ECC6 to EhP7 SSFS Problem

[brodgers]

Hi,

We're going from flat ECC6 straight to EhP7 on one of our systems.  We're getting to a point in the extraction phase where it needs to connect to the database and it fails when using the 7.40 kernel it has extracted as it needs to use SSFS.

We followed all of the steps in Note 1622837 without issue and if I set the env parameters to use /usr/sap/<sid>/SUM/abap/exe for everything and run R3trans -d it connects 0000 using the stored username and password without issue.  If I use the regular kernel 721_ext patch 300 and run R3trans -d it fails but indicates that it has loaded all of the information from ssfs and then tries to connect with /<passwd>@<SID> instead of SAPR3/<passwd>@<SID> as it does on the 740 kernel.  It then gives an error indicating that it was unsuccessful in connecting. 

Is there any points that I'm missing here?  I can't upgrade the system kernel past 721 as the system is flat 7.00 and doesn't support a kernel higher. 

4 ETW000 R3trans version 6.24 (release 721 - 08.05.14 - 16:50:00).
4 ETW000 ===============================================
4 ETW000 
4 ETW000 date&time   : 02.06.2014 - 09:25:25
4 ETW000 control file: <no ctrlfile>
4 ETW000 R3trans was called as follows: R3trans -d
4 ETW000  trace at level 2 opened for a given file pointer
4 ETW000  [     dev trc,00000]  Mon Jun  2 09:25:25 2014                                                 225  0.000225
4 ETW000  [     dev trc,00000]  db_con_init called                                                        50  0.000275
4 ETW000  [     dev trc,00000]  set_use_ext_con_info(): ssfs will be used to get connect information
4 ETW000                                                                                                 202  0.000477
4 ETW000  [     dev trc,00000]  determine_block_commit: no con_hdl found as blocked for con_name = R/3
4 ETW000                                                                                                  49  0.000526
4 ETW000  [     dev trc,00000]  create_con (con_name=R/3)                                                 26  0.000552
4 ETW000  [     dev trc,00000]  Loading DB library '/usr/sap/<SID>/SYS/exe/run/dboraslib.so' ...            82  0.000634
4 ETW000  [     dev trc,00000]  Mon Jun  2 09:25:26 2014                                               74086  0.074720
4 ETW000  [     dev trc,00000]  DlLoadLib() success: dlopen("/usr/sap/<SID>/SYS/exe/run/dboraslib.so"), hdl 0
4 ETW000                                                                                                  77  0.074797
4 ETW000  [     dev trc,00000]  Library '/usr/sap/<SID>/SYS/exe/run/dboraslib.so' loaded                    35  0.074832
4 ETW000  [     dev trc,00000]  function DbSlExpFuns loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  65  0.074897
4 ETW000  [     dev trc,00000]  Version of '/usr/sap/<SID>/SYS/exe/run/dboraslib.so' is "721.02", patchlevel (0.224)
4 ETW000                                                                                                 333  0.075230
4 ETW000  [     dev trc,00000]  function dsql_db_init loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  55  0.075285
4 ETW000  [     dev trc,00000]  function dbdd_exp_funs loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                 123  0.075408
4 ETW000  [     dev trc,00000]  function sapic_get_instant_client_version loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  71  0.075479
4 ETW000  [     dev trc,00000]  function sapic_get_instant_client_flavor loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  60  0.075539
4 ETW000  [     dev trc,00000]  function sapic_get_patchset_version loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  59  0.075598
4 ETW000  [     dev trc,00000]  function sapic_get_ls_inventory loaded from library /usr/sap/<SID>/SYS/exe/run/dboraslib.so
4 ETW000                                                                                                  57  0.075655
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=47=DBSL_CMD_IMP_FUNS_SET) -> changed=30, tagset=1
4 ETW000                                                                                                  84  0.075739
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=39=DBSL_CMD_SET_SINGLETASK)                     38  0.075777
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=10=DBSL_CMD_DBCA_PTR_GET)                       31  0.075808
