# AWS Backint Agent for SAP ASE AWS Backint Agent for SAP ASE AWS Backint Agent for SAP ASE is a backup and restore application for SAP ASE relational database management systems (RDBMS) running on Amazon EC2 instances. AWS Backint Agent runs as a standalone application that integrates with your existing workflows to back up your SAP ASE database to Amazon S3. AWS Backint Agent runs on the SAP ASE database instance, where backups and transaction logs are transferred from SAP ASE to AWS Backint agent. Based on the configurations in your agent file, AWS Backint agent stores your files in Amazon S3. To restore your SAP ASE database, specify the backup location Amazon S3. **Topics** + [ ## How AWS Backint Agent for SAP ASE works ](#ase-backint-how-it-works) + [ ## Architecture Components ](#ase-backint-architecture) + [ ## Workflow ](#ase-backint-workflow) + [ ## Pricing ](#ase-backint-pricing) + [ ## Supported Database Versions ](#ase-backint-database-versions) + [ ## Supported Operating Systems ](#ase-backint-operating-systems) + [ ## Supported AWS Regions ](#ase-backint-regions) + [ # Prerequisites ](ase-backint-preprequisites.md) + [ # Installation ](ase-backint-install.md) + [ # Backup and Restore ](ase-backint-dump-load.md) + [ # Troubleshooting ](ase-backint-troubleshooting.md) + [ # Version history ](aws-backint-agent-ase-version-history.md) ## How AWS Backint Agent for SAP ASE works AWS Backint Agent for SAP ASE is built on the same foundation as the AWS Backint Agent for SAP HANA and provides a similar experience and capabilities. AWS Backint Agent implements the SAP ASE Backup Server Archive API. DUMP and LOAD commands can be initiated via, for example, the SAP ASE command line interface. ## Architecture Components Architecture components include the SAP ASE database, SAP ASE backup server, AWS Backint Agent (for ASE), and an implementation of the ASE backup server archive API for AWS Backint Agent. ### SAP ASE Backup Server SAP ASE backup server is a component of the SAP ASE database system that manages database backup and restore operations. It’s a separate process that runs alongside the main database server and is specifically designed to handle the movement of data during backup and recovery operations. ### Backup Server Archive API The SAP ASE Backup Server API provides an interface for third-party applications to integrate with ASE’s backup and recovery operations. This API enables communication between the ASE database engine and external storage systems, allowing for efficient backup and restore operations without requiring intermediate storage. ### AWS Backint Agent Backint Agent is responsible for streaming backup-related data to and from the destination in Amazon S3. The agent Backint Agent is largely independent of the database management system. ## Workflow SAP ASE database, SAP ASE backup server, AWS Backint Agent for ASE and AWS Backint Agent API are installed on a single EC2 instance. 1. Administrator initiates backup or restore via methods, which are native to SAP ASE. For example, a database statement via isql. 1. The **SAP ASE database** reads data pages from database devices and transfers these pages to the Backup Server through the IPC channel. 1. **Backup Server** opens byte-streams (one per stripe) and invokes Backint-specific implementation of the Archive API (Backint Archive API). 1. **Archive API** handles communication between Backup Server and AWS Backint Agent. 1. **Backint Agent** streams data to (backup) and from (restore) **Amazon S3**. ![\[Backint for ASE Architecture\]](http://docs.aws.amazon.com/sap/latest/sap-AnyDB/images/ase-backint-architecture.png) ## Pricing AWS Backint agent is free of charge. You pay only for the underlying AWS services that you use, for example Amazon S3. See [Amazon S3](https://aws.amazon.com/s3/pricing/) pricing for more information. ## Supported Database Versions AWS Backint agent for SAP ASE supports the following SAP ASE database versions. + SAP ASE 16.0 + SAP ASE 16.1 Please note that only SAP ASE databases on Amazon EC2 are supported. ## Supported Operating Systems AWS Backint agent is supported on the following operating systems. + SUSE Linux Enterprise Server + SUSE Linux Enterprise Server for SAP + Red Hat Enterprise Linux for SAP All major and minor versions that are currently supported for SAP ASE are supported. Please refer to the SAP Product Availability Matrix (PAM) at [support.sap.com/pam](http://support.sap.com/pam) for more information. ## Supported AWS Regions AWS Backint agent is available in all commercial Regions. China (Beijing), China (Ningxia), and GovCloud are not supported. # Prerequisites Prerequisites This section provides information on mandatory prerequisites for AWS Backint Agent for SAP ASE. **Topics** + [ ## AWS Identity and Access Management (IAM) ](#ase-backint-iam) + [ ## Amazon S3 Bucket ](#ase-backint-s3-bucket) ## AWS Identity and Access Management (IAM) To enable S3 bucket access for your Amazon EC2 instance, create or update an inline IAM policy with the following permissions and attach it to your EC2 service role. Replace the resource names, such as the S3 bucket name, to match your setup. You must provide the AWS Region and Amazon S3 bucket owner account ID along with the Amazon S3 bucket name and KMS Key for Encryption. ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketPolicyStatus", "s3:GetBucketLocation", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::your-bucket-name/*", "arn:aws:s3:::your-bucket-name" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id" }, { "Effect": "Allow", "Action": [ "s3:PutObjectTagging", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::your-bucket-name/your-folder-name/*" } ] } ``` **Note** If you want to allow cross-account backup and restore, you must add your account details under a principal element in your policy. For more information about principal policies, see [AWS JSON Policy Elements: Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in the * AWS Identity and Access Management User Guide*. In addition, you must ensure that the S3 bucket policies allow your account to perform the actions specified in the IAM policy example above. For more information, see the example for [Bucket owner granting cross-account bucket permissions](https://docs.aws.amazon.com/AmazonS3/latest/dev/example-walkthroughs-managing-access-example2.html) in the *Amazon S3 Developer Guide*. For more information about managed and inline policies, see the [IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html). ## Amazon S3 Bucket In preparation for installation of the AWS Backint agent, identify or create an S3 bucket in the target Region where SAP ASE backups will be stored. The bucket must have been created after May 2019 in order to be compatible with AWS Backint agent and must have public access blocked, as backups will fail if public access is enabled. AWS Backint agent supports backing up to Amazon S3 with VPC endpoints. Using an Amazon S3 gateway endpoint can improve performance, help prevent timeouts, enhance security, and reduce costs. For more information, see [VPC Endpoints](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html). ### S3 storage classes AWS Backint agent supports storing SAP ASE database backups in S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Intelligent-Tiering storage classes. By default, backups use the S3 Standard storage class, but this can be changed through the AWS Backint agent configuration file, [S3 Lifecycle rules](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lifecycle-mgmt.html), or directly via APIs. AWS Backint Agent for SAP ASE does not support the following storage classes: . Reduced Redundancy . Deep Archive . Glacier While S3 Intelligent-Tiering can automatically move objects to archival tiers, AWS Backint agent requires objects to be in standard access tiers for recovery or deletion operations. For more information, see [Amazon S3 Storage Classes](https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-class-intro.html) in the *Amazon S3 Developer Guide*. ### Encryption AWS Backint agent supports encrypting your SAP ASE backup files while storing them in Amazon S3, using server-side encryption with AWS Key Management Service (KMS). You can encrypt your backups with an AWS managed key (aws/s3) or you can use your own customer managed key stored in AWS KMS. To encrypt your backup files with AWS KMS keys (AWS managed or customer managed), you must provide the KMS key ARN during installation or update the AWS Backint agent configuration file later. To learn more about encrypting your S3 objects using AWS KMS, see [How Amazon S3 uses AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/services-s3.html) in the * AWS Key Management Service Developer Guide*. Alternatively, you can enable default encryption for your Amazon S3 bucket using either AWS KMS keys or keys managed by Amazon S3 (SSE-S3). To learn more about enabling default encryption for your bucket, see [How do I enable default encryption for an Amazon S3 bucket?](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/default-bucket-encryption.html) in the *Amazon S3 Console User Guide*. ### Object locking You can store objects using a *write-once-read-many* (WORM) model with S3 Object Lock. Use S3 Object Lock if you want to prevent your SAP ASE backup files from being accidentally deleted or overwritten for a specific time period or