From cf193d204a2d9bf625f5b26b62e32a6de7a16c3f Mon Sep 17 00:00:00 2001 From: humblejay Date: Thu, 4 Apr 2024 19:00:45 -0700 Subject: [PATCH] Cross referenced and added ARG queries (#385) Co-authored-by: Eric Henry <44706965+ejhenry@users.noreply.github.com> Co-authored-by: Dost --- .../sap-on-azure/_index.md | 330 ++++-------------- .../{sap-22/sap-22.kql => sap-17/sap-17.kql} | 0 .../sap-on-azure/code/sap-24/sap-24.kql | 2 - .../sap-on-azure/code/sap-34/sap-34.kql | 1 - .../sap-on-azure/code/sap-43/sap-43.kql | 1 - .../sap-on-azure/code/sap-44/sap-44.kql | 1 - .../sap-on-azure/code/sap-47/sap-47.kql | 1 - .../sap-on-azure/code/sap-48/sap-48.kql | 1 - .../sap-on-azure/code/sap-6/sap-6.kql | 1 - .../sap-on-azure/code/sap-7/sap-7.kql | 1 - .../sap-on-azure/code/sap-8/sap-8.kql | 1 - .../sap-on-azure/code/sap-9/sap-9.kql | 1 - 12 files changed, 70 insertions(+), 271 deletions(-) rename docs/content/services/specialized-workloads/sap-on-azure/code/{sap-22/sap-22.kql => sap-17/sap-17.kql} (100%) delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-24/sap-24.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-43/sap-43.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-44/sap-44.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-47/sap-47.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-48/sap-48.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-6/sap-6.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-7/sap-7.kql delete mode 100644 docs/content/services/specialized-workloads/sap-on-azure/code/sap-8/sap-8.kql diff --git a/docs/content/services/specialized-workloads/sap-on-azure/_index.md b/docs/content/services/specialized-workloads/sap-on-azure/_index.md index 51df2242f..92c4315c5 100644 --- a/docs/content/services/specialized-workloads/sap-on-azure/_index.md +++ b/docs/content/services/specialized-workloads/sap-on-azure/_index.md @@ -7,40 +7,39 @@ msAuthor = "kupole" draft = false +++ -The presented resiliency recommendations in this guidance include Azure Sap Solution and associated resources and settings. +The presented resiliency recommendations in this guidance include Azure SAP Solution and associated resources and settings. + +Refer to - +- Azure Center for SAP Solutions +- Opensource Quality Checks +- Openssource Inventory Checks ## Summary of Recommendations {{< table style="table-striped" >}} | Recommendation | Category | Impact | State | ARG Query Available | |:--------------------------------------------------|:-----------------------------------------------------------------------:|:---------------:|:----------------:|:-------------------:| -| [SAP-1 - Ensure that each SAP production system is designed for high availability using availability zones.](#sap-1---ensure-that-each-sap-production-systems-are-designed-for-high-availability) | Availability | High | Verified | No | -| [SAP-2 - Run SAP application servers on two or more VMs using VMSS Flex.](#sap-2---run-sap-application-servers-on-two-or-more-vms-using-vmss-flex) | Availability | High | Verified | No | -| [SAP-6 - Avoid placing application server and database VMs in one Proximity Placement Group.](#sap-6---avoid-placing-application-server-and-database-in-one-proximity-placement-group) | Availability | High | Verified | No | -| [SAP-7 - Avoid placing VMs from multiple SAP systems in a single Proximity Placement Group.](#sap-7---avoid-placing-vms-from-multiple-sap-systems-in-a-single-proximity-placement-group) | Availability | High | Verified | No | -| [SAP-8 - When creating availability sets, ensure that you have maximum number of fault domains and a sufficient number of update domains.](#sap-8---when-creating-availability-sets-ensure-that-you-have-maximum-number-of-fault-domains-and-a-sufficient-number-of-update-domains) | Availability | High | Verified | No | -| [SAP-9 - If using single-instance VMs, all OS and data disks must be Premium SSD or Ultra Disk.](#sap-9---if-using-single-instance-vms-all-os-and-data-disks-must-be-premium-ssd-or-ultra-disk) | Availability | High | Verified | No | +| [SAP-1 - Ensure that each SAP production system is designed for high availability across availability zones.](#sap-1---ensure-that-each-sap-production-system-is-designed-for-high-availability-across-availability-zones) | Availability | High | Verified | No | +| [SAP-2 - Run SAP application servers on two or more VMs using VMSS Flex.](#sap-2---run-sap-application-servers-on-two-or-more-vms-using-vmss-flex) | Availability | High | Verified | Yes | +| [SAP-9 - If using single-instance VMs, all OS and data disks must be Premium SSD or Ultra Disk.](#sap-9---if-using-single-instance-vms-all-os-and-data-disks-must-be-premium-ssd-or-ultra-disk) | Availability | High | Verified | Yes | | [SAP-14 - Ensure that each database replicates changes synchronously (SYNC mode) to a stand-by node.](#sap-14---ensure-that-the-data-is-replicated-synchronously-sync-mode-between-the-primary-and-secondary-database-hosting-vm-nodes) | Availability | High | Verified | No | -| [SAP-15 - Ensure that SAP shared file systems are designed for high availability, and when possible using availability zones.](#sap-15---ensure-that-the-sap-shared-files-systems-are-made-highly-available) | Availability | High | Verified | No | +| [SAP-15 - Ensure that SAP shared file systems are designed for high availability and when possible using availability zones.](#sap-15---ensure-that-sap-shared-file-systems-are-designed-for-high-availability-and-when-possible-using-availability-zones) | Availability | High | Verified | No | | [SAP-16 - Test high availability solutions thoroughly to ensure fail overs work as expected.](#sap-16---test-high-availability-solutions-thoroughly-to-ensure-fail-overs-work-as-expected) | Availability | High | Verified | No | -| [SAP-18 - Remove unwanted location constraints from your Linux Pacemaker clusters.](#sap-18---remove-unwanted-location-constraints-from-your-linux-pacemaker-clusters) | Availability | High | Verified | No | -| [SAP-22 - Protect SAP production workloads with a cross-region disaster recovery solution.](#sap-22---protect-sap-production-workloads-with-a-cross-region-disaster-recovery-solution) | Disaster Recovery | High | Verified | No | -| [SAP-24 - Implement an offsite backup strategy for production workloads by utilizing the second Azure region for backups.](#sap-24---implement-an-offsite-backup-strategy-for-production-workloads-by-utilizing-the-second-azure-region-for-backups) | Disaster Recovery | High | Verified | No | +| [SAP-18 - Remove unwanted location constraints from Linux Pacemaker clusters.](#sap-18---remove-unwanted-location-constraints-from-linux-pacemaker-clusters) | Availability | High | Verified | No | | [SAP-26 - Secure compute resource capacity for critical VM roles in DR region.](#sap-26---secure-compute-resource-capacity-for-critical-vm-roles-in-dr-region) | Disaster Recovery | Medium | Verified | No | -| [SAP-27 - Ensure that the production databases are replicated (ASYNC) to DR location, use database vendor's replication.](#sap-27---ensure-that-the-production-databases-are-replicated-async-to-dr-location-use-database-vendors-replication) | Disaster Recovery | High | Verified | No | +| [SAP-27 - Ensure that the production databases are replicated (ASYNC) to DR location using the database vendor's replication technology.](#sap-27---ensure-that-the-production-databases-are-replicated-async-to-dr-location-using-the-database-vendors-replication-technology) | Disaster Recovery | High | Verified | No | | [SAP-28 - SAP components