PUBLIC SAP IT Operations Analytics 1.0: Administrator's and User's Guide

Document Version: ITOA 1.0-1.3 2015-10-06 PUBLIC SAP IT Operations Analytics 1.0: Administrator's and User's Guide

Content 1 Introduction....5 1.1 Technical Architecture....5 1.2 Basic Prerequisites....7 1.3 Related Information....8 2 Installation and Configuration....9 2.1 Set Up a User for SAP HANA XS Administration.... 9 2.2 Deploy the Core Application....10 2.3 Set Up Users....11 2.4 Define the SQL Connection Configuration....12 2.5 Set Up the XS Job....13 2.6 Initialize the Core Application....14 2.7 Install the Input Adapter.... 15 Install the Input Adapter with hdbsetup....15 Install the Input Adapter with hdbinst....16 2.8 Configure the HTTP Destination for Smart Data Streaming....17 2.9 Set Up the Connection to the Syslog Server....17 2.10 Start the Syslog Server....18 3 Security....20 3.1 Configure Browser Security....21 3.2 Roles for SAP IT Operations Analytics....21 4 Operations....23 4.1 Monitoring Events Streaming....23 4.2 Updating....23 4.3 Troubleshooting....25 5 Analyzing Events....26 2 2015 SAP SE or an SAP affiliate company. All rights reserved. Content

Document Change Log The following updates have been made since the first version of this document was released for SAP IT Operations Analytics 1.0. Many of these changes are the result of user feedback. If you would like to give us your own feedback about the documentation, please send an e-mail to your SAP contact who can then forward it to the authoring team or the development team. Tip The document version is not the same as the software release version. The software release version in all cases below is 1.0. Table 1: What's new and what's changed? In which document version? Where are the updates? Document change log 1.2 With this overview, you don't need to read the whole guide over again to find out what has changed in the documentation since the previous version. Two hosts 1.2 Basic Prerequisites [page 7] You learn up front that separate hosts are required for SAP HANA and Smart Data Streaming. Starting the Web service provider from the <sid>adm user before starting the syslog server 1.2 Start the Syslog Server [page 18] We've provided some additional guidance. Updating your software to a higher patch 1.2 Updating [page 23] The steps are now described in a sequence that enables you to complete this process without hitches, including post-update checks. Document Change Log 2015 SAP SE or an SAP affiliate company. All rights reserved. 3

What's new and what's changed? In which document version? Where are the updates? Feature scope description 1.1 Introduction [page 5] We've presented this information in a clearer way and enhanced the information itself. Related information 1.1 Related Information [page 8] We now provide links to commonly referenced sources of additional information in one place rather than scattered throughout the guide. Security 1.1 Security [page 20] You'll understand the security information better if you refer to the technical architecture diagram shown in Chapter 1, so we've added this as a tip. Troubleshooting 1.1 Troubleshooting [page 25] You'll now find all troubleshooting information in one single SAP Note. We simply refer to it in this guide. Timestamps 1.1 Analyzing Events [page 26] We explain how to interpret the different timestamps in the table view. 4 2015 SAP SE or an SAP affiliate company. All rights reserved. Document Change Log

1 Introduction With SAP IT Operations Analytics, you can stream and analyze syslog data in real time, thus gaining insights into events of interest. The delivered features let you: Feature Description Collect and handle syslog data Stream syslog data into the database in real time Store the data for a defined period Automatically clean up/remove older data Identify and analyze events of interest, including critical events Search for events with one or more attributes Exclude events with selected attributes Drill down to the detail of an event View and compare event data in tables and charts Download event data as text or charts Save analytics filters as dashboards for frequent use The following documentation is available for SAP IT Operations Analytics: The above feature scope description The installation, configuration, security, and update information within this document The bucket configuration information available in the application 1.1 Technical Architecture SAP IT Operations Analytics is an SAP HANA XS application that runs on SAP HANA with SAP HANA Smart Data Streaming. The solution comprises the following components: Component Description Syslog client Syslog adapter The device that sends the events to SAP HANA Smart Data Streaming, for example, via port 1515 An internal syslog server that receives and parses the data, and then sends the events to the streaming project The regular expressions rules for the data transfer to SAP HANA are read via a JDBC connection on the SQL port. Introduction 2015 SAP SE or an SAP affiliate company. All rights reserved. 5

Component Description Output adapter Sends the data to SAP HANA based on the data service itoa_service that is defined for this purpose. For information about the ports for SAP HANA Smart Data Streaming, see the SAP HANA Master Guide. Web service provider Browser The streaming project and the syslog adapter are deployed, started, and stopped using the Web service provider. The default port is 9091. Users access the application via the Chrome Web browser. 6 2015 SAP SE or an SAP affiliate company. All rights reserved. Introduction

1.2 Basic Prerequisites A number of things need to be in place before you install SAP IT Operations Analytics. SAP HANA SPS 09 Revision 95 has been installed. Introduction 2015 SAP SE or an SAP affiliate company. All rights reserved. 7

SAP HANA Smart Data Streaming Revision 95 has been installed on a separate host. For more information, see the SAP HANA Smart Data Streaming: Master Guide and the SAP HANA Smart Data Streaming: Installation Guide. Remember Make sure you add the Smart Data Streaming host with the fully qualified domain name. On operating system level, the time zone has been set to UTC on both the SAP HANA host and the Smart Data Streaming host. Java 1.7 or higher has been installed on the SAP HANA Smart Data Streaming host. An ODBC driver manager and an ODBC Data Source have been configured, and [hanaservice] dsn has been defined, as described in the SAP HANA Smart Data Streaming: Configuration and Administration Guide. JAVA_HOME has been set for the user <SID>adm on the SAP HANA Smart Data Streaming host. The latest version of Google Chrome has been installed locally on each user's computer. 1.3 Related Information In addition to this document, please refer to the following resources: Resource Location Release note for SAP IT Operations Analytics 1.0 SAP Software Download Center http://service.sap.com/sap/support/notes/2169954 https://support.sap.com/software.html In the alphabetical list of products, look under ("I") for SAP ITOA. SAP HANA documentation http://help.sap.com/hana_platform_earlier_releases SAP HANA Smart Data Streaming documentation http://help.sap.com/hana_options_earlier_releases 8 2015 SAP SE or an SAP affiliate company. All rights reserved. Introduction

2 Installation and Configuration The installation and initial configuration of SAP IT Operations Analytics consists of a number of tasks. Make sure you carry out these tasks in the order below. 1. Set Up a User for SAP HANA XS Administration [page 9] 2. Deploy the Core Application [page 10] 3. Set Up Users [page 11] 4. Define the SQL Connection Configuration [page 12] 5. Set Up the XS Job [page 13] 6. Initialize the Core Application [page 14] 7. Install the Input Adapter [page 15] 8. Configure the HTTP Destination for Smart Data Streaming [page 17] 9. Set Up the Connection to the Syslog Server [page 17] 10. Start the Syslog Server [page 18] 2.1 Set Up a User for SAP HANA XS Administration Before starting the installation and configuration of SAP IT Operations Analytics, you must ensure the existence of a user or users with the required roles and privileges for the SAP HANA XS administration of the application. Prerequisites You are logged on to SAP HANA with a user that is authorized to assign privileges and manage roles. For more information about user authorization in SAP HANA, see the SAP HANA Security Guide. Procedure Create a user for SAP HANA XS administration tasks with the following roles: Role Name This role is required to... sap.hana.xs.lm.roles::administrator Deploy the SAP IT Operations Analytics core application using SAP HANA lifecycle management at http://<host>:<port>/sap/ hana/xs/lm. Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 9

