SAP NetWeaver Licensing Mechanism in Microsoft Azure Cloud - Part 1
Published Apr 17 2019 03:35 AM 18.6K Views
Microsoft

As an SAP administrator, you surely faced situations where suddenly a valid SAP license becomes invalid for no obvious reason.


For an SAP ABAP system, the system will automatically generate a temporary 28 days license and users will get a popup that the license is expiring in 28 days.

 

License expiration.png

 

In case of an SAP Java system, the system will shut down after 30 minutes!


Such issues are not pleasant for SAP users or administrators.

 

They can become even more frequent in an Azure cloud environment, due to the ability to dynamically provision a new computer infrastructure on demand.

 

To increase the stability of the SAP license mechanism, SAP updated the licensing mechanism with the Azure cloud specific functionality.


In this blog, we’ll explain what is new in the SAP licensing mechanism for Azure and how it is different to the on-premises environment.

 

Role of an SAP Hardware (HW) Key

 

Every SAP NetWeaver ABAP or Java system needs a valid SAP license. Customers will generate an SAP license on SAP Service Marketplace, by providing different input values like the SAP product name, SAP SID, DBMS and last but  not least, an SAP Hardware (HW) key.

 

SAP SWMP Create New License 1.png

 

 

SAP SWMP Create New License 2.png

 

An SAP hardware key is generated on an operating system host where SAP message server process is running.

You can SAP HW key by running command line program:

 

saplicense -get

 

For an SAP ABAP-based system, SAP message server is part of:

  • SAP ASCS instance (ABAP Central Services)
  • SAP DVEBMGS instance (so-called central instance)
    As newer SAP installations do not install the DVEBMGS instance anymore, there is a small chance that you will run into this kind of setup.

 

For SAP Java based systems, the SAP message server is part of:

  • SAP SCS instance (Java Central Services)

 

SAP Hardware Key Input Parameters in an On-Premises Environment

 

In the physical and virtual environments , the SAP hardware key is using  the following input parameters:

 

On Windows

  • Windows Computer SID (Secure ID)
  • (local) hostname

On Linux:

  • The MAC address of the first valid network card

It is important to mention that any change of HW key input parameters will cause an existing valid SAP license to become invalid.

For example, a valid license will become invalid if you change Windows local host name, or you do a sysprep (which will generate new Windows computer SID) where your SAP ASCS/SCS instance is running.

 

Similarly, the same will happen on Linux if you exchange the network card, or you change the order of multiple network cards.

 

SAP Hardware Key Input Parameters in an Azure Cloud

 

For the SAP systems in Azure, input parameters used for calculation of the hardware key is changed in the following way:

 

On Windows

  • Windows Computer SID
  • (local) hostname
  • Azure VM Unique ID

On Linux:

  • Azure VM Unique ID

 

On Windows, we got a new input parameter (Azure VM Unique ID), in addition to two existing ones e.g. Windows Computer SID and hostname.

 

On Linux, the first valid NIC MAC address is replaced with Azure VM Unique ID

 

This change is introduced in the following SAP kernel versions:

 

On Windows starting with:

  • SAP kernel 7.21 PL #332 or higher
  • SAP kernel 7.38 PL #72 or higher
  • SAP kernel 7.41 PL #210 or higher
  • SAP kernel 7.42 PL #31 or higher

 

On Linux starting with:

  • SAP kernel 7.21 EXT PL #622 or higher
  • SAP kernel 7.22 EXT PL #112 or higher
  • SAP kernel 7.42 PL #324 or higher
  • SAP kernel 7.45 PL #111 or higher

 

Azure VM Unique ID

 

Azure VM Unique ID is a 128bits identifier that is encoded and stored in all Azure IaaS VM’ SMBIOS and can be read using platform BIOS commands. It can also be read  using Azure PowerShell or Azure CLI.

 

Check the blog Accessing and Using Azure VM Unique ID.

 

Every newly  created VM will have unique Azure VM ID.

 

The act of recreating an existing VM means deleting act of recreate of an existing VM, which means you delete the definition of an existing VM (without disk deletion), and create it again using existing disk, will generate a new Azure VM Unique ID.

 

After VM recreate, everything except the Azure VM Unique ID will stay the same on OS level - hostname, all OS settings, parameters, etc.

 

Azure Unique VM ID won ’t change in case of:

  • VM Reboot
  • VM shutdown (either planned or unplanned), 
  • VM start/stop de-allocate, 
  • VM service healing or restore 
  • Redeploy (move VM to another Azure host)

 

Getting input parameters for SAP HW Key

 

You can get the details on exact input parameters for SAP  HW key calculation, by running saplicense command tool with TRACE=2 option

 

 

saplicense –get TRACE=2

 

A new file dev_slic will be created. 


Inside of this file, you will get detailed information of the  input parameters as well as generated HW key.

