Master of the obvious....that's me!!!

One thing I hadn't realized until I started researching HA/DR incidents for recent stats is just how often failures happen.   Maybe I am a bit isolated due to the excellent services our IT org does .....but some interesting tidbits I learned:

• Data Center failures happen on average about twice per year per customer.   Ouch.   Now I - like many others - were aware of the quarterly DC downtime for maintenance - but wasn't quite aware the we tended to have so many unplanned outages.  Turns out (not surprising) that the biggest cause of DC outages is power related.  2nd place was water.   The first I understand - that's the downside of all those cores & spindles.   The second makes sense when you realize that most DC's are ground level ....and those leaking pipes above....or that ground water drainage problem....and suddenly we have H2O in the HP's.    The other one I was looking for was backhoes....as I know they habitually take DC's down when they dig up the cable....

• The longest downtimes are due to hacking.   Now that one makes sense when you think about it.....   Forensic analysis takes a while....and you can't put the system back online until you are sure all the bad stuff is gone.

• Human error is the leading cause......geee.....given the complexities of today's systems, this one is almost a gimmee.

• Another leading cause is over-capacity/surge.  For those of you who tried to get those $1 airfares from a certain low cost airline recently understand the problem.   And they aren't alone.   Another well known leading discount department store has suffered two major outages when internet orders flooded their systems the first day of new clothing from certain fashion brands were launched.

• The most common failure time is right after an upgrade - either hardware or software.   I was amazed at how often network upgrades were the culprits as I assumed that application upgrades would be high....and they were - but network upgrade failures tied app upgrades as cause for major outages.

• It can happen a lot.....another leading internet auction site had 14 major outages in 2014 alone.   They got hacked....ran out of ipv4 addresses - you name it.

I would have thought by now that as smart as all of us IT folks are that outages would have been diminishing ....or at least much less often.    With hardware reliability at a fairly high compared to a decade (or two) ago and especially with SSD's eliminating moving parts.....   But, alas, we still have software to blame things on.

The reason I was doing this research is that in my job as a Product Manager for ASE, I was tasked with focusing on the ASE Always-On option that we are releasing with ASE 16sp02.   While it has been under development for sometime, it was fun (and sometimes exasperating) to put my hands on it and take it for a test spin.   One of the considerations behind Always-On is to address two of those problems above - the Data Center failures and Upgrades.

With regard to the former, Always-On is based on typical HADR synchronous replication.  This allows you to take a hit on the primary and failover to the standby with minimal latency and zero data loss.  While the last is key, the former was really surprising at how well we did even at higher volumes.   While the solution is based on SAP Replication Server, even under heavy load, engineering has done such a good job of pretuning it that one customer was able to get ~20K rows/sec from primary to standby with <5secs latency.  Internally (and with better HW) we were able to get much better....   And to think I remember categorizing 5K rows/sec as high volume a few years ago...

With respect to the upgrades, ASE Always-On will be just that - always on - even during upgrades.  Yes, even when you upgrade to ASE 17 or whatever the next major release is.  The current installer installs the software and then manages the failover/failbacks in such a way that overall processing is never interrupted.

Not only that, but failover times were quite impressive.  I spent a lot of time recently doing kill -9's on my dataservers to simulate a crash.  When the project originally started, there were some fairly long times discussed as a possibility (which influenced the JDBC api a bit).  However, under testing (including customer tests), the speed is much faster than OS clustering and competing with ASE Cluster Edition in some cases.

Now, doing this did take a few changes to both ASE and SRS.  For example, we all are familiar with "near zero" downtime approaches in which you get ready to failover and at the appointed time, you kill all the applications (or have them log out), flip to the new system and restart the applications.  With luck and enough staff, it can be done in minutes.  But ASE 16sp02 added a new soft quiesce feature that even eliminates that - as a result, planned outages can happen without disrupting the applications.

There were some other modifications made.   On next Wednesday, I am hosting a webcast on the ASE 16sp02 Always-On option.  If you would like to hear more - join me.

Join us for a webcast September 30th, 10:00 EDT: SAP ASE 16 Always-On– The ultimate in zero downtime/zero data loss. I’ll be discussing the new SAP ASE 16 always-on feature that leverages synchronous log replication and SAP’s leading database replication technologies to create a solution for customers that is a comprehensive solution for high availability (HA) and disaster recovery (DR) requirements.  This new feature will allow zero downtime during major upgrades to SAP ASE or key hardware components (such as a complete storage upgrade) while being impervious to data storage failures.   Offering zero data loss in HA configuration, it helps to reduce application RTO objectives while providing transparent application failover for both planned and unplanned outages. 

Register now:https://event.on24.com/eventRegistration/EventLobbyServlet?target=registration.jsp&eventid=1037729&sessionid=1&key=17D483428DC9F0816E6889EE38912E96&sourcepage=register

Which DBA Tool to use with ASE, and when?

ASE 16 SP02 was launched in September 2015, with a new User Interface (or Tooling) component called ASE Cockpit. (ASE Cockpit uses the same versioning as its ASE, therefore, this debut release is called ASE Cockpit 16 SP02.) Prior to its release, we provided some information on what ASE Cockpit is and what it offers for ASE 16 SP02.

In the information provided in the previous series of blogs, we also compared ASE Cockpit with SCC, Sybase Central, and DBA Cockpit. However, the information provided was a brief reference to such comparisons, as we continued on to make our original point towards the purpose of that blog. In this blog, we take a deeper look at when to use which of these tools, and expand it to comparison with additional tools like Solution Manager and SAP DB Control Center (DCC). This information will provide you a guidance on which tool is most appropriate for your use case.

ASE Cockpit versus other SAP Tooling

ASE Cockpit is a tool for custom ASE use, and not necessarily for use with SAP's Business Suite Applications (or other NetWeaver stack products). This is how we differentiate the role and use of ASE Cockpit vis-a-vis DBA Cockpit. ASE Cockpit and DBA Cockpit use different underlying technologies, and therefore, any configurations, preferences and scripts used with one are not readily available or integrated with the other. Also, the operators (or personas) who use these tools have different motivations - viz., ASE Cockpit is meant for DBAs and DBA Cockpit is meant for System Administrators (SAs) who use the ASE database in context of the Business App.

We dedicate a separate section to comparing ASE Cockpit with SCC below; but it is prudent to make the following point before we compare them on their respective abilities: ASE Cockpit is the replacement of SCC. And SCC was the replacement for Sybase Central. So, newer versions of ASE are likely to continue support for ASE Cockpit only. Prior versions of ASE that are in-market will continue to need to use SCC, as ASE Cockpit does not provide backward support to prior ASE versions. Sybase Central was supported at one time with prior ASE versions, but has been End of Life (EOL) a few years ago, with a migration path to SCC.

A summary of capabilities per various tools is shown in the table below:

The above captures the comparison of these tools across several dimensions, so you are able to quickly cross-check which Tools are applicable to your use case.

Although the above already captures the broad-strokes of comparison between ASE Cockpit and SCC, let's dwell into the more detailed items of packaging, architecture and other such aspects in the next section of this blog.

ASE Cockpit replacing SCC for ASE

With ASE Cockpit positioned to replacing the SCC tool for ASE, let's look into the equivalence of the two tools, and any gaps between them. As noted in the responses to the previous blogs in this series, ASE Cockpit is architecturally a close cousin of SCC, and uses several [modified] components of SCC internally. The reason we re-used SCC components in ASE Cockpit was to continue the equivalent feature support and familiarity as you migrate from SCC to ASE Cockpit.

A summary of the comparison of capabilities and gaps between the debuting ASE Cockpit and its predecessor ASE Cockpit are as follows:

In the above Table:

     + means Added

     - means Eliminated

The above summary provides you decision-making points for your various use cases, and helps avoiding surprises in your upgrade of ASE 16 SP02.

The last few rows in the above Table provide new information on ASE CE, Landscape support, Migration, and EOL; and in its summarized format may raise further questions about how to use ASE Cockpit and how to migrate from SCC. Therefore, let us spend a few words on that.

