Install SAP NetWeaver high availability on a Windows failover cluster and file share for SAP ASCS/SCS instances on Azure

This article describes how to install and configure a high-availability SAP system on Azure, with Windows Server Failover Cluster (WSFC) and Scale-Out File Server as an option for clustering SAP ASCS/SCS instances.

Prerequisites

Before you start the installation, review the following articles:

You need the following executables and DLLs from SAP:

  • SAP Software Provisioning Manager (SWPM) installation tool version SPS21 or later.

  • Download the latest NTCLUST.SAR archive with new SAP cluster resource DLL. The new SAP cluster DLLs support SAP ASCS/SCS high availability with file share on Windows Server Failover Cluster.

    For more information about the new SAP cluster resource DLL, see this blog: New SAP cluster resource DLL is available!.

We do not describe the Database Management System (DBMS) setup because setups vary depending on the DBMS you use. However, we assume that high-availability concerns with the DBMS are addressed with the functionalities that various DBMS vendors support for Azure. Such functionalities include AlwaysOn or database mirroring for SQL Server, and Oracle Data Guard for Oracle databases. In the scenario we use in this article, we didn't add more protection to the DBMS.

There are no special considerations when various DBMS services interact with this kind of clustered SAP ASCS/SCS configuration in Azure.

Note

The installation procedures of SAP NetWeaver ABAP systems, Java systems, and ABAP+Java systems are almost identical. The most significant difference is that an SAP ABAP system has one ASCS instance. The SAP Java system has one SCS instance. The SAP ABAP+Java system has one ASCS instance and one SCS instance running in the same Microsoft failover cluster group. Any installation differences for each SAP NetWeaver installation stack are explicitly mentioned. You can assume that all other parts are the same.

Install an ASCS/SCS instance on an ASCS/SCS cluster

Important

Currently, a high-availability setting with a file share configuration is not supported by the SAP SWPM installation tool. Therefore, some manual adoption is necessary to install an SAP system (for example, to install and cluster an SAP ASCS/SCS instance and configure a separate SAP global host).

There is no change in other installation steps to install (and cluster) a DBMS instance and SAP application servers.

Install an ASCS/SCS instance on your local drive

Install an SAP ASCS/SCS instance on both nodes of the ASCS/SCS cluster. Install it on local drive. In our example, the local drive is C:\, but you can choose any other local drive.

To install the instance, in the SAP SWPM installation tool, go to:

<Product> > <DBMS> > Installation > Application Server ABAP (or Java) > Distributed System > ASCS/SCS instance

Important

Currently, the file-share scenario is not supported by the SAP SWPM installation tool. You cannot use the following installation path:

<Product> > <DBMS> > Installation > Application Server ABAP (or Java) > High-Availability System > …

Remove SAPMNT and create an SAPLOC file share

SWMP created an SAPMNT local share in the C:\usr\sap folder.

Remove the SAPMNT file share on both ASCS/SCS cluster nodes.

Execute the following PowerShell script:

Remove-SmbShare sapmnt -ScopeName * -Force

If the SAPLOC share does not exist, create one on both ASCS/SCS cluster nodes.

Execute the following PowerShell script:

#Create SAPLOC share and set security
$SAPSID = "PR1"
$DomainName = "SAPCLUSTER"
$SAPSIDGlobalAdminGroupName = "$DomainName\SAP_" + $SAPSID + "_GlobalAdmin"
$HostName = $env:computername
$SAPLocalAdminGroupName = "$HostName\SAP_LocalAdmin"
$SAPDisk = "C:"
$SAPusrSapPath = "$SAPDisk\usr\sap"

New-SmbShare -Name saploc -Path c:\usr\sap -FullAccess "BUILTIN\Administrators", $SAPSIDGlobalAdminGroupName , $SAPLocalAdminGroupName  

Prepare an SAP global host on the SOFS cluster

Create the following volume and file share on the SOFS cluster:

  • SAP GLOBALHOST file C:\ClusterStorage\Volume1\usr\sap\<SID>\SYS\ structure on SOFS cluster shared volume (CSV)

  • SAPMNT file share

  • Set security on the SAPMNT file share and folder with full control for:

    • The <DOMAIN>\SAP_<SID>_GlobalAdmin user group
    • The SAP ASCS/SCS cluster node computer objects <DOMAIN>\ClusterNode1$ and <DOMAIN>\ClusterNode2$

To create a CSV volume with mirror resiliency, execute the following PowerShell cmdlet on one of the SOFS cluster nodes:

