrol enter the following command:

./saphostexec –install –gid <gid>

If you have already installed SAP systems on other servers, we recommendthat you use the same group ID (GID) for all sapsys or R3GROUP groups inthe system landscape. To do this, enter your landscape system GID into<gid> on the above command. If user profile R3GROUP already exists, or ifyou want the saphostcontrol installation to automatically generate a newgroup ID, enter the command saphostexec –install without the addition–gid <gid>.

6. Leave the PASE interactive terminal session using function key F3.

If it did not already exist, R3GROUP was created during the installation. Eventhough SAP Host Agent does not require special authorities, we recommendthat you grant the required authorities for system API’s that need to beauthorized for user profile R3GROUP for your SAP system now. For moreinformation, see SAP Note 175852.

Result After the installation has finished successfully, SAP Host Agent is up and running.




SAP Library



o The SAP ILE daemon SAPILED


o The SAP Database Performance Collector for IBM i, if the/usr/sap/sapservices file contains the related entry as described inSAP Note 1622665.

If you use System Landscape Directory (SLD), register the host with the SLD afterinstalling SAP Host Agent (see Registering Hosts with the SLD Using sldreg [Page27]). You need this data in the SLD, for example, for using the Adaptive ComputingInfrastructure.


4.2 Installing SAP Host Agent Using SoftwareProvisioning Manager 1.0

You can also install SAP Host Agent using software provisioning manager 1.0(formerly known as SAPinst). The required files are on the kernel medium for the currentrelease.

ProcedureProceed as described in section Installing SAP Host Agent Separately in the documentationInstallation Guide - SAP Systems Based on the Application Server ABAP of SAP NetWeaveron <OS>: <DB>- Using Software Provisioning Manager 1.0 at:

http://service.sap.com/instguidesnw <Release> Installation

4.3 Uninstalling SAP Host Agent

You can uninstall SAP Host Agent by running the saphostexec executable from thecommand line.

PrerequisitesWindows: You must be logged on as a member of the local Administrators group.

UNIX: You must be logged on as a user with root authorizations.

IBM i: You must be logged on as a user profile with special authorities *SECADM and*ALLOBJ, for example as user profile QSECOFR.

Procedure1. IBM i: Enter the command CALL PGM(QP2TERM) to start a PASE interactive terminal

session.

2. Change to the directory of the saphostexec executable:


http://service.sap.com/instguidesnw

SAP Library


o UNIX, IBM i: cd /usr/sap/hostctrl/exe

o Windows: cd %ProgramFiles%\SAP\hostctrl\exe

3. Run the following command from the command line:

o UNIX, IBM i: ./saphostexec -uninstall

o Windows: saphostexec.exe -uninstall

ResultThis command stops the executables and services and deletes the following:

The working directory of SAP Host Agent

The local sapadm user

UNIX: It does not delete the sapsys group assigned to user sapadm.

IBM i: It does not delete the group profile R3GROUP.

Windows: The local SAP_LocalAdmin group

More InformationReference – Command Line Options of the saphostexec Executable [Page 38]

5 SAP Host Agent Upgrade

SAP Host Agent is automatically installed during the installation of all new SAP systeminstances based on SAP NetWeaver 7.0 including Enhancement Package 2 or higher. As partof the SAP instance, SAP Host Agent is upgraded automatically when you patch or upgradethe SAP kernel. However, you can also upgrade SAP Host Agent independently from the SAPinstance.

We recommend that you configure automated upgrade for SAP Host Agent. If required, youcan also manually upgrade SAP Host Agent.

More InformationAutomated Upgrade of SAP Host Agent []


5.1 Automated Upgrade of SAP Host Agent

SAP Host Agent is enabled to check for updates automatically and get upgraded if a versionof the SAP Host Agent executable is found that is higher than the existing one.

SAP Library


More InformationConfiguring the Automated Update Behavior of SAP Host Agent []

Avoiding Incomplete Upgrade of SAP Host Agent [Page 20]

Configuring Delayed Auto-Upgrade of SAP Host Agent to Avoid Network Bottlenecks[Page 20]


5.1.1 Configuring the Automated UpgradeBehavior of SAP Host Agent

The running saphostexec executable regularly checks a directory, by default/usr/sap/hostctrl/new (on UNIX and IBM i) or%ProgramFiles%\SAP\hostctrl\new (on Windows), where it expects to find the latestversion of the executable of SAP Host Agent from the unpacked SAPHOSTAGENT.SARarchive. An upgrade is only performed if a version of the SAP Host Agent executableprograms is found in the new directory that is higher than the version of the executableprograms that exist in the SAP Host Agent executable directory.