4 ETW000  [     dev trc,00000]  New connection 0 created                                                  27  0.075835
4 ETW000  [     dev trc,00000]  0: name = R/3, con_id = -000000001, state = DISCONNECTED, tx = NO , bc = NO , hc = NO , perm = YES, reco = NO , frco = NO , timeout = 000, con_max = 255, con_opt = 255, occ = NO , prog =  
4 ETW000                                                                                                  54  0.075889
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=10=DBSL_CMD_DBCA_PTR_GET)                       31  0.075920
4 ETW000  [     dev trc,00000]  db_con_connect (con_name=R/3)                                             28  0.075948
4 ETW000  [     dev trc,00000]  determine_block_commit: no con_hdl found as blocked for con_name = R/3
4 ETW000                                                                                                  48  0.075996
4 ETW000  [     dev trc,00000]  find_con_by_name found the following connection:                          26  0.076022
4 ETW000  [     dev trc,00000]  0: name = R/3, con_id = 000000000, state = DISCONNECTED, tx = NO , bc = NO , hc = NO , perm = YES, reco = NO , frco = NO , timeout = 000, con_max = 255, con_opt = 255, occ = NO , prog =  
4 ETW000                                                                                                  52  0.076074
4 ETW000  [     dev trc,00000]  read_con_info_ssfs(): reading connect info for connection R/3             27  0.076101
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=74=DBSL_CMD_CON_INFO_EXT_SUPPORT) -> rc=0=DBSL_ERR_OK, con_vers=0
4 ETW000                                                                                                  75  0.076176
4 ETW000  [     dev trc,00000]  con_info_ext_support(): DBSL supports extended connect protocol           32  0.076208
4 ETW000                          ==> connect info for default DB will be read from ssfs
4 ETW000  [     dev trc,00000]  con_info_ext_support(): auth/shadow_upgrade = undefined                   50  0.076258
4 ETW000                         ==> Using default key set to get connect info from ssfs
4 ETW000  [     dev trc,00000]  read_ssfs_record(): register callback ssfs_dbi_trace and max level 2
4 ETW000                                                                                                  68  0.076326
4 ETW000  [     dev trc,00000]  RSecSSFs: Entering function "RSecSSFsGetRecord" [rsecssfs.c 872]         154  0.076480
4 ETW000  [     dev trc,00000]  RSecSSFs: Configuration data read from environment parameters [rsecssfs.c 4359]
4 ETW000                                                                                                8812  0.085292
4 ETW000  [     dev trc,00000]  RSecSSFs: Data file "/usr/sap/<SID>/SYS/global/security/rsecssfs/data/SSFS_<SID>.DAT" opened for read [rsecssfs.c 2539]
4 ETW000                                                                                                 126  0.085418
4 ETW000  [     dev trc,00000]  RSecSSFs: Key file "/usr/sap/<SID>/SYS/global/security/rsecssfs/key/SSFS_<SID>.KEY" not found, using default key [rsecssfs.c 1424]
4 ETW000                                                                                                  92  0.085510
4 ETW000  [     dev trc,00000]  RSecSSFs: Exiting function "RSecSSFsGetRecord" with return code 0 (message: <No message available>) [rsecssfs.c 936]
4 ETW000                                                                                                 738  0.086248
4 ETW000  [     dev trc,00000]  read_ssfs_record(): DB_CONNECT/DEFAULT_DB_USER read successfully from ssfs
4 ETW000                                                                                                  50  0.086298
4 ETW000  [     dev trc,00000]  read_ssfs_record(): deregister callback ssfs_dbi_trace                    28  0.086326
4 ETW000  [     dev trc,00000]  read_ssfs_record(): register callback ssfs_dbi_trace and max level 2
4 ETW000                                                                                                  47  0.086373
4 ETW000  [     dev trc,00000]  RSecSSFs: Entering function "RSecSSFsGetRecord" [rsecssfs.c 872]          32  0.086405
4 ETW000  [     dev trc,00000]  RSecSSFs: Configuration data read from environment parameters [rsecssfs.c 4359]
4 ETW000                                                                                                  78  0.086483