New-Volume -StoragePoolFriendlyName S2D* -FriendlyName SAPPR1 -FileSystem CSVFS_ReFS -Size 5GB -ResiliencySettingName Mirror

To create SAPMNT and set folder and share security, execute the following PowerShell script on one of the SOFS cluster nodes:

# Create SAPMNT on file share
$SAPSID = "PR1"
$DomainName = "SAPCLUSTER"
$SAPSIDGlobalAdminGroupName = "$DomainName\SAP_" + $SAPSID + "_GlobalAdmin"

# SAP ASCS/SCS cluster nodes
$ASCSClusterNode1 = "ascs-1"
$ASCSClusterNode2 = "ascs-2"

# Define SAP ASCS/SCS cluster node computer objects
$ASCSClusterObjectNode1 = "$DomainName\$ASCSClusterNode1$"
$ASCSClusterObjectNode2 = "$DomainName\$ASCSClusterNode2$"

# Create usr\sap\.. folders on CSV
$SAPGlobalFolder = "C:\ClusterStorage\Volume1\usr\sap\$SAPSID\SYS"
New-Item -Path $SAPGlobalFOlder -ItemType Directory

$UsrSAPFolder = "C:\ClusterStorage\Volume1\usr\sap\"

# Create a SAPMNT file share and set share security
New-SmbShare -Name sapmnt -Path $UsrSAPFolder -FullAccess "BUILTIN\Administrators", $SAPSIDGlobalAdminGroupName, $ASCSClusterObjectNode1, $ASCSClusterObjectNode2 -ContinuouslyAvailable $false -CachingMode None -Verbose

# Get SAPMNT file share security settings
Get-SmbShareAccess sapmnt

# Set file and folder security
$Acl = Get-Acl $UsrSAPFolder

# Add a file security object of SAP_<sid>_GlobalAdmin group
$Ar = New-Object  system.security.accesscontrol.filesystemaccessrule($SAPSIDGlobalAdminGroupName,"FullControl", 'ContainerInherit,ObjectInherit', 'None', 'Allow')
$Acl.SetAccessRule($Ar)

# Add  a security object of the clusternode1$ computer object
$Ar = New-Object  system.security.accesscontrol.filesystemaccessrule($ASCSClusterObjectNode1,"FullControl",'ContainerInherit,ObjectInherit', 'None', 'Allow')
$Acl.SetAccessRule($Ar)

# Add a security object of the clusternode2$ computer object
$Ar = New-Object  system.security.accesscontrol.filesystemaccessrule($ASCSClusterObjectNode2,"FullControl",'ContainerInherit,ObjectInherit', 'None', 'Allow')
$Acl.SetAccessRule($Ar)

# Set security
Set-Acl $UsrSAPFolder $Acl -Verbose

Stop ASCS/SCS instances and SAP services

Execute the following steps:

  1. Stop SAP ASCS/SCS instances on both ASCS/SCS cluster nodes.
  2. Stop SAP ASCS/SCS Windows services SAP<SID>_<InstanceNumber> on both cluster nodes.

Move the \SYS... folder to the SOFS cluster

Execute the following steps:

  1. Copy the SYS folder (for example, C:\usr\sap\<SID>\SYS) from one of the ASCS/SCS cluster nodes to the SOFS cluster (for example, to C:\ClusterStorage\Volume1\usr\sap\<SID>\SYS).
  2. Delete the C:\usr\sap\<SID>\SYS folder from both ASCS/SCS cluster nodes.

Update the cluster security setting on the SAP ASCS/SCS cluster

Execute the following PowerShell script on one of the SAP ASCS/SCS cluster nodes:

# Grant <DOMAIN>\SAP_<SID>_GlobalAdmin group access to the cluster

$SAPSID = "PR1"
$DomainName = "SAPCLUSTER"
$SAPSIDGlobalAdminGroupName = "$DomainName\SAP_" + $SAPSID + "_GlobalAdmin"

# Set full access for the <DOMAIN>\SAP_<SID>_GlobalAdmin group
Grant-ClusterAccess -User $SAPSIDGlobalAdminGroupName -Full

#Check security settings
Get-ClusterAccess

Create a virtual host name for the clustered SAP ASCS/SCS instance

Create an SAP ASCS/SCS cluster network name (for example, pr1-ascs [10.0.6.7]), as described in Create a virtual host name for the clustered SAP ASCS/SCS instance.

Update the default and SAP ASCS/SCS instance profile

To use the new SAP ASCS/SCS virtual host name and SAP global host name, you must update the default and SAP ASCS/SCS instance profile <SID>ASCS/SCS<Nr><Host>.