PrerequisitesWindows: You must be logged on as a member of the local Administrators group.



ProcedureYou can configure the automated upgrade behavior by adapting the host_profile file inthe $DIR_EXECUTABLE directory, where $DIR_EXECUTABLE is the path to the directorywhere the executables saphostcontrol and saphostexec of SAP Host Agent arelocated: /usr/sap/hostctrl/exe (UNIX and IBM i),%ProgramFiles%\SAP\hostctrl\exe (Windows).

By default, the saphostexec program performs a check for updates every 5minutes. You can change this behavior by adapting profile valuehostexec/autoupgrade_delay=<minutes>.

In addition, you can also change the name and path of the directory that contains thenewest SAP Host Agent version using profile value DIR_NEW=<path to adirectory>.

ResultOnce you have changed the SAP Host Agent profile, you need to restart SAP Host Agent inorder to make the changes take effect:

1. IBM i: Enter the command CALL PGM(QP2TERM) to start a PASE interactive terminalsession .

2. Change to the directory of the saphostexec executable.

SAP Library


o /usr/sap/hostctrl/exe (UNIX and IBM i)

o %ProgramFiles%\SAP\hostctrl\exe (Windows)

3. Run the following command to restart SAP Host Agent:

saphostexec -restart

More InformationAvoiding Incomplete Upgrade of SAP Host Agent []

Configuring Delayed Auto-Upgrade to Avoid Network Bottlenecks [Page 20]

Reference – Command Line Options of the saphostexec Executable [Page 38]

5.1.2 Avoiding Incomplete Upgrade of SAP HostAgent

We recommend that you create an empty file called .upgrading in the $DIR_NEW directoryto avoid that saphostexec starts the upgrade procedure during the extraction ofSAPHOSTAGENT.SAR – with the consequence that only part of the newest version of thepackages is upgraded.

Procedure1. Create the .upgrading file in the $DIR_NEW directory.

2. Extract SAPHOSTAGENT.SAR to $DIR_NEW.

3. Remove .upgrading from the $DIR_NEW directory.

Example> cd /usr/sap/hostctrl/new/

> touch .upgrading

> SAPCAR -xvf SAPHOSTAGENT.SAR

> rm .upgrading

5.1.3 Configuring Delayed Auto-Upgrade of SAPHost Agent to Avoid Network Bottlenecks

Within large installations, it normally makes sense to use one single share where the contentof SAPHOSTAGENT.SAR is extracted regularly. With this configuration the simultaneousupgrade of many machines is very easy. Unfortunately, if all machines start to access a singlenetwork share, it could result in a network bottleneck, and in case of a restrictive firewallconfiguration, to a complete outage.

To avoid this kind of problem, for large landscapes you can additionally create a configurationfile within $DIR_NEW, containing the maximum time range of an upgrade. In this case the

SAP Library


various saphostexec processes of the different machines will plan the upgrade in a randomway within a well defined time window.

To configure this capability, proceed as follows:

ProcedureCreate a file in $DIR_NEW called .delay.

The format of the file is as follows: <Value1>random-<Value2>

where

<Value1> represents the number of minutes after an auto-upgrade is checked, and<Value2> the maximum value of minutes after which the auto-upgrade is started.

The real upgrade delay value in minutes is given by: Delay = Value1 +randomValue *Value2

500

Auto-upgrade checks the version of the file contained in $DIR_NEW every500 minutes.

<Value2> is optional and could be omitted.

500random500

Auto-upgrade checks the version of the file contained in $DIR_NEW every500 minutes.

Once the version of SAP Host Agent contained within $DIR_NEW is newer,the upgrade will be started within the next 500 minutes. The exact time whenthe upgrade is started is a random value between 1 and 500 minutes.

5.2 Manual Upgrade of SAP Host Agent

You can upgrade SAP Host Agent from a downloaded SAPHOSTAGENT<SP-version>.SARarchive with a higher version. You perform the upgrade by executing the saphostexecexecutable with the –upgrade option and providing the path to the downloadedSAPHOSTAGENT<SP-version>.SAR archive.