4 ETW000  [     dev trc,00000]  RSecSSFs: Data file "/usr/sap/<SID>/SYS/global/security/rsecssfs/data/SSFS_<SID>.DAT" opened for read [rsecssfs.c 2539]
4 ETW000                                                                                                  96  0.086579
4 ETW000  [     dev trc,00000]  RSecSSFs: Key file "/usr/sap/<SID>/SYS/global/security/rsecssfs/key/SSFS_<SID>.KEY" not found, using default key [rsecssfs.c 1424]
4 ETW000                                                                                                  76  0.086655
4 ETW000  [     dev trc,00000]  RSecSSFs: Exiting function "RSecSSFsGetRecord" with return code 0 (message: <No message available>) [rsecssfs.c 936]
4 ETW000                                                                                                 485  0.087140
4 ETW000  [     dev trc,00000]  read_ssfs_record(): DB_CONNECT/DEFAULT_DB_PASSWORD read successfully from ssfs
4 ETW000                                                                                                  50  0.087190
4 ETW000  [     dev trc,00000]  read_ssfs_record(): deregister callback ssfs_dbi_trace                    27  0.087217
4 ETW000  [     dev trc,00000]  read_ssfs_record(): register callback ssfs_dbi_trace and max level 2
4 ETW000                                                                                                  46  0.087263
4 ETW000  [     dev trc,00000]  RSecSSFs: Entering function "RSecSSFsGetRecord" [rsecssfs.c 872]          32  0.087295
4 ETW000  [     dev trc,00000]  RSecSSFs: Configuration data read from environment parameters [rsecssfs.c 4359]
4 ETW000                                                                                                  78  0.087373
4 ETW000  [     dev trc,00000]  RSecSSFs: Data file "/usr/sap/<SID>/SYS/global/security/rsecssfs/data/SSFS_<SID>.DAT" opened for read [rsecssfs.c 2539]
4 ETW000                                                                                                  92  0.087465
4 ETW000  [     dev trc,00000]  RSecSSFs: Key file "/usr/sap/<SID>/SYS/global/security/rsecssfs/key/SSFS_<SID>.KEY" not found, using default key [rsecssfs.c 1424]
4 ETW000                                                                                                  77  0.087542
4 ETW000  [     dev trc,00000]  RSecSSFs: Exiting function "RSecSSFsGetRecord" with return code 0 (message: <No message available>) [rsecssfs.c 936]
4 ETW000                                                                                                 239  0.087781
4 ETW000  [     dev trc,00000]  read_ssfs_record(): DB_CONNECT/DEFAULT_DB_CON_ENV read successfully from ssfs
4 ETW000                                                                                                  49  0.087830
4 ETW000  [     dev trc,00000]  read_ssfs_record(): deregister callback ssfs_dbi_trace                    28  0.087858
4 ETW000  [     dev trc,00000]  -->DbSlConnect(vers=0, type=0, env='<SID>', usr='', kernel dbsl='721')
4 ETW000                                                                                                 104  0.087962
4 ETW000  [     dev trc,00000]  Register application info.                                               329  0.088291
4 ETW000  [     dev trc,00000]  Oracle client version: 11.2.0.3.0, V1, default build, (dbsl 721 140314, non-unicode)
4 ETW000                                                                                                 172  0.088463
4 ETW000  [     dev trc,00000]  Installed Oracle client patches:                                          65  0.088528
4 ETW000  [     dev trc,00000]  # Patch  13508485     : Created on 21 Dec 2011, 13:23:38 hrs PST8PDT
4 ETW000                                                                                                  53  0.088581
4 ETW000  [     dev trc,00000]  # Patch Description: Created on 30 Dec 2011, 03:13:30 hrs PST8PDT         36  0.088617
4 ETW000  [     dev trc,00000]  # Patch  11742262     : Created on  7 Mar 2012, 12:22:41 hrs CET          41  0.088658
4 ETW000  [     dev trc,00000]    Default connection: tnsname ='<SID>'                                      52  0.088710
4 ETW000  [     dev trc,00000]  -->oci_initialize(con=0, char='WE8DEC', nchar='AL16UTF16', nls=-1),uc_ln=1
4 ETW000                                                                                                  56  0.088766
4 ETW000  [     dev trc,00000]   OCIEnvCreate(mode=0=OCI_DEFAULT) returned 0 (for default NLS handle)

