1 Copyright © 2013, Oracle and/or its affiliates. All...

Copyright © 2013, Oracle and/or its affiliates. All rights reserved. 1

SAP System Copy with Oracle – what to look out for

Bettina Weissinger-Stelzel, SAP

Andreas Becker, Oracle


The following is intended to outline our general product direction. It is intended

for information purposes only, and may not be incorporated into any contract.

It is not a commitment to deliver any material, code, or functionality, and should

not be relied upon in making purchasing decisions. The development, release,

and timing of any features or functionality described for Oracle’s products

remains at the sole discretion of Oracle.


Agenda

SAP System Copy Overview

– Tools

– ABAP Secure Store (SSFS)

– Copy Methods

SAP System Copy and Oracle Compression


Agenda

SAP System Copy and Oracle TDE

SAP System Copy and Oracle Database Vault

SAP System Copy and Patching

SAP System Copy and Shared Oracle Homes

SAP Upgrade on Oracle


SAP System Copy from the Database Viewpoint


SAP System Copy

There are two basic copy procedures:

– Database-Independent System Copy

R3Load (ABAP)

JLoad (Java)

– Database-specific system copy

Backup/Restore, RMAN, O2O, Snapshot-Copy, Standby (Data Guard), ...

In this presentation, “R3Load” is synonymous with “Database-Independent System Copy” and

“Backup/Restore” with “Database-Specific System Copy”.

Introduction / Overview


SAP System Copy Database-Independent System Copy (R3Load)

Source

DB Target

DB R3Load

Export R3Load R3Load


SAP System Copy Database-Specific System Copy (Backup/Restore)

Source

DB Target

DB Database files (Backup/Restore,RMAN

Split mirror, snapshot, O2O,...)


SAP System Copy Comparison of the Procedures

R3load – Database-Independent

Data is unloaded from the database in a

database-independent R3load format

The target database is completely recreated

Maximum flexibility

Suitable for all types of migration

Backup/Restore – Database-Specific

Data remains inside the database; only the

database files are copied

The basic structure of the database is

preserved, only control files / redo logs are

recreated

Certain parameters cannot be altered (e.g.

block size, character set)

Suitable for frequent system copy operations

(PRD DEV, DEV QA), database-specific

optimization possible


SAP System Copy and Transparent Data Encryption (TDE)


SAP System Copy and TDE

Transparent Data Encryption

“With TDE, sensitive data is protected against unauthorized access

when it is accessed directly from outside the database”, see SAP Note

974876.

If data in the source system are encrypted because they required

protection, they should also be encrypted in the target system following

system copy.

Transparent Data Encryption (TDE)

http://service.sap.com/sap/support/notes/974876



SAP System Copy and TDE

TDE can be defined on tablespace level as of Release 11.2

– Is defined with CREATE TABLESPACE, cannot be changed CREATE TABLESPACE <tsname>… ENCRYPTION DEFAULT STORAGE (ENCRYPT);

DBA_TABLESPACES.ENCRYPTED

– Cannot be overridden at table level

– CREATE TABLE-DDL for encrypted tablespaces and non-encrypted

tablespaces are identical



SAP System Copy Without TDE Without TDE in Source System

Source

DB Target

DB R3Load

Backup/Restore

R3Load

Export

Backup Files


SAP System Copy With TDE in Source System

Source

DB Target

DB R3Load

Backup/Restore

R3Load

Export

Backup Files


SAP System Copy with R3Load TDE (tablespace encryption)

Source

DB Target

DB

Manual configuration of TDE

1. SQLNET.ORA

(ENCRYPTION_WALLET_LOCATION)

2. Create TDE encryption wallet with TDE master key

3. Create encrypted tablespaces

4. Define wallet password

R3Load

Export Data not

encrypted

with TDE


SAP System Copy with Backup/Restore TDE (tablespace encryption)

Source

DB Target

DB

Manual configuration of TDE

1. Copy TDE encryption wallet

2. Depending on security requirements,

define new wallet password, set up new

master key

Backup/Restore


Copy with R3Load Copy with Backup/Restore

1. Configure location for TDE encryption wallet

in sqlnet.ora.