You can use the saphostexec executable either of the existing SAP Host Agent installationor of the downloaded SAPHOSTAGENT<SP-version>.SAR archive. If you use thesaphostexec executable of the existing SAP Host Agent installation, you do not need todecompress the downloaded SAPHOSTAGENT<SP-version>.SAR archive manually butexecute the program with the additional option –archive and provide the direct path to thedownloaded SAPHOSTAGENT<SP-version>.SAR archive.

SAP Library


On UNIX, you can also use the hostexecstart program for upgrading SAP Host Agent asa user without root authorization.

More InformationManually Upgrading SAP Host Agent on Windows []

Manually Upgrading SAP Host Agent on UNIX [Page 23]

Manually Upgrading SAP Host Agent on IBM i [Page 25]

5.2.1 Manually Upgrading SAP Host Agent onWindows



Prerequisites You are logged on as a member of the local Administrator group.

You have downloaded the desired target release version of the SAPHOSTAGENT<SP-version>.SAR archive.

Procedure To upgrade SAP Host Agent using the saphostexec executable of the existing SAP

Host Agent installation, proceed as follows:

1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archive to atemporary directory, for example c:\temp\hostagent.

2. Change to the directory where the saphostexec executable of SAP HostAgent is located:

cd %ProgramFiles%\SAP\hostctrl\exe\

3. Execute the following command:

saphostexec.exe -upgrade -archive <path to downloadedSAPHOSTAGENT<SP-version>.SAR>

saphostexec.exe -upgrade -archivec:\temp\hostagent\SAPHOSTAGENT126_126-20005735.SAR

SAP Library


To upgrade SAP Host Agent using the saphostexec executable of the downloadedSAPHOSTAGENT<SP-version>.SAR archive, proceed as follows:

1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archive to atemporary directory, for example c:\temp\hostagent.

2. Decompress the SAPHOSTAGENT<SP-version>.SAR archive with theSAPCAR tool to this directory. Take SAP Note 212876 into account whendoing so. You normally use the following command for decompression, andexecute it in the directory of the archive:

sapcar.exe -xvf SAPHOSTAGENT<SP-version>.SAR

sapcar.exe -xvf SAPHOSTAGENT126_126-20005735.SARc:\temp\hostagent

Among others, the archive contains the saphostexec.exe program.

3. Perform the upgrade by switching to this temporary directory and running thecommand saphostexec.exe -upgrade there.

Result After the upgrade has finished successfully, SAP Host Agent is up and running.

You can check the version of the upgraded host agent by executing the followingcommand: saphostexec.exe –version

You can now delete the temporary directory.


5.2.2 Manually Upgrading SAP Host Agent onUNIX



On UNIX, you can also use the hostexecstart program for upgrading SAP Host Agent asa user without root authorization.


SAP Library


Prerequisites You are logged on as a user with root authorization or at least as user that is a

member of the sapsys group.

You have downloaded the desired target release version of the SAPHOSTAGENT<SP-version>.SAR archive.

Procedure If you are logged on as a user with root authorization, you can choose between the

following options to perform the upgrade:

o To upgrade SAP Host Agent using the saphostexec executable of theexisting host agent installation, proceed as follows:

1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archiveto a temporary directory, for example /tmp/hostagent.

2. Change to the directory where the saphostexec executable of SAPHost Agent is located:

cd /usr/sap/hostctrl/exe/


./saphostexec -upgrade -archive <path to downloadedSAPHOSTAGENT<SP-version>.SAR>

o

o saphostexec -upgrade -archive/tmp/hostagent/SAPHOSTAGENT126_126-20005735.SAR

o

o To upgrade SAP Host Agent using the saphostexec executable of thedownloaded SAPHOSTAGENT<SP-version>.SAR archive, proceed asfollows:

1. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archiveto a temporary directory, for example /tmp/hostagent.

2. Decompress the SAPHOSTAGENT<SP-version>.SAR archive withthe SAPCAR tool to this directory. Take SAP Note 212876 intoaccount when doing so. Normally, you use the following commandfor decompression, and execute it in the directory of the archive:

./sapcar -xvf SAPHOSTAGENT<SP-version>.SAR

./sapcar -xvf SAPHOSTAGENT126_126-20005735.SAR /tmp/hostagent


3. Change to the temporary directory and run the command./saphostexec -upgrade there.


SAP Library


If you are logged on as a user that is a member of the sapsys group, for example<sapsid>adm, proceed as follows:

1. Decompress the downloaded SAPHOSTAGENT<SP-version>.SAR archiveto a temporary directory [temp_dir].

2. Change to this temporary directory and run the hostexecstart -upgrade[temp_dir] command there.

/usr/sap/hostctrl/exe/hostexecstart -upgrade /tmp/hostagent/


If you are logged on as a user with root authorization, you can check the version ofthe upgraded host agent by executing the following command: saphostexec –version



5.2.3 Manually Upgrading SAP Host Agent on IBMi



Prerequisites You have downloaded the desired target release version of the SAPHOSTAGENT<SP-

version>.SAR archive to a temporary directory.