indefinitely. If S3 Object Lock is enabled, you can’t delete your SAP ASE backups stored in Amazon S3 using SAP ASE Cockpit, SAP ASE Studio, or SQL commands until the retention period expires. To learn about S3 Object Lock, see [Locking objects using S3 Object Lock](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html) in the *Amazon S3 Developer Guide*. ### Object tagging By default, AWS Backint agent adds a tag called ` AWSBackintAgentVersion` when it stores your SAP ASE backup files in your S3 bucket. This tag helps to identify the AWS Backint version and the SAP ASE version used when backing up your SAP ASE database. You can [list the value of the tags from S3 console](https://docs.aws.amazon.com/AmazonS3/latest/user-guide/view-object-properties.html) or [using APIs](https://docs.aws.amazon.com/AmazonS3/latest/dev/object-tagging.html). To disable default tagging, modify the AWS Backint agent configuration file. See [Additional Parameters](ase-backint-install.md#ase-backint-additional-parameters) for more information. ### Data perimeter AWS Backint Agent must be installed on your Amazon EC2 instance. To download the installation binary, your EC2 instance needs access to the AWS-managed S3 buckets where the installer packages are hosted. If your organization uses data perimeter policies to control access to Amazon S3 in your environment, you might need to explicitly allow these service-owned buckets so that the EC2 instance can retrieve the required installer. The following policy shows an example Service control policy to permit access to service-owned resources through the resource perimeter, relevant service owned buckets are listed in the NotResource element of the policy. ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EnforceResourcePerimeterAWSResources", "Effect": "Deny", "Action": "*", "NotResource": [ "arn:aws:s3:::awssap-backint-agent-ase", "arn:aws:s3:::awssap-backint-agent-ase/*" ], "Condition": { "StringNotEqualsIfExists": { "aws:ResourceOrgID": "", "aws:PrincipalTag/dp:exclude:resource": "true" } } } ] } ``` The following policy shows an example VPC endpoint policy allowing access to specific service-owned resources through a VPC endpoint. Relevant service owned buckets are listed in the Resource element of the statement. ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "AllowRequestsToAWSOwnedResources", "Effect": "Allow", "Principal": "*", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::awssap-backint-agent-ase", "arn:aws:s3:::awssap-backint-agent-ase/*" ] } ] } ``` ### AWS Command Line Interface (CLI) AWS Backint agent installation leverages the AWS CLI to validate S3 bucket properties. To install or update to the AWS CLI, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html). # Installation Installation This section provides information to help you install the AWS Backint agent using the AWS Backint for SAP ASE installer. It also provides information to help you configure the agent, view logs, and get the current agent version. **Topics** + [ ## Backint for SAP ASE Installer ](#ase-backint-installer) + [ ## Verify Authenticity before Installation ](#ase-backint-verify-authenticity) + [ ## Configuration ](#ase-backint-configuration) ## Backint for SAP ASE Installer Backint for SAP ASE Installer AWS Backint Installer (`install-aws-backint-agent-ase`) is the recommended method for installing AWS Backint Agent for ASE on an Amazon EC2 instance running SAP ASE. 1. Download `install-aws-backint-agent-ase` from Amazon S3. ``` wget https://s3.amazonaws.com/awssap-backint-agent-ase/binary/latest/install-aws-backint-agent-ase ``` 1. Verify authenticity of installer. (See section [Verify Authenticity before Installation](#ase-backint-verify-authenticity)) 1. Start installation by running installer as `root`. The Installer installs AWS Backint Agent in a central directory (`/sybase/shared/aws-backint-agent-ase`). In addition, symbolic links are created at a database-specific location (e.g., `/sybase/AWS/lib`). This allows multiple instances of SAP ASE running on the same Amazon EC2 instance to use AWS Backint Agent. **Installation logs** are written to `install_aws_backint_YYYYMMDD_HHMMSS.log` in the current working directory. ### Interactive Mode Interactive Mode Interactive mode provides a guided installation experience. You are asked to provide each configuration value before the installation starts. ``` ./install-aws-backint-agent-ase ``` ### Silent Mode Silent Mode Silent mode allows for unattended installation without user interaction. It requires a response file - either created manually, or by running the installer in interactive mode and selecting "Create Response File". ``` ./install-aws-backint-agent-ase \ --mode silent \ --config-file install-aws-backint-agent-ase-response.rsp ``` #### Example: Response File Response File ``` [DEFAULT] s3_bucket = my-s3-bucket s3_bucket_folder = my-backup-folder s3_sse_kms_arn = arn:aws:kms:us-east-1:111122223333:key/1abcd9b9-ab12-1a2a-1abc-12345abc12a3 s3_sse_kms_enabled = True aws_account_id = 111122223333 aws_region = us-east-1 sid = AWS installation_directory = /sybase/shared binary_location = aws-backint-agent-ase.rpm verify_agent_binary = True create_response_file = True install_action = install ``` ### Upgrade Upgrade The installer supports upgrading an existing installation of AWS Backint Agent for SAP ASE. Follow the same steps as in the previous section. The installer will detect that the currently installed version is lower and perform the upgrade. In case of issues with the upgrade process, uninstall the existing installation first. ### Uninstall Uninstall In case you want to uninstall AWS Backint Agent for SAP ASE. 1. Remove the RPM package using the RPM package manager. ``` rpm -e aws-backint-agent-ase ``` 1. Remove the Installation directory. ``` rm -r /sybase/shared/aws-backint-agent-ase ``` 1. Remove stale symbolic links in database installation directory. ``` find /lib -type l -xtype l -delete ``` ## Verify Authenticity before Installation Verify Authenticity Files for installing AWS Backint Agent for SAP ASE - the installer (`install-aws-backint-agent-ase`) and the RPM package (`aws-backint-agent-ase.rpm`) - support signature verification. Use the AWS Backint public key to verify that the downloaded files are original and unmodified. ### Verify Installer Verify Installer 1. Download public key ``` > wget https://s3.amazonaws.com/awssap-backint-agent/binary/public-key/aws-backint-agent.gpg ``` 1. Import public key into your GPG keyring ``` > gpg --import aws-backint-agent.gpg gpg: key 1E65925B: public key "AWS Backint Agent" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1) ``` Make a note of the key value, as you will need it in the next step. In the preceding example, the key value is 1E65925B. 1. Verify fingerprint ``` > gpg --fingerprint 1E65925B pub 2048R/1E65925B 2020-03-18 Key fingerprint = BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B uid [ unknown] AWS Backint Agent ``` The fingerprint should be equal to the following: ``` BD35 7A5F 1AE9 38A0 213A 82A8 80D8 5C5E 1E65 925B ``` **Note** If the fingerprint string doesn’t match, don’t install the agent. Contact Amazon Web Services. 1. Download the signature file `install-aws-backint-agent-ase.sig` of the installer. ``` > wget https://s3.amazonaws.com/awssap-backint-agent-ase/binary/latest/install-aws-backint-agent-ase.sig ``` 1. Verify installer (`install-aws-backint-agent-ase`) and signature (`install-aws-backint-agent-ase.sig`). ``` > gpg --verify \ install-aws-backint-agent-ase.sig \ install-aws-backint-agent-ase ``` **Note** If the output includes the phrase BAD signature, check whether you performed the procedure correctly. If you continue to get this response, contact Amazon Web Services and avoid using the downloaded files. ### Verify RPM package Verify RPM By default, the installer verifies the signature of the RPM package automatically before installation. Installation fails if the authenticity of the RPM package - downloaded automatically or manually - fails. Follow the instructions below to verify the signature manually. 1. Import GPG key into RPM database. ``` > rpm --import aws-backint-agent.gpg ``` 1. Verify the signature. ``` > rpm -Kv aws-backint-agent-ase.rpm aws-backint-agent-ase.rpm: Header V3 RSA/SHA1 Signature, key ID 1e65925b: OK Header SHA1 digest: OK V3 RSA/SHA1 Signature, key ID 1e65925b: OK MD5 digest: OK ``` **Note** If the command fails (return code \$1= 0) or the key ID does not match the key ID of the GPG public key, do not install the RPM package. Contact Amazon Web Services. ## Configuration Configuration Installing AWS Backint Agent for SAP ASE with the installer creates a configuration file automatically. The configuration file is located at `/sybase/shared/aws-backint-agent-ase/aws-backint-agent-config.yaml`. The following tables summarize the configuration parameters added as part of the AWS Backint agent installation process. ### Default Parameters | Parameter | Description | | --- | --- | | `S3BucketAwsRegion` | AWS Region of your Amazon S3 bucket. For example, `us-east-1``. | | `S3BucketName` | Name of the Amazon S3 bucket, where you want to store your SAP ASE backup files. For example, `amzon-s3-demo-bucket`. | | `S3BucketFolder` | Name of the folder in the Amazon S3 bucket, where you want to store your SAP ASE backup files. For example, `my-folder`. | | `S3BucketOwnerAccountID` | 12-digit AWS