Go back to the main page

SAP ECC 6.0 EHP8 — User Guide

How to use the Management Cockpit for SAP ECC on Oracle
Overview

What is the ECC 6.0 EHP8 Cockpit?

The SAP ECC 6.0 EHP8 Management Cockpit is a web-based dashboard for monitoring and operating the SAP ECC IDES demonstration environment hosted on sapidesecc8.fivetran-internal-sales.com. This system runs on an Oracle 19c database, unlike the S/4HANA environment which uses HANA.

From a single page you can:

  • View server details, Oracle database version, OPatch and MOPatch versions
  • Monitor disk space with visual progress bars
  • Check the live status of the SAP Application Server and Oracle Database
  • Trigger on-demand Oracle backups via brbackup to disk and Google Cloud Storage
  • Start and stop SAP and Oracle services with safety controls
  • Access links to GCP console, DNS settings, and technical documentation
  • Retrieve SSH credentials automatically from the encrypted vault
URL: https://sapidesecc8.fivetran-internal-sales.com/sap_skills/docs/SAP_ECC6_EHP8.html
System Information

Server Details

The Server Details card displays static and dynamic information about the SAP server:

FieldDescription
HostnameServer hostname: sapidesecc8.fivetran-internal-sales.com. Includes an SSH button that auto-copies the root password from the vault to your clipboard.
SAP SystemSAP ECC 6.0 EHP8 IDES
SIDSystem ID: ABA
Instance NrInstance number: 00
ClientSAP client 800 (used for all operations)
DB SIDOracle database SID: ABA
DatabaseOracle 19c (19.0.0.0.0), retrieved live from the server
OPatch VersionOracle OPatch utility version, retrieved live via the hardware info API
MOPatch VersionSAP MOPatch utility version, retrieved live via the hardware info API
OSSUSE Linux Enterprise Server 15 SP5
Private IP10.128.15.241 (GCP VPC internal)
Public IP35.226.121.169
CPUs4 vCPUs, retrieved live via nproc
Memory23 GB RAM, retrieved live via free -g

Click the Refresh button at the top right of the section to re-query the database version, OPatch/MOPatch versions, CPUs, and memory from the live server.

Disk Space

The Disk Space card appears alongside Server Details and shows all mounted filesystems with visual progress bars. Data is retrieved via the /sap_skills/api/ecc_disk_space endpoint which runs df -h on the server.

Bar ColorUsage LevelAction
GreenBelow 70%Normal — no action needed
Yellow70% – 85%Monitor — plan cleanup soon
RedAbove 85%Critical — free space immediately

Each filesystem row shows: mount point, usage percentage bar, total size, and available space. Click Refresh to update the data.

Status Cards

Understanding the Status Section

The Status section contains two cards that show the real-time state of the system components. Click Check Status to query both at once.

CardWhat it monitorsDetails
SAP Application ServerSAP NetWeaver ABAP stackSID ABA, instance 00, user abaadm. Shows process count and kernel version.
Oracle DatabaseOracle 19c database instanceDB SID ABA, user oraaba. Shows last backup time, next scheduled backup, and live countdown.

SAP Application Server Card

The SAP card monitors the ABAP application server and displays:

  • Status — Active (green) or Inactive (red), determined via sapcontrol -nr 00
  • Process Count — number of running SAP processes
  • Kernel Version — SAP kernel version retrieved via disp+work -v
  • Start / Stop buttons to control the application server

Oracle Database Card

The Oracle card monitors the database instance and displays:

  • Status — Active (green) or Inactive (red), determined via sqlplus connectivity check
  • Last Backup — date and time of the last successful brbackup, shown in both AMS (Amsterdam) and LA (Los Angeles) timezones. Parsed from /oracle/ABA/sapbackup/backABA.log.
  • Next Backup — next scheduled backup time (Sunday 07:00), also shown in both AMS and LA timezones
  • Countdown — a live countdown timer to the next scheduled backup
  • Start / Stop / Backup buttons to control the database and trigger manual backups

Status Indicators

Each card displays a colored dot and status text:

IndicatorMeaning
Green dot + ActiveThe service is running and responding to queries
Red dot + InactiveThe service is down or unreachable
Grey dot + UnknownStatus has not been checked yet (page just loaded, waiting for response)
Backup Operations

ECC Backup Architecture

The ECC system uses SAP BR*Tools (brbackup / brarchive) for Oracle database backups — NOT HANA Backint. The process is two-phase: local disk backup first, then copy to Google Cloud Storage.

