Configuring Content Collector for SAP for use with IBM Tivoli Storage Manager and securing and monitoring Content Collector for SAP

Transcription

1 IBM Content Collector for SAP Applications Version 4 Release 0 Configuring Content Collector for SAP for use with IBM Tivoli Storage Manager and securing and monitoring Content Collector for SAP

2

3 IBM Content Collector for SAP Applications Version 4 Release 0 Configuring Content Collector for SAP for use with IBM Tivoli Storage Manager and securing and monitoring Content Collector for SAP

4 Note Before using this information and the product it supports, read the information in Notices on page 187. Third edition (December 2015) This edition applies to version 4, release 0, modification 0 of IBM Content Collector for SAP Applications (product number 5725-B46) and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright IBM Corporation 2010, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this information vii Intended audience vii Terminology and conventions used in this information vii Screen captures vii Accessibility features of Content Collector for SAP viii ibm.com and related resources viii Contacting IBM viii What's new in Version ix What s new in the third edition ix What s new in the second edition ix Part 1. Configuring Chapter 1. Preparing your environment Preparing your environment for Collector Server Configuring your environment for Tivoli Storage Manager Setting up a basic SAP system Creating a user with CPIC access Restricting the access of the CPIC user Creating a role and a profile for the CPIC user Assigning the role to the CPIC user Linking a logical system to the SAP client Defining a number range for SAP ArchiveLink Chapter 2. Configuring Tivoli Storage Manager for use with Content Collector for SAP Registering a Tivoli Storage Manager node with Content Collector for SAP Creating management classes Creating an archive copy group Validating and activating the STANDARD policy set Setting the password options Configuring a connection to a remote Tivoli Storage Manager server Chapter 3. Configuring IBM Content Navigator Configuring IBM Content Navigator for use with Tivoli Storage Manager Associating users with task manager roles Chapter 4. Configuring a daemon Configuring the server authentication on Collector Server Configuring the client authentication Starting the daemon Configuring the server authentication on the web application server Chapter 5. Configuring Collector Server Getting started with Configuration Feature Importing the instance configuration from a server configuration profile Creating several instances of Collector Server: Hints and tips Configuring the communication with SAP, IBM Content Navigator, and the API Communication with SAP, IBM Content Navigator, and the API: Overview Configuring the communication with SAP Configuring SAP for an HTTP connection Creating an SAP ArchiveLink protocol for an HTTP connection Creating SAP ArchiveLink queues for an HTTP connection Creating a content repository for an HTTP connection Enabling the use of HTTP requests with a seckey Configuring SAP for an RFC connection Creating an RFC destination for an RFC connection Creating an SAP ArchiveLink protocol for an RFC connection Creating SAP ArchiveLink queues for an RFC connection Creating a content repository for an RFC connection Configuring the communication with IBM Content Navigator Configuring the server authentication Configuring the server authentication on Collector Server Configuring the server authentication on the web application server Configuring the client authentication Storing documents in more than one Tivoli Storage Manager repository: Considerations Chapter 6. Configuring your environment for basic tasks Configuring for archiving data Setting up the sample archiving object FI_BANKS Configuring the SAP ArchiveLink path Checking your data archiving configuration 60 Copyright IBM Corp. 2010, 2015 iii

6 6.1.4 Creating test data for the sample archiving object Running an archiving session to test your archiving setup Configuring for archiving data and for protecting archived data and documents by using BC-ILM Configuring for archiving and protecting data by using BC-ILM Configuring for archiving data and protecting archived data and documents by using BC-ILM Creating a user for ILM-enabled data archiving Creating a user for ILM-enabled data archiving if the user data is stored in the SAP J2EE database Creating a user for ILM-enabled data archiving if the user data is stored in the SAP ECC database Creating a root collection in the empty logical archive Creating a destination in XML Data Archiving Service (XML DAS) Creating an archive store in XML Data Archiving Service (XML DAS) Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS) Creating the home paths for the archiving objects in the logical archive Assigning the home paths to the archive store Configuring for archiving incoming documents Configuring for archiving incoming documents by processing their bar codes Configuring for archiving incoming documents by creating work items in an SAP workflow Associating documents with a specific SAP workflow Enabling the Collector Server instance to archive incoming documents Configuring for archiving outgoing documents Configuring for archiving and viewing print lists Defining an archive device Associating print lists with an SAP business object of type DRAW Creating an SAP ArchiveLink batch job Enabling extended ALF viewing Enabling print-list viewing Configuring for viewing archived documents with the SAP GUI Chapter 7. Configuring your environment for more or advanced tasks Setting timeouts for the RFC or Java RFC dispatcher and the agents Setting the timeout for the RFC or Java RFC dispatcher Setting the timeout period for the agents Assigning fixed ports to the client dispatchers Configuring for preprocessing outgoing documents The preprocessor user exit Requirements for running a preprocessor The input for the preprocessor The result from the preprocessor The format of the result file The format of the result object The preprocessor Including the preprocessors in the archiving process Integrating Content Collector for SAP into the SAP Solution Manager Chapter 8. Running a Collector Server instance Creating and updating options files Starting a Collector Server instance Starting a Collector Server instance from IBM Content Navigator Starting a Collector Server instance from a command line Making an instance configuration available for use by Collector Server Exporting the instance configuration from Configuration Feature Downloading the instance configuration with the archcmd command Starting a Collector Server instance with the archpro command Starting a Collector Server instance that uses Tivoli Storage Manager, with the archpro command Stopping a Collector Server instance Restarting a Collector Server instance Chapter 9. Running a Collector Server instance as a Windows service Installing a Collector Server instance as a service and starting the service Installing a Collector Server instance as a service and running the service from IBM Content Navigator Installing a Collector Server instance as a service and running the service from a command line Running several instances of Collector Server as services Uninstalling a service Hints and tips Part 2. Security iv Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

7 Chapter 10. Changing the master key 131 Chapter 11. Changing the passwords in the password file Chapter 12. Setting up a secure communication with the API Setting up a secure connection on Collector Server Creating the keystores Enabling the Collector Server instance to communicate with the API Setting up a secure connection on the system with the API Scenario 1: One user uses the API Scenario 2: Several users where each user has a certificate Scenario 3: One certificate for several users in a private directory Scenario 4: One certificate for several users in a public directory Setting up a secure communication between the API and several Collector Server instances Chapter 13. Setting up an HTTPS communication with SAP Configuring the server authentication Configuring server authentication on Collector Server Creating an SSL keystore and a certificate for the Collector Server instance Having the certificate signed by a certificate authority Enabling the Collector Server instance for the server authentication Exporting the server certificate Configuring the server authentication in SAP Importing the Collector Server certificate into SAP Enabling SSL support for the content repositories Configuring the client authentication Exporting the SAP certificate Importing the SAP certificate into the SSL truststore Enabling the Collector Server instance for the client authentication Securing the communication with an entire Collector Server instance or with specific logical archives only Chapter 14. Configuring Content Collector for SAP for US government security standards Part 3. Monitoring Chapter 15. Monitoring the connection between Collector Server and the repositories Monitoring the connection between Collector Server and the repositories from IBM Content Navigator Monitoring the connection between Collector Server and the repositories by using the archcheck Java API Calling the archcheck Java API from a command line by using the archcheck program Calling the archcheck Java API from a Java application Chapter 16. Monitoring the compliance with the license agreements Monitoring document retrieval requests with the IUVU tool Configuring the IUVU tool Activating the IUVU tool Deactivating the IUVU tool Monitoring the document retrieval requests The SAP tables containing the retrieval requests: Overview Creating an IUVU report regularly Creating an IUVU report at your request The IUVU report: Description Determining the S_WFAR_OBJ users Part 4. Appendixes Notices Trademarks Terms and conditions for product documentation 189 IBM Online Privacy Statement Glossary Index Contents v

8 vi Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

9 About this information Intended audience This book shows how to configure IBM Content Collector for SAP Applications for use with Tivoli Storage Manager and how to secure and monitor Content Collector for SAP. For better guidance, it includes screen captures of the SAP windows. This book is intended for the administrators who are responsible for setting up IBM Content Collector for SAP Applications. Administrators should have an in-depth knowledge of SAP and the repositories that they intend to use. It is assumed that they are familiar with the three-tier architecture of SAP and that they have a basic understanding of document management and the repositories. In addition, they should have a good working knowledge of the underlying operating system. This book also addresses programmers who must create customized repository clients, and who must therefore familiarize themselves with the concepts of IBM Content Collector for SAP Applications and SAP so that they can modify and extend sample code. Terminology and conventions used in this information To facilitate reading, product names are abbreviated in this information, where applicable. v IBM Content Collector for SAP Applications Version 4.0 is abbreviated to Content Collector for SAP. v denotes Configuration Feature. Screen captures v denotes a server configuration profile. Related reference: Glossary on page 191 The glossary explains terms that are used in this information. Terms that are shown in italics are defined elsewhere in this glossary. The explanation of the various configuration tasks is complemented by screen captures of SAP windows. The screen captures were taken on a Windows system. Most of the entries and selections in the screen captures are examples only that you can change according to your needs. The screen captures are based on SAP ERP Central Component (ECC) 6. If you use another version of SAP ECC, your windows might differ slightly. The entries and selections in the SAP windows are often surrounded by a rectangle so that they are easier to spot. Copyright IBM Corp. 2010, 2015 vii

