Finding list of all ports used in an Active SAP system

We often come to a situation where there is an overlapping of ports for an application. A single port would be used by an SAP service and any non-SAP application/service on the same server simultaneously. This will cause the SAP service to fail/stop. For avoiding this, we should know the list of all the ports which are being used by a running SAP application, so another service is not configured on any of these ports.

You can find the list of ports using the below steps:

1. Login to the system using <sid>adm and navigate to the profile directory.
2. Find all the instance number of all the instances present in the directory.
3. For every instance number, run the below command.

Command: sapcontrol -nr <instance_nr> -function GetAccessPointList

e.g. sapcontrol -nr 00 -function GetAccessPointList

Output:

Shell script to automate diagnostic agent startup

 

Following  shell script  will be helpful to automate the startup of diagnostic  agent in case it is stopped.

 

You can schedule  the script  as a  crontab entry under the OS user that runs diagnostic agent.  The script will perform the status check and  if the diagnostic agent is found stopped it will be automatically started by the script.  You will be able to overcome the manual intervention needed.

 

 

Cron entry for  scheduling the script in every 5 minutes :   */5 * * * * /home/dadadm/check_diagnostic_agent.sh

 

In my case , DAD is the SID of the diagnostic agent. So I  have installed the script under the OS user dadadm.

 

The script is not intended to replace standard SAP process of starting the agent during OS startup.

If you observe that the agent  does not start up  during OS startup, check the following

 

1) whether  sapstartsrv service for the diagnostic agent has been configured  in sapservices file.  sapservices  can be located in /usr/sap directory

 

 

2)sapinit  is placed in /etc/init.d directory (this is for Linux systems)

 

3)Autostart parameter  has been set to 1 in instance profile of diagnostic agent

 

 

#SCRIPT STARTS HERE - COPY FROM THE LINE BELOW

 

#!/bin/sh

SID=""

profile_dir=""

LOG="$HOME/check_diagnostic_agent.log"

#DIR_LIBRARY=/usr/sap/DAD/SYS/exe/run

#=================================================================

startExecution()

{

start_timestamp=`date +"%Y-%m-%d %H:%M:%S"`

echo "[ Execution start timestamp:  ${start_timestamp}" >> "$LOG"

}

 

#=================================================================

exitOnError()

{

error_timestamp=`date +"%Y-%m-%d %H:%M:%S"`

echo "Execution end timestamp:  ${error_timestamp} ]" >> "$LOG"

exit 1

}

 

#=================================================================

endExecution()

{

end_timestamp=`date +"%Y-%m-%d %H:%M:%S"`

echo "Execution end timestamp:  ${end_timestamp} ]" >> "$LOG"

}

 

##################

##Main Function

startExecution

#================================================================

#Export Environment variables

if [ -f $HOME/.profile ]; then

     . $HOME/.profile

   #echo "Environment profile found..." >> "$LOG"

else

   echo "ERROR: No environment profile found!!!" >> "$LOG"

   exitOnError

fi

#================================================================

#Check Environment variable SAPSYSTEMNAME

if [ ! -z $SAPSYSTEMNAME ]

then

 SID="${SAPSYSTEMNAME}"

 profile_dir="/usr/sap/${SAPSYSTEMNAME}/SYS/profile"

 #echo "Diagnostic agent SID id ${SAPSYSTEMNAME}" >> "$LOG"

else

  echo "ERROR: SAPSYSTEMNAME environment variable not found...exiting!!!" >> "$LOG"

  exitOnError

fi

#================================================================

#check whether startsap exists

STARTSAP_DIR=""

for dir in `echo $LD_LIBRARY_PATH | sed 's/:/ /g'`

do

   if [ -x "${dir}/startsap" ]

   then

    STARTSAP_DIR="$dir"  

    break

   fi

done

#echo "STARTSAP_DIR=${STARTSAP_DIR}"

if [ -z "$STARTSAP_DIR" ]

then

 echo "ERROR: startsap executable not found...exiting!!!" >> "$LOG"

 exitOnError

fi

#=================================================================

#check if the SAP System is a diagnostic agent

if [ -d /usr/sap/$SAPSYSTEMNAME/SMDA[0-9][0-9] ]

then

 echo "SAP System ${SAPSYSTEMNAME} is a diagnostic agent..." >> "$LOG"

else

  echo "ERROR: Dignostic agent is not installed..." >> "$LOG"

  exitOnError

fi

#=================================================================

if [ -d "$profile_dir" ]

then

  #echo "File system /usr/sap/${SAPSYSTEMNAME}/SYS/profile exists..." >> "$LOG"

  echo "Checking if diagnostic agent is running...." >> "$LOG"

  if [ `$STARTSAP_DIR/startsap check|grep -c "is running"` -ge 1 ]

  then

      # check whether diagnostic agent processes are running

      ps -ef | grep "/usr/sap/$SAPSYSTEMNAME/SMDA[0-9][0-9]/exe/jstart" > /dev/null 2>&1

      rc1=$?

