orkungedik/SAP-basis-dataset huggingface dataset:
## 4.2 SQL Statement Analysis
A key step in identifying the source of poor performance is understanding how much time SAP HANA spends on query execution. By analyzing SQL statements and calculating their response times, you can better understand how the statements affect application and system performance.
You can analyze the response time of SQL statements with the following traces:
- SQL trace From the trace file, you can analyze the response time of SQL statements.
- Expensive statements trace On the Performance Expensive Statements Trace tab, you can view a list of all SQL statements that
exceed a specified response time.
In addition to these traces, you can analyze the SQL plan cache, which provides a statistical overview of what statements are executed in the system.
## 4.2.1  Analyzing SQL Traces
The SQL trace allows you to analyze the response time of SQL statements within an object.
## Procedure
1. In the Administration editor, choose the Trace Configuration trace and edit the SQL trace.
2. In the Trace Configuration dialog box, specify a name for the trace file, set the trace status to Active , and specify the required trace and user filters.
3. Choose Finish .
4. Run the application or SQL statements you want to trace.
5. Re-open the SQL trace configuration and set the trace status to Inactive .
6. Choose Finish .
7. Choose the Diagnosis Files tab and open the trace file you created.
8. Choose Show Entire File .
9. Analyze the response time of the relevant SQL statements to identify which statements negatively affect performance.
The SQL statements in the trace file are listed in order of execution time. To calculate the response time of a specific SQL statement, calculate the difference between the times given for # tracing PrepareStatement_execute call and # tracing finished PrepareStatement_execute .
## 4.2.2  Analyzing Expensive Statements Traces
The expensive statements trace allows you to identify which SQL statements require a significant amount of time and resources.
## Procedure
1. In the Administration editor, choose the Trace Configuration trace and edit the expensive statements trace.
2. In the Trace Configuration dialog box, set the trace status to Active and specify a threshold execution time in microseconds.
The system will identify any statements that exceed this threshold as expensive statements.
3. Choose Finish .
4. Run the application or SQL statements you want to trace.
5. Choose the Performance Expensive Statements Trace tab.
6. Analyze the displayed information to identify which statements negatively affected performance.
5. For each SQL statement, the following columns are especially useful for determining the statement's impact on performance:
- START_TIME
- DURATION_MICROSEC
- OBJECT_NAME (names of the objects accessed)
- STATEMENT_STRING
- CPU_TIME
## 4.2.3  Analyzing SQL Execution with the SQL Plan Cache
The SQL plan cache is a valuable tool for understanding and analyzing SQL processing.
Before it is executed, every SQL statement is compiled to a plan. Once a plan has been compiled it is better to reuse it the next time the same statement is executed rather than compiling a new plan every time. The SAP HANA database provides an object, the SQL plan cache, that stores plans generated from previous executions. Whenever the execution of a statement is requested, an SQL procedure checks the SQL plan cache to see if there is a plan already compiled. If a match is found, the cached plan is reused. If not, the statement is compiled and the newly generated plan is cached.
As the SQL plan cache collects statistics on the preparation and execution of SQL statements it is an important tool for understanding and analyzing SQL processing. For example, it can help you to find slow queries as well as to measure the overall performance of your system.
Various options are available for analyzing the plan cache for a statement:
- In SAP HANA cockpit the link for SQL Plan Cache is available in the Monitoring group.
- In SAP HANA studio SQL Plan Cache is a sub-tab of the Performance tab.
- The two system views associated with the SQL plan cache are m_SQL_PLAN_CACHE_OVERVIEW and m_SQL_PLAN_CACHE.
The SQL plan cache contains a lot of information. Filtering according to the following columns can help you identify statements that are more likely to be causing problems and/or could be optimized:
| Column                | Description                                                                                                                               |
|-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| TOTAL_EXECUTION_TIME  | The total time spent for all executions of a plan This helps to identify which statements are dominant in terms of time.                  |
| AVG_EXECUTION_TIME    | The average time it takes to execute a plan execution This can help you identify long-running SQL statements.                             |
| EXECUTION_COUNT       | The number of times a plan has been executed This can help you identify SQL statements that are executed more frequently than ex- pected. |
| TOTAL_LOCK_WAIT_COUNT | The total number of waiting locks This can help you identify SQL statements with high lock contention.                                    |
| USER_NAME             | The name of the user who prepared the plan and therefore where the SQL originated (ABAP/index server/statistics server)                   |
For a full list of all SQL cache columns including descriptions, see the documentation for the system views m_SQL_PLAN_CACHE_OVERVIEW and m_SQL_PLAN_CACHE in the SAP HANA SQL and System Views Reference . Refer also to the sections on Managing the Performance of SAP HANA in the SAP HANA Administration Guide .