2. Create TDE encryption wallet with master key

3. Create encrypted tablespaces for SAP data

before loading with R3Load

Optional:

If necessary, create auto-open wallet

1. Configure location for TDE encryption wallet

in sqlnet.ora

2. Copy TDE encryption wallet from source

system

Optional (depending on security policy):

If necessary, define new wallet password

If necessary, create new master key

If necessary, create Auto-open-Wallet

SAP System Copy with TDE in Source System Manual TDE Configuration for System Copy


SAP System Copy and Database Vault



Database Vault

“With Oracle Database Vault, sensitive data of the SAP application can

be protected from unauthorized access by highly-privileged database

users” – see SAP Note 1355140

Assumption: if data in the source system is worth protecting, it should

also be protected into a target system following system copy.

Whether protection is retained or needs to be configured afresh

depends on the system copy procedure of the database.

Database Vault (DV)



Database Vault Components of Database Vault (local DVA)

Partitioning, RAT, (RAC)

Database without Database Vault

Partitioning, RAT, (RAC), OLS, DV

Database with Database Vault

DVA

Admin GUI

SAP DV Policy

ORACLE_HOME

CATALOG

CATPROC

EM

DV

OLS

XMLDB

CATALOG

CATPROC

<OH>/<host>_<SID>

SQL>

SELECT * FROM

SAPSR3.<table>;

ERROR at line 1:

ORA-01031: insufficient

privileges

SQL>

SQL>

SELECT * FROM

SAPSR3.<table>;

...

10 rows selected.

SQL>

https://<host>:<port>/dva


Database Vault Components of Database Vault (central DVA)


Database without Database Vault


Database with Database Vault

DVA

(central)

SAP DV Policy

ORACLE_HOME

CATALOG

CATPROC

DV

OLS

XMLDB

CATALOG

CATPROC

SQL>

SELECT * FROM

SAPSR3.<table>;

ERROR at line 1:

ORA-01031: insufficient

privileges

SQL>

SQL>

SELECT * FROM

SAPSR3.<table>;

...

10 rows selected.

SQL>

https://<host>:<port>/dva


Local vs. Central DVA

For DVA, it is necessary to configure Enterprise Manager Database

Control in Release 11.2, which involves:

1. Installation of EM in the database (repository, SYSMAN)

2. Configuration in Oracle Home

For SAP system copy, it is recommended to use a central DVA (compare

SAP Note 1741523) configuration of the local DVA in the copy not

required

DVA – GUI for Database Vault Administration




R3Load

Target database rebuilt

Database components DV, OLS, XMLDB still

need to be installed

SAP data need to be reloaded

DV configuration

DV needs to be newly configured

Procedure as with DV new installation

No integration in SWPM/SAPInst

Backup/Restore

Database created from backup

Database components DV, OLS, XMLDB

already installed in database

SAP data already present in DB.

DV configuration

Can the DV configuration of the source

database still be used check

Procedure as in SAP Note 1716939

No integration with SWPM/SAPInst

SAP System Copy and Database Vault Comparison R3Load with Backup/Restore




Copy with R3Load

1. Perform system copy

2. Install Database Vault

Copy with Backup/Restore

1. Perform system copy (DV in target

database deactivated)

2. Possible variants:

• Variant #1: DV Reinstallation

• Variant #2: DV Reconfiguration

• Variant #3: Without reconfiguration

(planned)

SAP System Copy and Database Vault Manual Effort after System Copy



Step 1:

Perform system copy with R3Load

Step 2:

Install and configure Database Vault (= DV new installation)

System Copy with R3Load (DVA central)


SAP System Copy and Database Vault System Copy with R3Load (DVA central)

DVA (central)


CATALOG

CATPROC

OLS

DV

XMLDB

SAP DV Policy


SAP DV Policy

DV

OLS

XMLDB

CATALOG

CATPROC

R3Load

Export

Enable DV Partitioning, RAT, (RAC), OLS, DV

https://.../dva https://.../dva



Step 1:

Perform system copy with backup/restore

(DV in target database deactivated)

Step 2:

Variant #1: DV reinstallation (uninstallation + new installation)

Variant #2: DV Reconfiguration

Variant #3: Without DV reconfiguration (planned)

System Copy with Backup/Restore (central DVA)



