Server Installation Guide for UNIX - SAP Help Portal · PDF fileFor upgrade information when a previous version of the server ... For additional information on how to install SAP BusinessObjects

CUSTOMER

SAP BusinessObjects Predictive Analytics 3.12017-10-26

Server Installation Guide for UNIX

Content

1 What's New in Server Installation Guide for UNIX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41.1 Document History. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2 SAP BusinessObjects Predictive Analytics Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52.1 SAP BusinessObjects Predictive Analytics Enterprise Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52.2 Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Minimum Skills Required to Perform the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6User Accounts Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Server Sizing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Network Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Java Runtime Environment for Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8Java Web Start Deployment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8RedHat 6.7+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2.3 Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9Installing the Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Checking the Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2.4 Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Assisted Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Basic Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Configuration of SAP BusinessObjects Predictive Analytics Server Instances. . . . . . . . . . . . . . . . 15TCP Port and Address Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Communication Channel Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Authentication Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17User Mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21User Environment Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

2.5 Reloading the Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .242.6 Starting the Server on UNIX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Starting the Server and its Name Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Checking Whether the Server is Running. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Stopping the Server and its Name Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

2.7 Deploying the Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Using Java Web Start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Manually Install Clients for SAP BusinessObjects Predictive Analytics Server . . . . . . . . . . . . . . . 27

3 Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283.1 Starting the Administration Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283.2 Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

2 C U S T O M E RServer Installation Guide for UNIX

Content

4 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294.1 Displaying the Server Log File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294.2 Error: ./tmp/KxAuthServer_.pid is not running. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Missing openssl Library. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Server Installation Guide for UNIXContent C U S T O M E R 3

1 What's New in Server Installation Guide for UNIX

Links to information about the new features and documentation changes for Server Installation Guide for UNIX.

SAP BusinessObjects Predictive Analytics 3.0

What's New Link to More Information

Communication channel encryption is no longer enabled by default. You need to explicitly enable it.

Communication Channel Encryption [page 16]

For server authentication based on a fixed password list, default users are no longer declared at installation time. You need to create users after installation.

To know how to create users, see:

● Authenticated Server Based on a Fixed Password List [page 19]

● Authenticated Server Based on a Fixed Encrypted Password List [page 19]

1.1 Document History

Product Version What's Changed

SAP BusinessObjects Predictive Analytics Update on server sizing.

See Hard Disk Space [page 7]


What's New in Server Installation Guide for UNIX

2 SAP BusinessObjects Predictive Analytics Server

2.1 SAP BusinessObjects Predictive Analytics Enterprise Edition

The enterprise edition of SAP BusinessObjects Predictive Analytics is a three-tier client-server architecture. Communication between the Automated Analytics server and the data is identical to the desktop edition, using either ODBC or the native file system. For each client connection, a new Automated Analytics instance process is started on the server. Depending on the server configuration, the process can be started with a specific system account, or with the user account. Communication between the clients and server can be encrypted using SSL or TLS.

This configuration offers the following benefits:

● Users are authenticated because clients must log in before being able to use the modeling server. User accounts can be configured to implement security policy.

● User activity monitoring and logging is possible and activated by default.

Server Installation Guide for UNIXSAP BusinessObjects Predictive Analytics Server C U S T O M E R 5

● Database connectivity needs to be configured only once on the server. Operating system rights can be used to check access to the different resources (for example, modeling data).

● Resources are used more fully because each modeling session has a dedicated process. The process size limit applies only to a single user.

● Network administration is simplified because all network traffic from the client is directed to the server. This means only two TCP ports need to be opened for an Automated Analytics installation.

2.2 Requirements

2.2.1 Minimum Skills Required to Perform the Installation

The installation of Automated Analytics server requires some minimum skills that are described in the following list.

The installation of Automated Analytics server must be performed by someone with a system administrator profile who:

● knows the main UNIX administration commands (managing users, groups, and so on),● has administration rights on the machine,● has the rights to set up services on the machine,● knows how to set up ODBC drivers on UNIX systems.

Before setting up the server, the person performing the installation must contact the database administrator to obtain all necessary information about the database the application will be connected to.

2.2.2 User Accounts Requirements

The default installation procedure requires you to create:

● a kxenusers group● a kxenadmin user, belonging to the kxenusers group.

Note that any users that will access to the server need to be added to this group.

2.2.3 Server Sizing

A tool is provided on the SAP Help Portal (http://help.sap.com/pa) allowing you to estimate the size needed for using the application server in your environment.


SAP BusinessObjects Predictive Analytics Server

http://help.sap.com/pa

2.2.3.1 Data Access

Data access for Automated Analytics is either through the ODBC layer of a relational database, or directly against files in a file system. The application allows direct access to several types of files formats: SAS, SPSS, Excel, Minitab, delimited text, and fixed length text. For efficiency, the application does not create a separate analytics data store but reads data from the existing data sources, and saves output and models back into the data source.

When working in a client-server environment, all data are accessed by the server. The data source (ODBC, ...) must be installed (drivers, ...) and configured on the server.

NoteTo know how to install and configure the data source, read the Automated Analytics configuration guide: Connecting to your Database Management System on Unix or Windows.

2.2.3.2 CPU Usage

The training of a single model consumes the resources of a single CPU for the duration of the training. Each model being trained will spawn a separate thread, each being assigned to an available CPU. Training 2 models simultaneously on the same CPU will approximately double the training time of each model. Therefore, 1 CPU (500MHz or above) is recommended per concurrent user.