## Related Information
Managing and Monitoring SAP HANA Performance SAP HANA SQL Reference Guide for SAP HANA Platform SQL Plan Cache Analysis [page 185]
## 4.3 Query Plan Analysis
In SAP HANA, to identify queries that are inefficiently processed, you can both technically and logically analyze the steps SAP HANA took to process those queries.
From a technical perspective, analyzing query plans allows you to identify long running steps, understand how much data is processed by the operators, and see whether data is processed in parallel. However, if you understand the idea and purpose behind the query, you can also analyze query plans from a logical perspective and consider questions such as:
- Does SAP HANA read data from multiple tables when only one is required?
- Does SAP HANA read all records when only one is required?
- Does SAP HANA read the best table, possibly a large table even though another table has a much smaller result set?
To gain the insight you need to answer such questions, the following tools are available for query plan analysis:
- Plan explanation
- Plan visualization
Both tools are available as SQL commands but are also integrated into administration tools. The following SAP Notes provide additional information:
- 2073964 Create & Export PlanViz in HANA Studio for an introduction to using PlanViz in SAP HANA studio
- 2119087 How-To: Configuring SAP HANA Traces
## SQL Analyzer Tool for SAP HANA
The legacy administration tools described above have now been superseded by the SQL analyzer tool for SAP HANA, which is available as a separate tool in SAP Business Application Studio and can be used with both on-premise and cloud versions of SAP HANA. You can use this application by exporting the query plan of a statement (in PLV format) and importing it into the tool to visualize and analyze the plan. Real time analysis of currently running statements is also possible using the SQL Plan Execution Monitor.
More information about the SQL analyzer tool for SAP HANA is available from the tool's product page. An introductory blog in the SAP Community gives background information and tips on setting the tool up - see links below.
## Related Information
Analyzing SQL Execution with the Plan Explanation [page 249] Analyzing SQL Execution with the Plan Visualizer [page 253]
## Links to other documents
Monitor and Analyze Statements with SQL Plan Cache (SAP HANA Cockpit Cloud)
Analyzing SQL and Saving Plans (SAP HANA Cockpit - On-Premise)
SQL Analyzer Tool for SAP HANA (Product Page)
SQL Analyzer now available in Business Application Studio (SAP Community blog)
## 4.3.2  Analyzing SQL Execution with the Plan Visualizer
To help you understand and analyze the execution plan of an SQL statement, you can generate a graphical view of the plan.
## Procedure
1. Visualize the plan of the SQL statement in one of the following ways:
- a. Enter the statement in the SQL console and choose Visualize Plan in the context menu.
- b. On the SQL Plan Cache tab or the Expensive Statements Trace tab of the Performance tab, right-click the statement and choose Visualize Plan .
A graphical representation of the query, with estimated performance, is displayed.
## Visualized Plan
2. Validate the estimated performance by choosing Execute Plan in the context menu. Or use the shortcut key F8
Another similar high-level graphic is generated with execution time information for each of the parts.
As of SPS 9, by default, a gray color indicates that the operator is not physical, meaning the operator simply exists to give a more structured graph display.
Almost all of these non-physical operators can be removed from the graph if you prefer, by selecting 'None' for the 'Node Grouping' option provided on the left of the graph.
##  Note
Execution time is given as a pair of values: "Exclusive" (the execution time of the node), and "Inclusive" (the execution time including the descendent nodes.
## Results
This graphic is a very powerful tool for studying performance of queries on SAP HANA databases. You can explore the graphic further, for example, you can expand, collapse, or rearrange nodes on the screen. You can also save the graphic as an image or XML file, for example, so you can submit it as part of a support query.
## 4.3.2.2 Statement Statistics
Visualization of execution plans for procedures displays a set of statistics for each SQL statement involved in a procedure.
## Context
This set of statistics is automatically visualized when a procedure is executed and it provides a good starting point for analyzing performance of procedures as it lets you easily drill-down into the most expensive SQL statements. Basic information such as execution count, execution/compile time, allocated memory size and
so on are provided for each statement so that you can sort the column (criterion) of interest to find the most expensive statement.
The following pieces of information are available: SQL Statement, Line Number, Execution Count, Execution Times, Compilation Times, Memory Allocated, Result Record Count, Explain Plan Result, and Procedure Comment
Statement Statistics view
By right-clicking on any element of the SQL statement, you will have access to these menus:
- Show Plan in Graph: Displays the execution plan corresponding to the selected statement in the context of entire plan.
- Show Plan in New Window: Displays the execution plan corresponding to the selected statement ONLY in a separate pop-up window.
- Execute Statement: Enables users to reproduce the execution of a single statement
##  Note
To use this feature, the 'Keep Temp Tables' button ( ) located on the top-right corner of a graph editor (Plan Visualizer) must be toggled before obtaining the executed plan of the procedure under analysis.