10 Accessibility features of Content Collector for SAP The graphical user interface of Content Collector for SAP is deployed as a plug-in in IBM Content Navigator. Therefore, the accessibility features of IBM Content Navigator apply. For more information, go to the IBM Content Navigator product documentation ( and search for Accessibility features. ibm.com and related resources Product support and documentation are available from ibm.com. Support and assistance From ibm.com, click Support & downloads and select the type of support that you need. From the Support Portal, you can search for product information, download fixes, open service requests, and access other tools and resources. IBM Knowledge Center See your online product information in IBM Knowledge Center at contentcollectorforsap_welcome_4.0.0.html. PDF publications See the PDF publications for your product at docview.wss?rs=86&uid=swg Contacting IBM For general inquiries, call 800-IBM-4YOU ( ). To contact IBM customer service in the United States or Canada, call IBM-SERV ( ). For more information about how to contact IBM, including TTY service, see the Contact IBM website at viii Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

11 What's new in Version 4.0 Content Collector for SAP V4.0 provides advanced archiving capabilities that help SAP users run their businesses more efficiently. Content Collector for SAP is designed to provide access to a wide range of business information, transfer older information to lower-cost storage with optional SAP retention enforcement, and improve system performance. This section summarizes the significant improvements or enhancements over Content Collector for SAP Version 3.0 and refers you to the relevant topics for more information. What s new in the third edition This edition includes the following updates: Configuring v You can start and stop a Collector Server instance directly from IBM Content Navigator. For more information, see 8.2.1, Starting a Collector Server instance from IBM Content Navigator, on page 118. v You can install a Collector Server instance as a Windows service from IBM Content Navigator and start and stop the service from IBM Content Navigator. For more information, see 9.1.1, Installing a Collector Server instance as a service and running the service from IBM Content Navigator, on page 125. Security v You can create a master key also when you start a Collector Server instance from IBM Content Navigator. For more information, see Chapter 10, Changing the master key, on page 131. v The topic about how to change passwords in the password file has been updated. For more information, see Chapter 11, Changing the passwords in the password file, on page 133. Monitoring You can monitor the connection between Collector Server and the repositories from IBM Content Navigator. For more information, see 15.1, Monitoring the connection between Collector Server and the repositories from IBM Content Navigator, on page 163. Technical changes and major changes to the text are indicated by a vertical bar () to the left of each new or changed line of information. What s new in the second edition This edition includes the following updates: Configuring v To use IBM Content Navigator, you must also copy the iccsaptasks.jar file to the web application server where IBM Content Navigator is installed. Copyright IBM Corp. 2010, 2015 ix

12 v v v For more information, see 3.1, Configuring IBM Content Navigator for use with Tivoli Storage Manager, on page 25. To use Operation Feature of Content Collector for SAP, you must associate the users with the predefined task manager roles. For more information, see 3.2, Associating users with task manager roles, on page 26. The information about how to configure the communication between IBM Content Navigator and a Collector Server instance has been updated in various topics. For more information, see 5.2.3, Configuring the communication with IBM Content Navigator, on page 47. The topic about fixed ports has been reworked. For more information, see 7.2, Assigning fixed ports to the client dispatchers, on page 110. Security The information about how configure an HTTPS connection between SAP and a Collector Server instance has been updated in various topics. For more information, see Chapter 13, Setting up an HTTPS communication with SAP, on page 145. x Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

13 Part 1. Configuring Which components of Content Collector for SAP and which products you must configure depends on the tasks that you want to complete with Content Collector for SAP. All tasks require a running Collector Server instance. Thus, the following configuration steps are mandatory: 1. Chapter 1, Preparing your environment, on page 3 2. Chapter 2, Configuring Tivoli Storage Manager for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 To start and stop the Collector Server instances from IBM Content Navigator, complete this task: Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 33 After you complete these steps, you have a basic Collector Server instance configuration. Decide which tasks you want to complete with Content Collector for SAP and go to the appropriate configuration topics under Chapter 6, Configuring your environment for basic tasks, on page 53 and, optionally, Chapter 7, Configuring your environment for more or advanced tasks, on page 109. Some of these tasks require additional configuration of Collector Server, the repositories, or SAP. Then, start the configured Collector Server instances. You complete all configuration tasks and you start the Collector Server instances in your role as Collector Server administrator. Restriction: Only SAP configuration tasks that are necessary for Content Collector for SAP to work successfully or that are required for the communication between SAP and Content Collector for SAP are described in this information. For all other SAP configuration tasks, see the SAP documentation. Copyright IBM Corp. 2010,

14 2 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

15 Chapter 1. Preparing your environment Content Collector for SAP requires at least one instance of Collector Server. In addition, you must set specific environment variables and set up a basic SAP system. Before you begin: You installed Tivoli Storage Manager and Content Collector for SAP. Procedure: , Preparing your environment for Collector Server , Configuring your environment for Tivoli Storage Manager, on page , Setting up a basic SAP system, on page Preparing your environment for Collector Server Content Collector for SAP requires at least one instance of Collector Server. Each instance requires specific directories. Before you begin: Plan for a secure Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: 1. Log on as Collector Server administrator. 2. Linux UNIX Add the following call of the shell script to the.profile file, which is in the home directory of the Collector Server administrator:. InstallHome/server/bin/csenv.sh Note the space between the period (.) and InstallHome. 3. Create the following directories: a. Create an instance directory where all instance-related files are to be stored: v Linux UNIX Create the instance directory in the UserHome directory of the Collector Server administrator. For example: /home/iccsapadmin/instance1 v Windows It is good practice to create the instance directory in the env_var_appdata directory of the Collector Server administrator. For example: C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\instance1 Create as many instance directories as you plan to create Collector Server instances. Each instance must have its own instance directory. Make a note of the path to the instance directory. You must specify this path later when you configure Collector Server. b. In the instance directory, create a directory that is named SAPCertificates. The SAP certificates for the repositories are stored in this directory. c. In the instance directory, create a directory with the name queue for the job queues. If you want to store the job queues in different directory or if you expect many job queues, do not create this directory. Instead, specify a path of your choice when you configure Collector Server. Copyright IBM Corp. 2010,

16 Important: Fix Pack 1 Those directories are created for you when you start the Collector Server instance from IBM Content Navigator. What to do next: 1.2, Configuring your environment for Tivoli Storage Manager 1.2 Configuring your environment for Tivoli Storage Manager You must configure specific environment variables so that the Tivoli Storage Manager API clients can locate certain files. Before you begin: 1.1, Preparing your environment for Collector Server, on page 3 Proceed as follows: v Set the DSMI_CONFIG environment variable to the fully qualified path to the empty client option file dsm.opt. Examples: Linux UNIX If you saved the file to the /opt/ibm/cssap/server/ client_opt directory, specify the environment variable as follows: DSMI_CONFIG=/opt/ibm/iccsap/server/client_opt/dsm.opt v Windows If you saved the file to the C:\Program Files\IBM\iccsap\server\ client_opt directory, specify the environment variable as follows: DSMI_CONFIG=C:\Program Files\IBM\iccsap\server\client_opt\dsm.opt Set the DSMI_DIR environment variable to the following path: Linux UNIX /usr/tivoli/tsm/client/api/bin64. The environment variable must point to the bin64 directory. It must not point to the bin directory. v v Windows The path where the Tivoli Storage Manager message file dscenu.txt is stored. Set the DSMI_LOG environment variable to the directory where the Tivoli Storage Manager error log dsmerror.log is stored. Set the PATH environment variable to the directory where the Tivoli Storage Manager API DLLs are stored. What to do next: 1.3, Setting up a basic SAP system 1.3 Setting up a basic SAP system To perform any of the Content Collector for SAP tasks, a basic SAP system must exist. Before you begin: 1.2, Configuring your environment for Tivoli Storage Manager Procedure: , Creating a user with CPIC access , Linking a logical system to the SAP client, on page , Defining a number range for SAP ArchiveLink, on page Creating a user with CPIC access Create a user in the SAP client that you want to use with Content Collector for SAP. 4 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

17 Create the sample user CPICUSER1 in SAP client 800. Procedure: 1. In the SAP GUI, enter the transaction code SU01 to open the User Maintenance: Initial Screen window. 2. In the User field, specify a name for the CPIC user that you want to create. For example, type: CPICUSER1 Note: SAP translates lowercase characters or a mixture of lowercase and uppercase characters into uppercase characters. Figure 1 shows the User Maintenance: Initial Screen window containing the sample user name CPICUSER1. Figure 1. User Maintenance: Initial Screen window containing the sample user name CPICUSER1 You must specify the CPIC user name later when you configure Collector Server. 3. Click the Create icon. The Maintain User window opens. 4. On the Address page, in the Last name field, type the surname of the user. For example, type: CPICUSER1_family Figure 2 on page 6 shows the Maintain User window containing CPICUSER1_family as sample surname for sample user CPICUSER1. Chapter 1. Preparing your environment 5

18 Figure 2. Address page of Maintain User window containing the sample surname CPICUSER1_family 5. Click the Logon data tab and specify the following information. a. From the User Type field, select Communications Data. b. In the Initial password field, type a password for the user. c. Repeat this password in the Repeat password field. d. Optional: In the Valid from and Valid through fields, specify the start date and end date of the period during which this user is valid. Figure 3 on page 7 shows what the Logon data page of the Maintain User window might look like after you completed step 5. 6 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