Role Name This role is required to... sap.hana.xs.admin.roles::jobadministrator sap.hana.xs.admin.roles::sqlccadministrator sap.hana.xs.admin.roles::httpdestadministrator sap.hana.xs.admin.roles::runtimeconfadministrator Define the SQL connection configuration. Set up the XS job. Configure the HTTP destination for SAP HANA Smart Data Streaming. Set the browser security of the application. Alternatively, you can use these roles as templates for creating your own roles and users. 2.2 Deploy the Core Application SAP IT Operations Analytics is an SAP HANA XS app. Prerequisites You have downloaded the archive from SAP Software Download Center. A user has been set up to perform SAP HANA XS administration tasks. Context This procedure covers how to import the delivery unit using SAP HANA application lifecycle management. You can also do this in the SAP HANA studio. A third option is to install the software component archive using the hdbalm tool as described in the SAP HANA Administration Guide. Procedure 1. Unzip the software component archive. 2. As the SAP HANA XS administration user, log on to SAP HANA application lifecycle management at http://<host>:<port>/sap/hana/xs/lm and import the delivery unit (that is, the.tgz file). You can find precise instructions about how to import a delivery unit in the SAP HANA Developer Guide for the SAP HANA studio. 10 2015 SAP SE or an SAP affiliate company. All rights reserved. Installation and Configuration

2.3 Set Up Users Before you continue with the configuration of SAP IT Operations Analytics, it will save you time to create all the users you are going to need in one go. Prerequisites You are logged on to SAP HANA at http://<host>:<port>/sap/hana/ide/security or to the SAP HANA studio with a user that is authorized to create other users. For information about user authorization in SAP HANA, see the SAP HANA Security Guide and the SAP HANA Administration Guide. Procedure Create the following users based on the predefined *dci* roles: User Description Role Additional Instructions Technical user for SQLCC Connection to the database is done by this technical user. End users and the administrator do not have direct access to the database. sap.dci.core.role:sql cc 1. You need to change the initial password of this user before it can be assigned to the SQL connection configuration. One way to do this is as follows: 1. Log off from http:// host:port/sap /hana/ide/ security and then log back in again, this time with the user you just created. 2. At the prompt, change the initial password. You can ignore the error message that appears. 2. Optional: To exclude this user from the Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 11

User Description Role Additional Instructions maximum password lifetime check, use the SQL statement ALTER USER <user_name> DISABLE PASSWORD LIFETIME. Technical user for XS job Before end users can start to work, an XS job must be set up to remove at regular intervals data that no longer needs to be retained in SAP HANA. A technical user must be set up to run this job. sap.dci.core.role:job You need to change the initial password of this user before it can be assigned to the XS job. For a description of how to do this, see above. Administrative user for SAP IT Operations Analytics Responsible for initializing the core application and for starting the syslog server sap.dci.core.role:adm in End users for SAP IT Operations Analytics Data center administrators and analysts sap.dci.core.role::vi ewer Related Information Roles for SAP IT Operations Analytics [page 21] 2.4 Define the SQL Connection Configuration Users do not have direct access to the database. Therefore, a technical user must be set up to connect to the database. Prerequisites The technical user for SQLCC has been created. 12 2015 SAP SE or an SAP affiliate company. All rights reserved. Installation and Configuration

Procedure 1. Open SAP HANA XS administration at http://<host>:<port>/sap/hana/xs/admin. 2. Log on with the SAP HANA XS administration user that has the role sap.hana.xs.admin.roles::sqlccadministrator. 3. By clicking the Expand arrows ( ), navigate to the package sap.dci.core.services. 4. Select the SQL connection configuration AdminConnection.xssqlcc. 5. Specify the credentials of the SQLCC technical user by choosing Edit on the bottom right, entering the user's name and password, and saving. 2.5 Set Up the XS Job Before users can start to work with the application, you need to configure and activate the data retention job. Prerequisites The technical user for the XS job has been created. Procedure 1. Open SAP HANA XS administration at http://<host>:<port>/sap/hana/xs/admin. 2. Log on with the SAP HANA XS administration user that has the role sap.hana.xs.admin.roles::jobadministrator. 3. By clicking the Expand arrows ( ), navigate to the package sap.dci.core.services. 4. Select the job ItoaJob.xsjob. 5. Configure the job as follows: a. Choose the Configuration tab. b. Enter the name and password of the XS job technical user. c. Activate the job by selecting the Active checkbox. d. If required, change the frequency with which the deletion and/or the cleanup will be done by editing the respective schedules. e. Save the job. Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 13