Old values
SAP ASCS/SCS host name = SAP global host ascs-1
SAP ASCS/SCS instance profile name PR1_ASCS00_ascs-1
New values
SAP ASCS/SCS host name pr1-ascs
SAP global host sapglobal
SAP ASCS/SCS instance profile name PR1_ASCS00_pr1-ascs

Update SAP default profile

Parameter name Parameter value
SAPGLOBALHOST sapglobal
rdisp/mshost pr1-ascs
enque/serverhost pr1-ascs

Update the SAP ASCS/SCS instance profile

Parameter name Parameter value
SAPGLOBALHOST sapglobal
DIR_PROFILE \\sapglobal\sapmnt\PR1\SYS\profile
_PF $(DIR_PROFILE)\PR1_ASCS00_ pr1-ascs
Restart_Program_02 = local$(_MS) pf=$(_PF) Start_Program_02 = local$(_MS) pf=$(_PF)
SAPLOCALHOST pr1-ascs
Restart_Program_03 = local$(_EN) pf=$(_PF) Start_Program_03 = local$(_EN) pf=$(_PF)
gw/netstat_once 0
enque/encni/set_so_keepalive true
service/ha_check_node 1

Important

You can use the Update-SAPASCSSCSProfile PowerShell cmdlet to automate the profile update.

The PowerShell cmdlet supports both the SAP ABAP ASCS and SAP Java SCS instances.

Copy SAPScripts.psm1 to your local drive C:\tmp, and run the following PowerShell cmdlet:

Import-Module C:\tmp\SAPScripts.psm1

Update-SAPASCSSCSProfile -PathToAscsScsInstanceProfile \\sapglobal\sapmnt\PR1\SYS\profile\PR1_ASCS00_ascs-1 -NewASCSHostName pr1-ascs -NewSAPGlobalHostName sapglobal -Verbose  

Figure 1: SAPScripts.psm1 output

Figure 1: SAPScripts.psm1 output

Update the <sid>adm user environment variable

  1. Update the <sid>adm user environment new GLOBALHOST UNC path on both ASCS/SCS cluster nodes.
  2. Log on as <sid>adm user, and then start the Regedit.exe tool.
  3. Go to HKEY_CURRENT_USER > Environment, and then update the variables to the new value:
Variable Value
RSEC_SSFS_DATAPATH \\sapglobal\sapmnt\PR1\SYS\global\security\rsecssfs\data
RSEC_SSFS_KEYPATH \\sapglobal\sapmnt\PR1\SYS\global\security\rsecssfs\key
SAPEXE \\sapglobal\sapmnt\PR1\SYS\exe\uc\NTAMD64
SAPLOCALHOST pr1-ascs

Install a new saprc.dll file

  1. Install a new version of the SAP cluster resource that supports the file-share scenario.

  2. Download the latest NTCLUST.SAR package from the SAP Service Marketplace.

  3. Unpack NTCLUS.SAR on one of the ASCS/SCS cluster nodes, and then run the following command from the command prompt to install the new saprc.dll file:

.\NTCLUST\insaprct.exe -yes -install

The new saprc.dll file is installed on both ASCS/SCS cluster nodes.

For more information, see SAP Note 1596496 - How to update SAP resource type DLLs for Cluster Resource Monitor.

Create a SAP <SID> cluster group, network name, and IP

To create a SAP <SID> cluster group, an ASCS/SCS network name, and a corresponding IP address, run the following PowerShell cmdlet:

# Create SAP Cluster Group
$SAPSID = "PR1"
$SAPClusterGroupName = "SAP $SAPSID"
$SAPIPClusterResourceName = "SAP $SAPSID IP"
$SAPASCSNetworkName = "pr1-ascs"
$SAPASCSIPAddress = "10.0.6.7"
$SAPASCSSubnetMask = "255.255.255.0"

# Create an SAP ASCS instance virtual IP cluster resource
Add-ClusterGroup -Name $SAPClusterGroupName -Verbose

#Create an SAP ASCS virtual IP address
$SAPIPClusterResource = Add-ClusterResource -Name $SAPIPClusterResourceName -ResourceType "IP Address" -Group $SAPClusterGroupName -Verbose

# Set a static IP address
$param1 = New-Object Microsoft.FailoverClusters.PowerShell.ClusterParameter $SAPIPClusterResource,Address,$SAPASCSIPAddress
$param2 = New-Object Microsoft.FailoverClusters.PowerShell.ClusterParameter $SAPIPClusterResource,SubnetMask,$SAPASCSSubnetMask
$params = $param1,$param2
$params | Set-ClusterParameter