 

On Windows, you will see:

 

…..
SlicGetHwId: VM Instance ID: 8ac7ebca-0a2a-ee42-b84d-2f54f4d3ecde
SlicGetHwId: ID >S-21-1940833746--186857679-1893085103-gor-sap1-8ac7ebca-0a2a-ee42-b84d-2f54f4d3ecde<
SlicGetHwId: CUSTOMER KEY: >T1746343904<

 

You’ll notice that you have 3 input parameters on Windows.

 

 

SAP LiKey Input Parameters Windows.png

On Linux, you will see:

 

SlicGetFullHwId: hwid 'AZURE_3B924F79-3F43-5744-AFFD-70A9EDFFBCDC' found
SlicGetHwId: ID >AZURE_3B924F79-3F43-5744-AFFD-70A9EDFFBCDC<
SlicGetHwId: CUSTOMER KEY: >Y0348768522<


e.g. only one input parameter is used:

 

SAP LiKey Input Parameters Linux.png

 

You can use also Azure PowerShell to get Azure Unique VM ID

(Get-AzureRmVM -ResourceGroupName <ResourceGroup> -Name <VMName>).VmId


The Azure VM ID from PowerShell looks a bit different from the one we got from dev_slic , for example:

  • 8ac7ebca-0a2a-ee42-b84d-2f54f4d3ecde -is the an example from dev_slic file
  • caebc78a-2a0a-42ee-b84d-2f54f4d3ecde - is what you get from PowerShell

This is the same Azure VM ID number, only the formatting is different - the first 3 sets are a bit rotated, and the last 2 sets are the same.

 

In the second part of this blog, we’ll cover some typical Azure scenarios where you can run into invalid SAP licenses. We’ll show you the way how to troubleshoot the SAP licensing issues, and proactively prevent them.

 

Useful SAP Notes & Blogs

 

 

 

 

 

6 Comments
Copper Contributor

Hi Goran, I am new to SAP we have a NetWeaver WIndows setup, but our DB is SLES, which server do I need to run the command you mentioned above, as we have a license expiry problem and think it maybe related to the Azure UUID not matching the SAP HW key when first generated so would like to check using the command you mentioned 

 

saplicense –get TRACE=2

How and were do I enter this command, I can SSH into the SAP DB vm but the command doesn't work.  Appreciate any help on this.

Microsoft

 

 

If you recheck the blog (or video), it is stated

An SAP hardware key is generated on an operating system host where SAP message server process is running.

 

For an SAP ABAP-based system, SAP message server is part of:

  • SAP ASCS instance (ABAP Central Services)
  • SAP DVEBMGS instance (so-called central instance)
    As newer SAP installations do not install the DVEBMGS instance anymore, there is a small chance that you will run into this kind of setup.

 

For SAP Java based systems, the SAP message server is part of:

  • SAP SCS instance (Java Central Services)

So you have to run saplicense on the SAP message server host (ASCS/SCS instance and maybe DVEBMS instance)

 

If you log as SAP OS admin <sid>adm user , the environment path to saplicense should be predefined , so saplicense should work without specifying path to saplicense executable. This is demonstrated in the video where I was logged with <sid>adm user , both on Windows and Linux OS.

With other users which most probably do not have defined path environment point to saplicense executable, you need to specify the full path to saplicense .

 

On linux full path to saplicense can be :

 

/usr/sap/<SID>/SYS/exe/uc/linuxx86_64/saplicense

/usr/sap/<SID>/SYS/exe/run/saplicense

 

On windows could be something like this:

 

\\<globalhost>\sapmnt\<SID>\SYS\exe\uc\NTAMD64\saplicense.exe

 

You can find location of saplicense if you log on as <sid>adm user and run command

 

where saplicense

Copper Contributor

Hi,

 

Where Is the second part of this continuation.

 

We faced same issue hardware key changed while we upgrading SAP Netweaver java system, hence valid licence went invalid and then system was down. We are unable to up the system because execution phase were running. Could you please suggest

Copper Contributor

So we received this error when we failed our fully licensed on premise SAP server to Azure using Zerto.  Migration was flawless.  But then that error showed up when we logged in.  So what exactly would I have to do to license this in Azure in the future?  

Copper Contributor

Hi,
We recent change to azure, but I review note and blog but no restart our licenses, the comman only result one line

 

saplicense.exe -get TRACE=2
Sat May 29 15:15:55 2021
MtxInit: 0 0 0
saplicense: HARDWARE KEY = O0937835068 --> this is temporal for 28 Day

 

Our kernel is on version ok?

>msg_server

--------------------
msgserver information
--------------------

kernel release 722

kernel make variant 722_EXT_REL

compiled on NT 6.0 6002 S x86 MS VC++ 16.00 for NTAMD64

compiled for 64 BIT

compilation mode UNICODE

compile time Mar 30 2018 12:03:04

update level 0

patch number 600

source id 0.600

 

so Can you comment or tell about,

regards,

Copper Contributor

Hello Goran, Could you please share link to the Second part of this video?

Version history
Last update:
‎Apr 17 2019 03:38 AM
Updated by: