SLES 15 OS Prerequisites & Baseline Hardening for SAP S/4HANA 2023 and HANA 2.0: Complete Field Runbook

1. Architecture Overview & Official SAP Notes Matrix #

Provisioning SUSE Linux Enterprise Server 15 (SLES 15 SP3, SP4, SP5, or SP6) for enterprise SAP workloads requires strict compliance between OS kernel parameters, systemd process boundaries, storage subsystems, and SAP memory management.

SAP S/4HANA 2023 operates on ABAP Platform 2023 (Kernel 7.93), which enforces modern glibc, systemd, and memory allocator requirements alongside SAP HANA 2.0 (SPS07 / SPS08).

┌─────────────────────────────────────────────────────────────────────────────┐
│                 SLES 15 OS TOPOLOGY: DISTRIBUTED VS SINGLE-BOX              │
├──────────────────────────────────────┬──────────────────────────────────────┤
│ DISTRIBUTED ARCHITECTURE             │ SINGLE-BOX APPLIANCE                 │
│                                      │                                      │
│  [Node 1: S/4HANA Application]       │  [Single Host: App + HANA DB]        │
│  * SLES 15 (SP4/SP5/SP6)             │  * SLES 15 (SP4/SP5/SP6)             │
│  * ABAP Kernel 7.93 (S/4HANA 2023)   │  * HANA 2.0 SPS07+ Engine            │
│  * saptune profile: S4HANA-APP       │  * S/4HANA 2023 App Server           │
│                                      │  * saptune profile: S4HANA-DBS       │
│  [Node 2: SAP HANA Database]         │                                      │
│  * SLES 15 for SAP Applications      │  * Dedicated NUMA Node Allocation    │
│  * HANA 2.0 SPS07+ / SPS08           │  * Combined Shared Memory & Semaphors│
│  * saptune profile: HANA             │                                      │
└──────────────────────────────────────┴──────────────────────────────────────┘

Essential SAP Notes & Standards Matrix #

Before initiating any OS installation or software provisioning, verify compliance against the following mandatory SAP Notes:

2. System Registration, Packages & Kernel Patch Requirements #

Step 2.1: Register SLES Modules & Refresh Repositories #

SLES 15 uses a modular architecture. Ensure the following modules are registered and enabled via SUSE Customer Center (SCC) or your local SUSE Manager / RMT server:

# Verify registered extensions and modules
SUSEConnect --status-text

# Ensure mandatory modules are activated:
# - Basesystem Module 15
# - Server Applications Module 15
# - SAP Applications Module 15 (if running SLES for SAP Applications)
# - Desktop Applications Module 15 (optional, for X11/GUI SWPM)
# - Legacy Module 15 (required if deploying HANA 1.0 SPS12 or HANA 2.0 SPS03)

Refresh repository metadata:

zypper ref -s

Step 2.2: Install SUSE SAP Patterns #

SUSE provides bundled patterns that install all prerequisites, shared libraries, and tools:

# 1. On S/4HANA Application Server Node:
zypper install -y -t pattern sap-server

# 2. On SAP HANA Database Node:
# (Installs numactl, hardware tuning libraries, libaio, and saptune)
zypper install -y -t pattern sap-hana

Step 2.3: Mandatory Standalone Packages Checklist #

Install essential utility packages and compatibility libraries required by ABAP Kernel 7.93 and HANA 2.0:

zypper install -y \
  insserv-compat \
  libatomic1 \
  libaio1 \
  numactl \
  sysstat \
  uuidd \
  tcsh \
  glibc-locale \
  nfs-client \
  xfsprogs \
  parted \
  lvm2 \
  sysctl-logger \
  cpupower \
  chrony

[!IMPORTANT]
Why insserv-compat is mandatory (SAP Note 2578899): SLES 15 removed the classic SysVinit insserv binary. Standard SAP start/stop scripts (such as startsap, stopsap, and sapinit) still utilize LSB header inspection. Without insserv-compat, SAP instance registration during SWPM will throw fatal script execution errors.

Step 2.4: glibc Patch Requirement for AVX2 CPUs (SUSE TID 21026 / SAP Note 2684254) #

On x86_64 systems running SLES 15 SP3 and SP4 with the AVX2 CPU extension, older glibc versions contain a known regression that causes spontaneous crashes in the SAP HANA calculation engine and database indexserver.

1. Check if the CPU supports AVX2:

   lscpu | grep -i avx2
   

2. Check the installed glibc version:

   rpm -q glibc
   

3. If running SLES 15 SP3 or SP4, ensure glibc is upgraded to at least glibc-2.31-150300.46.1 or newer:

   zypper update -y glibc
   

Step 2.5: Special Hardware & Version Requirements #

• IBM Power (ppc64le): Upgrade the Linux kernel to version 4.12.14-150.14.2 or newer (SAP Note 2774105).
• Scale-out installations on SLES 15 SP1 / SP2: OpenSSH changed its default key format. Generate PEM-format keys using ssh-keygen -m PEM -q before distributing keys, or pass root_password directly to hdblcm.
• HANA 1.0 SPS12 or HANA 2.0 SPS03: Enable the Legacy Module and install libopenssl1_0_0 and libssh2-1.

3. Storage Engineering: Raw Disk Partitioning, LVM & XFS Filesystem Creation #

In real-world enterprise architectures, physical block devices (/dev/sdb, /dev/sdc, etc.) are illustrative assumptions. Disk mapping varies depending on whether you are deploying on Bare-Metal SAN storage, VMware vSphere VMDKs, or Public Cloud block storage (AWS EBS gp3/io2, Azure Premium SSD/Ultra Disk, Google Cloud Persistent Disk).

The power of Logical Volume Management (LVM) is that it decouples physical disks from operating system mount points: multiple Logical Volumes (LVs) can share a single underlying physical disk / Volume Group (VG), or conversely, multiple physical disks can be striped together into a single high-performance VG.

Golden Rule: Mount at Base Level — Never Hardcode the <SID> in /etc/fstab #

[!IMPORTANT]
SID-Agnostic Storage Architecture:
In standard SAP Basis administration, filesystems should never hardcode the SAP SID in /etc/fstab (do not mount /sapmnt/<SID>, /hana/data/<SID>, or /hana/log/<SID>).

Instead, mount directly at the base architectural root directories:

• Application Server: Mount directly to /usr/sap and /sapmnt.
• SAP HANA Database: Mount directly to /hana and /hana/log (with /usr/sap and swap sharing the primary HANA disk).

When the SAP installers (SWPM for S/4HANA Application Server and hdblcm for SAP HANA) execute, they will automatically create the requisite <SID> subdirectories (e.g. /sapmnt/<SID>, /hana/data/<SID>, /hana/log/<SID>, /hana/shared/<SID>). This completely decouples OS storage provisioning from SAP application sizing and lifecycle management.

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                   STREAMLINED BASE MOUNT STORAGE ARCHITECTURE                          │
├────────────────────────────────────────┬───────────────────────────────────────────────┤
│ S/4HANA APPLICATION SERVER NODE        │ SAP HANA DATABASE NODE                        │
│                                        │                                               │
│  [Shared App Disk: /dev/sdb]           │  [Main HANA Storage Pool: /dev/sdb]           │
│   └── vg_sap                           │   └── vg_hana                                 │
│       ├── lv_usrsap → /usr/sap         │       ├── lv_hana   → /hana                   │
│       ├── lv_sapmnt → /sapmnt          │       │   (Hosts /hana/data & /hana/shared)   │
│       └── lv_swap   → swap (32 GB)     │       ├── lv_usrsap → /usr/sap (Instance)     │
│                                        │       └── lv_swap   → swap (32 GB / 64 GB)    │
│  (Or /sapmnt mounted from central NFS) │                                               │
│                                        │  [Dedicated Redo Log Disk: /dev/sdc]          │
│                                        │   └── vg_hana_log                             │
│                                        │       └── lv_hana_log → /hana/log             │
│                                        │           (Strictly isolated <1ms write tier) │
└────────────────────────────────────────┴───────────────────────────────────────────────┘

The Critical Rule of /hana/log Isolation & Disk Consolidation #

• Why /hana/log Must ALWAYS Have Isolated, Low-Latency I/O:
  • Per SAP HANA TDI (Tailored Datacenter Integration) standards and SAP Note 1944799, redo log writing is synchronous and strictly latency-sensitive (target write latency < 1 ms).
  • If /hana/log shares a physical disk with /hana (which handles heavy asynchronous I/O during database savepoints, column loads, and delta merges), log flushes will stall. This creates database-wide bottlenecks, delays transaction commits, and causes user work processes to queue up.
  • Best Practice: In both on-premise and cloud environments, /hana/log should reside on its own dedicated physical LUN, NVMe drive, or high-IOPS Cloud storage tier (e.g., AWS EBS io2 or Azure Ultra Disk), mounted cleanly at /hana/log.
• Consolidation of /hana, /usr/sap (Instance), and Swap on the Primary Disk:
  • The main HANA disk (/dev/sdb) hosts vg_hana, from which /hana (data and shared), /usr/sap (instance profiles, Host Agent, and SAP binaries), and swap are carved out as separate Logical Volumes.
  • The database installer (hdblcm) automatically allocates /hana/data/<SID> and /hana/shared/<SID> as subdirectories under /hana.