You must be logged on as a user profile with special authorities *SECADM and*ALLOBJ, for example as user profile QSECOFR.

Procedure To upgrade SAP Host Agent using the saphostexec executable of the existing SAP

Host Agent installation, proceed as follows:

SAP Library


1. Enter the CALL PGM(QP2TERM) command to start a PASE interactiveterminal session.

2. Copy the downloaded SAPHOSTAGENT<SP-version>.SAR archive to atemporary directory, for example /tmp/hostctrl.

3. Change to the directory where the saphostexec executable of SAP HostAgent is located:

cd /usr/sap/hostctrl/exe/


./saphostexec -upgrade -archive <path to downloadedSAPHOSTAGENT<SP-version>.SAR>

./saphostexec -upgrade -archive/tmp/hostctrl/SAPHOSTAGENT126_126-20005735.SAR

To upgrade SAP Host Agent using the saphostexec executable of the downloadedSAPHOSTAGENT<SP-version>.SAR archive, proceed as follows:

1. Enter the CALL PGM(QP2TERM) command to start a PASE interactiveterminal session .

2. Make the directory that contains SAPCAR and the archiveSAPHOSTAGENT<SP-version>.SAR your current directory using thefollowing command:

cd /tmp/hostctrl

3. Decompress the archive SAPHOSTAGENT<SP-version>.SAR with theSAPCAR tool using the following command:

./SAPCAR -xvf SAPHOSTAGENT<SP-version>.SAR

./SAPCAR -xvf SAPHOSTAGENT126_126-20005735.SAR/tmp/hostctrl


4. Change to the temporary directory used for decompressingSAPHOSTAGENT<SP-version>.SAR archive and run the followingcommand:

./saphostexec -upgrade


You can check the version of the upgraded SAP Host Agent by executing thefollowing command: saphostexec –version


SAP Library



6 SAP Host Agent Configuration

Once you have installed SAP Host Agent, you can configure its upgrade behavior and ensuresecure communication.

More InformationAutomated Upgrade of SAP Host Agent [Page 18]

Registering Hosts with the SLD Using sldreg []

SSL Configuration for SAP Host Agent [Page 29]

Configuring User sapadm as a Domain User [Page 37]

6.1 Registering Hosts with the SLD Using sldreg

To register a host without an SAP instance or component with the System LandscapeDirectory (SLD), call the sldreg executable on that host.

Prerequisites SAP Host Agent is installed on the relevant host.

Windows: You must be logged on as a member of the local Administrators group.



Procedure1. You are on the host that you want to register in the SLD.

2. IBM i: Enter the command CALL PGM(QP2TERM) to start a PASE interactive terminalsession .

3. Change to the following directory as current directory (DIR_GLOBAL Directory):

Windows (language-dependent): C:\Program Files\SAP\hostctrl\exe

UNIX, IBM i: /usr/sap/hostctrl/exe

4. Call the sldreg executable with the following command:

Windows: sldreg -configure slddest.cfg

UNIX, IBM i: ./sldreg -configure slddest.cfg

SAP Library


You have to make sure that the SLD connection file is named slddest.cfgand that it is located in the DIR_GLOBAL directory of SAP Host Agent.Otherwise the registration does not work.

UNIX, IBM i: To be able to access its libraries, the sldreg program requiresthe path /usr/sap/hostctrl/exe in the search path for libraries.

o UNIX: For example, under Linux with a C shell, you can achieve thiswith the following command:

setenv LD_LIBRARY_PATH/usr/sap/hostctrl/exe:$LD_LIBRARY_PATH

o IBM i: From within QP2TERM, you can achieve this with the followingcommand: exportLIBPATH=/usr/sap/hostctrl/exe:$LIBPATH

5. Enter the connection data for the SLD with which you want to register this host:

o SLD user that has been assigned the role DataSupplierLD

o Password of the above user

o Host and HTTP port of the SLD

o Protocol (HTTP or HTTPS)

6. Confirm that you want to save this data in the encrypted file slddest.cfg.

7. Restart SAP Host Agent:

1. Change to the directory of the saphostexec executable.

UNIX, IBM i: /usr/sap/hostctrl/exe

Windows: %ProgramFiles%\SAP\hostctrl\exe

2. Run the following command from the command line:

saphostexec -restart

8. The restart generates an XML file in the working directory of SAP Host Agent andtransfers it to the SLD. This XML file contains all of the information about the host thatthe SLD requires.