ComponentDetail
Backup ToolingSAP BR*Tools (brbackup, brarchive)
GCS Bucketgs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/
Bucket Consolehttps://console.cloud.google.com/storage/browser/sap-hana-backint
Local Backup Dir/media/oraclebackup
Backup Logs/oracle/ABA/sapbackup/backABA.log
Local RetentionLast 6 backups (-n 6 flag)

Crontab Schedule (sapidesecc8)

Three scheduled jobs run automatically via cron on sapidesecc8:

JobScheduleScriptPurpose
Archive Log BackupSundays 06:00/usr/local/bin/brarchive_aba.shArchives Oracle redo logs to disk
Full Database BackupSundays 07:00/usr/local/bin/brbackup_aba.shOffline force full backup to disk, then GCS copy
Web Portal BackupMon–Fri 23:00/usr/local/bin/backup_webserver.shBacks up the web portal configuration and files
Crontab entries:
0 6 * * 0  /usr/local/bin/brarchive_aba.sh
0 7 * * 0  /usr/local/bin/brbackup_aba.sh
0 23 * * 1-5  /usr/local/bin/backup_webserver.sh

Backup Scripts

brbackup_aba.sh

Performs an offline force backup locally, then copies the output to the GCS bucket:

#!/bin/bash # Offline force backup locally, then copy to GCS bucket su - abaadm -c 'brbackup -u / -p /oracle/ABA/sapprof/initABA.sap -d disk -t offline_force -c -m all -n 6' RC=$? if [ $RC -eq 0 ]; then LATEST=$(ls -td /media/oraclebackup/b* 2>/dev/null | head -1) if [ -n "$LATEST" ]; then gsutil -m cp -r "$LATEST" gs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/ gsutil -m cp -r /media/oraclebackup/ABA gs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/ fi fi

Key flags: -t offline_force forces an offline backup (SAP is stopped), -d disk backs up to local disk, -m all includes all datafiles, -n 6 keeps 6 backup generations.

brarchive_aba.sh

Archives Oracle redo logs to disk using the archive log profile:

#!/bin/bash su - abaadm -c 'brarchive -u / -p /oracle/ABA/sapprof/initABA_archlog.sap -d disk -c'

Backup Process Flow

  1. Sunday 06:00brarchive runs: archives Oracle redo logs to disk using profile initABA_archlog.sap.
  2. Sunday 07:00brbackup runs: offline_force full backup to /media/oraclebackup, then gsutil copies output to gs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/.
  3. SAP ECC is STOPPED during the offline_force backup (typically 60–90 minutes).
  4. Backup logs are written to /oracle/ABA/sapbackup/backABA.log.
  5. Local backup files are stored in /media/oraclebackup.
  6. The -n 6 flag ensures only the last 6 backups are kept locally.

GCS Bucket Structure

PathContents
gs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/ABA/Oracle datafile copies
gs://sap-hana-backint/SAP_ON_ORACLE_BACKUP/b*/Individual backup run directories
Cron logs on GCS mount:
/mnt/sap-hana-backint/SAP_ON_ORACLE_BACKUP/brbackup_cron.log
/mnt/sap-hana-backint/SAP_ON_ORACLE_BACKUP/brarchive_cron.log

Manual Backup via Cockpit

The Oracle Database card includes a Backup Now button to trigger an immediate backup.

Manual Backup Workflow

  1. Click Backup Now on the Oracle Database card.
  2. A confirmation dialog appears. Click OK to proceed.
  3. You will be prompted for the master password (required for all manual backup operations).
  4. The button changes to "Running..." and a live timer starts counting.
  5. The backup runs in the background on the server. You can navigate away — the timer is purely local.
  6. Click Refresh to check progress. When the backup completes, the last backup date updates.