## Procedure
1. Open an SQL Console
2. Enter any procedure into the console and choose Visualize Plan from the context menu.
3. Choose F8 to see executed plan from the visualized plan.
Statement Statistics will be shown automatically and it will list all the statements that were involved in the procedure. You can use this view to drill down to the potential root-cause of a long running procedure. For example you might detect a single statement that takes up most of the time and check whether this is indeed expected or notice that an identical statement is repeatedly executed with varying statistics (for example, big gap between minimum execution time and maximum execution time).
## 4.3.2.3 Timeline View
The Timeline view provides a complete overview of the execution plan based on visualization of sequential time-stamps.
## Context
The following pieces of information are available in the view:
- X-axis: time elapsed since query execution,
- Y-axis: list of operators
- Duration of each operator execution represented by rectangular bars
- The nature of each time-stamp (for example, open, fetch, close, and so on.)
The view supports:
- Synchronized selection with operators in graphical plan
- Hierarchical display of operators based on parent-child relationship
- Re-configuration of scales via a toolbar option
## Procedure
1. To see a temporal breakdown of the individual operations processed in the execution of the query, open the Timeline view.
From the main menu choose Window Show View Timeline .
Timeline View
2. Use this view to drill down to the potential root-cause of a long running query:
For example you might
- Detect a single operator that takes up most of the time and check whether this is expected
- Notice that some operators are executed sequentially instead of running in parallel, so you might check the system environment
## Next Steps
However, users should take into account the following point and limitations when analyzing the Timeline view:
- Any gaps or multiple occurrence of 'open', 'fetch', and so on in the Column Search operator invoked by the row engine indicates that there was another operation called by the column engine in the meantime.
- The adjustment for exclusivity of time-stamps as described above is not applicable for column engine operators, meaning some operators may not be actually running in parallel but simply calling one another.
- Logical grouping operators for the column engine (those colored in gray) simply display the aggregated time-stamps of their constituent operators.
## 4.3.2.4 Operator List for Plan Visualizer
The Operator List view is used within the context of the Plan Visualizer perspective. It lists detailed characteristics of all operators within a current plan, both visualized and executed.
The Operator List can be used to dynamically explore the operator set along user defined filters in order to pinpoint specific operators of interest. The view supports:
- Display of various KPIs, for example,. isPhysical (meaning whether an operator is a real, physically executed one), offset, execution time, CPU time
- Setting of filters along all the columns and KPIs
- Display of the number of operators within the filtered set
- Immediate aggregated information (max, min, sum, and so on) regarding the same KPIs on the filtered operator set and the remaining set (not within the filter)
- Detailed display of all operators within the filtered set (which can be further sorted)
- Export of the (filtered) operator list to a CSV file
- Forwards and backwards browsing through the history of applied filters.
The following features are supported:
- Show or hide columns using the preferences dialog (preferences icon next to save button)
- Change the order of columns using drag and drop
- Order and column visibility are stored in users workspace
- Remote search functionality. Press Ctrl+F when displaying an executed plan and specify search parameters. When you carry out a search the operator list is updated accordingly
Operator List
You can use the Operator List view to analyze the set of operators within a plan for the occurrence of specific conditions, even before looking into the visualized plan. For example, you might
1. Filter all operators that process a certain number of (input) rows
2. Further restrict the filter to physical operators (using "x" as the search criteria in filter column "Physical")
3. Display the executed plan, press Ctrl+F and set "Execution Time - At least" to 50
4. Finally, double click on an operator you are interested in to check its positioning within a visualized plan.
## 4.3.2.5 Network View
The Network View can visualize sequential network data transfers between different servers based on their given timestamps when an execution plan is based on a distributed query.
## Context
The following pieces of information are available in the view:
- X-axis: servers involved,
- Y-axis: time elapsed since query execution
- Duration of each operator represented by rectangular bars
- Size of data transferred in bytes
The view supports:
- Synchronized selection with network operators in graphical plan
- Hover information for network bars
- Zoom in and out
You may use this view to discover any issues related to a distributed environment.
## Procedure
1. Open the view
2. Check the results
For example you might notice that an unusually long time is spent on a particular network data transfer, so you might check the data size and/or network condition and see that network data transfers occur too frequently between a particular set of servers, so you might improve the distribution set-up.
3. Optimize your distributed landscape based on the results.
## 4.3.2.6 Tables Used
The table usage view provides an overview on which tables have been used during the processing of a statement.
## Context
The Tables Used view can be used to cross-check your business understanding about which tables are needed to fulfill a given SQL statement.
The view displays 3 metrics per table:
- Maximum number of entries processed, that is the overall output cardinality of any processing step on that table in the statement execution.
