This quick start guide will help Accenture MDR customers configure SAP HANA to send logs to the Log collection Platform (LCP).
This document includes the following topics:
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.
Port Requirements
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
SAP HANA | LCP | 601 (TCP) | Default port
|
Configuring SAP HANA
Steps to enable Audit Logging on the device
Auditing is not enabled by default. Auditing can be configured by executing the ALTER SYSTEM ALTER CONFIGURATION and CREATE AUDIT POLICY SQL statements.
The following SQL statement enables auditing in the system database.
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'system') set ('auditing configuration', 'global_auditing_state') = 'true';
The next statement sets the audit target to database table (the default is SYSLOGPROTOCOL).
ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'system') set ('auditing configuration', 'default_audit_trail_type') = 'CSTABLE';
If auditing is active, certain actions are always audited and are therefore not available for inclusion in user-defined audit polices. These actions are audited by the internal audit policy MandatoryAuditPolicy.
Configuring syslog message forwarding by using rsyslogd
SAP HANA does not provide log forwarding capabilities, however the operating system syslog daemon can be configured to forward audit logs coming from SAP HANA.
Log in as an root/administrator user in the Linux OS where SAP HANA is installed.
To stop rsyslogd, at a command prompt, type the following command:
#systemctl stop rsyslog
Use a text editor such as vi to open and edit the following file:
Add one of the following line at the end of the /etc/rsyslog.conf file, as required:
For TCP forwarding,
:msg, contains, "<sid>;<instanceno>" @@<IP or Hostname of the collector:<port>
For example, this configuration forwards all logs from SAP HANA database server HXE instance 90 to 192.168.0.1 on port 601.
:msg, contains, "HXE;90" @@192.168.0.1:601
For UDP forwarding,
:msg, contains, "<sid>;<instanceno>" @<IP or Hostname of the collector:<port>
For example, this configuration forwards all logs from SAP HANA database server HXE instance 90 to 192.168.0.123 on port 514.
:msg, contains, "HXE;90" @192.168.0.123:514
Note: Port is optional. If not provided, then default port 514 will be used. In case of TCP use 601.
Save and close the rsyslog.conf file.
To start rsyslogd, at a command prompt, type the following command:
#systemctl start rsyslog
Log flow will start from the device to the Accenture Log Collection Platform.
LCP Configuration Parameters
Table 1-2: The SAP HANA event collector (Syslog -4004) properties to be configured by Accenture are given in the table.
Property | Default Value | Description |
Protocol | TCP | Protocol that LCP uses to receive events. |
Host Names/IP Addresses | * | The SAP HANA host name or the IP address that forward syslog messages to the LCP. The default value '*' means all hosts. Possible values are:
Specify ANY, any, or * to allow any SAP HANA to send events to the LCP, or specify multiple computer names. Separate multiple computer names or IP addresses with commas. |
Signatures | HDB_SYSTEMDB | The signatures used by the LCP to collect the necessary log events from the logs generated by the SAP HANA. If there are more than one signature, then the signatures must be seperated by a comma (,). If you add a new sensor configuration other than the default one, the Signatures field is empty. Then you must manually enter appropriate signatures. If the Signatures field is empty, the signature based filtering of messages does not happen. |
Port Number | 601 | The port number to which you have configured SAP HANA to send syslog messages. |