The brbackup command executed on the server is the same as the cron script:

brbackup -u / -p /oracle/ABA/sapprof/initABA.sap -d disk -t offline_force -c -m all -n 6
6-Hour Safety Block: Manual backups are blocked if the next scheduled backup is less than 6 hours away. This prevents overlapping backup operations that could cause data corruption or excessive disk usage. If the button is disabled, wait for the scheduled backup to complete.
Offline Backup Warning: The offline_force mode means the Oracle database will be temporarily shut down during the backup (typically 60–90 minutes). SAP ECC is unusable during this time. Plan manual backups during maintenance windows when users are not active on the system.

Claude Code Skill

Download the saporaclebackup skill for full reference: BR*Tools commands, initABA.sap / initABA_archlog.sap profile templates, gcsfuse mount unit, cron schedule, and troubleshooting for ORA-01102 / ORA-28001 / ORA-01017.

⬇ Download saporaclebackup.md
Start / Stop Operations

Starting Services

Each status card has a green Start button:

ButtonWhat it doesOS user
Start SAPRuns startsap R3 — starts the ABAP application server (ASCS + dialog instance)abaadm
Start DBRuns sqlplus / as sysdba then STARTUP — starts the Oracle databaseoraaba

A confirmation dialog asks you to confirm before starting. If the service is already running, you will see an informational message instead of starting it again.

Stopping Services

Each status card has a red Stop button. Stopping is a two-step authorization process:

  1. Warning dialog — a confirmation message explains the impact (e.g., "All connected users will be disconnected" or "Stop SAP before stopping the database").
  2. Master password — you must enter the vault master password. If the password is wrong, the operation is rejected.
ButtonWhat it doesOS userPre-check
Stop SAPRuns stopsap R3abaadmIf SAP is already down, returns info message
Stop DBRuns sqlplus / as sysdba then SHUTDOWN IMMEDIATEoraabaIf Oracle is already down, returns info message
Important — Shutdown Order: Always stop the SAP Application Server before stopping the Oracle Database. Stopping the database while SAP is running can cause data corruption and leave SAP processes in an undefined state. The cockpit warns you about this.
Startup Order: When bringing the system back up, start Oracle Database first, then the SAP Application Server. SAP requires the database to be running before it can start successfully.

Recommended Shutdown Sequence

  1. Stop SAP — Click "Stop SAP", confirm the warning, enter the master password.
  2. Check Status — Click "Check Status" and wait until SAP shows Inactive.
  3. Stop Oracle — Click "Stop DB" on the Oracle Database card, confirm, enter master password.

Recommended Startup Sequence

  1. Start Oracle — Click "Start DB" on the Oracle Database card. Wait until status shows Active.
  2. Start SAP — Click "Start SAP". The ABAP stack requires the Oracle database to be running first.
Disk Space Monitoring

Filesystem Monitor

The Disk Space card shows all mounted filesystems with visual progress bars. Data is fetched from the /sap_skills/api/ecc_disk_space endpoint which runs df -h on the server.

Key Filesystems to Watch

MountContainsWhy it matters
/oracle/ABAOracle database files (datafiles, control files, redo logs)If full, Oracle stops accepting writes and the database may crash
/oracle/ABA/sapbackupBackup logs and metadataBackup operations fail if insufficient space for logs
/media/oraclebackupLocal backup destination (brbackup output)Backups fail if this filesystem is full
/usr/sapSAP binaries, profiles, and work filesSAP cannot start or function properly if this is full
/oracle/ABA/oraarchOracle archive logsIf full, Oracle halts all transactions until space is freed
Archive Logs: Oracle archive logs grow continuously between brarchive runs (Sundays at 06:00). If the archive log filesystem approaches capacity mid-week, manual intervention with brarchive may be needed.
SSH Access

Automatic Credential Retrieval

The Server Details card includes an SSH button next to the hostname. Clicking this button:

  1. Calls the /sap_skills/api/ecc_ssh_credential endpoint to retrieve the root password from the encrypted vault.
  2. Automatically copies the password to your clipboard.
  3. Displays a confirmation message that the password has been copied.