2.6 Initialize the Core Application Before you can get started, the administrative user for SAP IT Operations Analytics needs to initialize the application. As a result, the default bucket is created and ready for the connection of the syslog client and for starting analyses. The default bucket is the storage unit for the syslog data you want to make available for analysis. Prerequisites An administrative user has been created for SAP IT Operations Analytics with the role sap.dci.core.role::admin. The application has been deployed, the SQL connection has been configured, and the XS job has been set up. Procedure 1. As the administrator for SAP IT Operations Analytics, log on to http://<host>:<port>/sap/dci/ core. If required, change the initial password. 2. On the initial screen, choose Get Started Now!. 3. Leave the default retention period of three days as it is or specify a different retention period, and then choose Next. 4. Leave the default values of the syslog configuration fields as they are for now, and choose Finish. You will have a chance to modify these defaults in a later configuration step. Results Once initialization has completed, you see a message to this effect and the default bucket appears. 14 2015 SAP SE or an SAP affiliate company. All rights reserved. Installation and Configuration

2.7 Install the Input Adapter The input adapter for SAP IT Operations Analytics controls how syslog event data is received into SAP HANA smart data streaming. You can install it either using a graphical user interface (hdbsetup) or on the command line (hdbinst). Install the Input Adapter with hdbsetup Prerequisites The basic prerequisites are fulfilled (see Chapter 1). You have downloaded the archive from the SAP Software Download Center. You know the SID of the SAP HANA system. You know the password of the SYSTEM user. Procedure 1. Log on to the Smart Data Streaming host as the root user. 2. Unpack the *.SAR file as follows: Change to the directoy where SAPCAR resides and issue the following command:./sapcar -xvf <directory where you placed the installer>/<name of.sar file> 3. Switch to the installer subdirectory. 4. Start./hdbsetup. 5. Follow the steps in the wizard. a. If required, overwrite the default installation path and the /hana/shared path. b. As the system identifier, enter the SID of the SAP HANA system on which Smart Data Streaming is running. c. Enter the password of the SYSTEM user for this SAP HANA system. d. Enter a name for the technical user of Smart Data Streaming, such as ITOA_STREAMER. If this user already exists, the role itoa.buckets.default::bucketadmin and the object privileges ITOA_STREAMER and SAP_DCI are added to it as part of the installation procedure. If this user does not already exist, it will be created. e. Specify and confirm the password for this technical user. This is not an initial password 6. Choose Install and then Finish. Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 15

Install the Input Adapter with hdbinst Prerequisites The basic prerequisites are fulfilled (see Chapter 1). You have downloaded the archive from the SAP Software Download Center. You know the SID of the SAP HANA system. You know the password of the SYSTEM user. Procedure 1. Log on to the Smart Data Streaming host as the root user. 2. Unpack the *.SAR file as follows: Change to the directoy where SAPCAR resides and issue the following command:./sapcar -xvf <directory where you placed the installer>/<name of.sar file> 3. Switch to the installer subdirectory. 4. Start./hdbinst. 5. Respond to the prompts as follows: a. Confirm the default installation path by choosing Enter or specify a different one. b. Confirm the default /hana/shared/ path by choosing Enter or specify a different one. c. Enter the SID of the SAP HANA system on which Smart Data Streaming is running. d. Enter the password of the SYSTEM user. e. Enter a name for the technical user of Smart Data Streaming, such as ITOA_STREAMER. This user will be created as part of the installation process. f. Enter and confirm a password for this user. This is not an initial password. Results A confirmation message appears, informing you that the installation has finished and that a log file has been written to the Smart Data Streaming host. 16 2015 SAP SE or an SAP affiliate company. All rights reserved. Installation and Configuration