Current state of ASE Tooling

Understandably, for the next several months, we are going through the stages of increasing our supported capabilities with ASE Cockpit and its eco-system, and that too with the exclusion of such support in SCC. As we do so, we are going to have a temporary phase where some of the capabilities are in ASE Cockpit and some others still continued in SCC until a time they are supported in ASE Cockpit. Current snapshot of the support for ASE is as follows:

Hopefully that clarifies the split of capabilities of ASE Cockpit and SCC. We are proud that the split of capabilities is quite clean for the debut release of ASE Cockpit, in that almost all of the SCC functionality was included in the first release of ASE Cockpit 16 SP02.

Conclusion and next opportunities

There were three blogs in this series, namely:

1. ASE Cockpit (in lieu of SCC 3 for ASE)
2. What's new in ASE Cockpit?
3. Which DBA Tool to use with ASE, and when?(this blog you are reading)

The purpose of these blogs was to provide transparency, clarity and better decision-making material for you. At the same time, the purpose also was to provide you the information on new innovations coming to you from our R&D, state our intention towards continuous incremental improvement, open these up for dialogue, and get your requirements for next set of releases.

Please contact us in comments below, or contact the author via e-mail, or reach out to us at SAP TechEd 2015 in Las Vegas-Nevada and in Barcelona-Spain. Besides being able to take your questions Live at SAP TechEd, we present you the opportunity to try out the ASE Cockpit in a Hands-on Session. Please find this ASE Cockpit Hands-on Session by its Session ID DMM162, or look up Kaleem Aziz and Jeff Tallman as its Speakers. The session itself is called: Using SAP ASE Cockpit for Database Administration and Monitoring.

***

Jump to a sub-topic in this blog:

***

Coming next ...Hands-on Session "Using SAP ASE Cockpit for Database Administration and Monitoring" at SAP TechEd Las Vegas-Nevada and Barcelona-Spain

This post explains how to perform a keyword search on the SAP Help Portal. As an example, I am searching for the SAP ASE 16.0 SP02 documentation for "create database".

Note that the documentation published on the Sybase InfoCenter is no longer supported. Starting in April 2014, SAP ASE user documentation is published only on the SAP Help Portal. For example, most up-to-date SAP ASE 16.0 documentation is available on the SAP Help Portal.

1. On the SAP Help Portal pagehttp://help.sap.com, locate the search bar at the top of the page (in case you, like me, miss the one in center :-))

2. Enter a search term and click on the search icon

You can use the following operators:

3. Under Solution Suite, click on Platform/Technology

4. Under Solution, click on SAP Adaptive Server Enterprise (SAP ASE)

5. Under Version, click on 16.0 SP2

If you make a mistake, you can undo the filtering by clicking on "x" next to a filter name.

6. If your search, like mine, returns 214 results, you may have to click on a few links before finding the information that you're looking for.

If you need to go back to the links that you have previously explored in the search session, click on the links on the 16.0 SP02 bar.

Or you can click on "x" to close any unnecessary pages.

There is no organization that can claim that they are 100% secure.  In the light of increasing attacks on data, it is essential that all organizations take precaution to protect their data in all possible ways. Organizations of all sizes do their due diligence to make sure that their data is well protected.  Even with all these precautions in place, Verizon Data Breach Investigations Report of 2014 stated that in 2013 alone there were 63,437 (an increase from 47,000) security related incidents of which 1,367 (an increase from 621) of them were confirmed to be data breaches.  Most of these incidents were opportunistic attacks which means that they could have been prevented.    The most difficult of these breaches occur from internal sources. Organizations need to be fully cognizant of this and take necessary steps to protect the data from reaching the wrong hands.

Perimeter protection is the first step any organization should take when it comes to security. Entry points like the network should be robust in terms of both in-coming as well as outgoing traffic. Firewall protection and policy protection combined with login authentication requirements should be extremely rigid.  The next step is to protect the database environment.  Compliance regulations such as the US Sarbanes-Oxley (SOX), US Healthcare Insurance Portability and Accountability Act (HIPAA), Japan Privacy Law, EU Privacy Directive, and the US California Senate Bill 1386 require tighter internal controls to prevent unauthorized disclosure or modification of sensitive information which could lead to identity theft and financial irregularities.

SAP ASE ensures that data is protected from all angles right from the time a user requests login permissions to when the database is being queried and even when the data is at rest. SAP ASE allows both internal and external mechanisms for authentication.  A ‘login’ is a means of providing a name and a password to request access to SAP ASE.  SAP ASE looks in a system table called syslogins to verify if the username and password provided are valid.  SAP ASE also supports a variety of external mechanisms as well.  Some of the mechanisms are Kerberos which provides a centralized and secure authentication mechanism where the authentication occurs with a trusted, third-party server called a key distribution center to verify both the client and the server, LDAP which provides a centralized authentication mechanism using login name and password, and finally PAM user authentication which provides a centralized authentication mechanism that uses operating system interfaces for administration and run-time application operations.   After the initial login requirements are met, SAP ASE manages access through a set of pre-defined system roles.  Each of these roles are associated with a pre-defined privileges which may not be taken away from users.   Each activity that gets executed in SAP ASE requires the user to possess specific roles.  In SAP ASE versions prior to 15.7 SP100, the system administrator had access to everything in the database and could assume Database Owner title of any database they wanted to access. 

SAP ASE has taken security to the next level by introducing granular permission control functionality which helps construct site-specific roles with privileges to match site job requirements.  ASE allows customers to revoke permissions from out-of-box system defined roles by enabling a new configuration option called “enable granular permissions”.  The nice thing is that it is possible to restrict DBO’s and SA’s from accessing specific user data as well.  In earlier release of ASE, a system admin and database owner had “unlimited” power with the data.  An user with sa_role/sso_role can almost do anything in the server and a database owner could access any user table via the setuser command.    With ASE 15.7 SP100 and later releases, system admin and database owner’s power can be limited if configured and implicit permission vested in sa_role/sso_role/dbo can be revoked.  This means that by default, sa_role would not have permissions on objects owned by dbo. Here is a quick look into what was available in the previous releases of ASE prior to 15.7 ESD#2  and what is now available:

SAP ASE 15.7 ESD#2 introduced additional security measures to protect data.  New granular, flexible and robust access control mechanism called Predicated Privileges was introduced to enforce policies that would allow users to read and write data.  This functionality allows the administrator to grant access to sensitive data based on the content of the data’s access tag.  SAP ASE qualifies all access to the sensitive table/column by adding one or more customized predicates that serve as a data filter for the table.   This data privacy protection mechanism is based on row-level access controls that dynamically grants privileges to a user based on data content and/or context information.   Predicates for role activation are a pre-requisite for time-based role activation which would be automatically set for a given user at some particular time (or other condition) and automatically revoked at some other time (or condition).

It is quite flexible in that access can be granted to users based on attributes of their session’s profile. This can be done directly, or through granting roles to login profiles.  If there is a need to restrict access to data to preserve its secrecy against fraud or theft, and also to protect the privacy of the owner of the data. Predicated Privileges are an enhancement to the ASE access control system where the “grant” statement is extended to grant row-level access control on a given object based on conditions expressed through a general SQL “where” clause. The where clause is applied when a query against the object is processed and the conditions are evaluated when a query is executed.  The important thing is that the “grant role” statement is extended to support role activation based on dynamic predicate evaluation, allowing user connections to associate with a defined security domain without the overhead of login triggers.

In closing, deploying technology that reliably keeps your enterprise data secure has become a necessary best practice to comply with security regulations.  And SAP ASE does it once again with adhering to security using access control to ensure that data is protected from both external as well as internal sources.

Join us for a webcast Wednesday, October 14^th, 10:00 EDT: Transaction Processing for the Digital Enterprise with SAP ASE In-Memory Technology.

