SNC Certificate expiry is very critical for ABAP systems where SNC logon is used. As soon as the certificate expires users will no more be able to login to system.
In System Monitoring for ABAP systems SAP provides a standard metric called Expiring PSE Certificates which monitors all PSE certificates that includes SNC certificates. When this metric turns red it will tell how many certificates are expiring/expired but not which one. Hence its beneficial to monitor separately the status of SNC Certificates.
This monitoring can be achieved by using Config Validation.
You can create a custom policy with the below XML code that checks the PSE_CERT store to check on status of SNC Certificate.
<?xml version="1.0" encoding="utf-8"?>
<targetsystem desc="SNC Certificate about to expire" id="ASML_SNCERT_TOBE_EXP" multisql="Yes" version="0000">
<configstore name="PSE_CERT" system_type="ABAP">
<checkitem desc="Valid in range" id="1" operator="">
<compliant>APPLICATION like '%SNCS%' and CONTEXT like '%' and TYPE like '%' and SUBJECT like '%sapci%' and ISSUER like '%' and SERIALNO like '%' and VALID_FROM like '%' and ( ( ( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) > to_number(replace(add_days(current_date, 30), '-', '')||replace(current_time, ':', '') ))
or (( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) < to_number(replace(add_days(current_date, 0), '-', '')||replace(current_time, ':', '') )) )</compliant>
<noncompliant>APPLICATION like '%SNCS%' and CONTEXT like '%' and TYPE like '%' and SUBJECT like '%sapci%' and ISSUER like '%' and SERIALNO like '%' and VALID_FROM like '%' and not ( ( ( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) > to_number(replace(add_days(current_date, 30), '-', '')||replace(current_time, ':', '') ))
or (( replace_regexpr ('^$' IN valid_to WITH (replace(current_date, '-', '')||replace(current_time, ':', '')))) < to_number(replace(add_days(current_date, 0), '-', '')||replace(current_time, ':', '') )) )</noncompliant>
</checkitem>
</configstore>
</targetsystem>
Note: In the above XML code, SUBJECT like ‘%sapci%’, you have to replace sapci with a hostname pattern that you use for all your SAP ABAP system hostnames.
To know more about policy maintenance you can refer to our below blog where in we have explained in detail with another example how to maintain policies, edit the XML code and then generate the policy.
Once you have created the policy, you can directly activate alerting on the policy.
For that go to the Configuration and Security Analytics app in the Advanced Configuration Monitoring area.
In the app navigate to Configuration Validation Alert Management under the the Related links tab.
In the Alert Management app click on Create button to create the alerting for the policy you just created.
In the next popup, enter details as shown below and then click on Select policy to select the policy for which you want to activate the alert.
In the next popup select the policy by clicking on the policy name.
Now click on Save to activate the alerting.
Additionally you can also activate email notification on the alert. For this in the Alert Management main screen, select the alert and then click on Notification/Outbound
In the next popup select the notification variant and save.
Now your alerting is active along with notification for SNC certificate expiry.
For more details on Config Validation you can refer to SAP documentation here.
Some filesystems are critical to a business, such as those used in interfaces. This custom metric group will alert if a filesystem is not mounted.
Create the Bash Script to Check the Filesystem Status
Firstly, we need to create a bash script that takes the filesystem as its input argument and then checks its status. Create the following script called /sbin/checkfilesystemmounted.sh (owner is root, permissions 755). You may put this script somewhere else if you prefer, but be sure to refer to the correct location later on in this post.
The findmnt command returns the mount details if the filesystem is mounted. The filesystem is passed as a script argument in variable $1. If the filesystem is mounted, the script returns integer 1. If the filesystem is not mounted, the script returns integer 0. For example, to check your desired filesystem, execute it like this as root:
The result should be as per the following example:
Webmethod returned successfully
Operation ID: 0A02C69098121EDDA68C041B50FE858D
----- Response data ----
description=Check if filesystem is mounted
{type:integer, name:FileSystemMounted, value:1}
exitcode=0
Create the Custom Alert in SAP Focused Run
In Focused Run, we create an alert in a Linux host monitoring template. For example, the alert name is “Interface Filesystem not Mounted”. The Alert should be in Category “Exceptions” and the Severity is up to you. In this case it is 9.
Create the Custom Metric Group in SAP Focused Run
Next, we create the custom Metric Group . A Metric Group allows variants to be created, and each variant corresponds to a filesystem you wish to monitor.
Overview Tab:
Name: “Interface Filesystem not Mounted”
Category: Exceptions
Class: Metric Group
Data Type: Integer
Technical Name: INTERFACE_FILESYSTEM_NOT_MOUNTED
Data Collection Tab:
Data Collector Type: Diagnostic Agent (push)
Data Collector Name: OS: ExecuteOperation
Collection Interval: 5 Minutes (depending on the criticality)
CUSTOM_OPERATION_NAME: checkfileystemmounted – This corresponds to the custom operation for saphostctrl created earlier
METRIC_NAME: FileSystemMounted – This corresponds to the name of the metric in the JSON output by the bash script
RETURNFORMAT: JSON – This is the output format of the bash script
Usage Tab:
Threshold Tab:
As the script returns a numeric value 0 if the filesystem is not mounted, then the threshold will alert if the value is 0.
Assignment Tab
Assign to the custom alert created earlier.
Add Variants
The variable passed to the saphostctrl operation is “FILESYSTEM”. We can add the rest of the filesystems as individual variants. The format for the operation parameters is as follows:
FILESYSTEM:/the/filesystem/you/want/to/check
For example:
You can enter as many filesystems as you like as separate variants.
Activate Alert
Go to the “Metrics, Events, Alerts Hierarchy” tab, and activate System Monitoring.
Testing the Metric
In a non-Production environment, try to unmount a filesystem, and at most 5 minutes later, there should be an alert produced.