- Number of accesses, meaning how often a table has been accessed during statement execution
- Maximum processing time, that is the maximum processing time across the possibly multiple table accesses
The view content can be sorted along any column; double-clicking on any row (table) leads to a corresponding operator list filtered for physical operators accessing the selected table.
You may use this view to understand whether the data processing of your statement matches your business expectations.
## Procedure
1. Review the tables used in your SQL. You may detect a table that has been processed which should not be needed from a business perspective,
so you might modify you SQL in a way that this table is no more used.
2. Review the number of times a table is accessed.
You may see that the number of processed entries is far higher than expected, so you can check if it is possible to improve the filtering in your SQL statement.
## 4.3.2.7 Performance Trace
The Performance Trace view displays the list of operators that have performance trace data. The data can be viewed by selecting any of the operator shown in the list.
## Context
The view consists of two main sections:
- The left panel shows list of operators you can select to view performance trace data
- The right panel shows the performance trace data for the operator you have selected
The view supports:
- synchronized selection between operators visualized in the graph
- double-clicking on a particular data to view its full-text
##  Note
This view is mainly targeted towards advanced users who are well acquainted with the core details of SAP HANA.
## Procedure
1. Look for any additional properties relevant to a particular operator that you cannot find from other views.
2. Fill in missing gaps in the Timeline view by deducing from the sequential list of activities.
3. Further break-down a specific operation into core engine-level details.
## 4.3.2.8 Plan Trace
Use the plan trace to collect SQL queries and their execution plans, executed in a given time frame for a particular application session.
## Context
The plan trace enables you to capture details of selected SQL queries and their execution plans. For each SQL query traced, you can visualize the execution plan to conduct further performance analysis.
##  Note
The plan trace captures only SELECT statements.
Plan Trace Editor Displaying the List of Traced Queries
## Procedure
1. Open the SQL Console.
2. Enable the plan trace and configure its parameters.
- a. Go to the Administration editor and then select Performance Sessions tabs.
To open the Administration editor, right-click on a database session you wish to trace and from the context menu select Configuration and Monitoring Open Administration .
##  Note
You can also directly access the Trace Configuration dialog by selecting the Trace Configuration tab within the Administration editor. Skip step 2b in this case.
- b. Right-click on the session corresponding to the SQL Console opened in step 1 and from the context menu, choose Configure Trace Plan Trace .
The corresponding session has the keyword ' SQLExecuteFormEditor in the Application Source column.
The Trace Configuration dialog opens.
- c. Select Start Tracing , configure the plan trace parameter as needed and click Finish .
3. Execute SELECT queries in the SQL Console.
4. Once queries are executed, disable the plan trace.
- a. Open the Trace Configuration dialog.
- b. Select Stop Tracing and click Finish .
The plan trace editor opens displaying the list of traced queries.
5. Optional: Double-click a traced query to visualize its execution plan.
## 4.3.2.9 Calculation Scenario Visualization
By navigating to a particular calculation view in the Systems view, you can access the Visualize View context menu, which will visualize the calculation scenario associated with the view.
The calculation scenario visualizer consists of following three main sections:
- left: an overview which provides a list of calculation nodes involved in the scenario with their main properties
- middle: the visualized graph of calculation scenario
- right: an input tab which provides mapping information of the selected node, an output tab which provides attributes of a selected node, and a source tab which shows the raw JSON data of the selected node
The visualizer supports:
- link with 'Properties' view for each selected node
- double-clicking on a particular data source to drill down to its calculation scenario
You may use this visualizer to check whether the scenario is designed according to your understanding, and, if not, find potential tweaking points.
## 4.4.1.2 Resources for Testing the Result Cache
This topic uses an example calculation view to illustrate how you can work with tools to test the result cache.
After caching a view it is important to verify that the view has been successfully cached, that correct results are returned, that the cached views is actually used and is effectively reducing CPU consumption. The following example uses the ALTER VIEW syntax to add a calculation view result to the cache with a retention period of 60 minutes:
```
ALTER VIEW "_SYS_BIC"."sap.hba.ecc/CostCenterPlanActualCommitmentQuery" ADD CACHE RETENTION 60;
```
Note that the top-most node of a calculation view should be an aggregation type node. If it is not but the calculation view does implicit grouping then caching will fail.
Carry out the following checks:
- 1) Check the system view RESULT_CACHE:
```
select schema_name, object_name, cache_type from RESULT_CACHE where object_name = 'my_view';
```
If the query on system view RESULT_CACHE returns a record, it indicates the successful creation of the cached view.
- 2) After running a query against the cached view, use the Explain Plan tool (context menu in the SQL Console) to confirm the source of the query result. The OPERATOR_NAME value should show RESULT_CACHE .