Learn about new in-memory capabilities in SAP ASE, 16 SP02 including, compiled queries, transactional memory, lockless data cache, latch-free btree and buffer cache extension. We’ll explain how each of these features work and how you can take advantage of them in your own environments. We will also highlight upcoming features in SAP ASE 16 SP02 that will further enhance transaction processing for mission critical applications. Speaker: Ashok Swaminathan, senior director, ASE product management

Register now:http://event.on24.com/r.htm?e=1037946&s=1&k=5A3ED3FA772E5B83A482B3FE8979461B

Join us for a webcast to learn about the SAP ASE workload analyzer option, new in SP02. This new functionality allows you to capture, analyze and replay a production workload in a non-disruptive manner. We’ll show you how to capture a workload on your production system, replay it on a testing environment, and quickly analyze the impact that changes in configuration parameters may have on application performance. Use real-life scenarios to determine the optimal configuration for your database, ensuring that your new configuration choices will have a positive impact on your production environment.

Wednesday, Nov 28th

1:00 PM EDT

Register now: https://event.on24.com/eventRegistration/EventLobbyServlet?target=registration.jsp&eventid=1054176&sessionid=1&key=4E986C0E2080077CF0957F4B88DC1A21&sourcepage=register

About SAP Adaptive Server Enterprise (ASE)

SAP ASE is market leading database management system for Online Transaction Processing - it is a major part of the SAP Data Management Portfolio for end-to-end, real-time data management (as shown in Figure 1 below).

                                                                              Figure 1

SAP ASE is a leader (Figure 2) in Gartner’s Magic Quadrant for Operational Database Management System. SAP ASE has established a performance standard in the Sales and Distribution (SD) benchmark (http://news.sap.com/sap-sybase-adaptive-server-enterprise-scores-top-two-processor-and-four-processor-linux-performance-results/) with a #1 ranking on Linux. SAP ASE is a patented technology with multiple grants.

Traditionally SAP ASE has been powering mission critical environments across the industries and has been a mainstay in the Financial Services Industry. With version 15.7, SAP ASE has expanded its capabilities to the cloud – now business organizations have the flexibility of deploying SAP ASE workloads across on-premise and cloud environments to better manage their Total Cost of Owership (TCO).

                                                                            Figure 2

What is the Cloud?

Gartner describes Cloud as (http://www.gartner.com/newsroom/id/1035013) a style of computing that is Service Based, Scalable and Elastic, Shared, Metered, Internet Technology Enabled, for External Customers.

There are multiple Cloud Reference Architectures (we reference the one from the National Institute of Standards and Technology - http://www.nist.gov/customcf/get_pdf.cfm?pub_id=909505  for our discussion) and from them the common theme is a set layered services abstractions such as IaaS (Infrastructure as a service which abstracts network, compute and storage resources), PaaS (Platform as a service which abstracts application scalability and elasticity), and SaaS (Software as a Service which abstracts Business Services), providing a framework for business on-demand.

In this article we will focus on the SAP ASE Persistence Instance (DBaaS, Database as a Service) offering on the SAP HANA Cloud PaaS Platform (as shown in Figure 3 below).

                                                                                                                Figure 3

SAP ASE Persistence Instance (DBaaS) Service Summary

Table 1 below provides a summary of this offering. As stated below the trial version (online self-serve is planned) and a production version is available today. The SAP ASE Persistence Instance is a Database as a Service (DbaaS) offering in the SAP HANA Cloud Platform PaaS Service.

                                                                           Table 1

Getting the Production Use SAP ASE Persistence Instance (DBaaS) Version Today

The Account Executive (AE) is the interface to the successful provisioning of SAP ASE DBaaS Persistence Service on SAP HANA Cloud Platform. Figure 4 below describes this process.

                                                                                    Figure 4

NOTE The same process (Figure 4) will apply for a Trial version as well. A self-help trial access is planned from the SAP ASE Persistence Instance website (URL given below).

Resources

SAP ASE Persistence Instance (DBaaS) on SAP HANA Cloud Platform:

http://hcp.sap.com/capabilities/data-storage/ase-dbaas.html

SAP HANA Cloud Platform Documentation:

https://help.hana.ondemand.com/help/frameset.htm?533384eda57e428f98a43815e6a11119.html

About SAP Adaptive Server Enterprise (ASE)

SAP ASE is market leading database management system for Online Transaction Processing - it is a major part of the SAP Data Management Portfolio for end-to-end, real-time data management (as shown in Figure 1 below).

                                                                              Figure 1

SAP ASE is a leader (Figure 2) in Gartner’s Magic Quadrant for Operational Database Management System. SAP ASE has established a performance standard in the Sales and Distribution (SD) benchmark (http://news.sap.com/sap-sybase-adaptive-server-enterprise-scores-top-two-processor-and-four-processor-linux-performance-results/) with a #1 ranking on Linux. SAP ASE is a patented technology with multiple grants.

Traditionally SAP ASE has been powering mission critical environments across the industries and has been a mainstay in the Financial Services Industry. With version 15.7, SAP ASE has expanded its capabilities to the cloud – now business organizations have the flexibility of deploying SAP ASE workloads across on-premise and cloud environments to better manage their Total Cost of Owership (TCO).

                                                                            Figure 2

What is the Cloud?

Gartner describes Cloud as (http://www.gartner.com/newsroom/id/1035013) a style of computing that is Service Based, Scalable and Elastic, Shared, Metered, Internet Technology Enabled, for External Customers.

There are multiple Cloud Reference Architectures (we reference the one from the National Institute of Standards and Technology - http://www.nist.gov/customcf/get_pdf.cfm?pub_id=909505  for our discussion) and from them the common theme is a set layered services abstractions such as IaaS (Infrastructure as a service which abstracts network, compute and storage resources), PaaS (Platform as a service which abstracts application scalability and elasticity), and SaaS (Software as a Service which abstracts Business Services), providing a framework for business on-demand.

In this article we will focus on the SAP ASE offering on the Amazon AWS Infrastructure as a Service (IaaS) Platform (as shown in Figure 3 below).

                                                                                                             Figure 3

Amazon Web Services (AWS)

As per Amazon.com, Amazon Web Services, is a collection of remote computing services, also called web services, that make up a cloud-computing platform offered by Amazon.com.These services operate from 11 geographical regions across the world.Wikipedia

SAP Adaptive Server Enterprise Amazon Web Services Summary

Table 1 below provides a summary of this offering. The SAP ASE Amazon Machine Image (AMI) Market Place offering in the Amazon Web Services (IaaS) Platform.

                                                                                                                            Table 1

Getting the Trial or Production Use SAP ASE AMI Today

The SAP ASE Amazon Machine Image (AMI) is available in the market place today for trial and productive use. To gain access, visit the following Market Place Web Links for either Linux (RHEL) or Windows imahes:

1. Linux Image: https://aws.amazon.com/marketplace/pp/B00PG7GZJM
2. Windows Image: https://aws.amazon.com/marketplace/pp/B00PG79OWM/ref=sp_mpg_product_title?ie=UTF8&sr=0-3

NOTE: To be able to launch either of these image users will require a valid Amazon Web Services Account. This account can be created via https://aws.amazon.com/account/. The SAP ASE AMI has a default trial period of 30 days on Amazon.

Resources

SAP Database and Mobile Solutions on AWS:

https://aws.amazon.com/sap/solutions/database/

SAP Adaptive Server Enterprise on Amazon AWS:

http://scn.sap.com/community/ase-custom-applications/blog/2015/01/13/sap-adaptive-server-enterprise-ase-on-amazon-web-services-aws

Well, [SAP] Sybase has always been well known (and coveted) for its replication technology.  Sybase Replication Server is a well established, rock-solidly stable product allowing homo- or heterogeneous replication solutions or different types and topologies across most platforms.  But as opposed to other DBMS vendors (say Microsoft?) the solution was always kept separate from ASE server.

It looks like SAP has decided to change this at last.  ASE 16 SP02 has finally bundled replication server into the core installation package - that is if you purchase the HADR ASE option...