You can then open your terminal and connect:

ssh root@sapidesecc8.fivetran-internal-sales.com
Paste the password from your clipboard when prompted.
No master password required: The SSH credential endpoint retrieves the root password from the vault automatically. Unlike stop operations, no master password prompt is needed for reading credentials.
Security & Credentials

Credential Management

The cockpit follows a strict no-hardcoded-passwords policy. All credentials are stored in the encrypted vault on the server and retrieved at runtime.

CredentialHow it's usedVault access
SSH root passwordCopied to clipboard via SSH buttonAuto-read (no master password needed)
SAP OS user (abaadm)Start/stop SAP via startsap R3 / stopsap R3Auto-read for start; master password required for stop
Oracle OS user (oraaba)Start/stop Oracle via sqlplus STARTUP / SHUTDOWNAuto-read for start; master password required for stop
Master passwordRequired for all stop operations and manual backup triggersValidates against vault encryption key
Master Password: The master password is required for all destructive operations: stopping SAP, stopping Oracle, and triggering manual backups (since offline_force shuts down the database). Reading credentials and starting services do not require it. If you do not know the master password, contact the SAP Specialist team.
Vault Integration: The vault is file-based and encrypted on the server. API endpoints decrypt credentials on-the-fly. No passwords are stored in the HTML cockpit page or transmitted in URLs.
Email Relay

SMTP Configuration

This server is configured to send email via smtp2go relay using Postfix.

PropertyValue
MTAPostfix (SUSE, lmdb maps)
Relaymail.smtp2go.com:2525
From Addresssapidesecc8@fivetran-internal-sales.com
AuthSASL (credentials in vault key smtp2go)
TLSEnabled (opportunistic)
Config/etc/postfix/main.cf, /etc/postfix/sasl_passwd

Send a test email:

echo "Test" | mailx -s "Test from sapidesecc8" -r "sapidesecc8@fivetran-internal-sales.com" recipient@email.com
Troubleshooting

Common Issues

ProblemCauseSolution
All status cards show "Error" API endpoints unreachable or web server down Check if the sapidesecc8 VM is running in GCP. All API endpoints run locally on this server.
SAP shows Inactive but Oracle is Active SAP application server is stopped while the database is still running Click "Start SAP" to start the ABAP stack. The database must be running first.
Oracle shows Inactive Oracle database has been shut down or crashed Click "Start DB" on the Oracle card. Check /oracle/ABA/saptrace/ for Oracle alert logs if it crashed.
Backup Now button is disabled Next scheduled backup is less than 6 hours away This is the 6-hour safety block. Wait for the scheduled backup to complete, then retry.
Backup Now returns "Error" Oracle instance is down, or brbackup configuration issue Ensure Oracle is Active first. Check /oracle/ABA/sapbackup/backABA.log for error details. Verify initABA.sap exists at /oracle/ABA/sapprof/.
Stop button says "Wrong master password" Incorrect master password entered Retry with the correct master password. Contact SAP Specialist team if forgotten.
Start/Stop says "Already running" or "Already stopped" The service is already in the requested state This is informational — no action needed. Click "Check Status" to confirm current state.
Disk Space shows "Error loading" API endpoint unreachable or server restart needed Try clicking "Refresh". If persistent, the sap_skills service on sapidesecc8 may need a restart.
SSH button does not copy password Vault read failed or clipboard API blocked by browser Ensure you are on HTTPS (clipboard API requires secure context). Check browser console for errors.
Last backup date is very old Scheduled backup cron may have stopped or failed Check crontab -l on sapidesecc8 and review /oracle/ABA/sapbackup/backABA.log for errors.
Archive log filesystem full brarchive has not run or archive logs growing faster than expected Run brarchive manually as oraaba to clear old archive logs. Check cron schedule (Sundays at 06:00).
Page returns 404 HTML file missing from server Re-deploy: scp SAP_ECC6_EHP8.html root@sapidesecc8:/usr/sap/sap_skills/docs/
Architecture

System Architecture

The cockpit page is a static HTML file served by the Python HTTPS server on sapidesecc8 (port 443). All dynamic data comes from API endpoints running locally on the same server. Unlike the S/4HANA cockpit, there is no SSH hop to a remote server — all commands (sapcontrol, sqlplus, brbackup) execute directly on sapidesecc8.