- 3) Continue to test the cached view by monitoring the execution times of queries based on the view. Expect the first execution of the query to be slow and look for performance improvements on subsequent runs. If there is no reduction in response time or CPU consumption when the cached view is used then it is not beneficial.
- 4) Use monitoring views m_RESULT_CACHE and m_HEAP_MEMORY to see more details of the cached view such as memory consumption and data refresh details.
## Related Information
Analyzing SQL Execution with the Plan Explanation [page 249]
## 4.5 Advanced Analysis
If have you an advanced knowledge of SAP HANA and SQL databases and you suspect that automated processes are making poor decisions that have negative impacts on query performance, you can perform advanced analyses to better understand how those decisions were made.
In SAP HANA cockpit you can use specific tracing features to generate detailed trace information to help analyze the following processes:
- Table joins using the join evaluation (je) trace
- Column searches using the query optimizer (qo) trace
##  Recommendation
Perform these types of analysis only if analyses of query plans and SQL statements were not enough to find the root cause of slow query performance.
## Exporting SQL Plans
In the SAP HANA backend, the SQL Query Processor parses the SQL query statements and generates optimized SQL Query Execution plans. As the Query Processor and the Query Optimizer continue to be developed the resultant execution plans for a given query may change. All developments are of course intended to improve performance but if you suspect that performance of a query might be worse after an upgrade, the Abstract SQL Plan feature makes it possible to export an abstracted version of an execution plan and reuse it in a different target system.
## 4.5.1  Analyzing Column Searches (qo trace)
In SAP HANA, if a column search takes a long time, you can analyze how the query-optimizer performed the column search. A query-optimizer (qo) trace of a single SAP HANA table search provides the details you need for such an analysis.
## Context
The qo trace provides a lot of detailed information that is hard to analyze if you are not an SAP HANA queryoptimizer expert; however, it provides very useful information for performance analysis. From the information within the trace files, you can see which column the query-optimizer decided to use as the first column in the column search and you can determine whether that decision negatively impacted the performance of the column search.
To start a user-specific qo trace in SAP HANA cockpit and analyze the relevant trace information, proceed as follows.
## Procedure
1. In SAP HANA Database Explorer choose Trace Configuration from the database context menu and create a new user-specific trace.
2. The Trace Configuration dialog box opens.
2. Specify a context name. The context name appears as part of the trace file name and should be easy for you to recognize and later
find.
3. Specify your database user or application user.
4. Enter qo as filter text and search for the trex_qo component.
5. For the trex_qo component, select DEBUG as the system trace level.
6. Choose OK .
7. Run the query you want to trace.
8. Switch off the trace by deleting the user-specific trace configuration.
9. Search through the Database Diagnostic Files folder and locate the trace file. The file opens on a new tab page.
10. In the trace section, analyze the trace information for each term (WHERE condition).
- a. Find the sections detailing the estimated results for the terms.
These sections are marked with GetEstimation.cpp .
- b. Find the sections detailing the actual search results for the terms.
These sections are marked with Evaluate.cpp .
- c. Compare the estimated results with the actual search results.
The query-optimizer selects which column to use as the first column of the search based on the term with the lowest estimated number of results.
## Results
If the actual results indicate that a different term should have been used to start the column search, then this may represent the source of poor performance. For more detailed analysis, you can send the trace file to SAP Support.
## 4.5.2  Analyzing Table Joins
In SAP HANA, if a query on joined tables takes a long time, you can analyze how the tables are joined and in what order. A join evaluation (je) trace of joined SAP HANA tables provides the details you need for such an analysis.
## Context
The je trace provides a lot of detailed information that is hard to analyze if you are not an SAP HANA join engine expert; however, it provides very useful information for performance analysis. From the information within the trace files, you can see which table is used as the first table when processing a join and how the order of tables in the join is defined. Y ou can use this information to determine whether query performance is negatively impacted by the table join.
To start a je trace in SAP HANA cockpit and analyze the relevant trace information, proceed as follows:
## Procedure
1. In SAP HANA Database Explorer choose Trace Configuration from the database context menu and create a new user-specific trace.
2. The Trace Configuration dialog box opens.
2. Specify a context name. The context name appears as part of the trace file name and should be easy for you to recognize and later find.
3. Specify your database user or application user.
4. Enter join as filter text and search for the join_eval component.
5. For the join_eval component, select DEBUG as the system trace level.
6. Choose OK .
7. Run the query you want to trace.
8. Switch off the trace by deleting the user-specific trace configuration.
9. Search through the Database Diagnostic Files folder and locate the trace file. The file opens on a new tab page.
10. From the end of the file, search backwards for the beginning of the trace section.
The trace section starts with i TraceContext TraceContext.cpp .