account ID of the Amazon S3 bucket owner. For example, `111122223333` | | `S3SseEnabled` | Specifies whether AWS KMS encryption is enabled. | | `S3SseKmsArn` | ARN of the kms-key that AWS Backint agent can use to encrypt the backup files stored in Amazon S3. For example, `arn:aws:kms:: 111122223333:key/5bfbc9b9-ab12-ab12-a123-11111xxx22xx`. | | `LogFile` | Location of the AWS Backint agent log file. | ### Additional Parameters You can add the following additional parameters to the configuration file. | Parameter | Description | Default value | Allowed values | | --- | --- | --- | --- | | `BackupObjectTags` | Additional S3 object tags. | None | JSON string with the following syntax: `[{Key=string,Value=string},{Key=string,Value=string},…​]` | | `EnableTagging` | Enables or disables default object tagging for backups files stored in S3. Tagging helps to identify the AWS Backint version and SAP HANA version used during the backup. | `true` | `true`, `false` | | `LogLevel` | Logging level for agent logs. | `info` | `info`, `debug` | | `LogRotationFrequency` | Log file rotation frequency. | `never` | `minute`, `hour`, `day`, `never` | | `S3StorageClass` | S3 storage class that is used for storing backups. | `STANDARD` | `STANDARD`, `STANDARD_IA`, `ONEZONE_IA`, `INTELLIGENT_TIERING` | | `UploadConcurrency` | Number of Amazon S3 threads that can work in parallel during backup. | `100` | `1` to `200` | | `UploadChannelSize` | Number of files that can be uploaded in parallel to the S3 bucket during the backups. | `10` | `1` to `32` | | `DownloadConcurrency` | Number of Amazon S3 threads that can work in parallel during restore. | `100` | `1` to `200` | # Backup and Restore Backup and Restore This guide shows you how to backup and restore SAP ASE databases using AWS Backint Agent for SAP ASE. You’ll learn how to install and configure the agent, create backups, restore databases, and manage logs. **Topics** + [ ## Interactive SQL ](#ase-backint-interactive-sql) + [ ## Placeholders ](#ase-backint-placeholders) + [ ## Backup Location ](#ase-backint-prefix-and-s3-location) + [ ## Backup Striping ](#ase-backint-backup-striping) + [ ## Create Backup Configuration ](#_create_backup_configuration) + [ ## Database Backup ](#ase-backint-database-backup) + [ ## Transaction Log Backup ](#ase-backint-transaction-log-backup) + [ ## Database Restore ](#ase-backint-database-restore) + [ ## Transaction Log Restore ](#ase-backint-transaction-log-restore) + [ ## Database Restore to Different Target Database ](#ase-backint-database-restore-different-target) ## Interactive SQL Interactive SQL (`isql`) is a command line interactive SQL parser to the SAP ASE server. Refer to [Using interactive isql from the Command Line](https://help.sap.com/docs/SAP_ASE/4fac18b4f65644b3ae50293f3ecdf95d/a83bcdd9bc2b101488a697dc6bd918f3.html?version=16.0.0.0) for more information. ## Placeholders The commands in this document use placeholders for illustration. Their values need to be set according to your environment configuration. | Placeholder | Description | Example Value | | --- | --- | --- | | `` | Name of the database | `ASE` | | `` | Custom prefix for backup identification | `my_custom_prefix` | | `` | Complete S3 path for restore operations | `sapaws_ASE_COMPLETE_my_custom_prefix_2/01-06-2025_1159/` | | `` | SAP ASE System ID | `ASE` | | `` | Database instance hostname | `sapaws` | | `` | Number of stripes | `1` | | `` | UTC timestamp of backup with format `DD-MM-YYYY_hhmm` | `01-06-2025_1159` | ## Backup Location Your backup location depends on: 1. Agent configuration (S3 bucket and folder) 1. SAP ASE System ID (SID) 1. Database instance hostname 1. Your custom prefix 1. Number of stripes 1. UTC timestamp If you’re performing a backup (load), Backint agent constructs the S3 location automatically. If you’re restoring a particular backup (load) created with AWS Backint Agent, you need to specify the S3 location manually. Database backups: ``` //__COMPLETE__// ``` Transaction log backups: ``` //__TRANSACTION__// ``` ### Finding backups via the AWS CLI The AWS CLI command below allows you to list available backups in Amazon S3. Database backups: ``` aws s3 ls s3://///__COMPLETE__/ ``` Transaction log backups: ``` aws s3 ls s3://///__TRANSACTION__/ ``` #### Example: ``` > aws s3 ls s3://my_s3_bucket/my_s3_folder/ABC/myhost_ABC_COMPLETE_my_daily_backup_1/ PRE 07-01-2025_120000/ PRE 07-02-2025_120000/ PRE 07-03-2025_120000/ PRE 07-04-2025_120000/ ``` ## Backup Striping Backup Striping allows adjusting the number of simultaneous backup and restore streams to and from Amazon S3. The ideal number of stripes depends mainly on the size of your database. Striping is defined by appending the following statement to your dump or load command. Striping is supported for DUMP and LOAD commands for both, database and transaction log backups. Add the following statement `(n-1)` times for `n` stripes. The number of stripes in a load statement need to match the number of stripes when creating the backup. The maximum number of stripes is 32. ``` stripe on "awsbackint::" ``` ## Create Backup Configuration SAP ASE provides several methods to configure backup operations. The stored procedure [sp\$1config\$1dump](https://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.infocenter.dc36273.1600/doc/html/san1393051993446.html) offers a straightforward way to set backup parameters and specify AWS Backint Agent as the backup target. **Note** Using a backup configuration will not allow you to specify a custom prefix. Instead, SAP ASE will generate a prefix with format `.DB.YYYYMMDD.hhmmss..000` automatically. Creating a dump configuration is optional and not required in case you prefer using the statements in the following section. AWS Backint Agent for SAP ASE supports the following parameters: | Parameter | Description | Required | | --- | --- | --- | | `@ext_api='awsbackint'` | Specifies AWS Backint Agent as the external API. | Yes | | `@num_stripes` | Number of stripe devices used during the dump operation. The default is 1. | No | | `@blocksize` | Block size for the dump device, overriding the default block size for the device. The value must be at least 1 database page, and an exact multiple of the database page size. For optimal performance, specify blocksize as a power of 2 (such as 65,536, 131,072, or 262,144). | No | | `@compression` | Compression level for compressed dumps. By default, compression is disabled. | No | ### Example Create database dump configuration `my_custom_config`, using the external API for AWS Backint Agent for SAP ASE, three stripes, a block size of 16,384 bytes, and compression level of 100. ``` sp_config_dump @config_name='my_custom_config', @ext_api='awsbackint', @num_stripes='3', @blocksize='16384', @compression='100', go ``` Once you have created a dump configuration, initiate a dump to Amazon S3 with the following statement. ``` dump database ASE using config='my_custom_config' go ``` ## Database Backup Use the following statement to create a full database dump of your database in Amazon S3. ``` dump database to "awsbackint::" ``` ### Example Dump database ASE to S3 with prefix `my_custom_prefix`, using two stripes. ``` dump database ASE to "awsbackint::my_custom_prefix" stripe on "awsbackint::my_custom_prefix" go ``` ## Transaction Log Backup Use the following statement to create a transaction log dump of your database in Amazon S3. ``` dump transaction to "awsbackint::" ``` ### Example Dump transaction log of database ASE to S3 with prefix `my_custom_prefix`, using one stripes. ``` dump transaction ASE to "awsbackint::my_custom_prefix" go ``` ## Database Restore Use the following statement to restore your database from Amazon S3. ``` load database from "awsbackint::" ``` ### Example Load database ASE from S3, using two stripes. ``` load database ASE from "awsbackint::sapaws_ASE_COMPLETE_my_custom_prefix_2/01-06-2025_1159/" stripe on "awsbackint::sapaws_ASE_COMPLETE_my_custom_prefix_2/01-06-2025_1159/" go ``` ## Transaction Log Restore Use the following statement to restore your transaction logs from Amazon S3. ``` load transaction from "awsbackint::" ``` ### Example Load transaction logs for database ASE from S3, using one stripes. ``` load database ASE from "awsbackint::sapaws_ASE_COMPLETE_my_custom_prefix_2/01-06-2025_1159/" go ``` ## Database Restore to Different Target Database ``` load database from "awsbackint::::" stripe on "awsbackint::::" ``` # Troubleshooting Troubleshooting This section helps you diagnose and resolve common issues with AWS Backint Agent for SAP ASE. You’ll find information about logging locations, performance optimization techniques, and solutions to frequently encountered problems. **Topics** + [ ## Prerequisites ](#_prerequisites) + [ ## Logging ](#ase-backint-logging) + [ ## Performance ](#_performance) + [ ## Common Issues and Solutions ](#_common_issues_and_solutions) + [ ## Best Practices ](#_best_practices) + [ ## Getting Help ](#_getting_help) ## Prerequisites Before troubleshooting, ensure you have: + AWS Backint Agent for ASE properly installed and configured + Valid AWS credentials with appropriate permissions + Access to AWS CloudTrail logs for permission debugging + SAP ASE database administrator privileges ## Logging Log files are located at the following locations. To get help with issues, submit all log files to AWS Support through the AWS Support Center. | Log Type | Location | | --- | --- | | Installation logs | `install_aws_backint_YYYYMMDD_HHMMSS.log` in the current working directory | | Backint Agent logs | `/sybase/shared/aws-backint-agent-ase/logs/aws-backint-agent.log` | | Archive API logs | `/sybase/shared/aws-backint-agent-ase/logs/aws-backint-agent-archive-api.log` | | Backup Server log | `/ASE-16_/install/_BS.log` | | Database log | `/ASE-16_/install/.log` | ### Enable Detailed Logging 1. Configure the Backint Agent for verbose logging 1. Monitor AWS CloudTrail for API call failures 1. Check SAP ASE error logs for database-specific issues ### Key AWS Log Locations + AWS CloudTrail: AWS Management Console > CloudTrail ## Performance This section contains information on common measures for optimizing performance of AWS Backint Agent for SAP ASE. ### Striping Striping allows adjusting the number of simultaneous backup and restore streams to and from Amazon S3. The optimal number of stripes depends on a variety of factors, such as database size, network, and Amazon EC2 instance type. Three (3) to four (4) stripes are a reasonable choice for most database sizes. For more information on striping, refer to [Backup Striping](ase-backint-dump-load.md#ase-backint-backup-striping). ### Main Memory Consumption During LOAD Operations Main memory consumption of AWS Backint Agent for SAP ASE typically ranges between 10 and 20 GiB during LOAD operations. In case you experience significantly higher values, consider setting the following parameters in `/sybase/shared/aws-backint-agent-ase/aws-backint-agent-config.yaml`. Lower values reduce memory consumption but may increase LOAD operation time. The default values are shown below: | Parameter | Value | | --- | --- | | downloadConcurrencyDefault | 10 | | downloadChannelSizeDefault | 5 | ## Common Issues and Solutions This section covers common issues you may encounter while using AWS Backint Agent for SAP ASE. ### Install custom version By default, the installer automatically downloads the latest available version of AWS Backint Agent for SAP ASE. In case you need to install a specific version of the RPM, you can download the RPM package of any previous version from S3 and provide the RPM package to the installer. ``` # Download installer wget https://s3.amazonaws.com/awssap-backint-agent-ase/binary//install-aws-backint-agent-ase # Download RPM package wget https://s3.amazonaws.com/awssap-backint-agent-ase/binary//aws-backint-agent-ase.rpm # Add execute permission to installer chmod +x install-aws-backint-agent-ase # Run installer ./install-aws-backint-agent-ase --location aws-backint-agent-ase.rpm ``` ### S3 Permission Issues #### S3 Access Denied During Backup Operations **Problem**: Backup fails with `AccessDenied` error when attempting to write to S3 bucket. **Symptoms**: ``` Error creating upload id for bucket: key: error:AccessDenied: User: arn:aws:sts:::assumed-role// is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::/" because no identity-based policy allows the s3:PutObject action ``` **Root Cause**: The IAM role or user lacks the required S3 permissions for the specified bucket path. **Solution**: 1. Verify the S3 bucket policy includes the correct resource path: ``` { "Effect": "Allow", "Action": [ "s3:PutObjectTagging", "s3:PutObject", "s3:GetObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::your-bucket-name/your-folder-name/*" ] } ``` 1. Ensure the resource path in your IAM policy matches the actual S3 prefix used by the Backint Agent. 1. Test permissions using AWS CLI: ``` aws s3 cp test-file.txt s3://your-bucket-name/your-folder-name/ ``` **Time to Resolution**: Typically 2-5 minutes once the correct path is identified. #### S3 ListBucket Permission Denied During Restore **Problem**: Database restore fails when the Backint Agent cannot list S3 bucket contents. **Symptoms**: ``` ListObjects error: User: arn:aws:sts:::assumed-role// is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::" because no identity-based policy allows the s3:ListBucket action ``` **Root Cause**: Missing `s3:ListBucket` permission in the IAM policy. **Solution**: 1. Add the `s3:ListBucket` permission to your IAM policy: ``` { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::your-bucket-name" ] } ``` #### S3 GetObject Permission Denied During Restore **Problem**: Restore operation fails when attempting to download backup files from S3. **Symptoms**: ``` Key metadata fetch failed for bucket: key: error:Forbidden: Forbidden status code: 403 ``` **Root Cause**: The IAM role lacks `s3:GetObject` permission for the backup files. **Solution**: 1. Ensure your IAM policy includes `s3:GetObject` permission: ``` { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::your-bucket-name/your-folder-name/*" ] } ``` 1. Verify the object exists and the path is correct using AWS CLI: ``` aws s3 ls s3://your-bucket-name/your-folder-name/ ``` ### Backup and Restore Configuration Issues #### Stripe Count Mismatch During Restore **Problem**: Restore fails due to mismatch between backup and restore stripe configuration. **Symptoms**: ``` Error: Mismatch stripe count, load requested with: 2 stripes instead of 1 ``` **Root Cause**: The restore command specifies a different number of stripes than used during backup. **Solution**: 1. Check the original backup configuration to determine the correct stripe count. 1. Use the same stripe count for restore as was used for backup: ``` -- For single stripe backup LOAD DATABASE your_db FROM "awsbackint::backup_prefix" -- For multi-stripe backup LOAD DATABASE your_db FROM "awsbackint::backup_prefix" STRIPE ON "awsbackint::backup_prefix" ``` 1. If unsure about the original stripe count, check the S3 bucket structure to count the stripe files. #### Named Pipe Creation Failure **Problem**: Backup fails when attempting to reuse the same prefix after a previous failed attempt. **Symptoms**: ``` Error creating named pipe for stripe 0: File exists ``` **Root Cause**: Previous backup attempt left temporary files that weren’t cleaned up. **Solution**: 1. **Immediate workaround**: Use a different backup prefix: ``` DUMP DATABASE your_db TO "awsbackint::new_unique_prefix" ``` 1. **Long-term solution**: Clean up temporary files from the previous attempt: ``` # Remove temporary pipes and files from the Backint Agent working directory rm -f /sybase/shared/aws-backint-ase/pipes// ``` 1. **Best practice**: Always use unique prefixes for each backup operation. ### Configuration File Issues #### Configuration File Permission Errors **Problem**: Backint Agent fails to start due to incorrect file permissions on the configuration file. **Symptoms**: ``` Error reading config file Failed to validate config file permission, other users outside of group cannot have execution permission. ``` **Root Cause**: The configuration file has overly permissive file permissions. **Solution**: 1. Set correct permissions on the configuration file: ``` chmod 640 /sybase/shared/aws-backint-agent-ase/aws-backint-agent-config.yaml ``` 1. Ensure the file is owned by the correct user and group: ``` chown sap_user:sap_group /sybase/shared/aws-backint-agent-ase/aws-backint-agent-config.yaml ``` 1. Verify permissions: ``` ls -la /sybase/shared/aws-backint-agent-ase/aws-backint-agent-config.yaml ``` #### Missing S3 Bucket Configuration **Problem**: Backint Agent fails to start due to missing or incorrect S3 bucket configuration. **Symptoms**: ``` Error: S3 Bucket Name not found in aws-backint-agent-config.yaml ``` **Root Cause**: The configuration file is missing the S3 bucket name or has incorrect permissions. **Solution**: 1. Verify the S3 bucket name is correctly specified in the configuration file. 1. Ensure the configuration file has proper read permissions. 1. Check that the IAM role has access to the specified S3 bucket. ### KMS Encryption Issues #### KMS Key Type Mismatch **Problem**: Backup fails when using an asymmetric KMS key for S3 encryption. **Symptoms**: ``` KMS.InvalidKeyUsageException: You cannot generate a data key with an asymmetric CMK ``` **Root Cause**: S3 server-side encryption requires a symmetric KMS key, but an asymmetric key was specified. **Solution**: 1. Use a symmetric KMS key for S3 encryption. 1. Create a new symmetric key if needed: ``` aws kms create-key --description "S3 encryption key for SAP backups" --key-usage ENCRYPT_DECRYPT ``` 1. Update your S3 bucket configuration or Backint Agent configuration to use the symmetric key. #### KMS Permission Denied **Problem**: Backup fails due to insufficient KMS permissions. **Symptoms**: ``` AccessDenied: User: arn:aws:sts:::assumed-role// is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:::key/ with an explicit deny in an identity-based policy ``` **Root Cause**: The IAM role lacks the required KMS permissions. **Solution**: 1. Add KMS permissions to your IAM policy: ``` { "Effect": "Allow", "Action": [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource": [ "arn:aws:kms:region:account-id:key/key-id" ] } ``` 1. Ensure there are no explicit deny policies blocking KMS access. 1. Test KMS access: ``` aws kms generate-data-key --key-id your-key-id --key-spec AES_256 ``` ## Best Practices ### Backup Naming Convention + Use consistent and descriptive prefixes + Include timestamp information for easy identification + Avoid special characters that might cause parsing issues ### S3 Path Structure The Backint Agent creates the following S3 path structure: ``` ///sapci__COMPLETE__/_