With the new installation, the SAP DV Policy is adapted to the new

DB users (OPS$-User, SAP Schema)

(Sole) advantage: the local DVA is automatically configured when

DV is newly installed

Disadvantage: this variant is relatively time-consuming since all

components (DV, OLS, XMLDB) must be uninstalled and reinstalled

Variant #1: Database Vault Reinstallation


SAP System Copy and Database Vault Variant #1: Database Vault Reinstallation

DVA (central)


CATALOG

CATPROC

OLS

DV

XMLDB

SAP DV Policy


SAP DV Policy

DV

OLS

XMLDB

CATALOG

CATPROC



Backup/Restore

SAP DV Policy



Database components DV, OLS, XMLDB are not uninstalled. They

are not schema-dependent

The SAP DV policy must be reconfigured (dependencies on

schema, e.g. OPS$-User)

Advantage: significantly less effort compared to variant #1

Variant #2: Database Vault Reconfiguration


SAP System Copy and Database Vault Variant #2: Database Vault Reconfiguration

DVA (zentral)


CATALOG

CATPROC

OLS

DV

XMLDB

SAP DV Policy


SAP DV Policy

DV

OLS

XMLDB

CATALOG

CATPROC



Backup/Restore

SAP DV Policy



As variant #2 but:

– SAP DV Policy is not newly configured if there are no dependencies on

certain schema (OPS$-User)

Prerequisite: SSFS

If SSFS is configured and no OPS$-User (OPS$<SAPSID>ADM or

OPS$ORA<DBSID>) exist in the database, there is no need to

reconfigure the SAP DV policy

(Status: planned, not yet released)

Variant #3: Database Vault Reconfiguration not required


SAP System Copy and Database Vault Variant #3: Database Vault reconfiguration not required

DVA (central)


CATALOG

CATPROC

OLS

DV

XMLDB

SAP DV Policy


SAP DV Policy

DV

OLS

XMLDB

CATALOG

CATPROC



Backup/Restore

Prerequisite:

SSFS;

no schema

dependecies



DVA should be installed centrally

Advantages:

– No DVA configuration in Oracle Home

– No EM database control repository components in the database

– Not extra effort for system copy

DV and Shared Oracle Home

– With a shared Oracle Home, a second Oracle Home is required for a short

period so that DV can temporarily be switched off.

Recommendations



With SSFS (Secure Storage, SAP Note 1622837), DV configuration is

largely schema-independent (remote_os_authent)

– No OPS$-User (OPS$ORA<DBSID>, OPS$<SID>ADM)

Note: if OPS$ users are to be recreated in a system as part of the SSFS

configuration during post-SAPinst steps, these should be manually deleted

again.

– No or scarcely any schema dependencies in role definitions, definitions of

DV Realms/ DV Rules

– No reconfiguration of Database Vault required (planned)

Outlook



R3Load

Target database is recreated

SAP data are reloaded

DV configuration:

Procedure as with DV new installation

Database components DV, OLS,

XMLDB must be installed

DV must initially be reconfigured

No integration in SWPM/SAPInst

Backup/Restore

Database created from backup

SAP data are already in the database.

DV configuration:

Procedure as SAP Note 1716939:

Database components DV, OLS,

XMLDB already installed in the

database

SAP DV policy must be adapted to the

new database users (reconfiguration)

No Integration in SWPM/SAPInst

SAP System Copy and Database Vault Comparison R3Load with Backup/Restore




SAP System Copy and Shared Oracle Homes (Outlook)


Shared Oracle Homes

The term “shared Oracle Home” is used in two different situations.

Definition #1: “Sharing across hosts”

For a RAC installation, Oracle Home is on a shared file system, which

can be accessed from all RAC nodes. All RAC instances of the same

RAC database use the same Oracle Home.

Definition of Terms (1)


Shared Oracle Homes

Definition #2: “Sharing across databases”

Instances of several different databases use the same “shared Oracle Home”,

see SAP Note 1622837.

Aim:

– Fewer Oracle Homes, reduced patching effort, less disk space, uniform

patches

Definition of Terms (2)




Shared Oracle Homes

For RAC installations with SAP systems shared Oracle Homes – thatis,

“sharing across hosts” are used. This means there is one Oracle home

for all RAC instances.

For installations on an Exadata, the different RAC instances of a RAC

system use the relevant locally installed Oracle Homes (non-shared

according to definition #1). However, the different database instances

of an Exadata node share the local Oracle Home (shared according to

definition #2 “Sharing across databases”).

Use with SAP systems – current status


Shared Oracle Homes

Planned: general support for Shared Oracle Homes with SAP systems,

see SAP Note 1622837

Advantage:

– Fewer Oracle Homes reduced patching effort

– Fewer Oracle Homes less disk space

– For SAP system copy, copying / copying of Oracle Home if the database

copy uses the same Oracle Home.

Use with SAP System – Outlook





Shared Oracle Homes

Consequences:

– New TDE Wallet location with shared Oracle Home (see SAP Note

974876): <SAPDATA_HOME>/orawallet

– For installations with Database Vault, a second shared Oracle Home (with

identical patch level) should exist, so that deactivation of DV for one

system does not affect all other systems.

Use with SAP Systems – Consequences





Shared Oracle Homes withTDE TDE Encryption Wallet Location

/oracle/<DBSID1>/112



/oracle/RDBMS/11203

Runtime OH

/oracle/RDBMS/11203

/oracle/<DBSID3>/orawallet/ewallet.p12



TDE and Shared

Oracle Home:

SAP Note 974876

DBSID1

DBSID2

DBSID3



SAP System Copy and Oracle Upgrade + Patching


SAP System Copy Oracle Release Upgrade for DB Copy with R3Load

Source

DB Target

DB R3Load

Major Release Upgrade e.g. 10.2.0.X.<n> 11.2.0.Y.<m>

SBP / PSU Upgrade e.g. 11.2.0.3.<n> 11.2.0.3.<m>

Minor Release Upgrade e.g. 11.2.0.2.<n> 11.2.0.3.<m>


SAP System Copy No Change of Oracle Release for Database Copy with Backup / Restore

Source

DB Target

DB

Backup/Restore

Same Oracle Server version,

same patch level (usually)


Components of an SAP Bundle Patch Where are the effects felt of installing an SBP?

SPFILE

...

*._fix_control=...

*.event=...

...

ORACLE HOME

SAP Bundle Patch

SBP

Oracle

Dictionary

DBA_REGISTRY

MOPatch: install binaries

Post-Install Step

SQL> @catsbp.sql

Post-Install Step

set parameter

SAP Service

Marketplace

Download

to

DB-Server

1

2

3


SAP System Copy and Patching SBP Post-Installation Steps


SAP System Copy

From SBP README_201305_LINX8664.htm:

You must run catsbp.sql and you must execute the post-installation

instructions even when you create or upgrade a database after the

installation of this SBP.

– This means that, if the database has been recreated during a SAP system

copy (R3Load procedure), the SBP post-installation steps must be

performed.

– If the database was created with backup/restore and the patch level in the

new Oracle home has not changed, these steps do not need to be

performed.

SBP Post-Installation Steps (1)


SAP System Copy

For system Copy with SAPINST/SWPM, there is a breakpoint at which

the new ORACLE_HOME is installed (incl. SAP Bundle Patch)

There are currently no breakpoints in SAPINST/SWPM to perform the

SBP post-installation steps in SAPINST/SWPM.

– Directly after CREATE DATABASE, before loading the data, would be the

ideal point.

– Adapting of init<SID>.ora parameters is possible with SAPinst



SAP System Copy

Recommendations:

– Perform the SBP post-installation steps as soon as possible after creating

the database copy, at the latest immediately after the SAP system copy (do

not forget)

– If the database has been recreated or a newer SBP than in the source

system is installed, the SBP post-installation steps must be performed.



SAP Upgrade and TDE / DV


SAP Upgrade / EHPI

Replacement tablespace PSAP<SID><REL>

– If the database is encrypted with TDE, make sure that the replacement

tablespace is created in encrypted form

‘brspace -f tscreate -encryption yes’



SAP Upgrade / EHPI

During an SAP upgrade, DV remain active.

Deletion and recreation of the SAP<SCHEMA>SHD is with the

Security Account Manager (e.g. SECACCTMGR).