11. In the trace section, analyze the following trace information:
- Estimations for the WHERE conditions
- Table size and join conditions
- Join decision
## 4.6 Additional Analysis Tools for Support
To complement the standard tools for performance analysis, SAP HANA provides additional analysis tools that SAP Support can use to help determine the cause of performance issues.
The following analysis tools are available in SAP HANA; however, these tools are intended only for use when requested by SAP Support:
- Performance trace This tool records performance indicators for individual query processing steps in database kernel.
- Kernel profiler This tool provides information about hotspots and expensive execution paths during query processing.
## 4.6.3  Diagnosis Information
You can collect diagnosis information (a full system info dump) in the SAP HANA studio, in SAP HANA cockpit or using command line scripts.
To collect this information in SAP HANA studio open the Administration Editor and navigate to Diagnosis Files Diagnosis Information . Use the Collect function to run the system dump and use the List function to download the dump to a local file.
To collect this information in SAP HANA cockpit, on the system overview page, under Alerting & Diagnostics , select Manage full system information dumps . On the Diagnosis Files page, choose a zip file from the list or click Collect Diagnostics to create a new zip file.
The SQL variant can be used when SAP HANA is online, otherwise you can use the Python script fullSystemInfoDump.py in the python_support directory (shortcut cdpy ):
python fullSystemInfoDump.py
When the dump has completed you can download the file from the snapshots directory: /usr/sap/HAN/sys/ global/sapcontrol/snapshots
All options related to getting a system dump are fully described in SAP Note 1732157. This note also includes a video demonstration of the process.
 Tip
Guided Answers is a support tool for troubleshooting problems using decision trees. A guided answer is available on How to generate a runtime dump .
## Related Information
SAP Note 1732157
How to generate a runtime dump (Guided Answer)
## 6 Alerts and the Statistics Service
Alert checkers are part of the statistics service which is a central element of SAP HANA's internal monitoring infrastructure.
The statistics service is a key administration resource which notifies you when potentially critical situations arise in your systems. The statistics service is described in detail in the SAP HANA Administration Guide .
## Alert Checkers
A set of over 100 scheduled alert checkers run in the background monitoring the system for specific events. All alerts include a recommended user action and for many alerts a corresponding SAP Note is available. Details of all these alerts are given in the reference section which follows.
Alerts are defined in the following two tables:
- _SYS_STATISTICS.STATISTICS_ALERT_INFORMATION
- _SYS_STATISTICS.STATISTICS_ALERT_THRESHOLDS
Each alert also has a corresponding entry in the following statistics scheduling tables:
- _SYS_STATISTICS.STATISTICS_OBJECTS
- _SYS_STATISTICS.STATISTICS_SCHEDULE
## Configurable Severity Levels
Many alert checkers are defined with threshold values so that a degree of severity can be indicated if the alert is triggered. Default values are available for all severity thresholds and these can be over-ridden by user-defined values using the administration tools SAP HANA Studio and SAP HANA Cockpit. The scale of severity values is from one to four (1 = Information, 2 = Low, 3 = Medium, 4 = High) and alerts can use any, none or all of these as required depending on the event which is being monitored and the unit of measurement. Some alerts have just a single information level threshold and are not configurable.
A history of changes made to threshold levels for each alert is maintained and can be seen in system view STATISTICS_ALERT_THRESHOLDS_HISTORY.
## Configuration Tools
Alerts are configurable in either SAP HANA Studio or SAP HANA Cockpit:
- Studio: Administration Alerts tab
- Cockpit: Alerting and Diagnostics Configure Alerts
Configuration activities and administration features for both Studio and Cockpit are described in the SAP HANA Administration Guide . Y ou are recommended to use Cockpit which provides more options; it includes, for example, the ability to disable alerts and to trigger an alert manually on demand. A limitation in Studio is that only alerts with multiple threshold values can be maintained.
If an alert check fails for any reason it is automatically de-activated by the system for a period of at least 60 minutes (1 hour + the interval length). This is done by setting the value of the schedule status to 'Inactive' (_SYS_STATISTICS.STATISTICS_SCHEDULE STATUS). Alert checkers are re-enabled automatically after the timeout period by setting the schedule status to 'Idle' (this restart feature was introduced in HANA 01 SPS 09 Revision 93).
Refer to SAP Note 1991615 Configuration options for the Embedded Statistics Service for more details of the statistics service and examples of managing the service from the SQL command line.
## Related Information
The Statistics Service SAP Note 1991615
## 1 Introduction
## Target Audience
- Technology consultants
- Security consultants
- System administrators
This document is not included as part of the Installation Guides, Configuration Guides, Technical Operation Manuals, or Migration Guides. Such guides are only relevant for a certain phase of the software life cycle, whereas the Security Guides provide information that is relevant for all life cycle phases.