19 Figure 3. Logon data page of the Maintain User window containing the necessary settings 6. Decide whether you want to give the CPIC user access to the entire SAP system or whether you want to give the CPIC user only those authorizations that are needed to archive, link, and view data, print lists, and documents. v To give the CPIC user access to the entire SAP system, complete the following steps: a. Click the Profiles tab. b. In the first line of the Profile column, type: SAP_ALL c. In the second line of the Profile column, type: SAP_NEW Figure 4 on page 8 shows the Profiles page of the Maintain User window containing the necessary authorizations for sample user CPICUSER1. Chapter 1. Preparing your environment 7

20 Figure 4. Profiles page of the Maintain User window containing the necessary authorizations for sample user CPICUSER1 v d. Click the Save icon to save your settings. To restrict the access of the CPIC user, complete these steps: a. Click the Save icon to save your settings. b , Restricting the access of the CPIC user What to do next: Depending on your decision regarding the authorizations of the CPIC user, continue with either of the following tasks: v , Restricting the access of the CPIC user v 1.3.2, Linking a logical system to the SAP client, on page Restricting the access of the CPIC user Instead of giving the CPIC user access to the entire SAP system, you can give the CPIC user only those authorizations that are needed to archive, link, and view data, print lists, and documents Creating a role and a profile for the CPIC user: You must create a role for the CPIC user. In addition, you must create a profile where you specify the necessary authorizations. Create the sample iccsap_user. Procedure: 1. In the SAP GUI, enter the transaction code PFCG to open the Role Maintenance window. 2. In the Role field, type a name for the role. For example, type: iccsap_user 8 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

21 Figure 5 shows the Role Maintenance window containing the sample role iccsap_user. Figure 5. Role Maintenance window containing the sample role iccsap_user 3. Click the Single Role icon. The Create Roles window opens. 4. In the Description field, type a description. Then, click the Save icon to save your settings. For example, type: Authorizations for Content Collector for SAP Figure 6 shows the Create Roles window containing the sample role description. Figure 6. Create Roles window containing the sample role description 5. Click the Authorizations tab. The title of the window changes to Change Roles. 6. Under Information About Authorization Profile, click the Propose Profile Names icon to the right of the Profile Name field. SAP generates a profile name and a description. Figure 7 on page 10 shows the Change Roles window containing the generated profile name and description. You can change the description. Chapter 1. Preparing your environment 9

22 However, leave the generated profile name. Figure 7. Change Roles window containing the generated profile name and description 7. Click the Save icon to save your settings. 8. Under Maintain Authorization Data and Generate Profiles, click the Change authorization data icon. See Figure In the Change role: Authorizations window, click the Do not select templates icon. 10. Click the Manually icon. 11. In the Manual selection of authorizations window, type the following authorizations in the right column, one authorization on each line: v S_WFAR_LOG v S_WFAR_LOP v S_WFAR_OBJ v S_WFAR_PRI v S_WFAR_RED v S_RFC Figure 8 on page 11 shows the Manual selection of authorizations window containing the necessary authorizations. 10 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

23 Figure 8. Manual selection of authorizations window showing the necessary authorizations 12. Click the Continue icon to save your specifications and to return to the Change role: Authorizations window. Figure 9 shows the Change role: Authorizations window containing the specified authorizations. Figure 9. Change role: Authorizations window showing the specified authorizations Chapter 1. Preparing your environment 11

24 13. Activate the individual authorizations: Expand all nodes and click each asterisk (*). The background color of the asterisks changes from blue to green. When all asterisks have a green background, the status of the nodes automatically changes from yellow to green. Figure 10 shows the Change role: Authorizations window where some authorizations are activated. Figure 11 on page 13 shows what the Change role: Authorizations window must look like after you activated all authorizations. Figure 10. Change role: Authorizations window showing some asterisks with a green background 12 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

25 Figure 11. Change role: Authorizations window after activating all authorizations 14. Click the Save icon to save your settings. 15. Click the Generate icon to create the role and thus the profile. What to do next: , Assigning the role to the CPIC user Assigning the role to the CPIC user: You must assign the role, including the profile, to the CPIC user. Assign the sample role iccsap_user to the sample user CPICUSER1. Before you begin: , Creating a role and a profile for the CPIC user, on page 8 Procedure: 1. In the SAP GUI, enter the transaction code SU01 to open the User Maintenance: Initial Screen window. 2. In the User field, specify the name of the CPIC user to which you want to assign the role. For example, type CPICUSER1 3. Click the Change icon. 4. In the Maintain User window, click the Roles tab. 5. In the Role column of the Role Assignments table, specify the name of the role that you want to assign and press Enter. For example, type: iccsap_user Chapter 1. Preparing your environment 13

26 Figure 12 shows the Roles page of the Maintain User window containing the specified role. Figure 12. Roles page of the Maintain User window showing the specified role after you press Enter 6. Click the Profiles tab to check whether the profile is shown in the Assigned Authorization Profiles table. You should see the name and the description of the profile that you created. For example, you should see T-E and Profile for role iccsap_user. Figure 13 on page 15 shows what the Profiles page of the Maintain User window might look like. 14 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

27 Figure 13. Profiles page of the Maintain User window showing the name and the description of the sample role 7. Click the Save icon to save your settings. The role and the profile are assigned to the CPIC user. You can now work with this user. What to do next: 1.3.2, Linking a logical system to the SAP client Linking a logical system to the SAP client Define a logical system and link it to the SAP client that you want to use with Content Collector for SAP. Define a logical system for each SAP client that you want to use. Before you begin: 1.3.1, Creating a user with CPIC access, on page 4 Create the sample logical system T90CLNT090 and link it to SAP client 800, for which you created user CPICUSER1. Procedure: 1. In the SAP GUI, enter the transaction code BD54 to open the Change View "Logical Systems": Overview window. If a window opens with the message Caution: The table is cross-client., press Enter. 2. If the table already contains logical systems, you can use one of them. If you want to use an existing logical system, continue with 4 on page 16. Note: Do not change the settings of an existing logical system. 3. If no logical system exists, create one by following these instructions. As an example, create the logical system T90CLNT090. a. In the Change View "Logical Systems": Overview window, click New Entries. The New Entries: Overview of Added Entries window opens. Chapter 1. Preparing your environment 15

28 b. In the first free row of the Log. System column, type a name for the logical system. For example, type: T90CLNT090 You must later specify this name when you configure Collector Server. c. Add a description in the Name column of the same row. For example, type: First logical system for SAP client 800 Figure 14 shows what the New Entries: Overview of Added Entries window might look like after you completed step 3b and step 3c. Figure 14. New Entries: Overview of Added Entries window containing a sample name for the logical system and a sample description d. Click the Save icon. e. In the Request field of the Prompt for Workbench request window, type the name of, or select, an existing request. If a request does not exist, create one by using the Create Request icon. 4. Link the logical system to the SAP client for which you created a user with CPIC access. To link the sample logical system T90CLNT090 to the sample SAP client 800, take these steps: a. Enter the transaction code SCC4 to open the Display View "Clients": Overview window. b. Click the Change icon. If a window opens with the message Caution: The table is cross-client., press Enter. c. Double-click the row in the Client column that contains the SAP client to which you want to link the logical system. For example, double-click the row in the Client column that contains the number 800. d. In the Change View "Clients": Details window, select the logical system from the Logical system list. For example, select T90CLNT Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

29 Figure 15 shows the Display View "Clients": Overview window containing your selection in step 4d on page 16. Figure 15. Display View "Clients": Overview window containing the name of the sample logical system that you want to link 5. Click the Save icon to save your settings. What to do next: 1.3.3, Defining a number range for SAP ArchiveLink Defining a number range for SAP ArchiveLink Define a range for SAP ArchiveLink, if this interval does not exist yet. Before you begin: 1.3.2, Linking a logical system to the SAP client, on page 15 Procedure: 1. In the SAP GUI, enter the transaction code OANR to open the SAP ArchiveLink Number range window. 2. Click the Change Intervals icon. Figure 16 on page 18 shows the Maintain Number Range Intervals window containing the required interval. Chapter 1. Preparing your environment 17

30 Figure 16. Maintain Number Range Intervals window containing the required interval 3. If the required interval does not exist, take these steps: a. In the Maintain Number Range Intervals window, click the Insert Interval icon. b. In the Insert Interval window, specify the following settings: 1) In the No column, type: 01 2) In the From number column, type: ) In the To number column, type: Do not change the setting in the Current number column. c. Click the Insert icon to insert the specified interval. The Maintain Number Range Intervals window should look similar to Figure Click the Save icon to save your settings. 18 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

31 Chapter 2. Configuring Tivoli Storage Manager for use with Content Collector for SAP Configure Tivoli Storage Manager. If the Tivoli Storage Manager server and Collector Server are not installed on the same system, you must also configure a connection between the two servers. If you use tape drives or optical disks for archiving, you must complete extra steps to configure the Tivoli Storage Manager server for the chosen storage media. This information contains only the configuration steps that must be completed to use Tivoli Storage Manager with Content Collector for SAP. For more information, see the Tivoli Storage Manager documentation ( knowledgecenter/ssgsg7/welcome). Complete these tasks: Procedure: , Registering a Tivoli Storage Manager node with Content Collector for SAP , Creating management classes, on page , Creating an archive copy group, on page , Validating and activating the STANDARD policy set, on page , Setting the password options, on page , Configuring a connection to a remote Tivoli Storage Manager server, on page Registering a Tivoli Storage Manager node with Content Collector for SAP Complete these steps to register a Tivoli Storage Manager node with Content Collector for SAP. 1. From a command line, change to the directory where the dsmadmc program is installed. 2. Enter dsmadmc to start the command-line interface for administering the Tivoli Storage Manager server. 3. Log on with the user ID and the password of an administrator. The initial user ID and the initial password are both admin. After a successful logon, the following information is displayed: tsm: <NODE> 4. Enter the following command to register a new node with Content Collector for SAP: register node name password archdel=yes name is the name of the new node. password is the password that is used to log on to that node. archdel=yes specifies that the node can be deleted. What to do next: 2.2, Creating management classes, on page 20 Copyright IBM Corp. 2010,