4 ETW000                                                                                               13398  0.102164
4 ETW000  [     dev trc,00000]     OCIHandleAlloc(OCI_HTYPE_ERROR, con=0, ErrHp=8)                       135  0.102299
4 ETW000  [     dev trc,00000]     OCIHandleAlloc(OCI_HTYPE_ERROR, con=0, ErrBt=8)                        54  0.102353
4 ETW000  [     dev trc,00000]  NLS env. settings: lang=414D45524943414E                                 135  0.102488
4 ETW000  [     dev trc,00000]                     terr=414D4552494341                                    35  0.102523
4 ETW000  [     dev trc,00000]                     char=574538444543                                      32  0.102555
4 ETW000  [     dev trc,00000]  Client NLS setting (by OCINlsGetInfo(con=0)): 'AMERICAN_AMERICA.WE8DEC'
4 ETW000                                                                                                  51  0.102606
4 ETW000  [     dev trc,00000]  charset='WE8DEC', ncharset='AL16UTF16', UNI_ASC=FALSE                     29  0.102635
4 ETW000  [     dev trc,00000]  Connecting as /<pwd>@<SID> on connection 0 (nls 0) ... (dbsl 721 140314, non-unicode)
4 ETW000                                                                                                  88  0.102723
4 ETW000  [     dev trc,00000]     OCIHandleAlloc(OCI_HTYPE_SVCCTX, con=0, svchp=8)                       81  0.102804
4 ETW000  [     dev trc,00000]  Allocating server context handle                                          42  0.102846
4 ETW000  [     dev trc,00000]  Attaching to database server <SID> (con=0, svchp=8, srvhp=0)                57  0.102903
4 ETW000  [     dev trc,00000]  Assigning server context 0 to service context 8                        85495  0.188398
4 ETW000  [     dev trc,00000]     OCIHandleAlloc(OCI_HTYPE_SESSION, con=0, usrhp=0)                     134  0.188532
4 ETW000  [     dev trc,00000]  Assigning username to user session: con=0, usrhp=0                        36  0.188568
4 ETW000  [     dev trc,00000]  Assigning password to user session: con=0, usrhp=0                        32  0.188600
4 ETW000  [     dev trc,00000]  Starting user session: OCISessionBegin(con=0, usr='', svc=8, srv=0, usr=0)
4 ETW000                                                                                                 622  0.189222
4 ETW000  [     dev trc,00000]     OCISessionBegin(OCI_DEFAULT) failed with -1=OCI_ERROR                 390  0.189612
4 ETW000  [     dev trc,00000]     OCISessionBegin(OCI_DEFAULT) failed with SQL error 1017:               97  0.189709
4 ETW000  [     dev trc,00000]     ORA-01017: invalid username/password; logon denied                                                                            
4 ETW000                                                                                                  56  0.189765
4 ETW000  [     dev trc,00000]  server_detach(con=0,stale=1,srvhp=0)                                      32  0.189797
4 ETW000  [     dev trc,00000]  Server handle (con=0,svchp=8,srvhp=0) detached                           644  0.190441
4 ETW000  [     dev trc,00000]  Free server handle srvhp=0 of con=0                                       42  0.190483
4 ETW000  [dbsloci.c   ,00000]  *** ERROR => CONNECT failed with SQL error '1017'                        128  0.190611
4 ETW000  [     dev trc,00000]  -->oci_get_errmsg (con=0, rc=1017)                                        45  0.190656
4 ETW000  [     dev trc,00000]     OCIErrorGet() -> SQL error code: 1017                                  32  0.190688
4 ETW000  [     dev trc,00000]  ORA-01017: invalid username/password; logon denied                                                                               
4 ETW000                                                                                                  53  0.190741
4 ETW000  [     dev trc,00000]  ocica() -> SQL error code 1017,1017                                       30  0.190771
4 ETW000  [     dev trc,00000]     DbSlConnect(con=0) -> orc=1017, 99=DBSL_ERR_DB                         31  0.190802
4 ETW000  [    dblink  ,00000]  ***LOG BY2=>sql error 1017   performing CON                              152  0.190954
4 ETW000  [    dblink  ,00000]  ***LOG BY0=>ORA-01017: invalid username/password; logon denied            36  0.190990
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=41=DBSL_CMD_RELINFO_GET)                        53  0.191043
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=14=DBSL_CMD_VERSION_GET)                        33  0.191076
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=50=DBSL_CMD_GET_PATCH_INFO)                     31  0.191107
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=13=DBSL_CMD_VENDOR_NAME_GET)                   109  0.191216
4 ETW000  [     dev trc,00000]  -->DbSlControl(con=-1,cmd=52=DBSL_CMD_GET_DBLIB_VERSION)                  34  0.191250
4 ETW000  [     dev trc,00000]                 -> 'OCI_112, 11.2.0.3.0, V1, default build'                30  0.191280
2EETW169 no connect possible: "DBMS = ORACLE                           --- dbs_ora_tnsname = '<SID>'"