## Why Is Security Necessary?
With the increasing use of distributed systems and the Internet for managing business data, the demands on security are also on the rise. When using a distributed system, you need to be sure that your data and processes support your business needs without allowing unauthorized access to critical information. User errors, negligence, or attempted manipulation of your system should not result in loss of information or processing time. These demands on security apply likewise to SAP S/4HANA.
To assist you in securing SAP S/4HANA, we provide this Security Guide.
## About this Document
The Security Guide provides an overview of the security-relevant information that applies to SAP S/4HANA in general. In particular it comprises general considerations regarding the system access via SAP Fiori Apps. In case there are specific aspects for the underlying scenarios or applications these are described in an area-specific chapter.
## 2 Before You Start
## Fundamental Security Guides
SAP S/4HANA is based on ABAP Platform and the SAP HANA Platform. With respect to SAP Fiori apps, SAP Gateway plays a fundamental role as well. This means that the corresponding Security Guides are also applicable for SAP S/4HANA.
Whenever other guides are relevant, an appropriate reference is included in the documentation for the individual solution areas in the specific part of this guide.
Also consider the following fundamental security whitepapers found on https:/ /support.sap.com/en/securitywhitepapers.html :
- Secure Configuration of SAP NetWeaver Application Server Using ABAP
- SAP Security Recommendations: Securing Remote Function Calls (RFC)
- Protecting SAP Applications Against Common Attacks
## Approach for "Secure By Default"
SAP applies "secure by default" settings during system installation, system copies and system conversion from SAP ERP. Depending on the SAP S/4HANA release, the "secure by default" scope might vary. Overall, settings affect the profile parameters, ABAP platform configurations and HANA auditing.
## New Installations and System Copies
- You have the choice to skip the activation of the secure profile parameters.
- Due to the nature of the settings, ABAP platform configurations and HANA auditing will always be enabled for new installations and system copies.
## System Conversions
- You have the choice to skip the activation of the secure profile parameters.
- ABAP platform configurations and HANA auditing will only be enabled in case the source system does not have a customer configuration for the respective topic. For example, SAP Security Audit Log configuration is only enabled with "secure by default" settings in case the source system does not have any SAP security audit log configuration.
For detailed information on "secure by default" settings, see SAP Note 2926224 .
## Important SAP Notes
- SAP Note 1956820 contains information about saving temporary files when using Adobe Acrobat Reader in SAP applications.
- SAP Note 138498 contains information on single sign-on solutions.
- SAP Notes relating to security for the subcomponents of SAP S/4HANA are referenced in the documentation for the individual components in this guide.
- For a list of additional security-relevant SAP Hot News and SAP Notes, see the SAP Support Portal at http:/ /support.sap.com/securitynotes .
## 3 User Administration and Authentication
## Overview
SAP S/4HANA generally relies on the user management and authentication mechanisms provided with ABAP Platform, in particular the Application Server ABAP and the SAP HANA Platform. Therefore, the security recommendations and guidelines for user administration and authentication as described in the Application Server ABAP Security Guide and SAP HANA Platform documentation apply.
For more information, see:
- Go to https:/ /help.sap.com/s4hana\_op\_2021, enter Application Server ABAP Security Guide into the search bar, press Enter , and open the search result with that title.
- SAP HANA Security Guide at the SAP Help Portal under http:/ /help.sap.com/hana\_platform/ under Security
In addition to these guidelines, you can find information about user administration and authentication that specifically applies to SAP S/4HANA in the following topics:
- User Management [page 10] This topic lists the tools to use for user management, the types of users required, and the standard users that are delivered with SAP S/4HANA.
- User Data Synchronization [page 13] SAP S/4HANA can share user data with other components. This topic describes how the user data is
- synchronized with these other sources.
- Role Administration [page 13]
- Integration into Single Sign-On Environments [page 13]
## 3.1 User Management
## 3.1.2  SAP Fiori Technology
For details on the user management and authorization concepts used in SAP Fiori apps, go to https:/ / help.sap.com/s4hana\_op\_2021, enter SAP Fiori Overview into the search bar, press Enter , and open the search result with that title.
## 3.2 User Data Synchronization
By synchronizing user data, you can reduce effort and expense in the user management of your system landscape. Since SAP S/4HANA is based on ABAP Platform, you can use all of the mechanisms for user synchronization in ABAP Platform here.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter ABAP Platform Security Guide into the search bar, press Enter , open the search result with that title, and navigate to User Administration and Authentication User Data Synchronization .
## 3.3 Role Administration
Business roles in SAP S/4HANA represent the central object used to structure users' access on the frontend server.
For more information, go to https:/ /help.sap.com/s4hana\_op\_2021 and proceed as follows:
- General information on role maintenance in systems based on Application Server ABAP: Enter Configuration of User and Authorization Administration into the search bar, press Enter and open the search result with that title.
- Role maintenance for access based on SAP Fiori launchpad: Enter SAP Fiori Launchpad into the search bar, press Enter , open the search result with that title and then navigate to one of the following entries:
- Administration Guide Initial Setup of the Launchpad
- Security Aspects
- Authorization concepts and role maintenance for custom development: Enter From the Programmed Authorization Check to a Role into the search bar, press Enter and open the search result with that title.
- UI content and authorization concept for SAP Fiori apps: Enter SAP Fiori Launchpad Content and Authorization Concept into the search bar, press Enter and open the search result with that title.
## 3.4 Integration into Single Sign-On Environments
## Non-Fiori Technology
SAP S/4HANA supports the single sign-on (SSO) mechanisms provided by Application Server ABAP technology. Therefore, the security recommendations and guidelines for user management and authentication that are described in the ABAP Platform Security Guide also apply to SAP S/4HANA.
For non-Fiori technology SAP S/4HANA supports the following mechanisms:
- Secure Network Communications (SNC) SNC is available for user authentication and provides for an SSO environment when using the SAP GUI for Windows or Remote Function Calls.
· SAP Logon Tickets SAP S/4HANA supports the use of logon tickets for SSO when using a Web browser as the front-end client. In this case, users can be issued a logon ticket after they have authenticated themselves with the initial SAP system. The ticket can then be submitted to other systems (SAP or external systems) as an authentication token. The user does not need to enter a user ID or password for authentication, but can access the system directly once it has checked the logon ticket. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Application Server ABAP Security Guide into the search bar, press Enter , open the search result with that title, and navigate to User Administration and Authentication Integration in Single Sign-On Environments Logon Tickets
· Client Certificates As an alternative to user authentication using a user ID and passwords, users using a Web browser as a front-end client can also provide X.509 client certificates to use for authentication. In this case, user authentication is performed on the Web server using the Secure Sockets Layer Protocol (SSL Protocol). No passwords have to be transferred. User authorizations are valid in accordance with the authorization concept in the SAP system. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Application Server ABAP Security Guide into the search bar, press Enter , open the search result with that title, and navigate to User Administration and Authentication Integration in Single Sign-On Environments Client
Certificates .
For more information about the available authentication mechanisms, go to https:/ /help.sap.com/ s4hana\_op\_2021, enter User Authentication and Single Sign-On into the search bar, press Enter , and open the search result with that title.
## Fiori Technology
For details on the User Authentication and Single Sign-On concepts used in SAP Fiori apps, go to https:/ / help.sap.com/s4hana\_op\_2021, enter SAP Fiori Overview into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.
.
## 4 System Hardening with SAP Security Notes
## Backlog of Existing Security Notes
There is also a backlog of security notes that require your attention during early phases of your SAP S/4HANA system setup. The following is a list of important security notes which include manual configuration steps and which you need to implement in your SAP S/4HANA system. These implementations/configurations can only be carried out by you due to your specific landscape and specific application environment.
##  Note
Some of these SAP Notes may not be applicable in your system landscape.
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
|   SAP Note | Topic                                                                            |
|------------|----------------------------------------------------------------------------------|
|    1322944 | ABAP: HTTP security session management                                           |
|    1531399 | Enabling SSL for Session Protection                                              |
|    1585767 | Enabling Virus Scanning in SAP Content Server                                    |
|    1616535 | Secure configuration of ICM for the ABAP application server                      |
|    1693981 | Unauthorized modification of displayed content                                   |
|    1853140 | Managing SAProuter from external host                                            |
|    1973081 | XSRF vulnerability: External start of transactions with OK- Code                 |
|    2086818 | Fixing POODLE SSLv3.0 (CVE-2014-3566) Vulnerability                              |
|    2107562 | Fixing POODLE SSLv3.0 (CVE-2014-3566) Vulnerability in Money Mobiliser Platform  |
|    2142551 | Clickjacking Framing Protection in AS ABAP                                       |
|    2185122 | Switchable authorization checks for RFC in data extraction within CA-MDG-APP-FIN |
|    2245332 | Clickjacking Framing Protection in SAPUI5 Apps                                   |
|    2260344 | OScommandinjection vulnerability in SCTC_* Function modules                      |
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
<!-- image -->
|   SAP Note | Topic                                                                                              |
|------------|----------------------------------------------------------------------------------------------------|
|    2319172 | Clickjacking Framing Protection in SAP GUI forHTML                                                 |
|    2319192 | Clickjacking Framing Protection in BSP                                                             |
|    2333957 | Clickjacking Framing Protection in SAP Fiori Launchpad for NWASABAPbasedonalist of allowed domains |
|    2349128 | Clickjacking Framing Protection in UI theme designer on ABAP                                       |
|    2421287 | Front-end printing with SAP GUI 750                                                                |