32 2.2 Creating management classes Create the management classes where the documents are to be stored. Before you begin: 2.1, Registering a Tivoli Storage Manager node with Content Collector for SAP, on page 19 Enter the following command to create a management class: define mgmtclass standard standard class_name class_name is the name of the new management class, for example, R3DOCS. It can be up to 16 characters long. The additional parameters standard standard specify that the management class is to be created in the STANDARD policy domain, by using the STANDARD policy set. What to do next: 2.3, Creating an archive copy group 2.3 Creating an archive copy group Create a Tivoli Storage Manager archive copy group for use by Content Collector for SAP. Before you begin: 2.2, Creating management classes Proceed as follows: Enter either of the following commands to create an archive copy group: v For regular archiving, where SAP NetWeaver is connected to document management systems by using SAP ArchiveLink (BC-AL) or by using an HTTP protocol (BC-HCS), enter the following command: define copygroup standard standard class_name type=archive dest=diskpool serialization=static retver=nolimit v For data archiving by using the WebDAV Storage Interface for SAP NetWeaver Information Lifecycle Management (BC-ILM), enter the following command: define copygroup standard standard class_name type=archive dest=diskpool retver=0 retinit=event retmin=0 class_name is the name of the management class that you previously created. Explanation of the parameters: standard Uses the STANDARD policy domain. standard Uses the STANDARD policy set. type=archive Creates an archive copy group as opposed to a backup copy group. destination=diskpool Uses DISKPOOL (hard disks) as the primary storage pool. retver=nolimit 0 nolimit means that there is no restriction regarding the number of days that a file is kept in the copy group. Files stay in the copy group indefinitely. 0 means 20 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

33 that the objects in the copy group can be deleted immediately after the retention period ends. This setting is required for BC-ILM repositories. serialization=static Makes sure that Tivoli Storage Manager archives a file only if it is not currently modified. Tivoli Storage Manager attempts to archive a file only once. retinit=event Specifies that the retention time for the archived data is initiated by an application that uses API function calls. This setting is required for BC-ILM repositories. retmin=0 Sets the minimum number of days to retain an archive object to 0. This setting is required for BC-ILM archives. What to do next: 2.4, Validating and activating the STANDARD policy set 2.4 Validating and activating the STANDARD policy set Make sure that no configuration errors occurred and then validate and activate the STANDARD policy set. Before you begin: 2.3, Creating an archive copy group, on page 20 Procedure: 1. Validate the STANDARD policy set by entering the following command: validate policyset standard standard If the validation was successful, a message like this one is displayed: ANR1515I Policy set STANDARD validated in domain STANDARD (ready for activation). 2. Activate the policy set by entering the following command: activate policyset standard standard You receive a response like this one: ANR1514I Policy set STANDARD activated in policy domain STANDARD. 3. To leave the dsmadmc program, enter quit. What to do next: 2.5, Setting the password options 2.5 Setting the password options Tivoli Storage Manager offers different options for handling passwords. You must specify the settings for the password options that Content Collector for SAP supports. Before you begin: 2.4, Validating and activating the STANDARD policy set Content Collector for SAP supports the following password options: PASSWORDACCESS PROMPT and PASSWORDACCESS GENERATE. Update the client system-options file on Linux and UNIX systems (dsm.sys) or the client options file on Windows (dsm.opt) as follows: v If use want to use PASSWORDACCESS PROMPT, add the following settings: Chapter 2. Configuring Tivoli Storage Manager for use with Content Collector for SAP 21

34 v SERVERNAME server_name PASSWORDACCESS PROMPT NODENAME node_name If use want to use PASSWORDACCESS GENERATE, add the following settings: SERVERNAME server_name PASSWORDACCESS GENERATE Notes: v The use of the PASSWORDACCESS PROMPT option presupposes that you specified a password for the Tivoli Storage Manager node to which the option relates. You must specify this password when you start a Collector Server instance for the first time. The password is used for all connections. When it expires, update it on the Tivoli Storage Manager server and on Collector Server. v The use of the PASSWORDACCESS GENERATE option presupposes that you manually set an initial password for the node to which the option relates. You must specify this initial password when you connect to the Tivoli Storage Manager node for the first time. After the first access, Tivoli Storage Manager changes the initial password by generating a new password. The generated password is updated automatically and is stored on the Tivoli Storage Manager client and on the Tivoli Storage Manager server. All subsequent connections are established by using the generated password. v You connect to the Tivoli Storage Manager node for the first time by entering the following commands on a command line: 1. dsmc -se= server_name to log on to Tivoli Storage Manager server 2. dsmc q mgm to query the management classes After you enter the command for querying the management classes, Tivoli Storage Manager prompts you for the initial password. v Use the PASSWORDACCESS PROMPT option for initial testing because this option is easy to set. Use the PASSWORDACCESS GENERATE for your production environment because the passwords are automatically generated and updated. What to do next: 2.6, Configuring a connection to a remote Tivoli Storage Manager server 2.6 Configuring a connection to a remote Tivoli Storage Manager server If the Tivoli Storage Manager server is not installed on the same system as Collector Server, you must configure a connection between the two servers. Before you begin: 2.5, Setting the password options, on page 21 Procedure: 1. In the \TSM\config directory of your Tivoli Storage Manager installation, create the file server_name.opt. server_name stands for the name of the Tivoli Storage Manager library server. 2. Specify the following information in this file: Option Value commmethod TCPIP tcpport Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

35 Option tcpserveraddress Value Specify the TCP/IP address of the Tivoli Storage Manager library server. Chapter 2. Configuring Tivoli Storage Manager for use with Content Collector for SAP 23

36 24 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

37 Chapter 3. Configuring IBM Content Navigator To configure Collector Server, to archive or link incoming documents, and to transfer index information, you need IBM Content Navigator. Configure IBM Content Navigator for use with Content Collector for SAP. All of the following tasks must be completed by the IBM Content Navigator administrator. 3.1 Configuring IBM Content Navigator for use with Tivoli Storage Manager Because IBM Content Navigator is not delivered with Tivoli Storage Manager, you must install IBM Content Navigator first. Before you begin: Plan for configuring IBM Content Navigator. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: 1. Install IBM Content Navigator, which is bundled with Content Collector for SAP. For details, see the ( welcome). 2. Configure and deploy IBM Content Navigator according to the product documentation. When you create the configuration profile and you must specify which type of repositories you want to access from the IBM Content Navigator web application, select the No repository check box. 3. Copy the JAR files that were installed with the base package and that are in the following directory: v Linux UNIX InstallHome/navigator_plugins v Windows InstallHome\navigator_plugins 4. Paste the JAR files to the web application server where IBM Content Navigator is installed, as follows: a. Paste the iccsapplugin.jar file to a directory of your choice. Ensure that IBM Content Navigator can access this file during run time. b. Paste the iccsaptasks.jar file to the following directory: v Linux UNIX profiles/profilename/installedapps/cellname/ navigator.ear/taskmanagerweb.war/web-inf/dropins v Windows profiles\profilename\installedapps\cellname\ navigator.ear\taskmanagerweb.war\web-inf\dropins 5. Open a web browser and then open IBM Content Navigator in administration view by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=admin For example, type: 6. Log on as IBM Content Navigator administrator. Copyright IBM Corp. 2010,

38 7. Load the Content Collector for SAP plug-in: a. In the navigation pane on the left, click Plug-ins. b. On the Plug-ins page, click New Plug-in. c. In the JAR file path field of the New Plug-in page, type the fully qualified path to the iccsapplugin.jar file and then click Load. d. Optional: From the Trace level list, select the trace level that you need. By default, Error is selected. The tracing information is written to the console of your web application server. On IBM WebSphere Application Server, for example, the console output is redirected to the SystemOut.log file in the WAS_profile_location/logs/server directory. e. Click Save and Close. 8. Reload IBM Content Navigator. 9. Add Tivoli Storage Manager to IBM Content Navigator: a. In the navigation pane on the left, click Repositories. b. Click New Repository > Content Collector for SAP - Container-Managed Repository for Tivoli Storage Manager. c. Complete the required information and then click Save and Close. 10. Create the desktops that you need for Content Collector for SAP. The following steps guide you through the required desktop settings. You can adapt the desktop further, depending on your needs. a. In the navigation pane on the left, click Desktops. b. On the Desktops page, click New Desktop. c. In the General pane, specify a name and an ID for the new desktop and select the repository. In addition, limit the access to those users or user groups that are to work with the desktop. d. In the Layout pane, under Displayed features, select the Content Collector for SAP features that the desktop is to contain. e. Click Save and Close. 3.2 Associating users with task manager roles Operation Feature of Content Collector for SAP, where you create and schedule tasks, uses the task manager component of IBM Content Navigator. You must associate all users who are allowed to use this feature with the predefined task manager roles. Associate the users with task manager roles. For details, see the following topics: v If the task manager component of IBM Content Navigator is deployed on IBM WebSphere Application Server, see Associating users with task manager roles (WebSphere Application Server) ( SSEUEX_2.0.3/com.ibm.installingeuc.doc/eucde057.htm) v If the task manager component of IBM Content Navigator is deployed on Oracle WebLogic Server, see Associating users with task manager roles (Oracle WebLogic Server) ( com.ibm.installingeuc.doc/eucde065.htm) 26 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