What's in the package?  Let's have a closer look.  The last ISUG issue has a brief description of the solution, but since I have not found an open reference to this document and since the only other option is to read official product documentation I decided to summarize it here for those who do not have access to it.

ASE 16 SP02 came out with quite a few enhancements - Always On falls under the "Availability Enhancement" hood.  As the option name suggests Always On has both HA & DR capabilities to choose from.  It promises:

• Zero data loss (HA)
• Transparent Client fail-over
• Planned/Unplanned fail-over support
• Soft DB quiesce for planned fail-over without interrupting applications
• Zero downtime upgrades for minor & major DB releases
• Automated fault detection and handling
• Ability to leverage replicate DB in enforced read-only mode with zero user administration

Replication server has most of these capabilities in the past and indeed it is the infrastructure for the Always On option.  Yet, having them all bundled together is indeed a huge step forward.  I love in particular the transparent fail-over and automated fault detection - forced read only sounds nice too.

As said - the option comes in two configurations:  HA & DR. 

HA configuration encompasses two database servers tied in synchronous data replication mode (apparently relying on RS 157 SP300 capabilities of synchronous replication) - a pair of ASEs with a pair of dedicated RS applying transaction directly to the companion side with only one node being active at a time:

DR configuration replication mode is a-synchronous (although ISUG specifies otherwise - a typo?..).  This is a familiar topology we have been used with Sybase Replication Server for years - a pair of ASEs each with a dedicated RS connected through a direct route to speed up message delivery to the companion side:

I am very curious how simple the management of HADR option is and how scalable is the topology behind it.  I've been busy testing replication server for the last couple of months (replicating from an old ASE 15.x release to a new ASE 16 SP01PL2 in either direction).  Although the setup part is pretty easy, one of the hurdles I have been stumbling on was the volume of data transferred between various RS components.  In particular the pressure on the inbound queue.  In the HA configuration above the RS responsible for applying transaction to the companion ASE seems to be sitting close to the companion ASE rather than the primary ASE. 

As of today when replication agent follows transactions from the primary log to the inbound queue it translates each update/delete command into a command listing all of the primary table columns.  For wide tables this impacts the volume of data moved across network pretty badly (we've lodged CR to deal with this - CR791846).  As minimal column support kicks in only for the outbound queue I am very curious to see what the out-of-the-box HA implementation is able to achieve (unless it is based on stream replication rather than transaction replication).  In the testing I have been performing any latency introduced to the chain RA - inQ was threatening to blow the primary ASE transaction log - the nightmare for any DBA messing up with replication server.  And I have not been testing synchronous replication even!  I also wonder if HADR option includes various ASO enhancements introduced into RS for the past couple of years.

In short, HADR is our there - love it or leave it.

I hope we will go with the former but only time will tell...

Have fun,

ATM.

ps. I wonder what are the pricing differences between HADR option vs. RS CORE (+ASO).

I'm currently in the process of upgrading server OS's from WIN2003 to WIN2008 and need to purchase a version of sybase that is supported on WIN2008 R2 64bit.  I want to ensure I can import a Sybase Export file from a Sybase Version 16 DBMS into a Sybase 15 version.  My customers are on Sybase Version 15.  Would Sybase Version 16 support a version of Sybase 15 as a target delivery format?

While Part 1 of this sequence provided an introduction to the SAP ASE Persistence (DBaaS) Service this post will provide an introduction to the HCP Cockpit experience in the form of a walk-through.

On-line Access to the SAP ASE Persistence (DBaaS) Service

The SAP ASE Persistence (DBaaS) Service home can be accessed via a Web Brower. This home link will take the user to the following page as shown in Figure 1 below.

                                                                    Figure 1

In Figure 1 there are two circled (red) clickable buttons. The Trial SAP ASE (green) button will provide a trial registration form to gain access to the SAP ASE Persistence (DbaaS) Service. Once this is submitted the registrar will provide the access credentials for the Trial Account. The Launch HCP (blue) button will log the user into the HCP cockpit for trial or production Administration and Monitoring. NOTE: This self-serve is planned effort. As noted in Part 1 the access to the HCP for the SAP ASE Persistence Service (DBaaS) is via the Account Executive.

A Quick Start walk-through

Upon a successful login the HANA Cloud Platform (HCP) user experience will be driven be a HCP Cockpit console as seen in Figure 2 below. This Dashboard landing view will display a summary of all user deployed applications and account summaries.

                                                                                      Figure 2

The HCP Navigation Options in Figure 2 are explained in Table 1 below.

                                                  Table 1

The Account navigation button will take the user to the Account Management screen as shown below in Figure 3, where the user (with the appropriate privileges) can administer or manage groups and membership, including access control privileges.

                                                                                 Figure 3

The Databases & Schemas button will take the user to the Database Administration page as shown below in Figure 4, where the user (with appropriate privileges) can create and administer Databases and Schemas.

                                                                                    Figure 4

A User (with appropriate privileges) can click the New tab to create a new database. On clicking the New tab the Cockpit interface will display a form as shown in Figure 5 below, for the creation of a new SAP ASE Persistence Service (DBaaS).

                                                                                        Figure 5

The User can fill in the information and then click the Save button to create the instance or Cancel button to cancel the operation. Once filled in and Saved, HCP will create the instance, as shown in Figure 6 below, the "testinstance" has been created.

                                                                                      Figure 6

The View Requests button in Figure 6 lists out a trail of operations, as shown in Figure 7 below.

                                                                                 Figure 7

The HANA Cloud Platform (HCP) provides a rich set of tools to work with the platform and user deployed databases and applications, as shown in Table 2 below.

                                                                                  Table 2

Resources

Tools and Documents:

https://help.hana.ondemand.com/help/frameset.htm?abcae5b568c94e5391a74d15f5db9213.html

Other HCP Links:

http://hcp.sap.com/capabilities/data-storage/ase-dbaas.html

https://help.hana.ondemand.com/

Hi,

The install is running almost 3 hours and I copy the log as for the moment, at the end of this post.

I am trying to install SAP-ASE 16 SP2 on an Acer laptop Aspire V 15 Nitro with OS Microsoft Windows 10.

Intel Core i7-5500U 2.4GHz / 8GB DDR3 L / 1TB hard drive.

It is for evaluating and eventually developing a system (free install).

I left almost everything as default including 4k page size and only raised the device size of master and sybsystemprocs, rising the size of the corresponding databases too.

Did the same with tempdb, but I think I am stuck in an endless loop with almost 95 character set installations.

The previous attempt where I also changed the language and the character set, ended up in the same problem and I aborted it (yesterday).

I searched the posts with "install", "character" and "ASE16sp02" tags not finding anything similar. I skeemed the first 6 pages of posts not finding anything related, but obviously not all the pages.

Regards,

Thomas Magdahl

********************** LOG *************************************************************************************************

The log file for this session is 'D:\Thomas\Data\Megalux\Sistemas\DataBase\ASE-16_0\init\logs\log1125.001'.

Warning: You have selected '4k' as the logical page size for the SAP Adaptive Server Enterprise. If you plan to load dump from another database, make sure this logical page size matches the size of the source database. The default logical page size in previous SAP Adaptive Server Enterprise versions was 2KB.

Running task: update SAP Server entry in interfaces file.

Task succeeded: update SAP Server entry in interfaces file.

Running task: create the master device.

Building the master device

..Done

Task succeeded: create the master device.

Running task: update SAP Server entry in registry.

Task succeeded: update SAP Server entry in registry.

Running task: start the SAP Server.

waiting for server 'MGLX_ASE_01' to boot...

Task succeeded: start the SAP Server.

Running task: set System Administrator's password.

Task succeeded: set System Administrator's password.

Running task: create the sybsystemprocs database.

sybsystemprocs database created.

Task succeeded: create the sybsystemprocs database.

Running task: install system stored procedures.

Installing system stored procedures : 10% complete...

Installing system stored procedures : 20% complete...