2.8 Configure the HTTP Destination for Smart Data Streaming The communication between SAP IT Operations Analytics and the Web service provider requires the following configuration. Procedure 1. Open SAP HANA XS administration at http://<host>:<port>/sap/hana/xs/admin. 2. Log on with the SAP HANA XS administration user that has the role sap.hana.xs.admin.roles::httpdestadministrator. 3. By clicking the Expand arrows ( ), navigate to the package sap.dci.core.services.lib and select the HTTP destination wsp.xshttpdest. 4. Extend the HTTP destination wsp.xshttpdest by adding a new package to it. For example, enter itoa.extension as the extension package and wsp as the extension name. 5. Under General Information, enter the fully qualified domain name of the Smart Data Streaming server as the host. Leave the port as 9091. This is the standard port used by SAP HANA Smart Data Streaming for the Web service provider. 6. Under Authentication Details, select Basic as the authentication type and enter the name and password of the technical user (for example, ITOA_STREAMER) that was created as part of the input adapter installation process. 7. Save the HTTP destination details. 2.9 Set Up the Connection to the Syslog Server The syslog client must be configured so that it can connect to the internal syslog server in SAP HANA Smart Data Streaming. Each infrastructure, such as syslog-ng or rsyslog, has its own configuration mechanism. Whatever the syslog client, it must be configured in such a way that it can send events to the streaming host on the configured port using either UDP or TCP. The configuration format is TIMESTAMP EVENTSOURCE MESSAGE. Example You might define this for syslog-ng based on the following template for the destination: destination syslogdest { tcp("<your streaming host>" port(<your listening port on the streaming port>) time_zone("+00:00") template("$s_date $HOST $MSG\n")); }; Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 17

The default port is 1515, but you can use a different port if required. The log events are sent in UTC, independent of the local time zone configured on the host of the syslog client. 1. On the Smart Data Streaming host, you add the following lines to the file /etc/syslog-ng/syslogng.conf: Sample Code destination itoasyslogdest { tcp("localhost" port(1515) time_zone("+00:00") template("$s_date $HOST $MSG\n")); }; log { source(src); destination(itoasyslogdest); }; The host is "localhost" in this example because the syslog client and SAP HANA Smart Data Streaming are on the same host. However, the host is not restricted to this value. A syslog client on another host can also be configured to send syslog events to SAP IT Operations Analytics. 2. You restart the syslog-ng service. 2.10 Start the Syslog Server Starting the internal syslog server triggers the streaming of syslog events into SAP IT Operations Analytics. You do not need to start the streaming project separately. Prerequisites The Web service provider provides an API to deploy, start and stop the streaming project and the syslog adapter. It must be started before the syslog server can be started. The ODBC Data Source has been configured with [hanaservice]. For more information, see the SAP HANA Smart Data Streaming: Configuration and Administration Guide. The <sid>adm user has started the Web service provider in the $STREAMING_HOME/wsp directory, for example, with./wsp.sh &. If you first logged on with another account such as the root user, make sure you switch to <sid>adm using su - <sid>adm (the hyphen will ensure that the environment variables for this user are set) and specify the correct password for this user. Procedure 1. As the administrator for SAP IT Operations Analytics, log on to http://<host>:<port>/sap/dci/ core. 2. Choose the default bucket to open it. 3. Choose the Edit Bucket button (top right). 18 2015 SAP SE or an SAP affiliate company. All rights reserved. Installation and Configuration

4. In the Syslog Server window, specify the following: Table 2: Field Port of Syslog Server Description This port is used for the connection from the syslog client to the internal syslog server in SAP HANA Smart Data Streaming. This is the same port as the one you specified in the syslog client when setting up the connection to the syslog server. Communication Protocol Data Service Name UDP or TCP This data service is used for the connection from the output adapter in SAP HANA Smart Data Streaming to SAP HANA. The data service provided with the syslog input adapter is itoa_service. 5. Choose Start. Installation and Configuration 2015 SAP SE or an SAP affiliate company. All rights reserved. 19

3 Security To make SAP IT Operations Analytics as secure as possible, you need to do a number of things. Tip Refer to the Technical Architecture diagram when reading this topic. Configure browser security. Use the roles and privileges that are delivered with SAP IT Operations Analytics. Configure the SAP Web Dispatcher to use HTTPS (SSL) for incoming requests from SAP IT Operations Analytics. For more information, see "Configure HTTPS (SSL) for Client Application Access" in the SAP HANA Administration Guide. On the operating system level, restrict which clients can send event data to SAP IT Operations Analytics. Note Secure communication for the JDBC interface between SAP HANA and SAP HANA Smart Data Streaming is not currently supported. A secure connection between SAP IT Operations Analytics and the Web service provider through SSL is currently not supported. You secure the SAP HANA platform and SAP HANA Smart Data Streaming as described in the SAP HANA Security Guide and the SAP HANA Smart Data Streaming: Security Guide. Related Information Technical Architecture [page 5] Configure Browser Security [page 21] Roles for SAP IT Operations Analytics [page 21] 20 2015 SAP SE or an SAP affiliate company. All rights reserved. Security

3.1 Configure Browser Security By enabling custom headers and the x-frame option SAMEORIGIN, you guard against user interface redress attacks, also known as clickjacking. Procedure 1. Open SAP HANA XS administration at http://<host>:<port>/sap/hana/xs/admin. 2. Log on with a user that has the role sap.hana.xs.admin.roles::runtimeconfadministrator. 3. Navigate to the package sap.dci and choose Edit. 4. Select the tab Custom Headers. 5. Select the checkbox Enable Custom Headers. 6. Select the x-frame options SAMEORIGIN. 7. Save your settings. 3.2 Roles for SAP IT Operations Analytics User authorizations for SAP IT Operations Analytics are granted by assigning roles, just as in the SAP HANA platform. You can either use the standard roles directly or as templates for company-specific roles that you create yourselves. The following standard roles are delivered with SAP IT Operations Analytics. Table 3: Role sap.dci.core.role:admin sap.dci.core.role:expert Description This role contains all the privileges that are required for the administrator in SAP IT Operations Analytics. A user with this role has all the privileges of sap.dci.core.role:viewer, as well as the privileges to initialize SAP IT Operations Analytics and to edit the default bucket configuration. In version 1.0, this role has the same privileges as sap.dci.core.role:viewer. sap.dci.core.role:viewer A user with this role can open the default bucket, set filters in the default bucket, create dashboards and edit both his/her own dashboards as well as those of other users. Every user with this role is authorized to see all the streamed syslog events. Security 2015 SAP SE or an SAP affiliate company. All rights reserved. 21

Role sap.dci.core.role:job Description This role is assigned to the technical user that executes the data retention and cleanup job. Do not assign this role to a real person. sap.dci.core.role:sqlcc This role is assigned to the technical user that accesses the SAP HANA database. Do not assign this role to a real person. itoa.buckets.default::bucketadmin You do not need to assign this role directly. It is automatically added when a user with the role sap.dci.core.role:admin is deployed. It is also part of the role ITOA_STREAMER that is created as part of input adapter installation. itoa.buckets.default::bucketjob You do not need to assign this role directly. It is automatically added when the technical user with the role sap.dci.core.role:job is deployed. itoa.buckets.default::bucketviewer You do not need to assign this role directly. It is automatically added when an end user with the role sap.dci.core.role:viewer is deployed. For information about user authorizations for the SAP HANA platform and for SAP HANA Smart Data Streaming, see the SAP HANA Security Guide and the SAP HANA Smart Data Streaming: Security Guide. 22 2015 SAP SE or an SAP affiliate company. All rights reserved. Security

4 Operations 4.1 Monitoring Events Streaming To monitor events streaming, you use the SAP HANA cockpit. For information about how to configure and manage Smart Data Streaming with the SAP HANA cockpit, see the SAP HANA Smart Data Streaming: Configuration and Administration Guide. In the SAP HANA cockpit, you can see the status of the following: The project sds_itoa_buckets_default The input adapter HDCI_Input_Adapter1, type syslog_socket_input_adapter The output adapter HANAOut, type hana_out 4.2 Updating You need to perform an update for each new patch of the software. An update of the core application and of the input adapter are necessary. Prerequisites You have downloaded and unzipped the latest archive from the SAP Software Download Center. Procedure 1. With the user that has the role sap.dci.core.role:admin, stop the syslog server by logging on to SAP IT Operations Analytics and choosing Stop in the Syslog Server window of the default bucket configuration. 2. As the root user, uninstall the previous adapter by switching to the directory which contains the installed files (such as /usr/sap/sap_itoa_sds_input_adapter/install) and running./hdbuninst. To check that the uninstallation was successful: a. Verify that the install folder is empty or was deleted. Operations 2015 SAP SE or an SAP affiliate company. All rights reserved. 23

If the folder already contained files before installation took place, then it will not be removed and the files still exist. b. As the <sid>adm user, verify that the $STREAMING_HOME/adapters/framework/libj/itoa folder is empty or was deleted. If a streaming project is running when you uninstall, some.nfs files still exist and cannot be removed. c. As the <sid>adm user, verify that $STREAMING_HOME/lib/adapters/ syslog_socket_input_adapter.cnxml has been deleted. d. As the <sid>adm user, verify that the $STREAMING_HOME/adapters/framework/instances/ syslog_socket_input_adapter folder has been deleted. Caution If any of the above files/folders still exist, you must delete them manually before you continue. For this purpose, you may first need to stop the streaming server. If that does not work, use the kill <process id> command. 3. Install the new input adapter using hdbsetup or hdbinst, specifying the name of the technical user for streaming: for example, ITOA_STREAMER. This is the technical user that was created when the input adapter was first installed. In most cases, you do not need to create a new user. 4. Deploy the core application as follows: a. Extract the files from the core application.zip file. b. Log on to SAP HANA Application Lifecycle Management or to the SAP HANA Modeler perspective in the SAP HANA studio, and import the new delivery unit (that is, the.tgz archive). You can find precise instructions about how to import a delivery unit with SAP HANA Application Lifecycle Management in the SAP HANA Developer Guide for SAP HANA studio. 5. Complete the update as follows: a. Log on to SAP IT Operations Analytics with the user that has the role sap.dci.core.role:admin. and restart the syslog server. b. Clear the cache in the Web browser. c. If prompted, choose Upgrade. This action will not delete the existing data. d. Open the DEFAULT bucket and restart the syslog server. Results The previous event data as well as all buckets, filters, and dashboards still exist as before, and syslog messages are again streaming into the default bucket. 24 2015 SAP SE or an SAP affiliate company. All rights reserved. Operations

4.3 Troubleshooting If you encounter a problem when using SAP IT Operations Analytics, you'll want to know how to diagnose and fix it. To find out how to troubleshoot common issues, see SAP Note 2187390. Operations 2015 SAP SE or an SAP affiliate company. All rights reserved. 25