ResultYou have registered the local host with an SLD.

You can check if the registration was performed successfully. To do this, call the start page ofthe SLD with the URL http://<host>:<port>/sld, and choose Technical Systems.Choose AS Java In the Technical System Type drop-down list box. The host that you havejust registered is displayed.

More InformationSAP Host Agent Configuration [Page 27]

SAP Library


SAP Host Agent Reference – Command Line Options of the saphostexec Executable[Page 38]

6.2 SSL Configuration for the SAP Host Agent

Configuring secure socket layer (SSL) for SAP Host Agent is a multi-step procedure. Themain steps are as follows:

1. Preparing the environment for SAP Cryptographic Library

2. Preparing the Personal Security Environment (PSE) for the server

3. Preparing the Personal Security Environment (PSE) for the client

4. Establishing trust between the client and SAP Host Agent

5. Allowing the client to issue administrative commands

More InformationConfiguring SSL for SAP Host Agent on Windows []

Configuring SSL for SAP Host Agent on UNIX [Page 31]

Configuring SSL for SAP Host Agent on IBM i [Page 34]

6.2.1 Configuring SSL for SAP Host Agent onWindows

In the following procedure we assume that you are using the default naming for the serverPSE. If you want to override the default .pse name, you can use the following value in theprofile file of SAP Host Agent (host_profile):

ssl/server_pse= <Path to Server PSE>

You can find the host_profile file in $DIR_EXECUTABLE, where $DIR_EXECUTABLE thepath to the directory where the executables saphostcontrol and saphostexec of SAPHost Agent are located: <drive>:\usr\sap\hostctrl\exe

PrerequisitesYou must be logged on as a member of the local Administrators group.

Procedure1. Prepare the environment for SAP Cryptographic Library:

1. Open a command line prompt and change to the%PROGRAM_FILES%\SAP\hostctrl\exe directory.

2. Create a subdirectory named sec and set the SECUDIR environment variableto refer to the new directory using the following commands:

%PROGRAM_FILES%\SAP\hostctrl\exe>mkdir sec

SAP Library


%PROGRAM_FILES%\SAP\hostctrl\exe>setSECUDIR=%PROGRAM_FILES%\SAP\hostctrl\exe\sec

Alternatively, you can also use another directory, but then you haveto specify the location of the PSE file using the parameterssl/server_pse as described above.

Set up SECUDIR as an absolute path in order to avoid trouble withthe sapgenpse tool.

3. Make sure that the files are readable and executable by user sapadm.

2. Prepare the Personal Security Environment (PSE) for the server:

The server PSE contains the server certificate, which is presented to the client whenestablishing the SSL connection, and the names and public keys of the trustedcertificates. Trusted certificates can be either certificates issued by a CertificationAuthority (CA) or individually trusted certificates.

1. Create the server PSE, the server certificate therein, and the CertificateSigning Request (CSR) .

%PROGRAM_FILES%\SAP\hostctrl\exe> sapgenpse gen_pse-p SAPSSLS.pse -x passwd1 -r myhost-csr.p10"CN=myhost.wdf.sap.corp, O=SAP AG, C=DE”

This command creates a PSE file named SAPSSLS.pse (name isfixed), which can be used to authenticate myhost.wdf.sap.corpfor incoming SSL connections. The access to the PSE file isprotected with passwd1. Use the -r option to direct the certificatesigning request to a file, or omit it if you intend to copy and paste theCSR into a Web form.

2. Grant the SAP Host Agent access to the server PSE.

%PROGRAM_FILES%\SAP\hostctrl\exe> sapgenpseseclogin -p SAPSSLS.pse -x passwd1 -o sapadm

3. Get the certificate as follows:

1. If you do not use individually trusted certificates, send the certificatesigning request to an appropriate CA.

2. Copy the signed certificate from the output area — including the "---- BEGIN CERTIFICATE ----" and "---- ENDCERTIFICATE ----" lines — and paste it into a text file, forexample myhost.p7b.