      ps -ef | grep "/usr/sap/$SAPSYSTEMNAME/SMDA[0-9][0-9]/exe/sapstartsrv" > /dev/null 2>&1

      rc2=$?

      rc=`expr $rc1 + $rc2`

      if [ $rc -eq 0 ]; then

        echo "diagnostic agent is already running..." >> "$LOG"

      else

        echo "RC=$rc...Probably diagnostic agent is not running..Executing startsap...." >> "$LOG"

        $STARTSAP_DIR/startsap

      fi

   else

     echo "Probably diagnostic agent is not running..Executing startsap...." >> "$LOG"

     $STARTSAP_DIR/startsap

  fi

else

  echo "File system does not /usr/sap/${SAPSYSTEMNAME}/SYS/profile exist..." >> "$LOG"

  exitOnError

fi

endExecution

 

# END OF SCRIPT

 

Shell script to decypt files using gpg

#!/bin/bash
#PURPOSE: This shell script is indented to decrypt the encrypted files(*.gpg files) using gpg command. we have .gpg files (encrypted) and public key of the party who encrypted the files.. we want to decrypt the files and keep a copy of encrypted files as well.


###########################
#Change the directories according to your requirement, don't change the variables :)
HOME=/home/myuser
#location of encrypted files
SRC="$HOME/ENCRYYPTED"
#location of archiving
ARCHIVE="$HOME/ARCHIVED"
#location of decrypted files
DEST="$HOME/DECRYPTED"
#public key file - to be used to decrypt
KEYFILE="$SRC/key.asc"
#Encrypted file listing - temporary use
ENC_FILES="$SRC/encrypt_files.txt"
#log file
LOGFILE="$SRC/gpg_decrypt.log"
####################################

PATH=.:/sbin:/usr/sbin:/usr/local/sbin:/root/bin:/usr/local/bin:/usr/bin:/bin:$PATH
############
#Functions
############
check_dirs()
{
#check dirs
if [ ! -d "$SRC" -o ! -d "$DEST" -o ! -d "$ARCHIVE" ]; then
  echo "ERROR: All required directories are not available" | tee -a "$LOGFILE"
  exit 1
fi
#check key file
if [ ! -r "$KEYFILE" ]; then
  echo "ERROR: Key file $KEYFILE is not avaiable" | tee -a "$LOGFILE"
  exit 1
fi
}
copy_files_to_dest()
{
local files
local file
local timestamp
local extn
local cpfile
#change working dir to source dir
cd "$SRC"
if [ $? -ne 0 ]; then
  echo "ERROR:change to dir $SRC is not successful" | tee -a "$LOGFILE"
  exit 1
fi
#copy the gpg files from SRC dir to ARCHIVE dir
files=`ls -1 *.gpg 2>/dev/null`
echo "$files" > "$ENC_FILES"
if [ -r "$ENC_FILES" ]; then
while IFS=$'\n' read -r file
 do
   if [ -f "$file" ]; then  # if a file
    timestamp=`ls -l --time-style="long-iso" "$file" |awk '{print $6 "-" $7}'|sed "s/:/-/"`
    filename=`echo "$file" | awk -F . '{if (NF > 1) {print $1}'}`
    extn=`echo "$file" | awk -F . '{if (NF > 1) {print $NF}'}`
    cpfile="${filename}_${timestamp}.${extn}"
    echo "File name : $file " | tee -a "$LOGFILE"
    echo "Timestamp : $timestamp " | tee -a "$LOGFILE"
    echo "Target file name :  $cpfile" | tee -a "$LOGFILE"
    echo ""  | tee -a "$LOGFILE"
    cp -p "$SRC/$file" "$ARCHIVE/$cpfile"
    if [ $? -ne 0 ]; then
   echo "ERROR: Copy of $file from $SRC to $ARCHIVE failed " | tee -a "$LOGFILE"
   exit 1
    else
   echo "$file copied to $cpfile in $ARCHIVE " | tee -a "$LOGFILE"
    fi
   fi
 done < "$ENC_FILES"
fi
}
import_public_key()
{
#import gpg public key
gpg --import --no-verbose "$KEYFILE"
if [ $? -ne 0 ]
 then
   echo "Error in importing public key . Check the key " | tee -a "$LOGFILE"
   exit 1
fi
}
decrypt_files()
{
local file
local filename
local newfile
#decrypt files
while IFS=$'\n' read -r file
do
  if [ -f "$file" ]; then # proceed if it is a file
   filename=`echo "$file" | awk -F . '{if (NF > 1) {print $1}'}`
   newfile="$filename.txt"
   gpg --decrypt "$SRC/$file" > "$DEST/$newfile"
   if [ $? -eq 0 ]; then
  echo "$SRC/$file decrypted in $DEST/$newfile" | tee -a "$LOGFILE"
  rm "$SRC/$file"
  echo "$file removed from $SRC" | tee -a "$LOGFILE"
   fi
  fi
done < "$ENC_FILES"
}
del_tmp_file()
{
#delete temporary file
if [ -f "$ENC_FILES" ]
then
   rm "$ENC_FILES"
fi
}
init_log()
{
 NAME=`basename $0`
 echo "*******Executing $NAME at $(date +"%Y-%m-%d %T") ********" | tee -a "$LOGFILE"
}
###########
#Main()
###########
check_dirs
init_log
copy_files_to_dest
import_public_key
decrypt_files
del_tmp_file