Installing system stored procedures : 30% complete...

Installing system stored procedures : 40% complete...

Installing system stored procedures : 50% complete...

Installing system stored procedures : 60% complete...

Installing system stored procedures : 70% complete...

Installing system stored procedures : 80% complete...

Installing system stored procedures : 90% complete...

Installing system stored procedures : 100% complete...

Task succeeded: install system stored procedures.

Running task: set permissions for the 'model' database.

Task succeeded: set permissions for the 'model' database.

Running task: set local SAP Adaptive Server Enterprise name.

Task succeeded: set local SAP Adaptive Server Enterprise name.

Running task: set the XP Server for the SAP Adaptive Server Enterprise.

Task succeeded: set the XP Server for the SAP Adaptive Server Enterprise.

Running task: update XP Server entry in registry.

Task succeeded: update XP Server entry in registry.

Running task: create temporary database.

Task succeeded: create temporary database.

Running task: set optimization goal.

Task succeeded: set optimization goal.

Running task: install a character set(s).

Installing character set 'cp850'

Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

.........Installing character set 'cp850'

While Part 1 of this sequence provided an introduction to the SAP ASE on Amazon Web Services Market Place, this post will provide an introduction to deployment experience in the form of a walkthrough.

Amazon Market Place Access to the SAP ASE (Amazon Machine Image – AMI)

The SAP ASE AMI image can be accessed via a Web Brower. ASE supports multiple platforms in the market place, including Linux and Windows. In Figure 1 we show an example of the ASE Market Place page for the Linux AMI.

Figure 1

In Figure 1 please note the different regions that support ASE AMI (the image shows US East in N. Virginia). Also note the hourly utilization rates in the table, these rates might change based on the region selection. So while a customer brings their own license (BYOL), resource (compute, storage, and network) utilization rates will be metered based on these rates, by Amazon, separately.

A Quick Start walkthrough

Prior to the deployment users will require a valid Amazon Web Services Account. Users can log in or create a new account from this link as shown in Figure 2.

Figure 2

There are two ways to get to the desired ASE AMI for deployment. Either via a web search for the desired AMI leading to the page as shown in Figure 1 or after a log into the Amazon Web Services Management Console page as shown in Figure 3.

Figure 3

For this walk-through we shall use the Linux AMI, discovered from the Amazon AWS account (after a successful log in).

Amazon Deployment Walk-through

Log into the Amazon AWS Management Console as shown in Figure 4. If a user does not have an account then a new account (free) can be created by selecting the “I am a new user.” Radio button.

Figure 4

Once a user logs in, user will see the AWS Market Place link to the right as shown in Figure 3 (above). On clicking that link the user will see the page in Figure 5.

Figure 5

On this page the user can discover the AMI images for SAP Adaptive Server Enterprise using the “Search AWS Marketplace” text field. The search will yield the page shown in Figure 6.

Figure 6

On selecting the SAP Adaptive Server Enterprise link for version 16.0 SP02PL01, the user will see the page in Figure 1 (above). On clicking the Continue button the user will see the page in Figure 7.

Figure 7

Please note the available unique images in each region. On selecting the “Launch with EC2 Console” corresponding to the desired region of interest, the user will see the page in Figure 8 (a start of a EC2 workflow).

Figure 8

The user can select the image type based on the desired Compute, Storage, and Network capacities. The user can get more information about the mappings between virtual capacities to real capacities on Amazon Web Services site. In this example we choose the m4.2xlarge type, comprising 8 vCPUs (virtual CPUs), 32GB of memory and a pre-configured Elastic Block Storage (EBS). On selecting the “Next: Configure Instance Details” the user will see the page in Figure 9.

Figure 9

In Figure 9 please note that users can configure auto scaling group to automatically scale the capacity. Although this example has chosen to select the default Virtual Private Cloud (VPC) and Subnet, users can create their own VPC and/or Subnet. Users can allow the workflow to choose a public IP for this (default, note this will be disassociated on the instance stopping or terminating) or opt to associate an Elastic IP address (EIP, which is a separate service and cost). Placement group provides a logical grouping of nodes into a cluster (we have chosen the default for this example). IAM role is for secure access (we have chosen the default for this example), users can create a role to manage application access. Shutdown behavior is stop (the alternative is terminate, which means the instance and data will be garbage collected). Enable Termination Protection will insure prevention of accidental termination from the Amazon EC2 management console (we have chosen the default for this example). With Monitoring enabled, users can monitor the ASE instance with Amazon Web Service monitoring framework “CloudWatch”. ASE instance is by default EBS-optimized, for better disk throughput and performance. With respect to tenancy (we have chosen the default for this example), the alternatives are to run this instance on dedicated hardware or dedicated host. With respect to network interfaces settings the defaults apply (except association of an IP such as an EIP), although users can add additional Ethernet interfaces (devices). On selecting “Next: Add Storage” button the user will see the page as in Figure 10.

Figure 10

The default root file system is provisioned as 10GB (we have chosen the default in this example), this can be altered by the user. The default media is SSD (we have chosen the default in this example), the user can choose Provisioned IOPs (higher performing SSD) or Magnetic from the drop down. Optionally the user can add additional volumes (now or later). Once the user clicks the “Next: Tag Instance” button the workflow will lead to the page as shown in Figure 11.

Figure 11

Tagging allows a user to easily identify an asset for a specific use. In the example in Figure 11 we have tagged this instance as part of the ASE Product Engineering department and for use in Quality Assurance. Users can create additional tags (we have chosen to create only one for this example). When user clicks the “Next: Configure Security Group” button the workflow will move to the page as seen in Figure 12.

Figure 12

Security groups defines the network access policies for the instance, similar to IP tables in Linux or Firewall policies in a router. This example shows the policy for a secure shell (SSH). Users can add additional rules for other types of access. Although this example is creating a new security group, users can select an existing security (which they would have created via the EC2 management console). When the user clicks the “Review and Launch” button the workflow moves to the Review and Launch Page as shown in Figure 13, where the user can finalize edits before launching the ASE instance.

Figure 13

When user clicks the “Launch” button the workflow will prompt the user to provide a security key pair name, as shown in Figure 14. The user has a choice of selecting an existing key pair or associating a new one. Amazon Web Services uses a public key cryptography model to govern secure access to the running instances. The key pair name is a reference to the generated the public key (maintained on the server) and the associated private key for secure access.

Figure 14

In this example we create a new key pair for the security key generation as shown in Figure 15.

Figure 15

When the user clicks the “Download Key Pair” button, the user is prompted to save the file safely for secure access to the instance (for example using putty for SSH access), as shown in Figure 16. Please note the caution in Figure 15.

Figure 16

Upon completing this procedure the instance is deployed and launched as shown in Figure 17.

Figure 17

Once the private key file is saved (.pem file), then that file can be used to access the instance in multiple ways as shown in Figure 18. Users can connect to the instance from the Amazon Web Services EC2 management console. On selecting the instance of interest and clicking the “Connect” button the user us provided with multiple options to connect to the instance.

Figure 18

For more information please read the links in the Resources section below. The Amazon Web Services version of the SAP Adaptive Server Enterprise support all features as in the on premise version.

Resources

SAP Database and Mobile Solutions on AWS:

https://aws.amazon.com/sap/solutions/database/

SAP Adaptive Server Enterprise (ASE) on Amazon Web Services (AWS):

http://scn.sap.com/community/ase-custom-applications/blog/2015/01/13/sap-adaptive-server-enterprise-ase-on-amazon-web-services-aws

Connect to your Amazon Web Services instance:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-connect-to-instance-linux.html

Associate an Elastic Network Interface to an Amazon Web Services instance:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html

Associate an Elastic IP address to an Amazon Web Services instance:

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

Now that SAP ASE comes with it own brand-new Always On option it is worth having a closer look at it.

Below is a peep-view at Sybase HADR Option.