SAP Library


4. Import the signed certificate into the server PSE.

%PROGRAM_FILES%\SAP\hostctrl\exe> sapgenpseimport_own_cert -p SAPSSLS.pse -x passwd1 -cmyhost.p7b (if the used format is PKCS#7).

5. Verify the server certificate chain.

%PROGRAM_FILES%\SAP\hostctrl\exe> sapgenpseget_my_name -p SAPSSLS.pse -x passwd1 -v

3. Restart SAP Host Agent.

4. Prepare the Personal Security Environment (PSE) for the client:

The client PSE contains the client certificate that is sent to SAP Host Agent whenestablishing the SSL connection, and the names and public keys of the trustedcertificates. For the client, trusted certificates can only be certificates that are issuedby a Certification Authority (CA).

The configuration steps are client-specific, that is why we only describe them in ageneric way. Follow the instructions in the specific client documentation.

Examples for possible clients are the SAP Management Console (SAP MC), theDiagnostics Agent in SAP Solution Manager, or the SAP NetWeaver LandscapeVirtualization Management (LVM) software (formerly known as Adaptive ComputingController (ACC)).

Result

If you successfully applied the procedure described above, SAP Host Agent alsoserves port 1129 for SSL communication.

6.2.2 Configuring SSL for SAP Host Agent onUNIX



You can find the host_profile file in $DIR_EXECUTABLE, where $DIR_EXECUTABLE thepath to the directory where the executables saphostcontrol and saphostexec of SAPHost Agent are located: /usr/sap/hostctrl/exe

SAP Library


PrerequisitesYou are logged on as a user with root authorization.

Procedure1. Prepare the Personal Security Environment (PSE) for the server:

The server PSE contains the server certificate that is presented to the client whenestablishing the SSL connection, and the names and public keys of the trustedcertificates. Trusted certificates can be either certificates issued by a CertificationAuthority (CA) or individually trusted certificates.

Proceed as follows:

1. Create a directory /usr/sap/hostctrl/exe/sec using the mkdircommand.

Alternatively, you can also use another directory, but then you haveto specify the location of the PSE file using the parameterssl/server_pse as described above. In the following steps wealways refer to the sec directory for the sake of simplicity.

2. Assign the ownership for the sec directory to sapadm:sapsys.

3. Set up the shared library search path (LD_LIBRARY_PATH, LIBPATH orSHLIB_PATH) and SECUDIR environment variables, and change to the exedirectory of SAP Host Agent.

On Linux and Solaris, the required commands are as follows:

export LD_LIBRARY_PATH=/usr/sap/hostctrl/exe/

export SECUDIR=/usr/sap/hostctrl/exe/sec

cd /usr/sap/hostctrl/exe

On HP-UX, the required commands are as follows:

export SHLIB_PATH=/usr/sap/hostctrl/exe/



On AIX , the required commands are as follows:

export LIBPATH=/usr/sap/hostctrl/exe



SAP Library



4. Create the server PSE, the server certificate therein, and the CertificateSigning Request (CSR).

Run the command as user sapadm so that the created files are owned bythis user.

sudo -u sapadmLD_LIBRARY_PATH=/usr/sap/hostctrl/exeSECUDIR=/usr/sap/hostctrl/exe/sec sapgenpse gen_pse-p SAPSSLS.pse -x password -r /tmp/myhost-csr.p10"CN=myhost.wdf.sap.corp, O=SAP AG, C=DE"

This command creates a PSE file named SAPSSLS.pse (name isfixed), which can be used to authenticate myhost.wdf.sap.corpfor incoming SSL connections. The access to the PSE file isprotected with a password. Use the -r option to direct the certificatesigning request to a file, or omit it if you intend to copy and paste theCSR into a web formular.

5. Grant SAP Host Agent access to the server PSE.

sudo -u sapadmLD_LIBRARY_PATH=/usr/sap/hostctrl/exeSECUDIR=/usr/sap/hostctrl/exe/sec sapgenpseseclogin -p SAPSSLS.pse -x password -O sapadm


1. Send the certificate signing request to an appropriate CA.

2. Copy the signed certificate — including the "---- BEGINCERTIFICATE ----" and "---- END CERTIFICATE ----"lines — and paste it into a text file.

If the used format is PKCS#7, the text file could be namedmyhost.p7b. We use this file name in the followingexamples.