[brodgers · Accepted solution]

It ended up being DB_CONNECT/DEFAULT_DB_CON_ENV parameter.  When set it worked fine testing R3trans from the 740 kernel, but failed from the 721 or 720 kernel.  When we removed this parameter from the secure storage file it worked perfectly fine on both kernels and the upgrade was able to continue.

[Former Member · Accepted solution]

Hi

I am also facing the same issue SSFS problem.

ERROR:The new SAP tools in /media/upgrade/SUM/abap/exe cannot connect to your database.

Possible reasons are:

• Environment variables are not properly set for the version of the database client which is used by the new tools.

• Required database libraries are not accessible or cannot be found neither through a compiled-in path nor through explicit search via the shared library path.
• Auxiliary files such as language files etc. are not compatible with this version of the database client.
• Connection problem to Oracle via SSFS

Please help me how to proceed.

Thanks

Rajesh

[brodgers · Accepted solution]

Have you followed SAP note 1622837?

SSFS needs to be setup in your current system and R3trans -db must come back successfully with your existing kernel.

The short version we use is:

mkdir /usr/sap/<SID>/SYS/global/security

mkdir /usr/sap/<SID>/SYS/global/security/rsecssfs

mkdir /usr/sap/<SID>/SYS/global/security/rsecssfs/data

mkdir /usr/sap/<SID>/SYS/global/security/rsecssfs/key

Add to default.pfl

rsec/ssfs_datapath = $(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)data

rsec/ssfs_keypath  = $(DIR_GLOBAL)$(DIR_SEP)security$(DIR_SEP)rsecssfs$(DIR_SEP)key

rsdb/ssfs_connect = 1

Add to .dbenv logon scripts for sidadm / orasid

setenv RSEC_SSFS_DATAPATH /usr/sap/<SID>/SYS/global/security/rsecssfs/data
setenv RSEC_SSFS_KEYPATH /usr/sap/<SID>/SYS/global/security/rsecssfs/key

setenv rsdb_ssfs_connect 1

As sidadm

rsecssfx put DB_CONNECT/DEFAULT_DB_USER <DB User> -plain
rsecssfx put DB_CONNECT/DEFAULT_DB_PASSWORD <password>

Your R3trans should now connect 0000 with existing kernel.