HADR has three basic components:  ASE, RS and Fault Manager.  I skip the Fault Manager for the moment (although it reduces all of self-management to nil) and concentrate on the ASE|RS components. ASE setup with HADR enabled requires super user (sudo) credentials - for those who wishes to install the whole bundle at once.  It is also essential to remember that HADR is notdesigned to run on a single host.

Setup Phase:

Setup phase is pretty straightforward.  ASE 16 SP02 installation comes with a sample resource file for hadr in addition to the sample resource files it traditionally had for other ASE components ($SYBASE/$SYBASE_ASE/init/sample_resource_files/setup_hadr.rs).  You may need to make two copies of it - one for the primary side and another for the replicate - to make life easier.   The sample resource file is commented throughout - you just need to make sure that the resource file for each side is modified correctly following the guidelines in the template script.  Otherwise things may go wrong...

With the resource file fixed - the HADR setup consists of calling the setuphadr utility twice - once for the primary side and once for the replicate side.  DB synchronization is performed by the script itself (through calls to the RMA component - which has to be started on each host before calling setuphadr).

All in all it takes 2 simple steps to set things up (again, not counting FM installation).

When done, you may verify installation by connecting to RMA through its rma_tds_port - or you may connect to RS through its srs_port - both defined in the resource file.  To understand if all is good or not - beyond the success message setuphadr prints out - you will need to read documentation first.  RMA command line options are brand new set of sap_... commands.  RS has a lot of new components - some in suspended|down state even when the system is operating well.   There is also RS log file (to be found in $SYBASE/DM/{CID} directory.  And there is an RMA log file (to be found in $SYBASE/DM/RMA-15_5/instances/AgentContainer/logs).

Yet another option is ... ASE Cockpit (you will have to start it first from $SYBASE/COCKPIT-4/bin/cockpit.sh - default port is 4283 for https connection - but connectivity information is printed out so you don't need to worry remembering the right path)...

Monitoring Phase:

ASE 16 Sp02+ is now managed through ASE Cockpit - a new kid on the block.  The system that has HADR enabled will look like this:

You will find that under the system status there is another status:  site mode status.  This one indicates which side of the HADR system it is (primary|standby) and what is its health status (active|stopped|unknown).

HADR has its own screen in the Monitor section as well.  This will look like:

Here too one will see the state of the system (active|stopped|unknown) and in addition what the system components are with their corresponding states:

The "path" here is replicating from ASESRV1 to ASESRV2 for asedb, master and DA1 databases (master and DA1 are "default" databases to be replicated, with DA1 is the name of the cluster you choose in the hadr resource file).  one may see the direction of replication, state and health - across various parameters (components state, primary ASE log state, replication throughput, replication backlog and latency).

When the system will be up enough time to collect metrics ASE Cockpit will be able to show various handy statistics on the HADR.

Backlog:

RS Latency:

Primary ASE Log Status:

Replication Throughput:

This is a pretty nice way to visualize your HADR health status - including a neat breakdown of latency into RS components - once visible through manual

rs_ticket interface.  STP state is also visible through primary log status.

In addition to this it is possible to see other HADR performance statistics through the ASE Cockpit "Statistics Chart" interface across various RS related metrics:

I must confess that for those used to run manual commands to see what's going on with the replicated environment this is a massive step forward.  Looks neat.  Still things to be polished but hey, this is just a start!  It already provides a decent way to monitor replicated environment "out-of-the-box".

Operation Phase:

ASE Cockpit allows to manage the system as well as to monitor it.  This is done from the EXPLORE tab of the ASE Cockpit.

The management interface looks like this:

ASE Cockpit covers:

• Manual fail over
• Re-materialization
• Forcing the server to become primary if HADR state is unknown
• Stopping|starting basic RMA|RS components

For the fail over ASE Cockpit will also display the fail over status (log) during the operation:

For those attentive to detail... there is a blue-yellow motive adhered to....

Round Up:

HADR option looks like a valuable addition to ASE environment.   Although setting up replication server has never been a big issue for ASE DBAs  - an easily scripted task - having it all done for you is nice.  On the other hand, managing & monitoring the environment has been a thorny thing.  With HADR option this task has been addressed and elevated to a new level.  Everything ASE Cockpit displays may be still done manually (either using the new RMA interface or using the old good RS commands).  At the same time having the things in front of one's eyes easily accessible has a great value.

There are still things to be improved - like having embedded RS to work on auto-expanding partition rather than a fixed size one, having the cluster id database auto-expanding rather than fixed size, having more technicaldocumentation on how various components work and how the new system shall be troubleshooted in case things go wrong, having an ability to interact with ASE cockpit better, having more elastic licensing model, having more than one replicated nodes in the same configuration - but as a starting point this feature is definitely worth a try.  Big thumps to ASE & RS engineers  (I've heard rumors that the throughput is much faster for HADR than what we are used to and it looks like there are several ASO|HVAR options turned on by default).

I look forward to ASE 16 SP03...

ATM.

Whenever a new version of SAP Sybase ASE is released, I'm always looking forward to try new functionality.

One thing that got my attention is granular permissions

The idea of granular permissions is to only grant the permissions required for the job at hand (least privilege principle)

Sybooks says: grantable system privileges allow you to enforce "separation of duties"

Is it really that simple?

System roles can be restricted by revoking specific permissions, alternatively it's possible to create user defined roles and grant only specific permissions. The downside of using user defined roles is that user defined roles can't be audited, so if you rely on auditing sa_role you might want to restrict sa_role instead of creating a user defined my_sa_role. If you do change system roles, you can always get the original permissions back with procedure sp_restore_system_role, which requires permission manage server permissions.

Granular permissions can be granted on several levels, from server roles to object permissions. Permissions which would otherwise require object owner or dbo can now be granted separately. Which is a very nice feature. E.g. permission identity_insert, which can be very useful in some situations where you don't want to grant dbo access and still want to be able to provide explicit values for identity columns (e.g. with replication).

An example: sso_role. What kind of permissions are granted to sso_role?

Note that several permissions only apply to the current database, the permissions below are granted in the master database

grantor grantee  type  action                        object           column predicate grantable

------- -------- ----- ----------------------------- ---------------- ------ --------- ---------

dbo     sso_role Grant Alter Any Object Owner                         All    NULL      FALSE

dbo     sso_role Grant Change Password                                All    NULL      FALSE

dbo     sso_role Grant Decrypt Any Table                              All    NULL      FALSE

dbo     sso_role Grant Manage Any Encryption Key                      All    NULL      FALSE

dbo     sso_role Grant Manage Any Login                               All    NULL      FALSE

dbo     sso_role Grant Manage Any Login Profile                       All    NULL      FALSE

dbo     sso_role Grant Manage Any Remote Login                        All    NULL      FALSE

dbo     sso_role Grant Manage Any User                                All    NULL      FALSE

dbo     sso_role Grant Manage Auditing                                All    NULL      FALSE

dbo     sso_role Grant Manage Roles                                   All    NULL      FALSE

dbo     sso_role Grant Manage Security Configuration                  All    NULL      FALSE

dbo     sso_role Grant Manage Security Permissions                    All    NULL      FALSE

dbo     sso_role Grant Map External File                              All    NULL      FALSE

dbo     sso_role Grant Select                        builtin authmech        NULL      FALSE

dbo     sso_role Grant Set Tracing Any Process                        All    NULL      FALSE

dbo     sso_role Grant Show Switch                                    All    NULL      FALSE

dbo     sso_role Grant Update Any Security Catalog                    All    NULL      FALSE

dbo     sso_role Grant Use Any Database                               All    NULL      FALSE

How to use this feature to make my server more secure?

e.g. revoke "change password" from sso_role and it won't be possible anymore for sso_role to change the password for any other login.

Or create a user defined role, and only grant permission "Change Password". That sounds pretty good.

But what about the other permissions? Especially "Manage Roles", what can you do with this permission?

With this permission any role can be granted to (or revoked from) any login. There are no restrictions for granting sa_role & sso_role

A login with permission "manage roles" granted, can grant any role, including system roles sa_role and sso_role, to any login!

