Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is What’s New for SAP HANA 2.0 SPS 01
and in this video we will discuss database backup and recovery.
Hi, I am Denys van Kempen.
So what’s new?
Let me write them down for you.
New is backup encryption, support for 3rd party backup tools, and recovery from storage snaphots.
Enhanced or improved, is the backup support for tenant databases.
You can now add or remove a service without breaking the backup history.
There is a bit of overlap between this video and the What’s New for Security one,
as we already discussed the backup encryption feature there.
So, I will keep brief.
OK.
Backup Encryption.
New is SPS 01 is native support for backup encryption.
Native support means that HANA performs the encryption and decryption all by itself.
Obviously, backup encryption using 3rd party backup tooling has been available since the
BACKINT API was introduced in HANA 1.0 SPS 05.
December 2012, for those that were not around at that time.
But this depended on the backup tool, which either supported backup encryption or not,
and happened outside the orbit of SAP HANA.
Now, HANA is doing the encryption
and this completes the encryption of data-at-rest initiative started with data volume encryption is SPS 09,
followed by redo log encryption in HANA 2.0.
So how does this work?
It is simple.
First, you need to obtain the system privilege ENCRYPTION ROOT KEY ADMIN.
Then, to enable backup encryption, use the SQL statement:
ALTER SYSTEM BACKUP ENCRYPTION ON
and you have guessed how you can switch it off again.
No switch or button in the new HANA cockpit?
Nope, not yet.
But I’d be very surprised if we don’t get any UI for this feature in the upcoming release or so.
But for now it is SQL only.
Any caveats?
Points to note?
Yes.
Both the data backups (full and delta) and the log backups are encrypted and this is not configurable.
Either you encrypt or you don’t.
As it takes longer to create encrypted backups and to recover from them,
you may have wished that this was configurable but this is not the case.
This also means that it is not possible to encrypt a single backup.
Say, you need to send a backup to SAP support or someone else
and you want to encrypt it to prevent tampering during transportation.
Not possible.
It is possible, however, to enable/disable backup encryption per tenant database.
So, it not a system-wide setting.
In fact, when you enable backup encryption and then create a tenant, it will be automatically encrypted.
Also, each tenant database has its own backup root key.
Created when you create the tenant database.
There is a new view, so you can check if database backup encryption is enabled:
the M_ENCRYPTION_OVERVIEW view.
But you can also query the M_BACKUP_CATALOG view, for the column ENCRYPTION_ROOT_KEY_HASH.
No hash means it is not encrypted.
The backup catalog is never encrypted, by the way.
But there is no customer sensitive data in the catalog, so this makes sense.
SAP HANA cockpit also displays the backup encryption status information.
We can see that here.
We will add a video or two soon to the database backup and recovery playlist
here on the SAP HANA Academy on how this works in more detail, so stay tuned.
Next topic.
Third-party backup tools.
As I just mentioned, the BACKINT API has been around for some time.
At the time of this recording, there were 39 tools certified for SAP HANA database backup.
HP, IBM, EMC, and so on.
Search for the keyword HANA backup recovery interface 'BRINT' in the certified solutions directory.
And there is a note 17 30 932, Using backup tools with Backint for HANA that explains the fine print.
In the What’s New video for System Administration and also for Installation and Update,
we discussed that single-container database systems are no longer supported in SPS 01.
They no longer exist.
The only flavour is multi-tenant.
So far, third-party backup tools could only perform a backup - and do the restore -
at the system level.
What’s new in SPS 01, is that you can now use third party tools to work at the tenant level.
So you can make a tenant backup.
And because you can make a tenant backup, you can now also restore a tenant - and, why not?
restore it to a different system.
This also works if system one is single container, say SPS 12 and system two is running the latest
HANA 2.0 SPS 01 version in multi-container mode.
Third topic is recovery from storage snapshot.
For those not familiar, a storage snapshot is a capture, a picture, of storage at a point in time.
They are created in the storage subsystem, so creating them does not consume any database resources.
It is fast and with minimal impact.
Also, unlike a regular full database backup, if your database is getting any bigger,
the time needed to capture a snapshot does not change.
So, that’s a big advantage.
Recovery is also faster and you can use snapshots together with delta backups and log backups
the same way as you would with regular full database backups.
So, why bother with regular backups, you may ask?
Well, there is a bit of fine print with storage snapshots.
For example, you cannot use backup encryption to encrypt storage snapshots as technically,
they happen at the storage layer.
Now, you can use volume encryption, of course, but for this you need a different encryption key.
So, you need two keys: the backup root key and the volume encryption root key.
Also, you cannot use a storage snapshot of a single-container system
- and there are probably quite a few still out there - to restore a multi-tenant database container system.
What you can do, and this is new in SPS 01 - it is the first step - is that you can use
a storage snapshot to recover a multi-tenant database container system on the condition
that there is only a single tenant database.
So a system database with a single tenant database: not two, not three, just one.
You make the snapshot using SQL.
Here I am doing it in the Database Explorer SQL prompt.
But you can restore the snapshot using cockpit.
Like I said, it is the first step but, no doubt, there is more to come.
Finally, topology change is now supported for tenant databases.
What does this mean?
A topology change is when you add or remove a service.
For example, if you want to start to use the PAL, the predictive analysis library, you
need to start a script server for that tenant.
Now previously, you had to make a full backup after each topology change.
This is no longer the case
You can now add and remove services without affecting the backup history.
So, that’s good news.
Getting better all the time.
OK.
So much for database backup and recovery.
We mentioned: backup encryption;
tenant support for 3rd-Party backup tools;
storage snapshots for database recovery;
and topology change support for tenant databases.
For HANA cockpit SP 2, I mentioned the display the backup encryption status information,
and that you can use cockpit and snapshots to recover an MDC-system with a single tenant database.
SAP HANA database backup and recovery is documented in the SAP HANA Administration Guide,
the tasks that is, and the concepts in the SAP HANA Security Guide.
You can read both guides online or download them, free of charge, from the SAP Help Portal
on help.sap.com, under SAP HANA platform.
Make sure you select the correct version.
Also, there is an SAP note: 24 44 090 FAQ: SAP HANA Backup Encryption,
which provides some additional information.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates.
And we also have a page on Facebook and Google+.
If you are watching this video on YouTube, do not hesitate to leave your comments to
the video page and, if you like, give us your vote on his video.
Thank you for watching.