2.2.3.3 Memory Consumption

A minimum of 512MB of RAM per concurrent user for the server is recommended. Additionally, each client should have 128MB-256MB RAM to run the User Interface. In general, a model consumes about 100KB of RAM per variable during training, or about 10MB per 100 variables. The application graphical user interface consumes about 30MB of RAM.

By default the Data Cache is parameterized to use 500 MB RAM on a 64-bit architecture. The settings can be changed in <INSTALLATION_DIR>/DataCacheManager.cfg.

2.2.3.4 Hard Disk Space

The server software requires about 700 MB for the server and about 200 MB for each client installed on separate machines. No additional storage is required for data because the application does not create a separate data store.

However, approximately 10MB to 100MB of disk space will be required per saved model, depending on the model type and number of variables in the model. Note that Social models may require much more space. The models are stored in database or on the file system either on the server or somewhere accessible from the server. Be careful that users must be granted Write access to those spaces in order to be able to save their


work. As a best practice, modeling results are preferably saved as text files on a file system in the Development phase, the database format is usually relevant only for Production models.

By default the Data Cache is parameterized to use 500 MB on the disk on a 32-bit architecture and 2 GB on a 64-bit architecture. The settings can be changed in <INSTALLATION_DIR>/DataCacheManager.cfg.

2.2.4 Network Requirements

Each of the three components involved in the application, which are the name server, the SAP BusinessObjects Predictive Analytics server and the client application, can be located on a different machine. Note that in most installation settings, both the name server and the SAP BusinessObjects Predictive Analytics server are located on the same server.

The communication protocol used under the CORBA framework is the TCP protocol. The first requirement is that the:

● The SAP BusinessObjects Predictive Analytics server must be able to access the name server.● The client application must be able to access both the name server and the SAP BusinessObjects

Predictive Analytics server.

From a network administration point of view it means that:

● The name server and the server will be assigned a specific TCP port. By default, the startup scripts we use fix them, and they should probably set properly depending on the network strategy.

● Both of these ports must be accessible from the client machine. For example, network firewalls should allow communication on these ports between client machine and the servers.

2.2.5 Java Runtime Environment for Client

You need to install Java Runtime Environment (JRE) version 1.7 or above with support for Java Web Start (JNLP Protocol), which is available on the Java website.

2.2.6 Java Web Start Deployment

In order to provide Java Web Start deployment of Automated Analytics client applications, a Web server needs to be installed, configured and started on the machine where Automated Analytics server is installed.

Automated Analytics Java Web Start has been tested on the following server configurations:

● Windows IIS (Internet Information Service), on Microsoft Windows systems● Apache Server (http://www.apache.org ). For more information on how to install an Apache server, refer

to the Apache documentation (http://httpd.apache.org/docs/current/en/install.html ).



http://help.sap.com/disclaimer?site=http://www.apache.org

http://help.sap.com/disclaimer?site=http://httpd.apache.org/docs/current/en/install.html

2.2.7 RedHat 6.7+

For Redhat 6.7+, execute the following steps:

1. Download the compat-sap-c++ packages available on Redhat website. This compat-sap-c++ packages carry runtime compatibility libraries needed to run SAP HANA and SAP BusinessObjects Predictive Analytics. Refer to RHBA-2015:1818-3 https://rhn.redhat.com/errata/RHBA-2015-1818.html .

2. Install the compat-sap-c++-4.8.2-16.el6.x86_64.rpm in the default location /opt/rh/SAP/lib64.3. Create a symbolic link as follows:

ln -s /opt/rh/SAP/lib64/compat-sap-c++.so <SAP BO PA Install Dir>/libs/libstdc++.so.6

This will indicate to the application to use this compatibility library instead of your system one, which does not have the right version of libstdc++.

2.3 Installation

2.3.1 Installing the Server

CautionFor upgrade information when a previous version of the server or a SAP InfiniteInsight server is already installed, please refer to the Operations Guide provided on the SAP Help Portal (http://help.sap.com/pa/).

2.3.1.1 Standard Installation

There is no specific installation procedure for the executable files themselves; they should simply be uncompressed and extracted in the correct location.

NoteFor additional information on how to install SAP BusinessObjects Predictive Analytics server on AIX or Solaris platforms, please refer to the SAP Note 2174673 .

1. Create a group kxenusers and an account kxenadmin.

2. Log as kxenadmin.

3. Run the command umask 007.

4. From the home directory of the kxenadmin user run the command gunzip -c </directory/distribution_file.extension> | tar -xvf -.This command creates a directory named AutomatedAnalytics_<OS_Name> in the home directory of kxenadmin user.


http://help.sap.com/disclaimer?site=https://rhn.redhat.com/errata/RHBA-2015-1818.html

http://help.sap.com/pa/

http://help.sap.com/disclaimer?site=https://launchpad.support.sap.com/#/notes/2174673

5. If you need to create a global shortcut (outside of the kxenadmin home directory)a. Log in as root user.b. Go to the directory where you want to create the shortcut.c. Create a symbolic link to the installation directory of Automated Analytics.

ExampleIn the instructions, we will consider that Automated Analytics features are set up in the /softs/ directory:cd /softs

Example of a symbolic link to the installation directory of Automated Analytics.

ln -s /home/kxenadmin/AutomatedAnalytics_<OS_Name> AutomatedAnalytics

When the install is complete, register your license keycode. A temporary license key is included in the software. Apply for a permanent license key immediately after installing your SAP software on the SAP Support Portal at http://support.sap.com/keys-systems-installations/keys.html .

To register the keycode, edit the License.cfg file located under the root folder where the SAP BusinessObjects Predictive Analytics tar archive was extracted. Enter new keycodes in the format described in the License.cfg file.

CautionIf you are using server authentication based on a fixed password list, encrypted or not, note that default users are no longer declared at installation time. You need to create users as described in the Authentication section. Refer to the related information below.

2.3.1.2 Installation Directory Content

Once the installation has been completed the following folders will be available:

Folder Content

Doc documentation

KJWizardCORBA the remote assistant for client/server modeling

KJWizardJNI the modeling assistant, which is a Java GUI based on Java Native Interface, is available on some UNIX platforms only - for the list of platforms, see the PAM.

KxShell a command line interpreter to test the C++ API

KxenServer the server instance

Messages messages files used by the kernel

NameServer a name server

Samples some sample data files

libs libraries



http://help.sap.com/disclaimer?site=http://support.sap.com/keys-systems-installations/keys.html

Folder Content

include include and IDL files

KxNodeCodeGenerator node code generator

KxCORBAShell remote Shell utility

KxAuthServer Automated Analytics server: authenticate users

WebStart simplify the deployment of the Automated Analytics client through a Web page

ODBCShell a simple command line utility to test ODBC connections

odbcconfig folder containing ODBC configuration template files, and where the ODBC configuration should be set

EXE runtimes for the code generator

Resources resources required by the kernel (messages, additional configuration files, ...)

KCG stand-alone C source code generator

2.3.1.3 Start-up Script Installation

Once SAP BusinessObjects Predictive Analytics has been installed, the folder /softs/AutomatedAnalytics_<OS_Name> exists:

1. Edit /softs/AutomatedAnalytics_<OS_Name>/KxenServer_initd to put the proper path into the shell variable <KXEN_INSTALLATION_PATH>.

2. Copy the updated version of /softs/AutomatedAnalytics_<OS_Name>/KxenServer_initd into /etc/init.d or /etc/rc.d

# cp /softs/AutomatedAnalytics_<OS_Name>/KxenServer_initd /etc/init.d

3. Create the link from /etc/init.d/KxenServer_initd to the folders /etc/rc?.d

# cd /etc/rc3.d; ln ../init.d/KxenServer_initd S93KxenServer_initd # cd /etc/rc0.d; ln ../init.d/KxenServer_initd K93KxenServer_initd# cd /etc/rc1.d; ln ../init.d/KxenServer_initd K93KxenServer_initd# cd /etc/rc2.d; ln ../init.d/KxenServer_initd K93KxenServer_initd # cd /etc/r cS.d; ln ../init.d/KxenServer_initd K93KxenServer_initd

2.3.2 Checking the Installation

Once the installation is done, you can use the script KxCheckConfig.sh (located in the SAP BusinessObjects Predictive Analytics root directory) to check the installation and verify if the required OS patches are installed on the machine.


This script can also be used to communicate with the support by generating a report of the installation in a report.txt text file. This file contains the full description of the machine and a snapshot of the configuration and log files from the installation directory.

./KxCheckConfig.sh -v > report.txt

2.4 Configuration

The configuration of the server is included in several files. The following table summarizes the location of the parameters in a distribution:

Description File Location

TCP ports and possibly IP addresses to be used by the server, and SSL activation switch

${SAP_PA_HOME}/KxenCorbaConfig.sh

Name of the log configuration file, authentication mode and other authentication parameters

${SAP_PA_HOME}/KxAuthServer/KxAuth.cfg

List of users if the file authentication is selected ${SAP_PA_HOME}/KxAuthServer/users

Mapping between authenticated users and physical users if specified in the KxAuth.cfg

${SAP_PA_HOME}/KxAuthServer/mapping

Default configuration file used for server instances

For a description of the available option for each instance, see the related information below.

${SAP_PA_HOME}/KxenServer/KxCORBA.cfg

NoteIf you modify the configuration, you will need to restart the server.

Related Information

Configuration of SAP BusinessObjects Predictive Analytics Server Instances [page 15]

2.4.1 Assisted Configuration

A script is provided to help you configure the server after installation.

It goes through all the steps listed in the related links section below and saves the parameters in a .ini file that will allow you to automatically reuse the parameters when installing a new version. The script modifies all the necessary configuration files and creates back-up copies of the default files as well as of the modified files.



Description Location File

Configuration script ${SAP_PA_HOME}/PostInstall/

PostInstallScript.sh

File containing the parameters provided by the user when running the PostInstall script

${SAP_PA_HOME}/PostInstall/

PostInstall.ini

Folder containing the back-up copies of the default configuration files

${SAP_PA_HOME}/PostInstall/Org/

N/A

Folder containing the back-up copies of the modified configuration files

${SAP_PA_HOME}/PostInstall/Bkp/

N/A

Related Information

Configuration of SAP BusinessObjects Predictive Analytics Server Instances [page 15]Basic Configuration [page 13]TCP Port and Address Configuration [page 15]

2.4.1.1 Using the Configuration Script

1. Launch the script PostInstall.sh . The script asks you whether you want to reload an existing configuration from a previous installation.

2. If you want to reload a configuration, enter Y , else enter N .

3. When prompted to select the type of component you want to configure, enter S to select the server.

4. When prompted, enter the values requested by the script. Once the script has been successfully completed, the following line is displayed.

INFO: The installation has been checked, the following script can be executed: INFO: - kxen.server

2.4.2 Basic Configuration

The basic server configuration option can be found in the file KxAuth.cfg located at the root of the installation folder. This file contains keys and values separated by an equal sign, as shown in the following example.

Example

############## AuthServer configuration AuthServer.TimeOut=4000AuthServer.MaxConnections=50AuthServer.ExeName=KxCORBA3AuthServer.ExeStartDirectory=../CORBA


AuthServer.DomainName=KXEN01 AuthServer.Admin=rootAuthServer.Admin=admin

Option Default Value Description

AuthServer.TimeOut 4000 Internal time-out parameter used when starting internal instance. If the instance started after user authentication cannot be reached after this specified number of milliseconds, then a time-out occurs and the connection fails. In most cases it is due to a bad configuration or installation of the instance.

AuthServer.MaxConnections 50 Maximum number of concurrent connections on the server.

This can be used to hard-limit the number of Instance processes launched at any time.

AuthServer.ExeName KxCORBA3 Name of the Instance executable file. It should not be changed.

AuthServer.ExeStartDirectory ../CORBA Name and path of the Instance execution directory. It should not be changed.

AuthServer.InstanceConfigFile KxCORBA.cfg Can be used to specify a different configuration file for instances started by Authenticated Server. It can be used for example in a context where the server is used both as Authenticated and as a regular server. More over if the name contains the string '%u' it will be replaced by the authenticated user name starting the instance, so that each user can have a separate configuration. It can be used to specify different Data Sources (FileStoreRoot) or different License for each user.

AuthServer.InstanceConfigPath . Specify the path to be searched for configuration file. By default the configuration file are located in the same directory that the KxCORBA3 executable, but this allow to give a specific directory for all configuration files.

AuthServer.UserMappingFileName

(none) Name of a text file which describe the user mapping. See User Mapping in the related information below.

AuthServer.DomainName KXEN01 Name of the Windows domain to be used for Windows authentication. See Authenticated Server based on the System in the related information below.

AuthServer.Admin root Logging name(s) of the server administrators. Server administrators can see and disconnect all the user connections in the Administration Console.AuthServer.Admin admin

Related Information

User Mapping [page 21]Authenticated Server Based on the System [page 17]



2.4.3 Configuration of SAP BusinessObjects Predictive Analytics Server Instances

The configuration of a server instance, which consists of a CORBA process, requires to set:

● the proper TCP port,● and the proper configuration for the server itself.

The server instance can be configured using the configuration file called KxCORBA.cfg, located in the folder <installation_folder>/KxenServer/. This file is loaded at start-up, and includes several Key/Values properties. The first line should not be edited, blank lines are accepted, and each valid line should include: one of the accepted keyword, the equal sign and the associated value.

The main usual configuration step is the definition of the FileStoreRoot to be used on the local system. It is generally a good idea to set up entries for common data storage such as /tmp/data/ and also a specific entry to store built models for example, /tmp/models/).

Option Description

KxAdmin The root name of the file or table used to store the models in a directory or ODBC store. This file is automatically generated when "commit" or "save" operations are performed on Automated Analytics models. It is used to quickly retrieve the list of available models in a store. By default it is KxAdmin so that it will creates KxAdmin.txt file or KxAdmin tables.

MessageFile Such a message file allows for a quick and easy localization of applications. New message files can be added for new language. The convention used for such message file name is: <Name>_<language>.umsg, where language is an ISO code of a language. For example, fr for French, en for English, de for German.

MessageDirectory This option allows you to load all message files from a single directory. All .umsg file found in that directory will be loaded as message.

FileStoreRoot Such entries are used by the server to retrieve the main file store to be displayed when client applications ask for top-level file directory.

Config Load another configuration file. This is used to load the license file, or to load some data access library, but could be used also to base different configuration files on some common settings, for example one for each user.

LogConf This option gives the name of the log system configuration file to be used. See the related information section below for a description of the logging configuration file itself.

ExampleTo display two directories in the file selection drop down, add the following lines:

FileStoreRoot=/tmp/data/ FileStoreRoot=/tmp/models/

2.4.4 TCP Port and Address Configuration

1. Edit the file KxenCorbaConfig.sh located in the folder /softs/AutomatedAnalytics_<OsName>/.


2. Modify the value of the option NS_PORT. The default value is 12345.

8 # Port used by the CORBA Name Server 9 # This one must also be set on the client's GUI startup scripts.10 # 11 NS_PORT=12345 12 export NS_PORT

3. Modify the value of the option KXEN_PORT. The default value is 12346.

16 # Port used by the server itself 17 # 18 KXEN_PORT=12346 19 export KXEN_PORT

4. Modify the value of the option KXEN_AUTH_PORT. The default value is 12347.

23 # Port used by the authenticated server 24 # 25 KXEN_AUTH_PORT=12347 26 export KXEN_AUTH_PORT

5. Optionally you can set the public address. This is especially useful when the network configuration includes NAT (Network Address Translation), for example when the server is on a private network exposed on another public address. Modify and uncomment the variables <OMNIORB_USEHOSTNAME> and <KX_PUBLIC_ADDRESS> as shown below.

Sample CodeIn this example, the public address of the server is 192.234.18.9.

OMNIORB_USEHOSTNAME=192.234.18.9 export OMNIORB_USEHOSTNAME KX_PUBLIC_ADDRESS=192.234.18.9 export KX_PUBLIC_ADDRESS

2.4.5 Communication Channel Encryption

CautionConnection through Transport Layer Security (TLS) or Secure Sockets Layer (SSL) is not activated by default when you install SAP BusinessObjects Predictive Analytics Server. You have to enable it explicitly.

To enable the encryption through TLS or SSL, you’ll need the following elements:

● A Certification Authority certificate (CA certificate)● The server private key● The server certificate● The server pass phrase (optional)



NoteIf your company can’t provide you with these elements, you can generate self-signed certificates with OpenSSL . Note that for security reasons, it is recommended to use certificates issued by a certificate authority.

2.4.5.1 Enabling the Encryption for Automated Analytics Server

To deploy the certificates on the Automated Analytics server, you’ll need to combine the private key and the server certificate into a single file with the .cer extension.

1. Edit the KxAuthServer.sh file located in <installation folder>/KxAuthServer.

2. Locate the line: exec KxAuthServer [...].

3. Add the following options at the end of the command line: -cacert %CACertificate% -servercert %ServerCertificate% -password %PassPhrase%.

4. Replace the placeholders by the following values:

Placeholder Name Value

%CACertificate% Name of the file containing the CA certificate

%ServerCertificate% Name of the file combining the private key and the server certificate

%PassPhrase% The server private key pass phrase. Only use this option if you have set up a passphrase for the server.

5. Replace tcp by ssl in the following options:

○ -ORBendPointNoPublish giop:tcp:<ADDRESS>:<PORT>○ -ORBendPointPublish giop:tcp:<ADDRESS>:<PORT>

You should then have:○ -ORBendPointNoPublish giop:ssl:<ADDRESS>:<PORT>○ -ORBendPointPublish giop:ssl:<ADDRESS>:<PORT>

6. Save the file.

2.4.6 Authentication Types

2.4.6.1 Authenticated Server Based on the System

If you choose to use the PAM authentication then you should update /softs/AutomatedAnalytics_<OsName>/KxAuthServer/KxAuth.cfg as follow and start the Automated Analytics server under the root user account so that you can use the system password.


http://help.sap.com/disclaimer?site=https://slproweb.com/products/Win32OpenSSL.html

1. Comment the lines starting with Authenticator.File by adding # at the beginning of each line.

2. Uncomment the lines starting with Authenticator.Name by removing the # at the beginning of each line.

############## Authenticator configuration #Authenticator.Name=Void#Authenticator.Name=File#Authenticator.File.FileName=users#Authenticator.File.StoreType=KXEN.FileStore#Authenticator.File.StoreName=.#Authenticator.File.User=#Authenticator.File.Password= Authenticator.Name=System #Authenticator.System.PamServiceName=login

2.4.6.1.1 Adding UNIX Users to the Users Group

In order to allow users to use SAP BusinessObjects Predictive Analytics server, they must be added to a specific users group called kxenusers, which is created during the installation process.

2.4.6.1.2 About PamServiceName

The PamServiceName option refers to the name of the PAM Service used for authentication. This option, for which the value is set to login is commented by default in the configuration file.

The PAM Service name has to be a valid entry defined in the system's PAM configuration file pam.conf located in /etc/. This configuration file defines services by listing the modules to be applied for each service. Refer to the PAM documentation for more details.

It is possible to define a new PAM service for SAP BusinessObjects Predictive Analytics. For example, if you want to implement a specific authentication strategy to be able to add or remove an authentication module.

2.4.6.1.2.1 Defining a New PAM Service

1. Define the proper lines in the /etc/pam.conf file, starting by kxenlogin.

2. Edit the KxAuthServer/KxAuth.cfg file.

3. Uncomment the line starting with Authenticator.System.PamServiceName.

4. Set the value to kxenlogin.



2.4.6.2 Authenticated Server Based on a Fixed Password List

By default, the authentication is based on a fixed file named users, which contains the login and password of each user and is located in the folder /softs/AutomatedAnalytics_<OsName>/KxAuthServer/users.

2.4.6.2.1 Activating and/or Customizing this Option

1. Open the file KxAuth.cfg located in the same folder as the users file.

2. In the section Authenticator configuration , check that the line Authenticator.Name=File is not commented, that is, does not begin with a hash sign (# ).

3. You can customize the options listed in the table below.

Option Description

Authenticator.File.FileName Sets the name of the store containing the users' logins and passwords. By default, the store name is users .

Authenticator.File.StoreType Indicates how the users' logins and passwords are stored, for example in a flat file, in a database, in a SAS file. The default value is KXEN.FileStore, which means that the data are stored in a flat file.

Authenticator.File.StoreName Sets the path where the users' data are stored. The default value is a dot (. ), which means that the data are stored in the same folder as the KxAuth.cfg file.

Sample Code

############## Authenticator configuration #Authenticator.Name=Void Authenticator.Name=FileAuthenticator.File.FileName=usersAuthenticator.File.StoreType=KXEN.FileStoreAuthenticator.File.StoreName=.Authenticator.File.User=Authenticator.File.Password= #Authenticator.Name=System#Authenticator.System.PamServiceName=login

2.4.6.3 Authenticated Server Based on a Fixed Encrypted Password List

By default, the authentication is based on a fixed file named users, which contains the login and password of each user and is located in the folder /softs/AutomatedAnalytics_<OsName>/KxAuthServer/users.


An authenticated server based on a fixed encrypted password list works on same principle than a standard filebased one except that it supports two types of passwords, which are encrypted and non-encrypted. In the password store, the encrypted passwords are preceded by a star (*).

Sample CodeThe following example shows a fixed encrypted password list containing both encrypted and non-encrypted passwords:

Key=Value admin=adminuser1=user1user2=user2 port=*901555fb06e346cb065ceb9808dcfc25

To implement this type of authentication, a password store such as a 'users' password file with passwords stored in clear should be used exactly as in the standard filebased authentication. At this point, it works exactly as an authenticated server based on a fixed file password list. Differences come when a user changes their password, which will then be automatically stored as an encrypted one.

It can be used with an existing 'users' password file used on a server based on the 'File' authentication. Passwords will be progressively encrypted when users change them using the Remote Control Panel.

1. Open the file KxAuth.cfg located in the folder <INSTALLATION DIR>/KxAuthServer.

2. In the section Authenticator configuration, check that the line Authenticator.Name=Encrypted is not commented , that is, does not begin with a hash sign (# ):

3. You can customize the options listed in the table below.

Option Description Default Value

Authenticator.Encrypted.FileName

Sets the name of the store containing the users' logins and passwords

users

Authenticator.Encrypted.StoreType

Indicates how are stored the users' logins and passwords, for example in a flat file, in a database, in a SAS file

KXEN.FileStore

This value means that the data are stored in a flat file.

Authenticator.Encrypted.StoreName

Sets the path where the users' data are stored

. (dot)

This value means that the data are stored in the same folder as the KxAuth.cfg file.

The following lines show the default settings to use for the encrypted authentication in the KxAuth.cfg file.

#Authenticator.Name=File #Authenticator.File.FileName=users#Authenticator.File.StoreType=KXEN.FileStore#Authenticator.File.StoreName=.#Authenticator.File.User=#Authenticator.File.Password=Authenticator.Name=EncryptedAuthenticator.Encrypted.FileName=users



Authenticator.Encrypted.StoreType=KXEN.FileStoreAuthenticator.Encrypted.StoreName=.#Authenticator.Encrypted.User=#Authenticator.Encrypted.Password=#Authenticator.Name=System #Authenticator.System.PamServiceName=login

2.4.6.4 No Authentication

Another authentication scheme called "Void" is available, but it should only be used with care, generally for technical integration with other system. This "Void" authenticator accept any combination of user and password as a valid one, it does not perform any actual identity check.

This authentication scheme can be used when the connections of the authenticated server are only created by another software components, such as web server, or another application where identity is already managed. The other software components might want to create connection as some user, but do not want or need to do an actual authentication.

The goal of specifying a user in a void authentication connection is to be able to trace the work and process on a per-user basis since most logs and trace information reference the connected user.

NoteAlthough it is possible to enter an empty user/password in such a case, it is not a recommended practice for traceability and efficiency purpose: all logs will be mixed in the same file, without any distinction.

If this kind of authentication is used, the software integrator or application developer should ensure that the server cannot be physically accessed another way by using proper firewalls, network configuration, …, as allowing a connection from another route will prevent data security.

Also in such a configuration, it is strongly recommended to not start the server as administrator or super user, as no impersonification will be done after authentication. The identity of the instance started will be the one used to start the server process itself.

2.4.7 User Mapping

Once a user is authenticated through the authentication module, the server will start a new instance for that user connection. The system account used for this new instance can be:

● The same system account as the one used to start the server. This occurs with “void” authenticator for example.

● The system account of the authenticated user, this is the default with the system authentication.● A different system account, as specified in a “User-Mapping” file. This file will specify, for each

authenticated user name the name of a system account to be used. This feature is available only on UNIX.

The mapping file contains the name of the logical authenticated user and the name of the actual user account to be used separated by an equal sign.


ExampleFor example, here is a sample file which maps 5 users on 2 different accounts:

Key=Value user1=kxuser1user2=kxuser1user3=kxuser1user4=kxuser2 user5=kxuser2

If a user is not present in this mapping file, then by default it will be denied, unless a specific entry is present in this mapping file:

*=kxusern

This indicates that “all other users” will be mapped to physical user “kxusern ”.

To be used by authenticated server, the mapping file need to be declared in the configuration file (KxAuth.cfg). Uncomment the UserMappingFile entry, and specify the correct filename.

Example

… AuthServer.UserMappingFileName=mymapping.txt …

User mapping can be used to simplify user account management, or to implement specific authorization policies.

Other special rules for user mapping allow creating specific mapping policies.

To map specific users as themselves:

Key=Value user1=*

The authenticated server will start a CORBA process as user1 when user1 authenticates himself. To map all the other users as themselves, use the following syntax.

Key=Value user1=kxuser1user5=kxuser2 *=*

Any other users than user1 and user5 will be mapped as themselves.

2.4.8 User Environment SetupThe SAP BusinessObjects Predictive Analytics server allows multiple users to run server processes via impersonation.

These users can have different needs in the global configuration of their work environment under UNIX Operating Systems.



One example is the need to access different databases such as Teradata and Oracle. The access to specific databases is set up in the user environment in variables like ODBCINI and the shared library path.

The idea is to allow the set-up of the execution environment of SAP BusinessObjects Predictive Analytics.

NoteThis setup is not automatically done by the assisted configuration script.

2.4.8.1 Options Allowing Set-up Configuration

The following options can be set up in the configuration file KxAuth.cfg

Option Description Default Value

AuthServer.ShellStarter the full path to the shell to use to launch the KxLauncher_start.sh for all the users.

/bin/sh

AuthServer.StartAsLoginShell

starts the shell as a login shell. A login shell will load the user's environment as if the user logs in with rlogin.

false

AuthServer.ShellOption the option to pass to the shell if needed. For example, on some operating systems bash needs to be launched as an interactive shell with the option -i in order to source its configuration scripts.

empty

So for example if the AuthServer.ShellStarter option above is /bin/bash and the AuthServer.ShellOption is -i, the process run will be equivalent to launch, for each user:

/bin/bash -i KxLauncher_start.sh

2.4.8.2 Guidelines

The guidelines listed below must be followed when defining variables:

● Any redefinition of the shared library path and the <$PATH> variable must take into account the previous values of this variables:

LD_LIBRARY_PATH=/usr/local/unixODBC_v2.4/libs:$LD_LIBRARY_PATH export LD_LIBRARY_PATH

● When the .kxen_profile is sourced, the current directory for the shell is the server directory.● The environment variable definition is using the POSIX standard shell sh semantic, which first defines the

variable, then exports it. To guarantee a proper functioning, you should use the following syntax to define your variables:

Code Syntax

MyVariable=ok


export MyVariable

● Use the <$HOME> variable rather than the tilde character ( ~ ) to refer to the Home directory:

ODBCINI=$HOME/MyOdbcini.ini

● Export ODBCINI

2.4.8.3 Troubleshooting

If the server does not start for a user, follow the procedure described below:

1. Log on the machine as the user.2. Make sure the user is in the KXEN group by executing the command: groups3. Go to $KXINSTDIR/KxenServer.

4. Execute the command: /bin/sh KxLauncher.sh KxCORBA3 -NoRegisterThe error should be displayed in the standard output.

2.5 Reloading the Configuration

You can reload part of the configuration of the server without restarting it.

Execute the following command: /softs/AutomatedAnalytics_<OsName>/kxen.server reload_configurationThis will reload only the options of the server such as identification, maximum connection, timeout, but will not reload the other options like the log files.

NoteSending the signal SIGUSR1 to the KxAuthServer process will have the same result.

2.6 Starting the Server on UNIX

The system account used to start the autenticated server should have sufficient rights to perform authentication and impersonation, that is, start the server instance as another user. In particular, it means that most of the time it should be started with the root user account if:

● System authentication is to be used through Pluggable Authentication Module (PAM). Access to UNIX System account password required root privileges.

● Server instances are going to be started with a different system account than the authenticated server.



So the only case where a different user (who is not identified as root) can be used is when void or File/Encrypted authentications are used, and all users are mapped to the same used as the one used to start the processes.

Before starting Automated Analytics server, make sure that:

● The user account used to run the server can write in the tmp directory of the application installation. It is the case if○ the user who runs SAP BusinessObjects Predictive Analytics is also the one used to install the software○ if the user running SAP BusinessObjects Predictive Analytics is root (which is ensure by the post

installation configuration script).● Users that will be connecting to the server should have rights also to write their logs on the file system. By

default it is the tmp directory of the installation. Typically this could be done by following the steps listed below:1. Create a UNIX group dedicated to Automated Analyticss users (for example kxenusrs).2. Add the concerned UNIX accounts to this group.3. Set this group as the group owner of the tmp directory. This should be done if the application has been

set up with a user account that has this group set as its primary group.4. Allow the group to write there. This is automatically done when using the post installation

configuration script.

chgrp kxenusrs tmp chmod g+w tmp

CautionThe three procedures described below should be executed as root.

2.6.1 Starting the Server and its Name Server

Enter the command: /softs/AutomatedAnalytics_<OsName>/kxen.server start

2.6.2 Checking Whether the Server is Running

Enter the command: /softs/AutomatedAnalytics_<OsName>/kxen.server check

2.6.3 Stopping the Server and its Name Server

Enter the command: /softs/AutomatedAnalytics_<OsName>/kxen.server stop


2.7 Deploying the Client

SAP BusinessObjects Predictive Analytics client applications are Java graphical user interface that connect to SAP BusinessObjects Predictive Analytics servers. The client application can be installed:

● Through Java Web Start: in this mode, a Web server needs to be installed and configured on the machine hosting the SAP BusinessObjects Predictive Analytics server. It will deliver, through web pages, the necessary content in order for the client computer to run the application.

● With standalone installers on each targeted client system.

We recommend using the Web Start facility, as it will allow automatic client version migration in case of a server upgrade.

Using Java Web Start

Java Web Start is an application launcher for the client application. It allows you to start the client from a web site.

The updates are automatically managed through the Java Web Start system. This system avoids having to manually install the client on every computer of the local network. As an extra, if the client is updated on the server, all the distributed applications will automatically be updated too.

The installation and configuration of Java Web Start is described in the Java Web Start Installation Guide provided on the SAP help portal.

Manually Install Clients for SAP BusinessObjects Predictive Analytics Server

For information on the installation and configuration of an SAP BusinessObjects Predictive Analytics client, read the Client Installation Guide.

2.7.1 Using Java Web Start

Java Web Start is an application launcher for the client application. It allows you to start the client from a web site.

The updates are automatically managed through the Java Web Start system. This system avoids having to manually install the client on every computer of the local network. As an extra, if the client is updated on the server, all the distributed applications will automatically be updated too.

The installation and configuration of Java Web Start is described in the Java Web Start Installation Guide provided on the SAP help portal.



2.7.2 Manually Install Clients for SAP BusinessObjects Predictive Analytics Server

SAP BusinessObjects Predictive Analytics clients can also be manually installed.

1. Use the SAP BusinessObjects Predictive Analytics installer to install a client.

NoteFor more detailed information on the installation and configuration of a SAP BusinessObjects Predictive Analytics client, read the Client Installation Guide .

2. To connect the client to the server, add the argument -authenticated on the command line.


3 Monitoring

3.1 Starting the Administration Console

The administration console is a tool that allows the server administrator to follow the users' activity on the server by:

● listing active connections, with information such as user, last activity time stamp, number of current models,

● listing the state of models being within each connection,● disconnecting an existing connection. This should be used with care, in case some pending connection

remains active while a client crashed for example, in order to free the associated process.

/softs/AutomatedAnalytics_<OsName>/KJWizardCORBA/KxControlPanel.sh serverhost where serverhost is the name of the host running the name server.

3.2 Logging

Automated Analytics offers a logging system which is activated by default and can be deactivated if needed. The goal of this logging system is for an administrator or a support team to be able to trace and analyze the application activity on within the kernel. Note that the activity of the client user interfaces is only seen through events fired within the kernel.

It can be deactivated within a server, or in the Shell utility.

The default log files for the server are:

● kxen_auth_log.txt: the default activity trace for the server, which can be used mainly for debugging purpose

● kxenusagelog.txt: the goal of this log file is to have a simpler monitoring of the overall Automated Analytics activity. This log will include one line for each of the following events: user connection, user disconnection, training of a model, application of a model, saving of a model.

These files are located in the tmp directory of the SAP BusinessObjects Predictive Analytics distribution.

For a detailed description of the logging system, see Operations Guide.


Monitoring

4 Troubleshooting

4.1 Displaying the Server Log File

Enter the command: cat nohup.outThe log displays the list of problems found when starting the servers.

4.2 Error: ./tmp/KxAuthServer_.pid is not running

When starting the server with the command ./kxen.server start, you may encounter this error. In that case, follow the procedure described below to identify the problem.

4.2.1 Missing openssl Library

If the log contains the following line:

KxAuthServer: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: …

This means that the required SSL library is not available on the system.

4.2.1.1 Correcting the Issue

1. Check that there is a SSL library installed on the system.On a RedHat Enterprise 5, use the command:

rmp –qa | grep ssl

2. Display the list of the files installed by the openssl package and filter it to display only the required libraries.On a RedHat Enterprise 5, enter the following commands:

rpm –ql openssl<installed_version> | grep libssl rpm –ql openssl<installed_version> | grep libcryp

where <installed_version> is the version of the openssl package listed in the previous step.

3. Go to the installation directory.

Server Installation Guide for UNIXTroubleshooting C U S T O M E R 29

4. Go to the libs folder.

5. Create the symbolic links using the name of the library indicated as missing.If the library lib_ssl.so.1.0.0 is missing, enter the following commands:

ln –s <lib64 path>/libssl.so.<version number> libssl.so.1.0.0 ln –s <lib64 path>/libcrytpo.so.<version number> libcrypto.so.1.0.0

where <lib64 path> is the location of the lib64 folder provided by the commands at step 2.

6. Restart the servers using the commands:

./kxen.server stop rm nohup.out ./kxen.server start

The servers should start. If they do not, check the log file again and contact your administrator or the support.


Troubleshooting

Important Disclaimers and Legal Information

Coding SamplesAny software coding and/or code lines / strings ("Code") included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended to better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, unless damages were caused by SAP intentionally or by SAP's gross negligence.

AccessibilityThe information contained in the SAP documentation represents SAP's current view of accessibility criteria as of the date of publication; it is in no way intended to be a binding guideline on how to ensure accessibility of software products. SAP in particular disclaims any liability in relation to this document. This disclaimer, however, does not apply in cases of willful misconduct or gross negligence of SAP. Furthermore, this document does not result in any direct or indirect contractual obligations of SAP.

Gender-Neutral LanguageAs far as possible, SAP documentation is gender neutral. Depending on the context, the reader is addressed directly with "you", or a gender-neutral noun (such as "sales person" or "working days") is used. If when referring to members of both sexes, however, the third-person singular cannot be avoided or a gender-neutral noun does not exist, SAP reserves the right to use the masculine form of the noun and pronoun. This is to ensure that the documentation remains comprehensible.

Internet HyperlinksThe SAP documentation may contain hyperlinks to the Internet. These hyperlinks are intended to serve as a hint about where to find related information. SAP does not warrant the availability and correctness of this related information or the ability of this information to serve a particular purpose. SAP shall not be liable for any damages caused by the use of related information unless damages have been caused by SAP's gross negligence or willful misconduct. All links are categorized for transparency (see: http://help.sap.com/disclaimer).

Server Installation Guide for UNIXImportant Disclaimers and Legal Information C U S T O M E R 31

http://help.sap.com/disclaimer/

go.sap.com/registration/contact.html

© 2017 SAP SE or an SAP affiliate company. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.Please see http://www.sap.com/corporate-en/legal/copyright/index.epx for additional trademark information and notices.

https://go.sap.com/registration/contact.html

https://go.sap.com/registration/contact.html

http://www.sap.com/corporate-en/legal/copyright/index.epx

http://www.sap.com/corporate-en/legal/copyright/index.epx

Documents

Server Installation Guide for UNIX - SAP Help Portal · PDF fileFor upgrade information when a previous version of the server ... For additional information on how to install SAP BusinessObjects