(Granting some permissions still requires specific permissions, like "manage server permissions", but granting sa_role with this permission already granted is no problem.)

With granular permissions disabled, to grant sa_role the sa_role must be granted to the grantor already.

If the grantor is not granted sa_role, then error 10353 will be raised:

Msg 10353, Level 14, State 6:

Server 'ASE157', Line 1:

You must have any of the following role(s) to execute this command/procedure: 'sa_role' . Please contact a user with the appropriate role for help.

But with granular permissions enabled, there's no restriction and the role is granted without any problem.

Note this is not a bug, this is the way it has been designed... If it's something you really want is a different question.

With default sa_role and sso_role you can also dynamically switch between enabling and disabling granular permissions, so you have full access.

Not all things are very straight forward with granular permissions. For example permission "manage any statistics" and "own any database"

The keyword "Any" means it should apply to all objects (there's an exception: server privileges with this keyword do not apply to sybsecurity)

Manage Any Statistics

This permission only applies to the current database. So it has to be granted in all databases separately.

If you have this permission it's possible to run update statistics on any user table.

For updating statistics on system tables, you need to be dbo as well.

But even when you are dbo, it's not sufficient. For security related tables like: sysroles and sysprotects extra permissions are required.

Even if you can do a select * on these tables, and you have the "Manage Any Statistics" permission, it's not allowed to run the update statistics command for these tables. What is required to run update stats on these tables is permission "Update Any Security Catalog"

IMHO running update statistics is not updating the security catalog itself, so why this permission is required for update stats is a bit of a mystery to me.

Own any database

If you want to restrict the DBA from accessing user data, this permission is probably something to look at. Revoke it from sa_role and the login with this role lost the dbo access to the database and can't access data anymore without explicitly being granted access to it. But what's the impact of doing this? What happens if your database is nearly full? Without dbo access it's not possible to extend the database. You'll have to find other ways to handle that. (e.g. using a procedurewith  option "with execute as owner", but that's a topic for a different blog)

Last but not least, some commands are not working when granular permissions is enabled

E.g. dbcc printolog('Msg')

Msg 10350, Level 18, State 45:

Server 'ASE157', Line 1:

Permission related internal error was encountered. Unable to continue execution.

This command can be easily replaced by dbcc logprint('Msg')

But it does mean you need to test carefully when implementing new functionality like granular permissions.

Note these dbcc commands are unsupported and should be used carefully.

Granular Permissions gives many possibilities, but also put more responsibilities on the DBA and/or security officers to define and manage a secure and practical security configuration. It's not straightforward to define a role with exactly the permissions you need.

Join us for a special webcast

Spotlight on healthcare: accelerating electronic patient management systems with SAP ASE 16

Date: Tuesday, January 19, 2016

Time: 10:00 AM PST

http://event.on24.com/wcc/r/1111375/3E75B1FBEB46DD6B190202CB19C89466

UZ Leuven, the largest healthcare provider in Belgium, provides a consolidated workspace for physicians, nurses, doctors and patients using SAP ASE 16. The company utilizes their medical file system with 17 other hospitals to prevent lost medical records when transferring patients to other hospitals. SAP ASE 16 allows UZ Leuven to transparently refer patients between hospitals with the same procedures and the same quality proposal. During the webcast we’ll show you how UZ Leuven uses SAP ASE 16 to:

•Successfully manage shared databases

•Support expected growth of 50%

•Scale systems to meet demand for increasing number of users

Please join us for a webcast with Reinoud Reynders, IT Manager Infrastructure & Operations at UZ Leuven, and Ashok Swaminathan, Senior Director, Product Management at SAP, to learn how this leading healthcare provider uses SAP ASE 16 to provide superior performance for its electronic patient management

application.

Register now: http://event.on24.com/wcc/r/1111375/3E75B1FBEB46DD6B190202CB19C89466

We all like to get presents for the holidays.   This year, ASE engineering came through with two that should make a lot of ASE users quite happy.

The first was ASE Cluster Edition 16sp01 on Linux.  While the main thrust of this release was to bring ASE Cluster Edition up to the ASE 16 level of functionality (and performance enhancements), there also was one of those "magic go faster" buttons added - via RDMA support.  One of the bottlenecks in any Shared Disk Cluster (SDC) is the need for the different cluster nodes to communicate between each other.  Often this coordination must be done in advance - e.g. logical or physical locks - and there is a LOT of it in any cluster.  Tons of it.   Mind boggling amounts of it.  Loosely, for ASE/CE, we referred to any and all communications beween the nodes as CIPC - or Cluster Interconnect Protocol Communications.  In the past, ASE/CE used UDP over IP as a slightly faster protocol for CIPC vs. TCP/IP.   However, whether TCP or UDP, both are packet framing protocols in which network operations move through multiple layers before finally being sent.  For ASE/CE implementations, this was often the bane of existence.  First, few OS system admins bothered to tune the network settings - and if they did, it was merely the OS kernel memory and often just for TCP vs. UDP.  Neglected was the ability to increase the hardware/NIC queue depth using ifconfig.  Worse yet, very often the private interconnects were not even set up correctly.  Enter RDMA.  RDMA is to network IO as DMA is to disk IO.  In otherwords, rather than copying memory contents repeatedly as happens with packet framing, instead the memory contents are mapped directly to the IO request.  The difference is enormous.  Whereas we usually measure network latency using TCP/IP in milliseconds, RDMA latency is often in the low 10's of microseconds.  In some cases short enough that the process doesn't even need to yield the CPU in cases of CPU threading.  RDMA can be implemented over Infiniband or Ethernet - the latter, of course, much cheaper.  Currently, ASE/CE 16sp01 only supports RDMA over Ethernet.  However, the good news for most is that for very little investment (<$10K US), you can upgrade the NICs used for CIPC and any switches from older non-RDMA supported HW to new 10GbE with RDMA support.  Current testing in engineering has shown a 35% improvement in application performance when in cluster mode, with badly partition applications showing nearly 200% performance gains.  Now the bad news:  1) This isn't to infer that ASE/CE should or could be used for horizontal scaling.  There simply are too many SDC related bottlenecks for this to work for OLTP applications we aim ASE at.  2) ASE/CE 16sp01 was only released on Linux - before you ask, I don't have dates for those of you running on AIX, Solaris SPARC or HPUX on HPIA/64.  For more information about what is new in ASE Cluster Edition 16sp01, download the ASE 16sp01 What's New guide that was published in December from http://help.sap.com/ase1601 (http://help.sap.com/Download/Multimedia/zip-ase1601/SAP_ASE_Whats_New_en.pdf)