7. Import the signed certificate into the server PSE.

sudo -u sapadmLD_LIBRARY_PATH=/usr/sap/hostctrl/exeSECUDIR=/usr/sap/hostctrl/exe/sec sapgenpseimport_own_cert -p SAPSSLS.pse -x password -c/tmp/myhost.p7b

SAP Library


8. Verify the server certificate chain.

sudo -u sapadmLD_LIBRARY_PATH=/usr/sap/hostctrl/exeSECUDIR=/usr/sap/hostctrl/exe/sec sapgenpseget_my_name -p SAPSSLS.pse -x passwd -v

2. Restart SAP Host Agent.

3. Prepare the client PSE.

The client PSE contains the client certificate that is sent to SAP Host Agent when theSSL connection is established, and the names and public keys of the trustedcertificates from CA.



Result


6.2.3 Configuring SSL for SAP Host Agent on IBMi



You can find the host_profile file in $DIR_EXECUTABLE, where $DIR_EXECUTABLE thepath to the directory where the executables saphostcontrol and saphostexec of SAPHost Agent are located: /usr/sap/hostctrl/exe

PrerequisitesYou must be logged on as a user profile with special authorities *SECADM and *ALLOBJ, forexample as user profile QSECOFR.

Procedure1. Prepare the Personal Security Environment (PSE) for the server:

SAP Library


The server PSE contains the server certificate, which is presented to the client whenestablishing the SSL connection, and the names and public keys of the trustedcertificates. Trusted certificates can be either certificates issued by a CertificationAuthority (CA) or individually trusted certificates.

Proceed as follows:

1. You must temporarily enable the login for user SAPADM. To change the userprofile, enter the following command:

CHGUSRPRF USRPRF(SAPADM) INLMNU(MAIN) LMTCPB(*NO)

2. Create a directory /usr/sap/hostctrl/exe/sec using the followingcommand:

CRTDIR DIR('/usr/sap/hostctrl/exe/sec') DTAAUT(*EXCLUDE)OBJAUT(*NONE)

Alternatively, you can also use another directory, but then you mustspecify the location of the PSE file using the parameterssl/server_pse as described above. In the following steps wealways refer to the sec directory for the sake of simplicity.

3. Change the owner and primary group of the PSE directory and set theappropriate authorities using the following command:

QSYS/CHGOWN OBJ('/usr/sap/hostctrl/exe/sec')NEWOWN(SAPADM)

QSYS/CHGPGP OBJ('/usr/sap/hostctrl/exe/sec')NEWPGP(R3GROUP) DTAAUT(*RWX)

4. Now log on as user SAPADM and execute the command CALLPGM(QP2TERM) before entering the commands of the following steps.

5. Set up the shared library search path (LIBPATH) and SECUDIR environmentvariables, and change to the exe directory of SAP Host Agent.

The required commands are as follows:

export LIBPATH=/usr/sap/hostctrl/exe




6. Create the server PSE, the server certificate therein, and the CertificateSigning Request (CSR) using the following command:.

./sapgenpse gen_pse -p SAPSSLS.pse -x <PASSWORD> -r<PKCS#10 requestfile> <DISTINGUISHED NAME>

SAP Library


This command creates the PSE file/usr/sap/hostctrl/exe/sec/SAPSSLS.pse (the name is fixed), whichcan be used to authenticate the host described by <DISTINGUISHEDNAME> for incoming SSL connections. Access to the PSE file is protectedwith password <PASSWORD>.

The CSR is written into the stream file <PKCS#10 requestfile>. You canignore the warning sapgenpse WARNING: Environment variable"USER" not defined!

./sapgenpse gen_pse -p SAPSSLS.pse -x pass -r/tmp/myhost-csr.p10 "CN=myhost.wdf.sap.corp, O=SAPAG, C=DE"

This command creates the PSE file/usr/sap/hostctrl/exe/sec/SAPSSLS.pse, which can beused to authenticate myhost.wdf.sap.corp for incoming SSLconnections. Access to the PSE file is protected with the passwordpass. The CSR is written into the stream file /tmp/myhost-csr.p10.

7. Grant SAP Host Agent access to the server PSE using the followingcommand:

./sapgenpse seclogin -p SAPSSLS.pse -x <PASSWORD> -Osapadm

./sapgenpse seclogin -p SAPSSLS.pse -x pass -Osapadm


1. Transfer the stream file containing the CSR (certificate signingrequest) to a PC and send it to the Certification Authority (CA) youare using.