39 Chapter 4. Configuring a daemon Fix Pack 1 To start and stop a Collector Server instance from IBM Content Navigator and to view logs and traces from IBM Content Navigator, you must configure a daemon on the system where Collector Server is installed. The daemon is used by IBM Content Navigator to control a Collector Server instance. Before you begin: Plan for running Collector Server instances. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH On the system where Collector Server is installed, take these steps: 1. Create a daemon path. All files that are created when the daemon is started, are stored in this path. You must have read/write access to this path. Strictly control the access to this path. For example, create the following path: /home/iccsapadmin/daemon 2. Create an instance base path. For example, create the following path: /home/iccsapadmin/instances All instance directories must be in this base path or in a subdirectory of this path , Configuring the server authentication on Collector Server , Configuring the client authentication, on page , Starting the daemon, on page , Configuring the server authentication on the web application server, on page Configuring the server authentication on Collector Server Fix Pack 1 Create a keystore and a certificate for Collector Server. Use the Java Keytool or the IBM Key Management Utility (IKEYMAN) to create the keystore, the private key, and the public key and to associate the public key with a certificate. The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe Copyright IBM Corp. 2010,

40 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: 1. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. keystore_file Specify the fully qualified file name for the keystore. The keystore must be stored in the daemon path. Example: keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap1 -validity 365 -keystore /home/iccsapadmin/daemon/keystore.jks Important: Ensure that your web application server can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your web application server. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name 28 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

41 What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: 4.2, Configuring the client authentication 4.2 Configuring the client authentication Fix Pack 1 You must export the certificate of the web application server that hosts IBM Content Navigator and import it into a truststore on the system where Collector Server is installed. You create the truststore during the import. Before you begin: 4.1, Configuring the server authentication on Collector Server, on page 27 Procedure: 1. Export the certificate of the web application server. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information a. In the WebSphere Application Server administration console, click Security > SSL certificate and key management. b. Under Related items, click Keystores and certificates. c. Select the keystore that contains the certificate. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. d. Under Additional properties, click Signer certificates. e. Select the check box next to the appropriate certificate and then click Extract. f. Specify a file name with the extension.der and select the Binary DER Data as data type. For example, type: root.der g. Click OK to extract the certificate. Make a note of fully qualified path that the file is extracted to. The path might look as follows: /opt/ibm/websphere/appserver/profiles/appsrv01/etc/root.der Chapter 4. Configuring a daemon 29

42 4.3 Starting the daemon 2. Copy the certificate file of the web application server to the system where Collector Server is installed. 3. Import the certificate of the web application server into the truststore by using the Java Keytool or IKEYMAN. The truststore is created during the import. To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: a. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon b. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore truststore_file certificate_file Specify the fully qualified file name of the certificate of the web application server. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. truststore_file Specify a fully qualified file name for the truststore. The truststore must be stored in the daemon path. Example: keytool -importcert -file /home/iccsapadmin/root.der -alias was1 -keystore /home/iccsapadmin/daemon/truststore.jks What to do next: 4.3, Starting the daemon Fix Pack 1 Ensure that you created all necessary keystores and paths before you start the daemon. Before you begin: v 4.2, Configuring the client authentication, on page 29. v Windows If you run several Content Collector for SAP versions on one Windows system, check the PATH environment variable on a command prompt. Procedure: 1. Change to the daemon directory and then open a command line. For example, change to the following directory: /home/iccsapadmin/daemon 2. Enter the following command: v Linux UNIX archcmd.sh com.ibm.esd.configplugin.daemon.daemon v Windows 30 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

43 archcmd.bat com.ibm.esd.configplugin.daemon.daemon 3. Specify the information that you are prompted for. When you enter a path, always specify the fully qualified path. Do not use any environment variables or shell expansions as part of a path. For example, enter the following information: Keystore file: /home/iccsapadmin/daemon/keystore.jks Keystore password: icc4sap Truststore file: /home/iccsapadmin/daemon/truststore.jks Truststore password: was Daemon port: 5000 Instance base path: /home/iccsapadmin/instances When you restart the daemon, you do not have to enter any of these values again. Tip: Windows If you have instance directories already and if they are on several partitions, enter <<ALL FILES>> as instance base path. The daemon is started. To stop the daemon, use the method that is provided by your operating system to end a process. What to do next: 4.4, Configuring the server authentication on the web application server 4.4 Configuring the server authentication on the web application server Fix Pack 1 Import the server certificate into the web application server that hosts IBM Content Navigator. Before you begin: 4.3, Starting the daemon, on page 30 Procedure: 1. Open the WebSphere Application Server administration console and log on as an administrator. 2. Click Security > SSL certificate and key management. 3. Under Related items, click Keystores and certificates. 4. Select the keystore that the server certificate is to be imported into. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. 5. Under Additional properties, click Signer certificates. Chapter 4. Configuring a daemon 31

44 6. On the next page, click Retrieve from port. 7. Complete the following information: a. In the Host field, type the fully qualified host name or the IP address of the system where Collector Server is installed. b. In the Port field, type the daemon port. c. In the Alias field, specify a name of your choice for the certificate. The name must be unique in the keystore that is to contain the certificate. For example, type: iccsap1 8. Click Retrieve Signer Information to review the information about the server certificate. Then, click OK. 9. Click Save to store the server certificate in the keystore. 32 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

45 Chapter 5. Configuring Collector Server You must configure at least one instance of Collector Server. You create and manage your instances in Configuration Feature of Content Collector for SAP. Before you begin: 1. Plan for configuring Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 1, Preparing your environment, on page 3 3. Chapter 2, Configuring Tivoli Storage Manager for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page 27 Figure 17 shows which parts of the Content Collector for SAP environment belong to a Collector Server instance. Figure 17. Configuration of Collector Server Start with a basic instance configuration as follows: In Configuration Feature, complete all mandatory fields and configure the appropriate communication with SAP, IBM Content Navigator, and the repositories. In addition, define the logical archives for your repositories. Chapter 6, Configuring your environment for basic tasks, on page 53 and Chapter 7, Configuring your environment for more or advanced tasks, on page 109 show which additional information must be specified in the instance configuration for the tasks that you can complete with Content Collector for SAP. Copyright IBM Corp. 2010,

46 5.1 Getting started with Configuration Feature You can configure a Collector Server instance from scratch, or you can edit the instance configuration that you imported from an existing server configuration profile. Before you begin: Chapter 3, Configuring IBM Content Navigator, on page 25 Procedure: 1. Open a web browser and then open the IBM Content Navigator desktop for the Collector Server administrator, by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=desktop_id You must have access to this desktop. For example, type: 2. Log on as Collector Server administrator. 3. In the plug-in pane on the left, click the IBM Content Collector for SAP Applications Configuration Feature icon. The Manage Collector Server Instances page opens where you start the configuration of Collector Server instances and manage your configurations. 4. In the upper right corner, you can change the view from Basic settings to Extended settings. InBasic settings view, you see all sections and controls that you must complete to create a basic instance configuration. The Extended settings view shows all available configuration sections and configuration options. Fix Pack 1 IBM Content Navigator remembers your selection until you change it again. 5. Configure as many instances of Collector Server as you need. Fix Pack 1 If you plan to start and stop the Collector Server instances from IBM Content Navigator, do not specify environment variables or shell expansions as part of a path in the instance configurations. Always specify the fully qualified paths Importing the instance configuration from a server configuration profile If you want to reuse a server configuration profile from a previous version of Content Collector for SAP, you must import the instance configuration from the profile into the IBM Content Navigator database. A Collector Server instance that is used for an archiving, a document-linking, or an index-transfer task must be available in the IBM Content Navigator database. To import an instance configuration that is specified in a server configuration profile, into the IBM Content Navigator database, complete these steps in Configuration Feature: 1. On the Manage Collector Server Instances page, click Import. 2. Select the server configuration profile that the instance configuration is to be imported from and then click Open. 3. In the Import Configuration from a Server Configuration Profile window, click OK. If the import was completed with warnings, a window opens where you find more details. Click Close. 34 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