The second present under the tree from engineering was ASE 16sp02 NV Cache.   While ASE 16sp02 was GA'd in October, there were two features in restricted release due to finalizing some usability aspects.  One of course is the HADR feature in the Always-On option - which should be unrestricted with the release of ASE 16sp02 pl03.  However, in ASE 16sp02 pl02, we moved the NV Cache feature from restricted to fully available.  The NV Cache feature leverages SSD devices to extend main memory through an industry standard technique called "SSD cache extension".  Whereas competitive offerings were limited to clean pages only and also didn't differentiate between cache hits, ASE engineering built a "smarter SSD cache".  In the case of ASE, the named caches (or default data cache) are divided into two page chains - Single Access Cache Chain (SACC) and Multi-Access Cache Chain (MACC).  The first time a page is read, it is appended to the SACC.  If the pages is read a second time while still in cache, it is then appended to the MACC.  When pages from the SACC hit the wash marker are not moved to the NV-Cache - but instead are simply discarded (if clean - if not, a write is posted then discarded once write completes).  However, when a page in the MACC hits the wash marker, it is copied to the NV-Cache.  If the page is re-read, it simply is read (and removed) from the NV Cache and placed back into the standard cache (on the MACC list obviously).  As a result, the NV Cache is more effective as it isn't filled with useless read-once-and-discard data.  In addition, the other competitive advantage to ASE's NV Cache over competitive offerings is that all writes are done via the NV Cache.  The rationale is a bit interesting.  Have you ever run a query with 'set statistics io on' and seen a lot of writes - in particular the writes increasing or fluctuating with increased concurrency on the system???  The answer is actually in the documentation.  While it *could* be sort spills or other worktable related query processing - it also *could* be the simple fact that in reading pages from disk into memory requires other pages to be pushed out - e.g. normal MRU-LRU processing.  As pages are brought into memory, your cache changes may push dirty pages already in cache through the wash marker, resulting in disk writes on tables/indexes you are not even affecting with your query - disk writes of dirty pages written to by other users.  Depending on the size of your cache (more specifically the wash size), you may have had to wait for these writes to complete before there were clean pages for you to be able to read pages from disk - called 'cache stalls'.  Admittedly, infrequent, but they do happen.  More to the point, when writing to the transaction log, any ULC flushes or commits had to wait for the actual writes to disk - which often was the biggest cause of log semaphore contention as was evident in the 'delayed commit' option implementation.  When a database is bound to an NV Cache, all writes instead happen first to the NV Cache - and then 'lazy cleaner' threads write the dirty pages to disk.  The number of lazy cleaners is configurable using sp_configure and the NV Cache supports a 'journal' which tracks the write sequence to ensure recoverability (and to denote which pages need to be written by the lazy cleaners).  Once again, early testing by our partner EMC using their XtremIO(TM) All Flash Array has shown that using these devices as NV Cache provides nearly the same performance as an all-SSD hosted database - despite using much slower HDD for actual storage.  The actual peformance numbers will be reported via a whitepaper that my colleague Andrew Neugebauer is working on with EMC.  More information on the NV Cache can be found in the ASE 16sp02 System Administration Guide volume 2, Chap 4 - Configuring Data Caches, Section 4.19 - Managing NV Cache.

....and based on the roadmap, all I can say is that next year's presents look equally attractive to speed freaks such as myself....only 340-odd days to go....

You can find it at http://help.sap.com/ase1602 in HTML and PDF format.

To access translated HTML content, open the HTML version of the book that you want to see, and use the dropdown to switch to a different language.

Zipped PDFs are available in the bottom of the page under "PDF Downloads".

Right here:

                                                     ......And what judgment

Would step from this to this? Sense sure you have,

Else could you not have motion. But sure that sense

Is apoplexed...                                                                  

I am of late have been involved in a lot of tuning activity around replication server.  Lots of things to tune.  Lots of hidden moving parts.  Complex creature (although may strike as simple and straightforward in layout).  I will not involve you in all the frustrations and victories taming this beast but one simple aspect I would like to emphasize.

As you all probably know modern replication server is intelligent enough to work without going into the trouble of defining replication definitions for the objects to be replicated. It even no longer requires you to have your primary table indexed.  It will pull data no matter what satisfying the customers eagerness to get things with minimal configuration effort (up to the point).

However, I'm not at all sure that RS capability of working without replication definitions is good at all.  It is definitely very convenient - less things to mess with.  But the price is way too high for this type of convenience.

Consider the graphs below:  the same workload on the primary.  The same replication topology.  The only difference between the two tests is that the second test has less replication definition defined (tables with no unique indices on the primary are left as they are and hence no replication definition defined on them).

Left side represents the activity on the primary ASE (16.0.1.2):  The load has ended by around 4 pm.  The application of the transactions to the replicate ended around 7 pm.   There are 3 hours of latency (bad enough - but this is a non-ASO instance and no stream replication.  The primary runs the workload with up to 70 threads.  Replicate has to serialize to some extend.  Not sure the latency can be battled further...

Now the same test with fewer replication definitions (still there on all tables that have unique indices, but there is ~10-15% of heaps with no unique index).  Activity on the primary stopped around 2 pm.  RS kept applying the transactions to the replicate until 6 am and beyond... 15+ hours of latency against 3 hours.  This is 5 times worse throughput for the replication server due to <15% of DMLs hitting heap tables with no replication definitions.

Before someone exclaims - "Yey - replicate DML table scans for each transaction - little surprise on this one" - the answer is no.  Replicate server applies transaction using indexed updates/deletes all the times.  The ONLY difference is - the size of the DML packet reaching it (heaps are indexed - having no unique clustered index does not mean the replicate will table scan).

A bit of explanation

RS architecture is pretty straightforward:  read the primary log, write into inbound queue, check who subscribes to what, move into outbound queue, distribute to the replicate.  Things are more complex than this - to be sure - but basically it moves data across its "pipes" manipulating it internally.  Here is where replication definition enters the picture.

Say we have a primary table:  prim_table (a int, b int, c int, &c) unique index on a.  Without replication definition a DML statement like update prim_table set b = 2 where a = 1 will reach the replicate ASE in the form of:  update dbo.prim_table set b=2 where a=1 and b=1 and c=1 &c....

Ah, there's the rub.  Even if you are "lucky" enough to set replicate_minimal_columns on on the connection level which will at least spare you the pains of bloating the packet further into update dbo.prim_table set a=1, b=2, c=3, &c where a=1 and b=1 and c=1 &c... the packet will still be filled with far less DMLs that it might have been.  Larger the commands RS moves internally - lower its throughput in the end.

It looks like a trifling thing - defining unique index & adding replication definition based on it as a primary key - but the price of omitting replication definition is sometimes disproportional to the effort of defining it. I really wish RS was NOT able to work without it in the first place in order not to generate the latency (and frustration associated with it) due to negligence.  But it is.

Other things to watch for:

1. You should send ONLY the columns affected by the primary DMLs to the replicate to minimize the size of the outbound queue.  However, defining replication definition with "replicate minimal columns" is NOT enough to... replicate minimal columns.  You should also add "set stanby all columns" in order for RS to actually start sending minimal set of columns across.  Pretty un-obvious (although documented).  So if you want to send ONLY the columns your primary DMLs affect specify for your rep definition that it should send all but replicate minimal.  Hm.

2.  Unfortunately, there is absolutely NO way to minimize the impact on the inbound queue.  Even though primary DML affects a  single column (as in our example), the inbound queue will still list the DML as "update prim_table set a=1,b=2,c=3,&c where a=1 &c".  I've opened a CR on this - to me it looks pretty weird that this is the default functionality for the modernized "intelligent" rep agent (autocorrection in not turned on by default anyway).  If the impact of bloating the DML on the outbound queue is SOOO bad, isn't fixing this in the inbound queue will too have a significant positive impact on RS - with minimal engineering effort?  Hm.

Anyway, I hope you will head the advice and define your replication definitions intelligently - with the smallest primary key possible.  It DOES matter to performance.

HTH,

Andrew

SAP notes provide clarification on issues that occur in the code or documentation of a product. You can use them to find out how to work around issues affecting a particular release.

When should I use SAP Notes?

• You’re considering whether to upgrade your system. Look up the SAP notes for the product version so you can plan around any issues impacting it.
• You’re seeing new error messages after upgrading your system. Look up SAP notes with the error message to find out how to work around the issue.
• You’re stuck on a particular task even after reading the documentation. Look up SAP notes for the product that may include information missing from the documentation.
• You're just not sure a feature is working correctly. Look up SAP notes with a feature keyword to find any information about reported issues and how to resolve them.

Where can I find SAP notes?

1. Go to the Support Portal.
2. Select Knowledge Base & Incidents from the menu at the top of the screen, then SAP Note & Knowledge Base Article Search.
3. Click the Launch the SAP Note and KBA search button.
4. Enter the product name in the Search Term field to find all notes for that product.
5. Alternatively, if you know the number of the note you’re looking for, type it in the Number field in the top right corner.

    6. If you need to narrow down your search results, include the Product Version.

Let us know!

What has your experience been with SAP notes?

Have you had issues looking them up? Do you find the content helpful or do you think it could be improved?

Feel free to post any comments or feedback about SAP Adaptive Server Enterprise SAP notes.