Shutdown your SUM tool, start it up with a fresh login of sidadm so that it has the SSFS pieces in the env variables and it should continue.

[Former Member · Accepted solution]

Hi Ben

How to set below environment variables in linux, oracle 11.2.

Add to .dbenv logon scripts for sidadm / orasid

setenv RSEC_SSFS_DATAPATH /usr/sap/<SID>/SYS/global/security/rsecssfs/data
setenv RSEC_SSFS_KEYPATH /usr/sap/<SID>/SYS/global/security/rsecssfs/key

setenv rsdb_ssfs_connect 1

when i execute with SIDADM getting command not found

setenv rsdb_ssfs_connect 1

-bash: setenv: command not found

Thanks

[Former Member · Accepted solution]

Hi Ben

Quick Question. What do your component versions state in System - Status Post EHP7 Upgrade

I've done one and it still says Enhancement Pack 6 not seven.......

[MGL · Accepted solution]

HI Ben J,

I am facing the same issue and followed the same steps what are mentioned in both the SAP Notes 1622837 and 1639578.

After restarting the SAP, I checked both R3trans -d and R3trans -x and both giving RC as 0000.

Then I shutdown SUM tool and start it with a fresh login of sidadm but getting same below error page each and every time.

When I checked DBCONNCHK.OUT  in log it shows RC 0012 for R3trans

Could you please let me know what's wrong happening and how to resolve it.

Regards

[Former Member]

Hi Ben,

Update the Kernel release from 720 to 738 will resolve the issue. Than rerun the SUM .

Thanks,

Neel

[former_member182657]

Hi Ben,

With ref SAP Note 1639578 - SSFS as password storage for primary database connect

Could you try to use SAP kernel 7.38 or above instead of 7.21_EXT for SSFS database connection.As per the note

If you use Oracle as a database platform, take the following into account: 

All SAP products that can be used only with kernel version < 7.20, exclusively support the standard OPS$ remote connect.

 All SAP products that are used with kernel version > 7.38, as well as all the Oracle databases > Version 11.2, exclusively support the new connect procedure with SSFS that is described here.

Hope this will help you.

Regards,

Gaurav

[brodgers]

I don't think this will work as our ECC system is 7.00 and won't start with a kernel higher than 7.21. I've tried 720, 721, and 721_EXT all with no luck.  7.40 connects through SSFS without issue and even starts the system successfully but gives errors indicating that 7.40 is too new for the component levels of the system.

[former_member188883]

Hi Ben,

As per SAP note

1622837 - Secure connection of AS ABAP to Oracle via SSFS

For 720 Kernel release you need to use patch 318 or higher.

Please try with higher patch level and post the results.

Hope this helps.

Regards,

Deepak Kori

[brodgers]

Thanks. This is the same note that SAP came back with in the Incident we logged.  All of the steps have been followed to setup SSFS and when using the 7.40 kernel it connects without issue but doesn't with the 721 kernel.  We're using 721-EXT level 300 which is the latest available and I believe the latest version of R3trans 310.

[sivakumar_kilari3]

Hi,

did you upgrade latest dbsl patches?

Thanks

siva

[brodgers]

Thanks for the suggestion.  I just downloaded 7.21_EXT lib_dbsl 310 and tried that and no luck unfortunately. 

[Sriram2009]

Hi Ben

Could refer the scn link error msg "CONNECT failed with SQL error '1017"

http://scn.sap.com/thread/913085

BR

SS

[brodgers]

Thanks for looking at this.  This one doesn't apply as we're trying to connect using SSFS, not the old ops$ method.