are backed up to DR location using an appropriate backup tool or ASR.](#sap-28---sap-components-are-backed-up-to-dr-location-using-an-appropriate-backup-tool-or-asr) | Disaster Recovery | High | Verified | No | -| [SAP-29 - SAP shared files systems are replicated or backed up to DR location.](#sap-29---sap-shared-files-systems-and-any-other-critical-to-dr-are-replicated-or-backed-up-to-dr-location) | Disaster Recovery | High | Verified | No | -| [SAP-32 - Automate DR infrastructure build or pre-deploy DR resources.](#sap-32---automate-dr-infrastructure-build-or-pre-deploy-dr-resources) | Disaster Recovery | Medium | Verified | No | -| [SAP-33 - Document and test DR procedure, ensure it meets RPO and RTO targets.](#sap-33---document-and-test-dr-procedure-ensure-it-meets-rpo-and-rto-targets) | Disaster Recovery | Medium | Verified | No | +| [SAP-29 - SAP shared files systems are replicated or backed up to DR location.](#sap-29---sap-shared-files-systems-are-replicated-or-backed-up-to-dr-location) | Disaster Recovery | High | Verified | No | +| [SAP-32 - Automate DR infrastructure build or pre-deploy DR resources.](#sap-32---automate-dr-infrastructure-build-or-pre-deploy-dr-resources) | Disaster Recovery | Medium | Verified | No | +| [SAP-33 - Document and test DR procedure ensure it meets RPO and RTO targets.](#sap-33---document-and-test-dr-procedure-ensure-it-meets-rpo-and-rto-targets) | Disaster Recovery | Medium | Verified | No | | [SAP-34 - Ensure there is a robust monitoring and alerting solution in place for the entire DR solution.](#sap-34---ensure-there-is-a-robust-monitoring-and-alerting-solution-in-place-for-the-entire-dr-solution) | Disaster Recovery | Medium | Verified | No | -| [SAP-36 - Configure scheduled events so you are notified of upcoming maintenance events.](#sap-36---configure-scheduled-events-notification) | Monitoring | High | Verified | No | -| [SAP-42 - ASCS-Pacemaker (Central Server Instance) Ensure Pacemaker cluster has been setup for SAP ASCS high availability.](#sap-42---ascs-pacemaker-central-server-instance-ensure-pacemaker-cluster-has-been-setup-for-sap-ascs-high-availability) | Automation | High | Verified | No | -| [SAP-43 - ASCS-Pacemaker-SLES (Central Server Instance) Ensure the Pacemaker cluster has been setup for SAP ASCS high availability.](#sap-43---ascs-pacemaker-sles-central-server-instance-ensure-the-pacemaker-cluster-has-been-setup-for-sap-ascs-high-availability) | Availability | High | Verified | No | -| [SAP-44 - ASCS-Pacemaker-RH (Central Server Instance) Ensure the Pacemaker cluster has been setup for SAP ASCS high availability.](#sap-44---ascs-pacemaker-rh-central-server-instance-ensure-the-pacemaker-cluster-has-been-setup-for-sap-ascs-high-availability) | Availability | High | Verified | No | +| [SAP-36 - Configure scheduled events notification](#sap-36---configure-scheduled-events-notification) | Monitor | High | Verified | No | +| [SAP-42 - ASCS-Pacemaker (Central Server Instance) Ensure Pacemaker cluster has been setup for SAP ASCS high availability.](#sap-42---ascs-pacemaker-central-server-instance-ensure-pacemaker-cluster-has-been-setup-for-sap-ascs-high-availability) | Availability | High | Verified | No | | [SAP-45 - ASCS-LB (Central Server Instance) Ensure the load balancer is configured correctly for SAP ASCS High availability.](#sap-45---ascs-lb-central-server-instance-ensure-the-load-balancer-is-configured-correctly-for-sap-ascs-high-availability) | Availability | High | Verified | No | | [SAP-46 - DBHANA-Pacemaker (Database Instance) Ensure the Pacemaker cluster has been setup for SAP HANA DB high availability.](#sap-46---dbhana-pacemaker-database-instance-ensure-the-pacemaker-cluster-has-been-setup-for-sap-hana-db-high-availability) | Availability | High | Verified | No | | [SAP-49 - DBHANA-LB (Database Instance) Ensure the load balancer is configured correctly for SAP HANA DB High availability.](#sap-49---dbhana-lb-database-instance-ensure-the-load-balancer-is-configured-correctly-for-sap-hana-db-high-availability) | Availability | High | Verified | No | + {{< /table >}} {{< alert style="info" >}} @@ -51,7 +50,7 @@ Definitions of states can be found [here]({{< ref "../../../_index.md#definition ## Recommendations Details -### SAP-1 - Ensure that each SAP production systems are designed for high availability +### SAP-1 - Ensure that each SAP production system is designed for high availability across availability zones **Category: Availability** @@ -63,16 +62,18 @@ Azure Availability Zones are physically separate locations within each Azure reg **Resources** +- [SAP ACSS Quality Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Inventory Checks](https://aka.ms/ACESInventoryCheckSAP) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [Move Regional SAP HA to Zonal](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/Move-VM-from-AvSet-to-AvZone/Move-Regional-SAP-HA-To-Zonal-SAP-HA-WhitePaper) - [High Availability Deployment Options for SAP](https://learn.microsoft.com/en-us/azure/sap/workloads/sap-high-availability-architecture-scenarios#high-availability-deployment-options-for-sap-workload) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) + **Resource Graph Query** {{< collapse title="Show/Hide Query/Script" >}} -{{< code lang="sql" file="code/sap-1/sap-1.kql" >}} {{< /code >}} +{{< code lang="sql" file="code/sap-1/sap-1.kql">}} {{< /code >}} {{< /collapse >}} @@ -91,96 +92,16 @@ Use Virtual Machines Scale Set (VMSS) with flexible orchestration to distribute **Resources** +- [OpenSource Inventory Checks](https://aka.ms/ACESInventoryCheckSAP) - [Virtual machine Scale Set SAP Deployment Guide](https://learn.microsoft.com/en-us/azure/sap/workloads/virtual-machine-scale-set-sap-deployment-guide) - [Considerations for Flexible VM Scale Sets for SAP](https://learn.microsoft.com/en-us/azure/sap/workloads/virtual-machine-scale-set-sap-deployment-guide?tabs=scaleset-cli#important-consideration-of-flexible-virtual-machine-scale-sets-for-sap-workload) - [Migrate existing SAP system VMs to VMSS Flex](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/how-to-easily-migrate-an-existing-sap-system-vms-to-flexible/ba-p/3833548) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-2/sap-2.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- -### SAP-6 - Avoid placing application server and database in one Proximity Placement Group - -**Category: Availability** - -**Impact: High** - -**Guidance** - -Proximity Placement Group (PPG) is a deployment constraint, therefore placing special VM families such as M- or Mv2- series or placing a large number of VMs in one PPG may lead to allocation failures. - -**Resources** - -- [Proximity Placement Scenarios](https://learn.microsoft.com/en-us/azure/sap/workloads/proximity-placement-scenarios) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) **Resource Graph Query** {{< collapse title="Show/Hide Query/Script" >}} -{{< code lang="sql" file="code/sap-6/sap-6.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- -### SAP-7 - Avoid placing VMs from multiple SAP systems in a single Proximity Placement Group - -**Category: Availability** - -**Impact: High** - -**Guidance** - -Ensure that VMs from different SAP systems are not colocated within a single Proximity Placement Group - -**Resources** - -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-7/sap-7.