API Endpoints

API EndpointMethodPurposeAuth
/sap_skills/api/ecc_system_status GET SAP status (sapcontrol -nr 00), Oracle status (sqlplus), kernel version (disp+work -v), last backup (backABA.log), next backup (cron Sunday 07:00) None
/sap_skills/api/ecc_hardware_info GET CPU count (nproc), total memory (free -g), OPatch version, MOPatch version None
/sap_skills/api/ecc_disk_space GET Disk usage for all mounted filesystems (df -h) None
/sap_skills/api/ecc_ssh_credential GET Root password from encrypted vault (auto-decrypt, no master password) None
/sap_skills/api/ecc_sap_control POST Start/stop SAP application server (abaadm: startsap R3 / stopsap R3) Master password for stop
/sap_skills/api/ecc_db_control POST Start/stop Oracle database (oraaba: sqlplus STARTUP / SHUTDOWN IMMEDIATE) Master password for stop
/sap_skills/api/ecc_trigger_backup POST Manual brbackup (offline_force). Blocked if next scheduled backup < 6 hours away. Master password
Local execution: All API endpoints execute commands directly on sapidesecc8 — no SSH connections to remote servers are involved. The web server and SAP/Oracle all run on the same machine.
Oracle SQL Console

Overview

The Oracle SQL Console provides an interactive query interface directly from the cockpit. Queries are executed on the Oracle 19c database via sqlplus on sapidesecc8 (local execution, no SSH).

PropertyValue
Toolsqlplus (via su - abaadm)
Execution Hostsapidesecc8 (local)
Database SIDABA
Output FormatPipe-delimited (COLSEP '|')
Query Timeout120 seconds
API EndpointPOST /sap_skills/api/oracle_sql_execute
AuthenticationNo master password required — credentials retrieved from server-side vault

Available Users

Connect AsAuthenticationDefault SchemaVault Key
/ as sysdbaOS authentication (no password)SYSsapidesecc8_oracle
SYSTEMPassword from vaultSYSTEMsapidesecc8_oracle
SAPSR3Password from vaultSAPSR3 (SAP application data)sapidesecc8_oracle
All connections run as OS user abaadm via su - abaadm -c "sqlplus ...". The SQL script is written to a temporary file to avoid shell escaping issues, then piped to sqlplus. The temp file is deleted after execution.

Features

  • User selector/ as sysdba, SYSTEM, or SAPSR3
  • Optional schema — sets ALTER SESSION SET CURRENT_SCHEMA
  • Ctrl+Enter — keyboard shortcut to execute
  • Results table — parsed from pipe-delimited sqlplus output with row count and elapsed time
  • Copy button — copies results as tab-separated text
  • Error display — ORA- and SP2- error messages shown in red box

Example Queries

-- Instance status
SELECT INSTANCE_NAME, STATUS, HOST_NAME FROM V$INSTANCE

-- Database size
SELECT TABLESPACE_NAME, ROUND(SUM(BYTES)/1024/1024/1024, 2) AS SIZE_GB
FROM DBA_DATA_FILES GROUP BY TABLESPACE_NAME ORDER BY SIZE_GB DESC

-- SAP client list (connect as SAPSR3)
SELECT MANDT, MTEXT FROM T000 ORDER BY MANDT

-- Active sessions
SELECT SID, SERIAL#, USERNAME, STATUS, PROGRAM
FROM V$SESSION WHERE USERNAME IS NOT NULL

-- Top 10 largest SAP tables (connect as SAPSR3)
SELECT TABLE_NAME, NUM_ROWS, ROUND(NUM_ROWS * AVG_ROW_LEN / 1024 / 1024, 2) AS SIZE_MB
FROM USER_TABLES ORDER BY NUM_ROWS DESC NULLS LAST
FETCH FIRST 10 ROWS ONLY