47 4. Go through the imported configuration, check the imported values, and add any missing values. The configuration panes that require values for mandatory fields are highlighted in the navigation pane. Fix Pack 1 If you plan to start and stop the Collector Server instances from IBM Content Navigator, ensure that the paths in the instance configurations do not contain any environment variables or shell expansions. Replace paths that contain environment variables or shell expansions with fully qualified paths. 5. After you finish, click Save Creating several instances of Collector Server: Hints and tips You might need more than one instance of Collector Server. The following tables give an overview of which paths and ports must differ for each instance. Paths that must differ for each instance Instance path Path to job queues The job queues must be stored in the queue directory within the instance path or in a path of your choice, as specified in the instance configuration. Where to find the path in Configuration Feature Basic Configuration > General > Instance path Basic Configuration > Paths > Paths > Job queues Temporary files Basic Configuration > Paths > Paths > Temporary files Path to master key file Basic Configuration > Security > General > Master key file Ports that must differ for each instance Collector Server port Basic Configuration > Communication > Ports > Collector Server port Web port Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > Web port SSL web port Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > SSL web port Web client port Basic Configuration > Communication > HTTPS Communication with IBM Content Navigator > Web client port 5.2 Configuring the communication with SAP, IBM Content Navigator, and the API Define how a Collector Server instance communicates with SAP, IBM Content Navigator, and the API of Content Collector for SAP. Chapter 5. Configuring Collector Server 35

48 Task Before you begin: Plan for a secure communication. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Communication with SAP, IBM Content Navigator, and the API: Overview How a Collector Server instance communicates with SAP, IBM Content Navigator, and the API and whether Java RFC dispatchers must be started depend on the task that you want to perform. The following table provides an overview. HTTP or HTTPS With SAP RFC With IBM Content Navigator With the API Java RFC dispatcher Remarks Archiving data x x Either an HTTP/HTTPS connection or an RFC connection is required. Archiving data and protecting data by using BC-ILM 2.0 Archiving data and protecting archived data and documents by using BC-ILM 3.0 Archiving incoming documents by creating work items in an SAP workflow Archiving incoming documents by processing their bar codes Archiving outgoing documents x x x x x Only the web dispatcher is used. Only the web dispatcher is used. The bar code is sent directly to SAP. x x Either an HTTP/HTTPS connection or an RFC connection is required. Archiving and viewing print lists Viewing archived documents and print lists with the SAP GUI Prefer an HTTP or HTTPS connection, which supports all MIME types. An HTTP or HTTPS connection is required if you want to change outgoing documents with a preprocessor before they are archived. x x Either an HTTP/HTTPS connection or an RFC connection is required. x x An RFC connection can be used for print lists only. 36 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

49 5.2.2 Configuring the communication with SAP To enable an SAP system to communicate with a Collector Server instance, you must specify an HTTP connection or an RFC connection in the instance configuration. In addition, you must configure SAP. Before you begin: Plan for a secure communication with SAP. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH To configure the instance for the appropriate connection, go to the Communication pane of Configuration Feature. To configure SAP, complete either of the following tasks: v , Configuring SAP for an HTTP connection v , Configuring SAP for an RFC connection, on page Configuring SAP for an HTTP connection You use the SAP GUI to configure SAP for an HTTP connection. Procedure: , Creating an SAP ArchiveLink protocol for an HTTP connection , Creating SAP ArchiveLink queues for an HTTP connection, on page , Creating a content repository for an HTTP connection, on page , Enabling the use of HTTP requests with a seckey, on page Creating an SAP ArchiveLink protocol for an HTTP connection: Create a protocol for the general SAP ArchiveLink interface to the HTTP content server. Create the sample protocol HTTP1. Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Click the New protocol icon. 3. In the Create New Protocol window, specify the following settings: Field Description Example Protocol Type a name for the protocol. Type: HTTP1 Version Description Specify the version of the SAP ArchiveLink HTTP Content Server Interface. Normally, 0045 is sufficient. However, if a cache server is used, specify Specify information about this protocol. Type: 0045 Type: Demo_HTTP Figure 18 on page 38 shows the Create New Protocol window containing the Chapter 5. Configuring Collector Server 37

50 sample specifications. Figure 18. Create New Protocol window containing the sample protocol name, the version, and a sample description The ArchiveLink: Communications Interface Administration window lists the new protocol. What to do next: , Creating SAP ArchiveLink queues for an HTTP connection Creating SAP ArchiveLink queues for an HTTP connection: Complete the following steps to create SAP ArchiveLink queues. Before you begin: , Creating an SAP ArchiveLink protocol for an HTTP connection, on page 37 Procedure: 1. In the SAP GUI, enter the transaction code OAQI to open the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window. 2. Make sure that all fields except for Queue Administrator contain an X. 3. In the Queue Administrator field, type the logon ID of an SAP user who should receive error notifications. By default, the current logon ID is inserted. For example, type: ADMIN 4. Click the Execute icon. Figure 19 shows the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings. Figure 19. SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings 38 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

51 What to do next: , Creating a content repository for an HTTP connection Creating a content repository for an HTTP connection: For each logical archive that is defined in the instance configuration, you must create a content repository in SAP. With a content repository, you establish the connection between an SAP system and a logical archive. Create the sample content repository A2 for the sample SAP ArchiveLink protocol HTTP1. Before you begin: , Creating SAP ArchiveLink queues for an HTTP connection, on page 38 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Click the Change icon. 3. In the Change Content Repositories: Overview window, click the Create icon. 4. In the Change Content Repositories: Detail window, click Full administration. 5. Specify the following information: Field Description Example Content Rep. Description Document area Storage type Protocol Version no. HTTP server Port Number Type the ID of the logical archive that you create the content repository for. Type a short description for the content repository. Select ArchiveLink. Select HTTP content server. Select the SAP ArchiveLink protocol that you created. Select the version of the SAP ArchiveLink HTTP Content Server Interface, which you specified in the SAP ArchiveLink protocol. Type the fully qualified host name or IP address of the system where Collector Server is installed. Type the port number of the TCP/IP port through which the web dispatcher of Collector Server gets its requests. Specify the same port number as in the following field in Configuration Feature: Basic Configuration > Communication > HTTP or HTTPS Communication with SAP > Web port. Type: A2 Type: Sample archive A2 Select HTTP1. Select Type: myhost.yourdomain.com Type: 5580 Chapter 5. Configuring Collector Server 39

52 Field Description Example HTTP Script Type: cs Basic Path Type the full path to the exchange directory where your SAP applications are to store the files that are to be archived by Content Collector for SAP. Type: D:\SAPSERVER\transfer\base\ The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Archive Path OutputDevice No signature Make sure that both servers can access this directory. Type the full path to the directory where Collector Server and SAP can retrieve the archived files. The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. It is usually the same path as for the Basic Path field. Select ARCH. If selected, no signature is used. Generally, use it for test purposes only. Type: D:\SAPSERVER\transfer\arch\ Figure 20 on page 41 shows the Change Content Repositories: Detail window containing your specifications. 40 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

53 Figure 20. Change Content Repositories: Detail window containing your specifications 6. Click the Save icon to save your settings. What to do next: , Enabling the use of HTTP requests with a seckey Enabling the use of HTTP requests with a seckey: HTTP requests from SAP usually contain the seckey parameter. The value of this parameter is an encrypted hash sum of selected URL parameters. To ensure that an SAP request was not manipulated, Collector Server uses the SAP certificate to evaluate the hash sum. An SAP certificate must be available for each logical archive that is defined in the Collector Server instance configuration and that the SAP system communicates with. Before you begin: , Creating a content repository for an HTTP connection, on page 39 Complete these steps to transfer an SAP certificate to the Collector Server instance: 1. In the SAP GUI, use either of the following procedures: v In the Change Content Repositories: Detail window, click the Send certificate icon. v Enter the transaction code OAHT to open the Send certificates to HTTP content server window. Double-click the content repository that defines the connection to a logical archive. For example, double-click A2. The corresponding Collector Server instance receives the SAP certificate and saves it in the SAPCertificates directory. For example, the SAP certificate for logical archive A2 would be stored as A2.pse.fingerprint.TO_BE_CONFIRMED. fingerprint stands for the hash value that uniquely identifies the SAP certificate. Chapter 5. Configuring Collector Server 41

54 2. To accept the SAP certificate, complete these steps: a. Open a command line and change to the directory where the server configuration profile that contains the logical archive is stored. b. Enter the following command: archcert -a archive_id archive_id stands for the logical archive ID. For example, A2. For more information about this command and the parameters that you can specify, see the topic archcert in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH c. The content of the SAP certificate is displayed. Review it. d. If you decide to accept the SAP certificate, enter YES. Collector Server saves the SAP certificate in the SAPCertificates directory as archive_id.pse.fingerprint, for example, A2.pse.fingerprint. You can verify the SAP certificate in SAP by comparing the fingerprint to the one in the Trust Manager (transaction code STRUST) Configuring SAP for an RFC connection You use the SAP GUI to configure SAP for a Remote Function Call (RFC) connection. Procedure: , Creating an RFC destination for an RFC connection , Creating an SAP ArchiveLink protocol for an RFC connection, on page , Creating SAP ArchiveLink queues for an RFC connection, on page , Creating a content repository for an RFC connection, on page Creating an RFC destination for an RFC connection: Create the sample RFC destination KD7.iccsap. Procedure: 1. In the SAP GUI, enter the transaction code SM59 to open the Configuration of RFC Connections window. 2. In the RFC Connections column, click TCP/IP connections and then click Create icon. 3. In the RFC Destination field of the RFC Destination window, type a name for the RFC destination. You can use a name of your choice. However, you might want to use the same name as in the Program ID field, which you specify in step 7 on page 43. For example, type: KD7.iccsap 4. Under Description, type a description in one or more of the Description fields. For example, type: RFC Connection 1 5. Click the Technical Settings tab. 6. Under Activation Type, click Registered Server Program. 42 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