2. The CA replies to the PKCS#10 requestfile with a “CA-response-file”which contains the signed certificate — between the ---- BEGINCERTIFICATE ---- and ---- END CERTIFICATE ---- lines.Paste everything between these two lines — including the lines —into a text file. Transfer this text file to a stream file on your IBM i.

The text file could be named myhost.p7b and transferred tothe stream file /tmp/myhost.p7b. We use this file name inthe following examples.

9. Import the signed certificate into the server PSE using the followingcommand:

./sapgenpse import_own_cert -p SAPSSLS.pse -x <PASSWORD>-c <CA-response-file>

SAP Library


./sapgenpse import_own_cert -p SAPSSLS.pse -x pass-c /tmp/myhost.p7b

10. Verify the server certificate chain using the following command:

./sapgenpse get_my_name -p SAPSSLS.pse -x <PASSWORD> -v

./sapgenpse get_my_name -p SAPSSLS.pse -x pass -v

11. To reset the changes to user profile SAPADM that you have made in step 1.a),leave program QP2TERM with function key F3 and enter the followingcommand: CHGUSRPRF USRPRF(SAPADM) INLMNU(*SIGNOFF)LMTCPB(*YES)

12. Log on as a user profile with special authorities *SECADM and *ALLOBJ, forexample as user profile QSECOFR and execute the command CALLPGM(QP2TERM) before entering the command following which restarts SAPHost Agent:

/usr/sap/hostctrl/exe/saphostexec -restart

2. Prepare the client PSE.

The client PSE contains the client certificate, which is sent to SAP Host Agent whenthe SSL connection is established, and the names and public keys of the trustedcertificates from CA.



Result


6.3 Configuring SAP Host Ageht User sapadm asa Domain User

In some cases it might be useful to configure sapadm as a domain user instead of a localuser, for example if you have multiple Windows hosts in your system landscape each of whichhas SAP Host Agent.

SAP Library


Procedure1. Check on each host whether saphostexec is already installed. If yes, remove it as

follows:

1. Change to directory %PROGRAM_FILES%\SAP\hostctrl\exe

2. Uninstall saphostexec by executing the following command:

saphostexec.exe -uninstall

2. Enter the following command to install saphostexec while specifying sapadm as thedomain user:

saphostexec.exe -install -user <domain>\sapadm

More InformationSAP Host Agent Configuration [Page 27]

7 SAP Host Agent Reference

Command Line Options of the saphostexec Executable []

Command Line Options of the hostexecstart Executable [Page 39]

7.1 SAP Host Agent Reference – Command LineOptions of the saphostexec Executable

Usually SAP Host Agent is automatically started when the operating system is booted. Youcan also manually control it using the saphostexec program.

PrerequisitesYou have to be a user with root authorization to be able to execute the program

FeaturesYou call the program from the command line with the following syntax: saphostexec[option] [pf=<ProfilePath>]

where <ProfilePath> is path to the profile file (host_profile) of SAP Host Agent. Bydefault the host_profile file is located in the executable directory.

You can execute saphostexec with the following command line options:

Option Meaning

-install Installs SAP Host Agent

-upgrade [-archive]

Upgrades SAP Host Agent

Using the –archive option you can provide the direct path to thearchive with the desired target release version without manually

SAP Library


extracting it before.

-uninstall Uninstalls SAP Host Agent

-restart Starts or restarts SAP Host Agent

-stop Stops a running SAP Host Agent

-status Returns the status of SAP Host Agent

-version Returns the version of SAP Host Agent with detailed information





7.2 SAP Host Agent Reference – Command LineOptions of the hostexecstart Executable

The hostexecstart program is a command line tool, which allows a user that does nothave root authorization to perform some control operations relevant for the lifecycle of SAPHost Agent.

PrerequisitesYou have to be member of group sapsys to be able to execute the program.

FeaturesCalling hostexecstart without any arguments starts SAP Host Agent

You can execute hostexecstart with the following command line options:

Option Meaning

-upgrade<path>

Upgrades SAP Host Agent using the path to the extractedSAPHOSTAGENT<SP-version>.SAR

-start Starts SAP Host Agent if it is not running

-restart Starts SAP Host Agent if it is not running

Stops SAP Host Agent if it is running

-status Returns the information whether SAP Host Agent is running or not running



SAP Library




sap host agent 20122012

Documents

programfilessaphostctrlexegt

programfilessaphostctrlexe

adaptive computing

sap ile daemon

sap solution

function key

personal security

adaptive computing