Filesystem Mount Options & Deprecation Warning #

[!WARNING]
XFS nobarrier Deprecation in SLES 15 SP2+ (SAP Note 2684254 / SUSE TID 20240):
In older SLES releases (SLES 11/12), mounting XFS with nobarrier was common. Starting with SLES 15 SP2 (Linux Kernel 5.3+), the nobarrier and barrier mount options were completely removed from the upstream XFS kernel driver. Specifying nobarrier in /etc/fstab on SLES 15 SP2, SP3, SP4, SP5, or SP6 will cause mount failures or generate system errors.

The official recommended mount options on SLES 15 SP2+ are:

• For SAP HANA persistence (/hana and /hana/log): defaults,noatime,nodiratime,allocsize=64M 0 2
• For Application Server filesystems (/usr/sap and /sapmnt): defaults,noatime 0 2

Step 3.1: Discover Attached Block Devices #

Inspect all raw block devices attached to the host:

lsblk -o NAME,HCTL,SIZE,TYPE,FSTYPE,MOUNTPOINT

Example output on a 2-disk HANA host:

NAME   HCTL       SIZE TYPE FSTYPE MOUNTPOINT
sda    0:0:0:0    100G disk        (OS Root disk)
├─sda1              1G part vfat   /boot/efi
└─sda2             99G part btrfs  /
sdb    0:0:1:0    1.5T disk        (Attached primary disk for /hana, /usr/sap, and Swap)
sdc    0:0:2:0    250G disk        (Attached dedicated low-latency disk for /hana/log)

Step 3.2: Walkthrough - S/4HANA Application Server (/usr/sap & /sapmnt) #

In this standard layout, a single application disk /dev/sdb (e.g., 250 GB) is shared between /usr/sap, /sapmnt, and swap:

# 1. Partition the disk with GPT
parted -s /dev/sdb mklabel gpt mkpart primary 0% 100%
parted -s /dev/sdb set 1 lvm on

# 2. Create Physical Volume & Volume Group
pvcreate /dev/sdb1
vgcreate vg_sap /dev/sdb1

# 3. Carve out Logical Volumes from the shared Volume Group
# Allocate 60 GB for /usr/sap, 40 GB for /sapmnt, and 32 GB for swap
# (Leaves remaining space unallocated in vg_sap for online expansion!)
lvcreate -L 60G -n lv_usrsap vg_sap
lvcreate -L 40G -n lv_sapmnt vg_sap
lvcreate -L 32G -n lv_swap   vg_sap

# 4. Format filesystems with XFS and Swap
mkfs.xfs -f -K /dev/vg_sap/lv_usrsap
mkfs.xfs -f -K /dev/vg_sap/lv_sapmnt
mkswap /dev/vg_sap/lv_swap

# 5. Create base mount directories (No SID hardcoding!)
mkdir -p /usr/sap
mkdir -p /sapmnt

# 6. Retrieve filesystem UUIDs
blkid /dev/mapper/vg_sap-lv_usrsap
blkid /dev/mapper/vg_sap-lv_sapmnt
blkid /dev/mapper/vg_sap-lv_swap

Production /etc/fstab for Application Server #

# ==============================================================================
# S/4HANA Application Server Persistence (Base Mounts)
# ==============================================================================
UUID=<UUID-of-lv_usrsap>  /usr/sap  xfs   defaults,noatime  0 2
UUID=<UUID-of-lv_sapmnt>  /sapmnt   xfs   defaults,noatime  0 2
UUID=<UUID-of-lv_swap>    none      swap  defaults,pri=1    0 0

[!TIP]
Central NFS Alternative for /sapmnt: If /sapmnt is exported from a central NFS server or clustered ASCS instance across multiple dialog application servers (AAS), mount /sapmnt over NFS instead:

nfs-central:/sapmnt  /sapmnt  nfs  rw,vers=4.1,rsize=65536,wsize=65536,hard,timeo=600,intr,noatime  0 0

Step 3.3: Walkthrough - SAP HANA Database (/hana, /hana/log, /usr/sap, Swap) #

In this streamlined 2-disk production layout:

• Disk 1 (/dev/sdb, e.g. 1.5 TB NVMe/SSD): Primary HANA disk (vg_hana) hosting /hana (data & shared), /usr/sap (instance), and Swap.
• Disk 2 (/dev/sdc, 250 GB Low-Latency NVMe): Dedicated redo log disk (vg_hana_log) hosting /hana/log.

# 1. Partition raw disks with GPT
parted -s /dev/sdb mklabel gpt mkpart primary 0% 100% && parted -s /dev/sdb set 1 lvm on
parted -s /dev/sdc mklabel gpt mkpart primary 0% 100% && parted -s /dev/sdc set 1 lvm on

# 2. Create Physical Volumes
pvcreate /dev/sdb1 /dev/sdc1

# 3. Create Volume Groups
vgcreate vg_hana     /dev/sdb1   # Primary storage pool (hosts /hana, /usr/sap, swap)
vgcreate vg_hana_log /dev/sdc1   # Dedicated low-latency Redo Log pool

# 4. Create Logical Volumes from vg_hana (Disk 1)
# Allocate 1000 GB for /hana, 100 GB for /usr/sap, and 32 GB for swap
# (Leaves remaining unallocated space in vg_hana for online expansion!)
lvcreate -L 1000G -n lv_hana   vg_hana
lvcreate -L 100G  -n lv_usrsap vg_hana
lvcreate -L 32G   -n lv_swap   vg_hana

# Create Logical Volume from vg_hana_log (Disk 2 - Dedicated Log)
lvcreate -l 100%FREE -n lv_hana_log vg_hana_log

# 5. Format with XFS and Swap
mkfs.xfs -f -K /dev/vg_hana/lv_hana
mkfs.xfs -f -K /dev/vg_hana/lv_usrsap
mkfs.xfs -f -K /dev/vg_hana_log/lv_hana_log
mkswap /dev/vg_hana/lv_swap

# 6. Create base mount directories
mkdir -p /hana
mkdir -p /hana/log
mkdir -p /usr/sap

# 7. Check UUIDs
blkid /dev/mapper/vg_hana-lv_hana
blkid /dev/mapper/vg_hana-lv_usrsap
blkid /dev/mapper/vg_hana_log-lv_hana_log
blkid /dev/mapper/vg_hana-lv_swap

Production /etc/fstab for SAP HANA Database #

[!IMPORTANT]
Mount Sequence in /etc/fstab:
The parent filesystem /hana MUST be declared and mounted before /hana/log. During system boot, the kernel mounts entries sequentially; mounting /hana first guarantees that the mount point directory /hana/log exists and receives the dedicated log filesystem cleanly on top.

# ==============================================================================
# SAP HANA Database Persistence (Base Mounts: /hana and /hana/log)
# Note: 'nobarrier' is intentionally omitted per SAP Note 2684254 / SUSE TID 20240
# ==============================================================================
UUID=<UUID-of-lv_hana>      /hana      xfs  defaults,noatime,nodiratime,allocsize=64M  0 2
UUID=<UUID-of-lv_hana_log>  /hana/log  xfs  defaults,noatime,nodiratime,allocsize=64M  0 2
UUID=<UUID-of-lv_usrsap>    /usr/sap   xfs  defaults,noatime                           0 2
UUID=<UUID-of-lv_swap>      none       swap defaults,pri=1                             0 0

Activate & Verify Mounts #

mount -a
swapon -a
df -hT /hana /hana/log /usr/sap
free -h | grep -i swap

When you later run hdblcm to install SAP HANA, you point the installer to:

• Data path: /hana/data (which lives on the /hana filesystem)
• Log path: /hana/log (which lives on the dedicated /hana/log filesystem)
• Shared path: /hana/shared (which lives on the /hana filesystem)

hdblcm will automatically create /hana/data/<SID>, /hana/log/<SID>, and /hana/shared/<SID> with correct <sid>adm:sapsys ownership and permissions without requiring any changes to /etc/fstab.

Step 3.4: Dynamic Online Volume Expansion with LVM & XFS #

One of the greatest operational benefits of LVM and XFS is the ability to grow filesystems online without stopping SAP:

# Example: Adding 50 GB to /usr/sap (from available space in vg_sap or vg_hana)
lvextend -L +50G /dev/vg_hana/lv_usrsap

# Expand the XFS filesystem on the fly
xfs_growfs /usr/sap

# Verify expanded capacity
df -hT /usr/sap

4. Automated OS Tuning with saptune v3 (The Recommended SUSE Standard) #

Per SAP Note 1275776 and SAP Note 2684254, saptune v3 is the official, certified configuration framework for SLES 15. It orchestrates sysctl parameters, IPC limits, page cache governors, and elevator schedulers according to official SAP release notes.

┌─────────────────────────────────────────────────────────────────────────────┐
│                       SAPTUNE V3 ORCHESTRATION PIPELINE                     │
├─────────────────────────────────────────────────────────────────────────────┤
│  1. Profile Selection        → saptune solution apply S4HANA-APP (or HANA)  │
│  2. Note-Specific Overrides  → saptune note apply 2684254                   │
│  3. Daemon Enforcement       → Prevents runtime configuration drift         │
│  4. Compliance Verification  → saptune solution verify                      │
└─────────────────────────────────────────────────────────────────────────────┘

Step 4.1: Initialize and Enable Saptune Daemon #

# Enable and start the saptune background service
saptune service enablestart

# Verify that the daemon is actively running
saptune daemon status

Step 4.2: Apply Dedicated SAP Solutions #

Apply the solution corresponding to your system role:

# Option A: For S/4HANA Application Server Node
saptune solution apply S4HANA-APP

# Option B: For Dedicated SAP HANA Database Node
saptune solution apply HANA

# Option C: For Combined Single-Box Appliance (App + DB on same host)
saptune solution apply S4HANA-DBS

Step 4.3: Apply Individual Official SAP Notes #

In addition to solutions, apply specific SAP Notes directly to enforce release-specific tuning:

# Apply HANA DB Recommended OS settings (SAP Note 2684254)
saptune note apply 2684254

# Apply SLES 15 Installation Notes (SAP Note 2578899)
saptune note apply 2578899

# Apply Timer Fallback / Clock Settings (SAP Note 2796692)
saptune note apply 2796692

# Apply SLES Preparation Baseline (SAP Note 1275776)
saptune note apply 1275776

Step 4.4: Verify Solution & Note Compliance #

Run the verification engine to validate that every OS setting strictly matches SAP engineering baselines:

# Verify active solution compliance
saptune solution verify

# Verify individual note compliance
saptune note verify 2684254

If any parameter reports not compliant due to manual overrides or conflicts, enforce compliance with:

saptune solution apply $(saptune solution enabled)

5. Kernel, GRUB & Bootloader Parameters Deep Dive #

While saptune adjusts dynamic sysctl values, low-level CPU power states, NUMA balancing, and huge page behavior must be configured at the bootloader level.

Step 5.1: Critical Bootloader Parameters Breakdown #

Edit /etc/default/grub and locate GRUB_CMDLINE_LINUX_DEFAULT. Ensure the following parameters are appended:

numa_balancing=disable intel_idle.max_cstate=1 processor.max_cstate=1 tsx=auto

┌──────────────────────────────┬───────────────────────────────────────────────────────────────────────────┐
│ PARAMETER                    │ TECHNICAL RATIONALE & SAP NOTE MAPPING                                    │
├──────────────────────────────┼───────────────────────────────────────────────────────────────────────────┤
│ numa_balancing=disable       │ SAP Note 2684254: HANA manages its own NUMA memory placement. Kernel      │
│                              │ autoNUMA causes unexpected CPU stalls, memory migration overhead, and     │
│                              │ transaction latency spikes.                                              │
├──────────────────────────────┼───────────────────────────────────────────────────────────────────────────┤
│ intel_idle.max_cstate=1      │ Disables deep CPU C-states (C2, C3, C6). Prevents latency penalties       │
│ processor.max_cstate=1       │ when CPU cores wake from sleep states during transactional bursts.        │
├──────────────────────────────┼───────────────────────────────────────────────────────────────────────────┤
│ tsx=auto                     │ SLES 15 SP6+: Intel TSX defaults to disabled. Setting tsx=auto enables     │
│                              │ hardware transactional synchronization where supported by Intel Xeon CPUs.│
└──────────────────────────────┴───────────────────────────────────────────────────────────────────────────┘

Step 5.2: Transparent Huge Pages (THP) Configuration #

[!IMPORTANT]
THP Policy Difference: SLES 15 SP5+ vs Older Service Packs (SAP Note 2684254 & Note 2131662)

• SLES 15 SP < SP5: Transparent Huge Pages MUST BE COMPLETELY DISABLED (never).
• SLES 15 SP5 and SLES 15 SP6: Configure THP to madvise. SAP HANA 2.0 SPS07+ takes advantage of explicitly advised huge pages for specific heap allocators without global fragmentation risks.

Multi-NUMA Alert (SUSE TID 22286): On early SLES 15 SP5 kernels running on multi-socket NUMA hardware, a kernel bug with madvise could trigger hangs. Ensure your SLES 15 SP5 kernel is updated to the latest maintenance release.

For SLES 15 SP < SP5: #

Append to GRUB_CMDLINE_LINUX_DEFAULT:

transparent_hugepage=never

For SLES 15 SP5 and SP6: #

Append to GRUB_CMDLINE_LINUX_DEFAULT:

transparent_hugepage=madvise

Step 5.3: Rebuild GRUB Boot Configuration #

Apply the new kernel parameters permanently:

# On UEFI-based systems (Standard for modern enterprise servers):
grub2-mkconfig -o /boot/grub2/grub.cfg

# Verify configuration in generated grub.cfg
grep -i "numa_balancing" /boot/grub2/grub.cfg

Step 5.4: CPU Governor & Energy Performance Bias #

Enforce the maximum performance CPU governor:

# Set CPU scaling governor to performance across all cores
cpupower frequency-set -g performance

# Set Energy Performance Bias (EPB) to maximum performance (profile 0)
cpupower set -b 0

Verify with:

cpupower frequency-info

6. Systemd Hardening & Process Boundaries #

In modern Linux distributions running systemd, default session and service management policies can terminate SAP background processes or limit threading capacity unless hardened.

Step 6.1: Disable IPC Removal on User Logout (RemoveIPC=no) #

Per SAP Note 2369910, when <sid>adm logs out of an SSH session, systemd-logind by default purges all Inter-Process Communication (IPC) objects and shared memory segments allocated by that user. This immediately crashes the SAP system with internal memory allocation faults.

Edit /etc/systemd/logind.conf:

[Login]
# Mandatory: Prevent systemd from purging SAP shared memory segments
RemoveIPC=no

Apply immediately without server reboot:

systemctl daemon-reload
systemctl restart systemd-logind

Step 6.2: Prevent Thread Exhaustion (UserTasksMax=infinity) #

In SLES 15 and SLES 15 SP1 running systemd versions older than 234-24.42.1, user slices were limited to 12,288 threads by default (UserTasksMax). Large SAP systems running hundreds of work processes and HANA indexservers exceed this threshold quickly.

1. In modern SLES 15 (SP2 through SP6), systemd defaults UserTasksMax to infinity.
2. Delete obsolete drop-in override files if present:

   rm -f /etc/systemd/logind.conf.d/sap.conf
   

3. Ensure /etc/systemd/system.conf and /etc/systemd/logind.conf enforce unlimited tasks:

   # /etc/systemd/system.conf
   [Manager]
   DefaultTasksMax=infinity
   
   # /etc/systemd/logind.conf
   [Login]
   UserTasksMax=infinity
   

   Reload systemd:

   systemctl daemon-reexec
   

Step 6.3: Exclude SAP Sockets from systemd-tmpfiles-clean #

Systemd periodically purges temporary directories. Prevent automated cleanup from destroying SAP communication sockets by creating /etc/tmpfiles.d/sap.conf:

# /etc/tmpfiles.d/sap.conf
# Exclude SAP IPC domain sockets and locks from automatic deletion
x /tmp/.sap*
x /tmp/.hdb*

Apply immediately:

systemd-tmpfiles --create /etc/tmpfiles.d/sap.conf

Step 6.4: Activate Essential System Daemons #

Enable and start required background services:

# 1. UUID Daemon (SAP Note 1928088): Mandatory for unique RFC/LUW generation
systemctl enable --now uuidd.socket
systemctl enable --now uuidd.service

# 2. Sysstat SAR monitoring (Historical performance telemetry)
systemctl enable --now sysstat.service

# 3. Sysctl Logger (Logs unauthorized kernel parameter changes to syslog)
systemctl enable --now sysctl-logger.service

Validate uuidd operation:

uuidd -p
# Target output: uuidd daemon is alive!

7. Network, Memory & Sysctl Parameters Deep Dive #

When not managed exclusively by saptune, ensure /etc/sysctl.d/99-sap.conf and /etc/security/limits.d/99-sap.conf contain the following certified parameters.

Step 7.1: Kernel & Memory Configuration (/etc/sysctl.d/99-sap.conf) #

# /etc/sysctl.d/99-sap.conf

# ==============================================================================
# Process & Thread Limits (SAP Note 2684254 / S/4HANA 2023)
# ==============================================================================
# Prevent 32-bit PID wrap-around under heavy process cycling
kernel.pid_max = 4194304

# System-wide file descriptor limit
fs.file-max = 20000000

# Inter-Process Communication Semaphores (semmsl semmns semopm semmni)
kernel.sem = 1250 256000 100 8192

# Maximum Virtual Memory Areas (VMA) per process (Crucial for HANA and Kernel 7.93)
vm.max_map_count = 2147483648

# ==============================================================================
# Pagecache Management (SLES 15 SAP Note 2684254)
# ==============================================================================
# Prevents excessive Linux file caching from choking SAP database memory
vm.pagecache_limit_ignore_dirty = 0

# ==============================================================================
# Ephemeral Port Range & Network Tuning (SAP Note 2578899)
# ==============================================================================
# Protect SAP instance ports (3200-3399, 4800-4899, 50000+) from ephemeral collision
net.ipv4.ip_local_port_range = 40000 60999

# Socket queue backlogs for high concurrency
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_tw_reuse = 1

# ==============================================================================
# Core Dumps & Diagnostic Handling
# ==============================================================================
# Enable core dumps for setuid processes (SAP work processes run with sidadm privileges)
fs.suid_dumpable = 2
kernel.core_pattern = /var/log/cores/core.%e.%p.%t

Load parameters:

sysctl --system

Step 7.2: User Resource Limits (/etc/security/limits.d/99-sap.conf) #

Configure PAM user limits for SAP administrative users (@sapsys, <sid>adm):

# /etc/security/limits.d/99-sap.conf
@sapsys          hard    nofile          1048576
@sapsys          soft    nofile          1048576
@sapsys          hard    nproc           unlimited
@sapsys          soft    nproc           unlimited
@sapsys          hard    memlock         unlimited
@sapsys          soft    memlock         unlimited
@sapsys          hard    stack           unlimited
@sapsys          soft    stack           unlimited

# Default fallback for administrative accounts
*                soft    nofile          1048576
*                hard    nofile          1048576

8. Time Synchronization (Chrony) & Preventing HANA Timer Crash #

The TimerFallbackEvent Crash Risk (SAP Note 2796692) #

SAP HANA uses a high-resolution, monotonic CPU hardware clock (clock_gettime(CLOCK_MONOTONIC)). In environments where the system clock experiences unstable time sources, backward step adjustments, or missing NTP synchronization, HANA encounters TimerFallbackEvent:

[12452]{-1}[-1/-1] 2026-10-12 14:10:05.123456 e Timer  TimerFallbackEvent.cpp(00045) : 
TimerFallbackEvent: timer drifted by 350 ms; fallback timer activated

If time drift continues or sudden time steps occur during transactional savepoints, SAP HANA will terminate the indexserver with an internal watchdog crash to prevent database catalog corruption.

Production chrony Setup on SLES 15 #

Edit /etc/chrony.conf:

# Reference enterprise NTP servers with low stratum
server ntp1.corp.internal iburst minpoll 4 maxpoll 6
server ntp2.corp.internal iburst minpoll 4 maxpoll 6

# Allow stepping the clock only during the first 3 updates
makestep 1 3

# Update the Real Time Clock (hardware clock) automatically
rtcsync

# Log tracking measurements
logdir /var/log/chrony
log measurements statistics tracking

Enable and start Chrony:

systemctl enable --now chronyd

Verify synchronization:

# Check tracking status and stratum offset
chronyc tracking

# Check active peer sources
chronyc sources -v

[!TIP]
Ensure System time offset is less than 10 milliseconds and Leap status reports Normal.

9. Hostname Resolution & Identity Rules #

SAP NetWeaver and HANA rely strictly on deterministic forward and reverse name resolution:

• Never map the host's actual hostname or FQDN to 127.0.0.1 or 127.0.0.2.
• 127.0.0.1 must resolve strictly to localhost.
• Map the primary network interface IP to the FQDN and short hostname in /etc/hosts:

# /etc/hosts
127.0.0.1       localhost
::1             localhost ipv6-localhost ipv6-loopback

# SAP System Landscape Mapping
10.20.10.50     s4app01.corp.internal s4app01
10.20.10.51     s4hana01.corp.internal s4hana01

Verify:

hostname
hostname -f
getent hosts $(hostname -f)

10. Automated Pre-Flight Verification Script #

Execute this complete bash verification script as root before running SWPM or hdblcm:

#!/bin/bash
# ==============================================================================
# SLES 15 Pre-Flight Verification Script for SAP S/4HANA 2023 & HANA 2.0
# ==============================================================================

echo "============================================================"
echo " 1. Operating System & Kernel Information"
echo "============================================================"
cat /etc/os-release | grep -E "PRETTY_NAME|VERSION="
uname -r

echo -e "\n============================================================"
echo " 2. AVX2 Extension & glibc Check (SAP Note 2684254)"
echo "============================================================"
if lscpu | grep -qi avx2; then
    echo "[OK] CPU supports AVX2 extension."
    rpm -q glibc
else
    echo "[INFO] CPU does not report AVX2."
fi

echo -e "\n============================================================"
echo " 3. saptune Solution & Daemon Compliance"
echo "============================================================"
saptune daemon status
saptune solution verify

echo -e "\n============================================================"
echo " 4. Bootloader Parameters (autoNUMA, C-States, TSX)"
echo "============================================================"
cat /proc/cmdline | tr " " "\n" | grep -E "numa_balancing|cstate|tsx|transparent_hugepage"

echo -e "\n============================================================"
echo " 5. Transparent Huge Pages (THP) Status"
echo "============================================================"
echo -n "Current THP Mode: "
cat /sys/kernel/mm/transparent_hugepage/enabled

echo -e "\n============================================================"
echo " 6. Systemd Hardening (RemoveIPC & UserTasksMax)"
echo "============================================================"
echo -n "RemoveIPC: "
grep -E "^RemoveIPC" /etc/systemd/logind.conf || echo "Not explicitly configured!"
echo -n "Active TasksMax: "
systemctl show --property=DefaultTasksMax

echo -e "\n============================================================"
echo " 7. Mandatory Services (uuidd, chronyd, sysctl-logger)"
echo "============================================================"
for s in uuidd.socket chronyd sysctl-logger sysstat; do
    printf "%-20s: %s\n" "$s" "$(systemctl is-active $s)"
done
uuidd -p

echo -e "\n============================================================"
echo " 8. Critical Kernel Sysctl Values"
echo "============================================================"
sysctl vm.max_map_count
sysctl kernel.pid_max
sysctl kernel.sem
sysctl net.ipv4.ip_local_port_range

echo -e "\n============================================================"
echo " 9. Filesystem & Mount Options Check (/etc/fstab)"
echo "============================================================"
grep -E "hana|sap" /etc/fstab | grep -v "^#"
echo -e "\nActive XFS Mounts:"
mount | grep xfs | grep -E "hana|sap"

echo -e "\n============================================================"
echo " 10. Memory & Swap Sizing (SAP Note 1597355)"
echo "============================================================"
free -h

11. Operational Troubleshooting & Common Gotchas Matrix #

┌──────────────────────────────────────┬──────────────────────────────────────────┬────────────────────────────────────────────────────────┐
│ SYMPTOM / ERROR                      │ ROOT CAUSE                               │ BASIS RESOLUTION                                       │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ SAP instance crashes immediately     │ systemd default RemoveIPC=yes purged     │ Set RemoveIPC=no in /etc/systemd/logind.conf and       │
│ when administrator logs out of SSH   │ shared memory segments (SAP Note 2369910)│ restart systemd-logind via systemctl.                  │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ ST22 dump RFC_ERROR_PROGRAM or       │ uuidd daemon is stopped or socket is     │ Execute: systemctl enable --now uuidd.socket           │
│ "Cannot create UUID" during runtime  │ inactive (SAP Note 1928088).             │ Validate with: uuidd -p.                               │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ HANA indexserver crashes during      │ Clock drift triggered fatal              │ Configure chrony with low-stratum NTP server and       │
│ savepoint with TimerFallbackEvent    │ TimerFallbackEvent (SAP Note 2796692).   │ ensure chronyc tracking shows offset < 10ms.           │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ XFS mount fails on SLES 15 SP2+ with │ Deprecated 'nobarrier' mount option used │ Remove 'nobarrier' from /etc/fstab. Use certified:     │
│ "unknown mount option" error         │ in /etc/fstab (SUSE TID 20240).          │ defaults,noatime,nodiratime,allocsize=64M.             │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ SWPM fails during SAP start/stop     │ Missing insserv binary in SLES 15        │ Install compatibility package:                         │
│ script execution with LSB error      │ (SAP Note 2578899).                      │ zypper install -y insserv-compat.                      │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ Calculation Engine crashes on        │ Bug in older glibc on AVX2 CPUs          │ Upgrade glibc to >= glibc-2.31-150300.46.1            │
│ SLES 15 SP3/SP4 with SIGSEGV         │ (SUSE TID 21026 / SAP Note 2684254).     │ via zypper update glibc.                               │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ Gateway port 3300 or 3200 cannot     │ Ephemeral port range default overlaps    │ Set net.ipv4.ip_local_port_range = 40000 60999 in      │
│ bind due to "Address already in use" │ with standard SAP port ranges.           │ /etc/sysctl.d/99-sap.conf and reload sysctl.           │
├──────────────────────────────────────┼──────────────────────────────────────────┼────────────────────────────────────────────────────────┤
│ Work processes killed silently with  │ systemd DefaultTasksMax / UserTasksMax   │ Set UserTasksMax=infinity and DefaultTasksMax=infinity │
│ exit code 137 / SIGKILL              │ hit max thread threshold.                │ in systemd configuration files.                        │
└──────────────────────────────────────┴──────────────────────────────────────────┴────────────────────────────────────────────────────────┘