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- -### SAP-8 - When creating availability sets ensure that you have maximum number of fault domains and a sufficient number of update domains - -**Category: Availability** - -**Impact: High** - -**Guidance** - -The default number of fault domains is 2 and changing it later is not possible online. -Important! If you are currently using Availability Sets or Regional VMs for SAP application servers, then you should consider moving to Availability Zones and VMSS Flex architecture to improve the resiliency posture of your SAP deployment. For the details on the process of migrating existing SAP workloads that are deployed in an availability set or availability zone to a flexible scale set with FD=1 deployment option, refer to our public documentation. - -**Resources** - -- [How availability sets work](https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-overview#how-do-availability-sets-work) -- [Migrate existing SAP system to VMSS Flex](https://techcommunity.microsoft.com/t5/running-sap-applications-on-the/how-to-easily-migrate-an-existing-sap-system-vms-to-flexible/ba-p/3833548) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-8/sap-8.kql" >}} {{< /code >}} +{{< code lang="sql" file="../../compute/virtual-machines/code/vm-1/vm-1.kql" >}} {{< /code >}} {{< /collapse >}} @@ -198,15 +119,17 @@ For single-instance VMs, both OS and data disks must be either Premium SSD or Ul **Resources** +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Inventory Checks](https://aka.ms/ACESInventoryCheckSAP) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [VM SLA](https://www.azure.cn/en-us/support/sla/virtual-machines/) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [SAP Storage Planning Guide](https://learn.microsoft.com/en-us/azure/sap/workloads/planning-guide-storage) **Resource Graph Query** {{< collapse title="Show/Hide Query/Script" >}} -{{< code lang="sql" file="code/sap-9/sap-9.kql" >}} {{< /code >}} +{{< code lang="sql" file="../../compute/virtual-machines/code/vm-24/vm-24.kql" >}} {{< /code >}} {{< /collapse >}} @@ -224,8 +147,8 @@ High availability for databases should be implemented using database native repl **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) **Resource Graph Query** @@ -237,7 +160,7 @@ High availability for databases should be implemented using database native repl

-### SAP-15 - Ensure that the SAP shared files systems are made highly available +### SAP-15 - Ensure that SAP shared file systems are designed for high availability and when possible using availability zones **Category: Availability** @@ -245,13 +168,16 @@ High availability for databases should be implemented using database native repl **Guidance** -SAP shared file systems such as /sapmnt, /usr/trans, interfaces should be made highly available. -In case of Azure File Shares, we recommend that you use ZRS (Zone-redundant storage) and for Azure NetApp Files use Zonal replication for your volumes. +SAP shared file systems such as /sapmnt, /usr/sap/trans, interfaces should be made highly available. + +In case of Azure File Shares, we recommend that you use ZRS (Zone-redundant storage). +In case of Azure NetApp Files, we recommend that you use Zonal replication for your volumes. + +You should review the results of individual checks on other Azure services to ensure SAP shared file systems are designed to protect from zonal failure: ST-1, ANF-1, ANF-6 **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [OpenSource Inventory Checks](https://aka.ms/ACESInventoryCheckSAP) **Resource Graph Query** @@ -276,8 +202,7 @@ The fail back can be either automatic or manual. **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [Test Cases](https://learn.microsoft.com/en-us/azure/sap/workloads/sap-hana-high-availability?tabs=lb-portal#test-the-cluster-setup) **Resource Graph Query** @@ -289,7 +214,7 @@ The fail back can be either automatic or manual.

-### SAP-18 - Remove unwanted location constraints from your Linux Pacemaker clusters +### SAP-18 - Remove unwanted location constraints from Linux Pacemaker clusters **Category: Availability** @@ -306,8 +231,6 @@ This approach allows for controlled resource movement within the cluster, facili **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) **Resource Graph Query** @@ -319,70 +242,11 @@ This approach allows for controlled resource movement within the cluster, facili

-### SAP-22 - Protect SAP production workloads with a cross-region disaster recovery solution - -**Category: Disaster Recovery** - -**Impact: High** - -**Guidance** - -To safeguard SAP production workloads against catastrophic events it is imperative to implement a cross-region disaster recovery solution. This approach ensures business continuity by replicating data and applications across geographically diverse regions, minimizing the risk of data loss and downtime in the event of a regional outage. - -**Resources** - -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-22/sap-22.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- -### SAP-24 - Implement an offsite backup strategy for production workloads by utilizing the second Azure region for backups - -**Category: Disaster Recovery** - -**Impact: High** - -**Guidance** - -To bolster your data protection strategy and ensure business continuity, it is important to implement an offsite backup strategy for production workloads leveraging a second Azure region. This approach enhances data security and business continuity by providing geographical redundancy and improved disaster recovery capabilities. This approach also often supports compliance with regulatory requirements ensuring your organization's resilience against data loss and operational disruptions. - -Ensure that any Azure Recovery Services vaults used for backing up production VMs are GRS. - -In addition, ensure that each of the following technical layers of an SAP system are protected with a suitable backup strategy and backups are also stored in the second region. - -Virtual Machine backups -Database -SAP Central Services -SAP Shared File Systems - -**Resources** - -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-24/sap-24.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- ### SAP-26 - Secure compute resource capacity for critical VM roles in DR region **Category: Disaster Recovery** -**Impact: High** +**Impact: Medium** **Guidance** @@ -392,9 +256,7 @@ Warm standby involves keeping VMs in the DR region running. On-demand Capacity R **Resources** -- [Capacity reservation overview](https://learn.microsoft.com/en-us/azure/virtual-machines/capacity-reservation-overview) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [Capacity Reservation](https://learn.microsoft.com/en-us/azure/virtual-machines/capacity-reservation-overview) **Resource Graph Query** @@ -406,7 +268,7 @@ Warm standby involves keeping VMs in the DR region running. On-demand Capacity R

-### SAP-27 - Ensure that the production databases are replicated (ASYNC) to DR location, use database vendor's replication +### SAP-27 - Ensure that the production databases are replicated (ASYNC) to DR location using the database vendor's replication technology **Category: Disaster Recovery** @@ -414,12 +276,12 @@ Warm standby involves keeping VMs in the DR region running. On-demand Capacity R **Guidance** -Replicate production databases (ASYNC) to the DR location using the database vendor’s replication technology. +The replication of production databases to a DR location using the database vendor's asynchronous replication technology is a key strategy in ensuring data availability and business continuity. **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [SAP Disaster Recovery Guide](https://learn.microsoft.com/en-us/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows) + **Resource Graph Query** @@ -443,8 +305,8 @@ SAP components such as (A)SCS, application servers, WebDispatchers, etc are back **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Inventory Checks](https://aka.ms/ACESInventoryCheckSAP) **Resource Graph Query** @@ -456,7 +318,7 @@ SAP components such as (A)SCS, application servers, WebDispatchers, etc are back

-### SAP-29 - SAP shared files systems and any other critical to DR are replicated or backed up to DR location +### SAP-29 - SAP shared files systems are replicated or backed up to DR location **Category: Disaster Recovery** @@ -468,8 +330,7 @@ Ensure that critical SAP shared file systems, such as /sapmnt, /usr/trans and /i **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [DR Guidance](https://learn.microsoft.com/en-us/azure/sap/workloads/disaster-recovery-sap-guide?tabs=windows) **Resource Graph Query** @@ -489,12 +350,10 @@ Ensure that critical SAP shared file systems, such as /sapmnt, /usr/trans and /i **Guidance** -Automate the build of disaster recovery (DR) infrastructure (or pre-deploy DR resources) and streamline SAP service recovery as much as possible. +Automate DR infrastructure build (or have pre-deployed DR resources) and SAP service recovery as much as possible. **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) **Resource Graph Query** @@ -506,7 +365,7 @@ Automate the build of disaster recovery (DR) infrastructure (or pre-deploy DR re