#SCRIPT ENDS here




How to use the script

• Place the encrypted *.gpg files in /home/myuser/ENCRYYPTED folder
• Place the publick key in  /home/myuser/ENCRYYPTED folder. Name it as key.asc
• Place the script in any location that suits your requirement
• Run the script.
• Copy of encrypted files will go in /home/myuser/ARCHIVED folder
• Decrypted files will go in /home/myuser/DECRYPTED folder
• Logfile of the script will be in /home/myuser

How to trigger background job in SAP system from external system

This blog explains the procedure to trigger a background job in SAP system from a third-party system using  shell script(FTP script).

 

 

Brief about the procedure:

 

I am going to illustrate a scenario in which a third party system uses FTP to place file in SAP host and requires to trigger a background job in SAP system after placing the file in SAP host..

 

 

As shown in below diagram the process can be summarized in three steps

1. You place the file in SAP host using FTP login
2. You use SSH login to trigger the SAP event in SAP host
3. The event triggers the Background job in SAP system. You must have defined an event based periodic background job in SAP system
   
   
   
   

1. EXT_USER is the OS user id in the external host (third party host) with which the FTP script is running.
2. SAP_EXT is the OS user id created in SAP host for allowing the third party host to access SAP host to place file and execute sapevt.
    
    
   In typical cases, the third party host uses FTP script to place file in SAP host. So you need add step 2 in your script. After you have added the step 2 in your FTP script, your FTP script will be able to trigger SAP event in SAP system and consequently trigger the background job in SAP system.
    
    
    
   In detail explanation:-
    
   (a)SAP host:
    
   Create a user defined event in SAP system. The event will be used to start the background job. You can create the event using  t-code SM62.
    
   Create the event based background job in SAP system. (SM36/SM37) . Use the event crated in above step in the background job
    
   Create local profile for SAPEVT  executable in SAP system. The profile must contain the values for rdisp/mshost and rdisp/msserv. The profile can be named as sapevt.pfl and placed in /usr/sap//SYS/profile directory in SAP system.
                Ex.
                      rdisp/mshost = saphost
                      rdisp/msserv = sapmsQAS
    
   Create a user id at OS level on SAP host(ex. SAP_EXT) .Ensure that the user id has executable access to the sapevt excutable located in /usr/sap//SYS/exe/run directory and the local profile created for sapevt  /usr/sap//SYS/profile/sapevt.pfl as well. This user id will be used by third party system for placing files in SAP host and executing sapevet in SAP host
      
   Share the command to be executed from the FTP script (shell script) with the third party application team. The command can be executed on SAP host from the third party system with some remote execution utility(ex. ssh).
            
            Ex.  /usr/sap/QAS/SYS/exe/run/sapevt  EVENT_NAME pf=/usr/sap/QAS/SYS/profile/sapevt.pfl
    
    
   (b)External host:
    
   Password less authentication mechanism must be set up between the OS user account of external host(EXT_USER) and the OS user account of SAP host(SAP_EXT).
    

This is often done by generating  a personal private/public key pair with the help of ssh-keygen command. The public key is then copied onto a remote systems' .ssh/authorized_keys file. Now SSH to the remote systems account is possible without the use of a password. You need to ask your unix team to perform this set up for you.

 

Once a password less authentication is set up, as shown in the diagram EXT_USER account on external host can do a password less logon to SAP_EXT user on sap host.

 

Please note that password less authentication to SAP_EXT user on SAP host is only possible from EXT_USER account of external host. So the password less logon is not possible from any other account of the same host or any other host. So this method of setting a password less authentication is secure.

 

 

Ouput:

 

Shell script executed in third party system to place file and trigger event:

 

Background job executed in SAP system: