Accenture MDR Quick Start Guide for SAP HANA

This quick start guide will help Accenture MDR customers configure SAP HANA to send logs to the Log collection Platform (LCP).

This document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring SAP HANA
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

SAP HANA

LCP

UDP(514) or

601 (TCP)

Default port

Configuring SAP HANA

Steps to enable Audit Logging on the device

Auditing is not enabled by default. Auditing can be configured by executing the ALTER SYSTEM ALTER CONFIGURATION and CREATE AUDIT POLICY SQL statements.

The following SQL statement enables auditing in the system database.

ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'system') set ('auditing configuration', 'global_auditing_state') = 'true';

The next statement sets the audit target to syslog (the default is SYSLOGPROTOCOL).

ALTER SYSTEM ALTER CONFIGURATION ('nameserver.ini', 'system') set ('auditing configuration', 'default_audit_trail_type') = 'SYSLOGPROTOCOL';

If auditing is active, certain actions are always audited and are therefore not available for inclusion in user-defined audit polices. These actions are audited by the internal audit policy MandatoryAuditPolicy.

Configuring syslog message forwarding by using rsyslogd

SAP HANA does not provide log forwarding capabilities, however the operating system syslog daemon can be configured to forward audit logs coming from SAP HANA.

Log in as an root/administrator user in the Linux OS where SAP HANA is installed.
To stop rsyslogd, at a command prompt, type the following command:

#systemctl stop rsyslog

Use a text editor such as vi to open and edit the following file:

Add one of the following line at the end of the /etc/rsyslog.conf file, as required:

For TCP forwarding,

:msg, contains, "<sid>;<instanceno>" @@<IP or Hostname of the collector:<port>

For example, this configuration forwards all logs from SAP HANA database server HXE instance 90 to 192.168.0.1 on port 601.

:msg, contains, "HXE;90" @@192.168.0.1:601

For UDP forwarding,

:msg, contains, "<sid>;<instanceno>" @<IP or Hostname of the collector:<port>

For example, this configuration forwards all logs from SAP HANA database server HXE instance 90 to 192.168.0.123 on port 514.

:msg, contains, "HXE;90" @192.168.0.123:514

Note: Port is optional. If not provided, then default port 514 will be used. In case of TCP use 601.

Save and close the rsyslog.conf file.

To start rsyslogd, at a command prompt, type the following command:

#systemctl start rsyslog

Log flow will start from the device to the Accenture Log Collection Platform.

LCP Configuration Parameters

Table 1-2: The SAP HANA event collector (Syslog -4004) properties to be configured by Accenture are given in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture MxDR onboarding team.
Host Names/IP Addresses	*	The SAP HANA host name or the IP address that forward syslog messages to the LCP. The default value '' means all hosts. Possible values are: IP address host name ANY any Specify ANY, any, or * to allow any SAP HANA to send events to the LCP, or specify multiple computer names. Separate multiple computer names or IP addresses with commas.
Signatures	HDB_SYSTEMDB	The signatures used by the LCP to collect the necessary log events from the logs generated by the SAP HANA. If there are more than one signature, then the signatures must be seperated by a comma (,). If you add a new sensor configuration other than the default one, the Signatures field is empty. Then you must manually enter appropriate signatures. If the Signatures field is empty, the signature based filtering of messages does not happen.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MxDR onboarding team if this is a requirement.