5 Analyzing Events You work in the default bucket and in one or more dashboards to analyze syslog event data from your data center in real time. Table 4: What to do How to do it Where to do it Change the interval at which event data is automatically refreshed in the bucket Note The default autorefresh interval is 15 seconds. Choose a different interval in increments of 5 or 10 seconds ( ) Default bucket: top right Filter the data you want to analyze 1. Select a time range. 2. Select one or more attributes. 3. Save the current selection as a filter ( ). Multiple filters may be created ( ). A user sees and can change/delete only his/her own filters. 4. Switch to a different filter that has already been saved ( ). Default bucket: time range, filter, attribute browser Do a text-based search for events Use the search field ( ). Default bucket: top center 26 2015 SAP SE or an SAP affiliate company. All rights reserved. Analyzing Events

What to do How to do it Where to do it Browse the data in the table and, as required, save selections for closer analysis 1. Scroll through the data in the table view. 2. View the details. 3. Drag an attribute from the attribute browser to the table view to see the details of the event. 4. Hover over a message cell to see more detail and filter by specific values. 5. Download as PNG or CSV ( ). If the table contains more than 10,000 rows, only the first 10,000 rows are downloaded to a CSV file. 6. Add a table to a new dashboard or to an existing dashboard, in each case as a dashboard item ( ). Tip Give dashboards and dashboard items meaningful names that will allow you to later recognize what data they contain without your having to open the items. Default bucket: table view Note The Timestamp is shown in local machine time. However, the event detail shows the timestamp from the event source, which could be on a different time zone. Analyzing Events 2015 SAP SE or an SAP affiliate company. All rights reserved. 27

What to do How to do it Where to do it View the data in one or more charts and, as required, save selections for closer analysis 1. Drag and drop an attribute to the charts view. 2. Select from several chart types. 3. Specify the measures and dimensions. 4. Exclude an attribute ( Exclude selected domain(s) ). Exclusion hides but does not delete the selected attribute. You can reinclude it by removing the exclusion in the filter. 5. Include only specific attributes ( Filter by selected domain(s)). Inclusion in this case means filtering by the selected attribute(s). You need to select the attribute(s) first. 6. Show only the top/bottom n results ( ). 7. Download as PNG ( ). 8. Add a chart to a new dashboard or to an existing dashboard, in each case as a dashboard item ( ). Default bucket: charts view Tip Give dashboards and dashboard items meaningful names that will allow you to later recognize what data they contain without your having to open the items. 28 2015 SAP SE or an SAP affiliate company. All rights reserved. Analyzing Events

What to do How to do it Where to do it Analyze the data in more detail 1. Click a dashboard to open it and see the dashboard items inside it. Dashboard 2. Scroll through the dashboard items (displayed as icons). 3. Work within a dashboard in one or more of the following ways: Compare different items in a dashboard. View the filter or save a new filter for a dashboard item ( ). If you change the filter on a dashboard item, this does not change the filter that was originally saved in the default bucket. Download a table item as CSV or a chart item as PNG ( ). Go back to the default bucket ( ). Delete a dashboard item ( ). Analyzing Events 2015 SAP SE or an SAP affiliate company. All rights reserved. 29

Important Disclaimers and Legal Information Coding Samples Any software coding and/or code lines / strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence. Accessibility The information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP in particular disclaims any liability in relation to this document. This disclaimer, however, does not apply in cases of wilful misconduct or gross negligence of SAP. Furthermore, this document does not result in any direct or indirect contractual obligations of SAP. Gender-Neutral Language As far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible. Internet Hyperlinks The SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: http://help.sap.com/disclaimer). 30 2015 SAP SE or an SAP affiliate company. All rights reserved. Important Disclaimers and Legal Information

Important Disclaimers and Legal Information 2015 SAP SE or an SAP affiliate company. All rights reserved. 31

www.sap.com/contactsap 2015 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies. Please see http://www.sap.com/corporate-en/legal/copyright/ index.epx for additional trademark information and notices.