55 7. In the Program ID field, type the program ID under which the dispatcher is registered on the SAP Gateway. Important: If the RFC destination is to be used by SAP Document Finder, append the number 1 to the ID. For example, if the program ID is KD7.iccsap, type KD7.iccsap1 in the Program ID field. For example, type: KD7.iccsap1 This program ID must also be specified in the following field in Configuration Feature: SAP System > General > General > Program ID. In Configuration Feature, the number 1 must be omitted. 8. Click the Save icon to save your settings. Figure 21 shows what the RFC Destination window might look like after you completed step 3 on page 42 through step 7. Figure 21. RFC Destination window containing the sample name of the RFC destination, the connection type, the sample description for the connection, the activation type, and the sample program ID What to do next: , Creating an SAP ArchiveLink protocol for an RFC connection Creating an SAP ArchiveLink protocol for an RFC connection: Create a protocol for the general SAP ArchiveLink interface to the RFC content server. Create the sample protocol RFC1. Chapter 5. Configuring Collector Server 43

56 Before you begin: , Creating an RFC destination for an RFC connection, on page 42 Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Click the New protocol icon. 3. In the Create New Protocol window, specify the following settings: Field Description Example Protocol Type a name for the protocol. Type: RFC1 Version Description Specify the version of the SAP ArchiveLink Interface, namely Specify information about this protocol. Type: Demo_RFC Figure 22 shows what the Create New Protocol window might look like after you typed the necessary information. Figure 22. Create New Protocol window containing the protocol name, the version, and a sample description 4. Click the Save icon to save your settings. What to do next: , Creating SAP ArchiveLink queues for an RFC connection Creating SAP ArchiveLink queues for an RFC connection: Complete the following steps to create SAP ArchiveLink queues. Before you begin: , Creating an SAP ArchiveLink protocol for an RFC connection, on page 43 Procedure: 1. In the SAP GUI, enter the transaction code OAQI to open the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window. 2. Make sure that all fields except for Queue Administrator contain an X. 3. In the Queue Administrator field, type the logon ID of an SAP user who should receive error notifications. By default, the current logon ID is inserted. For example, type: ADMIN 4. Click the Execute icon. 44 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

57 Figure 23 shows the SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings. Figure 23. SAP ArchiveLink: Create All Queues (CFBC, CARA, CGDA) window containing the required settings What to do next: , Creating a content repository for an RFC connection Creating a content repository for an RFC connection: For each logical archive that is defined in the instance configuration, you must create a content repository in SAP. With a content repository, you establish the connection between an SAP system and a logical archive. Create the sample content repository A1 for the sample SAP ArchiveLink protocol RFC1. Before you begin: , Creating SAP ArchiveLink queues for an RFC connection, on page 44 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Click the Change icon. 3. In the Change Content Repositories: Overview window, click the Create icon. 4. In the Change Content Repositories: Detail window, click Full administration. 5. Specify the following information: Field Description Example Content Rep. Description Document area Storage type Protocol Type the ID of the logical archive that you create the content repository for. Type a short description for the content repository. Select ArchiveLink. Select RFC Archive id. Select the SAP ArchiveLink protocol that you created. Type: A1 Type: Sample archive A1 Select RFC1. Chapter 5. Configuring Collector Server 45

58 Field Description Example Version no. Select RFC destination Select the RFC destination that you Select KD7.iccsap. previously created. Basic Path Type the full path to the exchange directory where your SAP applications are to store the files that are to be archived by Content Collector for SAP. Type: D:\SAPSERVER\transfer\ base\ The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Archive Path OutputDevice Specify the same path as in the following field in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP > Basic path. Type the full path to the directory where Collector Server and SAP can retrieve the archived files. The path must end with a delimiter, which is \ on Windows and / on Linux and UNIX systems. Specify the same path as in the following field in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP > Archive path. It is usually the same path as for the Basic Path field. Select ARCH. Type: D:\SAPSERVER\transfer\ arch\ Figure 24 on page 47 shows the Change Content Repositories: Detail window containing your specifications. 46 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

59 Figure 24. Change Content Repositories: Detail window containing your specifications 6. Click the Save icon to save your settings Configuring the communication with IBM Content Navigator You must configure the Collector Server instance for the communication with IBM Content Navigator. In addition, you must configure server authentication and client authentication on Collector Server and on the web application server that hosts IBM Content Navigator. Before you begin: Plan for a secure Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH To configure the instance for the communication with IBM Content Navigator, go to the Communication pane of Configuration Feature. To configure server authentication and client authentication, complete these tasks: Procedure: , Configuring the server authentication , Configuring the client authentication, on page Configuring the server authentication You must configure the server authentication on Collector Server and on the web application server that hosts IBM Content Navigator. Configure the server authentication on the web application server after you start the Collector Server instance Configuring the server authentication on Collector Server: Create an SSL keystore and a certificate for the Collector Server instance. Chapter 5. Configuring Collector Server 47

60 If you already created a server certificate for an HTTPS communication with an SAP system, you must use this certificate for the communication with IBM Content Navigator. In this case, skip the following procedure and continue with , Configuring the client authentication, on page 50. The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: 1. Open a command line on the system where the Collector Server instance runs. 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore ssl_keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. ssl_keystore_file Specify a fully qualified file name for the SSL keystore. Tip: Because an SSL keystore is required for each instance of Collector Server, it is good practice to create the SSL keystore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ keystore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\keystore.jks 48 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

61 Example: keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap_instance1 -validity 365 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks Important: Ensure that your web application server can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your web application server. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: , Configuring the client authentication, on page Configuring the server authentication on the web application server: Import the server certificate in the truststore of your web application server and enable SSL support for the IBM Content Navigator server. Before you begin: 8.2, Starting a Collector Server instance, on page 118 You use your web application server administration tools for this task. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information. Chapter 5. Configuring Collector Server 49

62 Procedure: 1. Start the Collector Server instance that is to communicate with IBM Content Navigator. 2. Open the WebSphere Application Server administration console and log on as an administrator. 3. Click Security > SSL certificate and key management. 4. Under Related items, click Keystores and certificates. 5. Select the keystore that the server certificate is to be imported into. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. 6. Under Additional properties, click Signer certificates. 7. On the next page, click Retrieve from port. 8. Complete the following information: a. In the Host field, type the fully qualified host name or the IP address of the system where Collector Server is installed. b. In the Port field, type the web client port, which IBM Content Navigator uses to communicate with the Collector Server instance. c. In the Alias field, specify a name of your choice for the certificate. The name must be unique in the keystore that is to contain the certificate. For example, type: iccsap_instance1 9. Click Retrieve Signer Information to review the information about the server certificate. Then, click OK. 10. Click Save to store the server certificate in the keystore. What to do next: , Configuring the client authentication Configuring the client authentication You must export the certificate of the web application server that hosts IBM Content Navigator and import it into the SSL truststore of the Collector Server instance. Before you begin: , Configuring the server authentication, on page 47 Procedure: 1. Export the certificate of the web application server. If IBM Content Navigator is installed on IBM WebSphere Application Server, use the following steps as guidance. If IBM Content Navigator is installed on another web application server or if you use custom security settings in WebSphere Application Server, refer to your web application server documentation for more information a. In the WebSphere Application Server administration console, click Security > SSL certificate and key management. b. Under Related items, click Keystores and certificates. c. Select the keystore that contains the certificate. The default name of this keystore is NodeDefaultTrustStore. For WebSphere Application Server Network Deployment, the default name is CellDefaultTrustStore. d. Under Additional properties, click Signer certificates. e. Select the check box next to the appropriate certificate and then click Extract. 50 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

63 f. Specify a file name with the extension.der and select the Binary DER Data as data type. For example, type: root.der g. Click OK to extract the certificate. Make a note of fully qualified path that the file is extracted to. The path might look as follows: /opt/ibm/websphere/appserver/profiles/appsrv01/etc/root.der 2. Copy the certificate file of the web application server to the system where Collector Server is installed. 3. Import the certificate of the web application server into the SSL truststore by using the Java Keytool or IKEYMAN. The SSL truststore is created during the import. To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: a. Open a command line on the system where the server instance runs. b. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore ssl_truststore_file certificate_file Specify the fully qualified file name of the certificate of the web application server. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. ssl_truststore_file Specify a fully qualified file name for the SSL truststore. Tip: Because an SSL truststore must not be shared by several instances of Collector Server, it is good practice to create the truststore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ truststore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\truststore.jks Example: keytool -importcert -file /home/iccsapadmin/root.der -alias was1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks 5.3 Storing documents in more than one Tivoli Storage Manager repository: Considerations When you store a document in more than one repository, each copy of a document is archived with the same document ID. When a document cannot be retrieved from one repository, Collector Server addresses the next repository that contains the requested document and tries to retrieve it from there. Collector Server checks whether another document on the same node already uses this ID. The document is archived only if the ID does not exist yet. Chapter 5. Configuring Collector Server 51

64 Install each repository on a different Tivoli Storage Manager node. The safest method is to have the nodes on different servers and the servers on different systems. Archiving documents in several repositories decreases the performance because more operations are necessary. An archiving operation is considered successful only if the document could be archived in all specified repositories. If Collector Server cannot access one of the repositories, it deletes the copies that were already archived. In this case, the document is not stored in any repository. Collector Server considers storing in, and retrieving from, several repositories a single operation: only one job is created, and you receive only one message. If Collector Server can retrieve the document from one of the repositories, a retrieving operation is considered successful. So, if Collector Server can retrieve the requested document from one repository, it ignores any errors with the other repositories. 52 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