The shadow schema SAP<SCHEMA>SHD, containing the

replacement tables, is by default not protected by Database Vault.

– Should the shadow schema be protected by DV?

– Does the SAP upgrade work with a protected shadow schema?

Database Vault (DV)


SAP Upgrade / EHPI

If table compression is controlled by the tablespace, set up the

replacement tablespaces in compressed form.

After the upgrade, check whether there are compressed tables with >

255 columns, see SAP Note 1818320)

Table Compression





References


Note 1436352 - Oracle 11g Advanced Compression for SAP Systems

Note 1426979 - Oracle 11g: SecureFiles - The new way to store LOB data

Note 1818320 - Oracle 11g Advanced Compression for LONG data restriction

Note 1109743 - Use of Index Key Compression for Oracle Databases

SAP Hinweise

SAP Notes Table Compression

References

https://service.sap.com/sap/support/notes/1436352



























Note 1716939 - SAP System

Copies with Database Vault

Note 1868094 - Overview:

Oracle Security SAP Notes

SAP Notes Database Vault

SAP Hinweise












Note 1622837 - Secure connection of AS ABAP to Oracle via SSFS

Note 1639578 - SSFS as password storage for primary database connect

Note 1623922 - Connect to Oracle database

Note 1764043 - Support for secure storage in BR*Tools

SAP Notes Secure Storage (SSFS)

SAP Hinweise
























Note 1778431 - Running

Multiple Databases From One

Oracle Home

SAP Notes Shared Oracle Homes

SAP Hinweise









© 2013 SAP AG. All rights reserved.

© 2013 SAP AG. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Excel, Outlook, PowerPoint, Silverlight, and Visual Studio are registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, z10, z/VM, z/OS, OS/390, zEnterprise, PowerVM, Power Architecture, Power Systems, POWER7, POWER6+, POWER6, POWER, PowerHA, pureScale, PowerPC, BladeCenter, System Storage, Storwize, XIV, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, AIX, Intelligent Miner, WebSphere, Tivoli, Informix, and Smarter Planet are trademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the United States and other countries.

Adobe, the Adobe logo, Acrobat, PostScript, and Reader are trademarks or registered trademarks of Adobe Systems Incorporated in the United States and other countries.

Oracle and Java are registered trademarks of Oracle and its affiliates.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems Inc.

HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Apple, App Store, iBooks, iPad, iPhone, iPhoto, iPod, iTunes, Multi-Touch, Objective-C, Retina, Safari, Siri, and Xcode are trademarks or registered trademarks of Apple Inc.

IOS is a registered trademark of Cisco Systems Inc.

RIM, BlackBerry, BBM, BlackBerry Curve, BlackBerry Bold, BlackBerry Pearl, BlackBerry Torch, BlackBerry Storm, BlackBerry Storm2, BlackBerry PlayBook, and BlackBerry App World are trademarks or registered trademarks of Research in Motion Limited.

Google App Engine, Google Apps, Google Checkout, Google Data API, Google Maps, Google Mobile Ads, Google Mobile Updater, Google Mobile, Google Store, Google Sync, Google Updater, Google Voice, Google Mail, Gmail, YouTube, Dalvik and Android are trademarks or registered trademarks of Google Inc.

INTERMEC is a registered trademark of Intermec Technologies Corporation.

Wi-Fi is a registered trademark of Wi-Fi Alliance.

Bluetooth is a registered trademark of Bluetooth SIG Inc.

Motorola is a registered trademark of Motorola Trademark Holdings LLC.

Computop is a registered trademark of Computop Wirtschaftsinformatik GmbH.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, SAP HANA, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company.

Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase Inc. Sybase is an SAP company.

Crossgate, m@gic EDDY, B2B 360°, and B2B 360° Services are registered trademarks of Crossgate AG in Germany and other countries. Crossgate is an SAP company.

All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.

The information in this document is proprietary to SAP. No part of this document may be reproduced, copied, or transmitted in any form or for any purpose without the express prior written permission of SAP AG.

Date post:	04-Mar-2020
Category:	Documents
Upload:	others
View:	3 times
Download:	0 times

1 Copyright © 2013, Oracle and/or its affiliates. All...

Documents