-### SAP-33 - Document and test DR procedure, ensure it meets RPO and RTO targets +### SAP-33 - Document and test DR procedure ensure it meets RPO and RTO targets **Category: Disaster Recovery** @@ -516,12 +375,12 @@ Automate the build of disaster recovery (DR) infrastructure (or pre-deploy DR re Create detailed documentation of your DR procedures for each layer of the SAP architecture—database, central services, application servers, and shared file systems. This documentation should include configuration details, failover mechanisms, and step-by-step recovery procedures. -Test a wide range of failure scenarios, including regional outages. Testing should confirm that your DR strategy is robust, meets your RPO and RTO targets, and provides seamless failover across all layers of the SAP architecture. This will ensure a comprehensive and resilient DR strategy capable of withstanding regional failures and ensuring business continuity. +Test a wide range of failure scenarios, including regional outages. Testing should confirm that your DR strategy is robust, meets your RPO and RTO targets, and provides seamless failover across all layers of the SAP architecture. + +This will ensure a comprehensive and resilient DR strategy capable of withstanding regional failures and ensuring business continuity. **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) **Resource Graph Query** @@ -541,14 +400,12 @@ Test a wide range of failure scenarios, including regional outages. Testing shou **Guidance** -For an SAP solution hosted on Azure it is imperative to implement a robust monitoring and alerting solution that comprehensively covers DR of each layer of the SAP architecture. Given the complexity of SAP systems, which span multiple layers using diverse technologies and Azure resources, each with potentially distinct DR replication mechanisms, an appropriate monitoring strategy is crucial. The different layers include database, central services, application, and shared file systems. +For an SAP solution hosted on Azure, it's imperative to implement a robust monitoring and alerting solution that comprehensively covers DR of each layer of the SAP architecture. Given the complexity of SAP systems, which span multiple layers using diverse technologies and Azure resources, each with potentially distinct DR replication mechanisms, an appropriate monitoring strategy is crucial. The different layers include database, central services, application, and shared file systems. **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) -**Resource Graph Query/Scripts** +**Resource Graph Query** {{< collapse title="Show/Hide Query/Script" >}} @@ -560,29 +417,24 @@ For an SAP solution hosted on Azure it is imperative to implement a robust monit ### SAP-36 - Configure scheduled events notification -**Category: Monitoring** +**Category: Monitor** **Impact: High** **Guidance** Scheduled events is an Azure Metadata Services that provides proactive notifications about upcoming maintenance events (for example, reboot) so that your application can prepare for them and limit disruption. You should configure scheduled events for all your critical Azure VMs. - - Resource agent azure-events-az can also integrate with Pacemaker clusters. To ensure high availability and service continuity in your Azure VMs, you should configure the azure-events-az resource agent within your Pacemaker clusters. This agent monitors for scheduled Azure maintenance events and can proactively relocate resources for a graceful node shutdown. Configure the agent to monitor specific event types such as Reboot and Redeploy, and enable verbose logging for detailed diagnostics. - - In addition, it is also important that you define a procedure on how to react to scheduled events. **Resources** - [VM Scheduled Events](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/scheduled-events) - [Configure Pacemaker for Azure Scheduled Events](https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-suse-pacemaker?tabs=msi#configure-pacemaker-for-azure-scheduled-events) -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) + **Resource Graph Query** @@ -606,8 +458,8 @@ For the ASCS-Pacemaker (Central Server Instance), ensure that the Pacemaker clus **Resources** -- [SAP ACSS checks](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) -- [OpenSource Quality checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [ASCS-Pacemaker - Central Server Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) **Resource Graph Query** @@ -620,54 +472,6 @@ For the ASCS-Pacemaker (Central Server Instance), ensure that the Pacemaker clus