# Create a corresponding network name
$SAPNetworkNameClusterResourceName = $SAPASCSNetworkName
Add-ClusterResource -Name $SAPNetworkNameClusterResourceName -ResourceType "Network Name" -Group $SAPClusterGroupName -Verbose

# Set a network DNS name
$SAPNetworkNameClusterResource = Get-ClusterResource $SAPNetworkNameClusterResourceName
$SAPNetworkNameClusterResource | Set-ClusterParameter -Name Name -Value $SAPASCSNetworkName

#Check the updated values
$SAPNetworkNameClusterResource | Get-ClusterParameter

#Set resource dependencies
Set-ClusterResourceDependency -Resource $SAPNetworkNameClusterResourceName -Dependency "[$SAPIPClusterResourceName]" -Verbose

#Start an SAP <SID> cluster group
Start-ClusterGroup -Name $SAPClusterGroupName -Verbose

Register the SAP start service on both nodes

Re-register the SAP ASCS/SCS start service to point to the new profile and profile path.

You must execute this re-registration on both ASCS/SCS cluster nodes.

In the elevated command prompt, run the following command:

C:\usr\sap\PR1\ASCS00\exe\sapstartsrv.exe -r -p \\sapglobal\sapmnt\PR1\SYS\profile\PR1_ASCS00_pr1-ascs -s PR1 -n 00 -U SAPCLUSTER\SAPServicePR1 -P mypasswd12 -e SAPCLUSTER\pr1adm

Figure 2: Reinstall SAP service

Figure 2: Reinstall SAP service

Make sure that the parameters are correct, and then select Manual as the Startup Type.

Stop the ASCS/SCS service

Stop the SAP ASCS/SCS service SAP<SID>_<InstanceNumber> on both ASCS/SCS cluster nodes.

Create a new SAP service and SAP instance resources

To finalize the creation of resources of the SAP SAP<SID> cluster group, create the following resources:

  • SAP <SID> <InstanceNumber> service
  • SAP <SID> <InstanceNumber> instance

Run the following PowerShell cmdlet:

$SAPSID = "PR1"
$SAPInstanceNumber = "00"
$SAPNetworkNameClusterResourceName = "pr1-ascs"

$SAPServiceName = "SAP$SAPSID"+ "_" + $SAPInstanceNumber

$SAPClusterGroupName = "SAP $SAPSID"
$SAPServiceClusterResourceName = "SAP $SAPSID $SAPInstanceNumber Service"

$SAPASCSServiceClusterResource = Add-ClusterResource -Name $SAPServiceClusterResourceName -Group $SAPClusterGroupName -ResourceType "SAP Service" -SeparateMonitor -Verbose
$SAPASCSServiceClusterResource  | Set-ClusterParameter  -Name ServiceName -Value $SAPServiceName

#Set resource dependencies
Set-ClusterResourceDependency -Resource $SAPASCSServiceClusterResource  -Dependency "[$SAPNetworkNameClusterResourceName]" -Verbose

$SAPInstanceClusterResourceName = "SAP $SAPSID $SAPInstanceNumber Instance"

# Create SAP instance cluster resource
$SAPASCSServiceClusterResource = Add-ClusterResource -Name $SAPInstanceClusterResourceName -Group $SAPClusterGroupName -ResourceType "SAP Resource" -SeparateMonitor -Verbose

#Set SAP instance cluster resource parameters
$SAPASCSServiceClusterResource  | Set-ClusterParameter  -Name SAPSystemName -Value $SAPSID -Verbose
$SAPASCSServiceClusterResource  | Set-ClusterParameter  -Name SAPSystem -Value $SAPInstanceNumber -Verbose

#Set resource dependencies
Set-ClusterResourceDependency -Resource $SAPASCSServiceClusterResource  -Dependency "[$SAPServiceClusterResourceName]" -Verbose

Add a probe port

Configure an SAP cluster resource, the SAP-SID-IP probe port, by using PowerShell. Execute this configuration on one of the SAP ASCS/SCS cluster nodes, as described in this article.

Install an ERS instance on both cluster nodes

Install an Enqueue Replication Server (ERS) instance on both nodes of the ASCS/SCS cluster. On the SWPM menu, follow this installation path:

<Product> > <DBMS> > Installation > Additional SAP System instances > Enqueue Replication Server Instance

Install a DBMS instance and SAP application servers

Finalize your SAP system installation by installing:

  • A DBMS instance.
  • A primary SAP application server.
  • An additional SAP application server.

Next steps