-### SAP-43 - ASCS-Pacemaker-SLES (Central Server Instance) Ensure the Pacemaker cluster has been setup for SAP ASCS high availability - -**Category: Availability** - -**Impact: High** - -**Guidance** - -For the ASCS-Pacemaker-SLES (Central Server Instance), ensure that the Pacemaker cluster configuration parameters are correctly set up for SAP ASCS high availability when running on SLES. - -**Resources** - -- [ASCS-Pacemaker-SLESCentral Server Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-43/sap-43.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- -### SAP-44 - ASCS-Pacemaker-RH (Central Server Instance) Ensure the Pacemaker cluster has been setup for SAP ASCS high availability - -**Category: Availability** - -**Impact: High** - -**Guidance** - -For the ASCS-Pacemaker-RH (Central Server Instance), ensure that the Pacemaker cluster configuration parameters are correctly set up for SAP ASCS high availability when running on Red Hat. - -**Resources** - -- [ASCS-Pacemaker-RH Central Server Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) - -**Resource Graph Query** - -{{< collapse title="Show/Hide Query/Script" >}} - -{{< code lang="sql" file="code/sap-44/sap-44.kql" >}} {{< /code >}} - -{{< /collapse >}} - -

- ### SAP-45 - ASCS-LB (Central Server Instance) Ensure the load balancer is configured correctly for SAP ASCS High availability **Category: Availability** @@ -680,6 +484,8 @@ For the ASCS-LB (Central Server Instance), ensure that the load balancer is conf **Resources** +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [ASCS-LB - Central Server Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) **Resource Graph Query** @@ -704,6 +510,8 @@ For the DBHANA-Pacemaker (Database Instance), ensure that the Pacemaker cluster **Resources** +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [DBHANA-Pacemaker - Database Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) **Resource Graph Query** @@ -728,6 +536,8 @@ For the DBHANA-LB (Database Instance), make sure the load balancer is configured **Resources** +- [SAP ACSS Insights](https://learn.microsoft.com/en-us/azure/sap/center-sap-solutions/get-quality-checks-insights) +- [OpenSource Quality Checks](https://github.com/Azure/SAP-on-Azure-Scripts-and-Utilities/tree/main/QualityCheck) - [DBHANA-LB- Database Instance](https://docs.microsoft.com/en-us/azure/advisor/advisor-reference-reliability-recommendations) **Resource Graph Query** diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-22/sap-22.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-17/sap-17.kql similarity index 100% rename from docs/content/services/specialized-workloads/sap-on-azure/code/sap-22/sap-22.kql rename to docs/content/services/specialized-workloads/sap-on-azure/code/sap-17/sap-17.kql diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-24/sap-24.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-24/sap-24.kql deleted file mode 100644 index 825659376..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-24/sap-24.kql +++ /dev/null @@ -1,2 +0,0 @@ -// under-development - diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-34/sap-34.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-34/sap-34.kql index 825659376..614a7f9ca 100644 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-34/sap-34.kql +++ b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-34/sap-34.kql @@ -1,2 +1 @@ // under-development - diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-43/sap-43.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-43/sap-43.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-43/sap-43.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-44/sap-44.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-44/sap-44.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-44/sap-44.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-47/sap-47.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-47/sap-47.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-47/sap-47.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-48/sap-48.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-48/sap-48.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-48/sap-48.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-6/sap-6.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-6/sap-6.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-6/sap-6.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-7/sap-7.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-7/sap-7.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-7/sap-7.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-8/sap-8.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-8/sap-8.kql deleted file mode 100644 index 614a7f9ca..000000000 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-8/sap-8.kql +++ /dev/null @@ -1 +0,0 @@ -// under-development diff --git a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-9/sap-9.kql b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-9/sap-9.kql index 825659376..614a7f9ca 100644 --- a/docs/content/services/specialized-workloads/sap-on-azure/code/sap-9/sap-9.kql +++ b/docs/content/services/specialized-workloads/sap-on-azure/code/sap-9/sap-9.kql @@ -1,2 +1 @@ // under-development -