65 Chapter 6. Configuring your environment for basic tasks Archiving and viewing data and print lists and archiving, linking, and viewing documents are the tasks that you probably complete most frequently. For these basic tasks, you need a basic environment, which is the SAP GUI, IBM Content Navigator, one or more Collector Server instances, and one or more repositories. Before you begin: 1. Chapter 1, Preparing your environment, on page Chapter 2, Configuring Tivoli Storage Manager for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 33. It is assumed that you completed a basic instance configuration. In Configuration Feature, you completed all mandatory fields, and you configured the appropriate communication with SAP and IBM Content Navigator. In addition, you defined the logical archives for your repository. Most of the basic tasks require additional settings in the instance configuration and additional configuration of SAP or of your repository. The following topics show which parts of the basic environment are used by a task and which parts require additional configuration. 6.1 Configuring for archiving data Content Collector for SAP supports various data archiving solutions. For example, it supports the archiving of data on different media, such as hard disks, tapes, or WORMs. In addition, it supports automatic moving of data from one medium to another. To archive data, you need the basic environment. Figure 25 on page 54 shows which parts of the Content Collector for SAP environment must be configured so that you can archive data. Copyright IBM Corp. 2010,

66 Figure 25. Configuration of your Content Collector for SAP environment for archiving data In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP v The logical archives where the data is to be stored Thus, your instance configuration is complete. To archive data, you must also configure SAP. The configuration tasks are explained by using the sample archive object FI_BANKS, which refers to bank master data. Bank master data is usually not archived. Therefore, you can use the sample archive object in an SAP production system. Procedure: , Setting up the sample archiving object FI_BANKS , Configuring the SAP ArchiveLink path, on page , Checking your data archiving configuration, on page , Creating test data for the sample archiving object, on page , Running an archiving session to test your archiving setup, on page Setting up the sample archiving object FI_BANKS Configure SAP for the use of the sample archiving object FI_BANKS. Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 54 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

67 2. In the Object Name field, specify: FI_BANKS Figure 26 shows the Archive Administration: Initial Screen containing the sample archiving object name. Figure 26. Archive Administration: Initial Screen window containing the name of the sample archiving object FI_BANKS 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Archiving Object-Specific Customizing, double-click Technical Settings. Figure 27 shows which item to double-click in the Data Archiving Customizing window. Figure 27. Data Archiving Customizing window showing which item to double-click 5. In the Change View "Customizing View for Archiving": Details window, specify the following settings unless they are already specified: a. Under Delete Jobs, select Start Automatically. b. Under Place File in Storage System: 1) In the Content Repository field, specify where the data is to be archived. Specify the logical archive ID. Where to find the information in Configuration Feature: Basic Configuration > Logical Archives > Overview > Logical Archive ID Chapter 6. Configuring your environment for basic tasks 55

68 For example, type: A1 2) Select the Start Automatically check box. This setting ensures that, when the archiving session is run, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. 3) Under Sequence, select Store Before Deleting. Figure 28 shows what the Change View "Customizing View for Archiving": Details window might look like after you completed step 5a on page 55 and step 5b on page 55. Figure 28. Change View "Customizing View for Archiving": Details window containing your settings 6. Click the Save icon to save your settings. 7. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 8. Click the Continue icon to return to the Change View "Customizing View for Archiving": Details window. What to do next: 6.1.2, Configuring the SAP ArchiveLink path Configuring the SAP ArchiveLink path Complete these steps to configure the SAP ArchiveLink path. Before you begin: 6.1.1, Setting up the sample archiving object FI_BANKS, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

69 Procedure: 1. In the SAP GUI, enter the transaction code FILE to open the Change View "Logical File Path Definition": Overview window. If a window opens with the message Caution: The table is cross-client., press Enter. 2. In the table, select ARCHIVE_GLOBAL_PATH by clicking in the first cell of the row that contains this entry. 3. Double-click Assignment of Physical Paths to Logical Path in the Dialog Structure pane on the left. Figure 29 shows which items you must select in the Change View "Logical File Path Definition": Overview window. Figure 29. Change View "Logical File Path Definition": Overview window reflecting your selections in Step 2 and Step 3 The Change View "Assignment of Physical Paths to Logical Path": Overview window opens. 4. In the Syntax grp column of the table, double-click the entry for your operating system. For example, double-click UNIX. Figure 30 on page 58 shows what your selection might look like. Chapter 6. Configuring your environment for basic tasks 57

70 Figure 30. Change View "Assignment of Physical Paths to Logical Path": Overview window containing your sample selection UNIX 5. As Physical path, specify the full path to the exchange directory where your SAP applications must store the files that are to be archived by Content Collector for SAP. Use the path that you specified in the Basic Path field when you created the content repository in SAP (transaction code OAC0). For example, type: /home/sap/transfer/base/ Figure 31 shows what your specification might look like. Figure 31. Change View "Assignment of Physical Paths to Logical Path": Overview window containing the sample physical path 6. In the Dialog Structure pane on the left, double-click Logical File Name Definition, Cross-Client. 58 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

71 7. In the Change View "Logical File Name Definition, Cross-Client": Overview window, double-click ARCHIVE_DATA_FILE_WITH_ARCHIVE_LINK. Figure 32 shows which item you must double-click. Figure 32. Change View "Logical File Name Definition, Cross-Client": Overview window showing which item to double-click 8. Check whether the Logical path field shows ARCHIVE_GLOBAL_PATH. Correct the path, if necessary. Figure 33 shows which field you must check. Figure 33. Change View "Logical File Name Definition, Cross-Client": Details window showing which field to check 9. Click the Save icon to save your settings. Then click the Back icon. 10. In the Change View "Logical File Name Definition, Cross-Client": Overview window, double-click the ARCHIVE_DATA_FILE table entry. See Figure 32, which also lists the ARCHIVE_DATA_FILE table entry. Chapter 6. Configuring your environment for basic tasks 59

72 11. Check whether the Logical path field shows ARCHIVE_GLOBAL_PATH. Correct the path, if necessary. Figure 34 shows which field you must check. Figure 34. Change View "Logical File Name Definition, Cross-Client": Details window showing which field to check 12. Click the Save icon to save your settings. What to do next: 6.1.3, Checking your data archiving configuration Checking your data archiving configuration Check the configuration for your sample archiving object FI_BANKS. Before you begin: 6.1.2, Configuring the SAP ArchiveLink path, on page 56 Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify: FI_BANKS Figure 26 on page 55 shows the Archive Administration: Initial Screen containing the sample archiving object name. 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Archiving Object-Specific Customizing, double-click Technical Settings. Figure 27 on page 55 shows which item to click in the Data Archiving Customizing window. 5. In the Change View "Customizing View for Archiving": Details window, check the following settings: a. Make sure that the Logical File Name field contains either of the following values: v ARCHIVE_DATA_FILE v ARCHIVE_DATA_FILE_WITH_ARCHIVE_LINK b. Under Settings for Delete Program, check whether the Test Mode Variant contains a test variant, for example: SAP&TEST 60 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

73 c. Check whether the Production Mode Variant field contains a production variant, for example: SAP&PROD d. Under Delete Jobs, check whether Start Automatically is selected. e. Under Place File in Storage System, check whether the correct archive is specified in the Content Repository field. For example, check if A1 is specified. f. Check whether the Start Automatically check box is selected. This setting ensures that, when the archiving session is run, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. g. Under Sequence, check whether Store Before Deleting is selected. Figure 35 shows what the Change View "Customizing View for Archiving": Details window might look like with the information that you checked in step 5a on page 60 through step 5g. Figure 35. Change View "Customizing View for Archiving": Details window containing the necessary settings 6. Click the Save icon to save your settings. 7. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. Chapter 6. Configuring your environment for basic tasks 61

74 8. Click the Continue icon to return to the Change View "Customizing View for Archiving": Details window. Your settings are saved. What to do next: 6.1.4, Creating test data for the sample archiving object Creating test data for the sample archiving object Complete these steps to create test data for the sample archiving object FI_BANKS. Before you begin: 6.1.3, Checking your data archiving configuration, on page 60 Procedure: 1. In the SAP GUI, enter the transaction code FI01 to open the Create Bank: Initial Screen window. 2. In the Bank Country field, type: AD 3. In the Bank Key field, type: Figure 36 shows what the Create Bank: Initial Screen window might look like after you completed step 2 and step 3. Figure 36. Create Bank: Initial Screen window containing your specifications 4. Press Enter. 5. In the Create Bank: Detail Screen window, type Archiving test in the Bank name field. Figure 37 on page 63 shows the Create Bank: Detail Screen window containing the bank name. 62 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

75 Figure 37. Create Bank: Detail Screen window containing the bank name 6. Click the Save icon to save your settings. What to do next: 6.1.5, Running an archiving session to test your archiving setup Running an archiving session to test your archiving setup Test your setup by archiving the test data for archiving object FI_BANKS. Before you begin: 6.1.4, Creating test data for the sample archiving object, on page 62 Procedure: 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify: FI_BANKS 3. Optional: If necessary, click Customizing to check and correct your configuration settings. 4. Click Write. 5. In the Archive Administration: Create Archive Files window, specify a variant in the Variant field For example, type: test_variant Figure 38 on page 64 shows the Archive Administration: Create Archive Files window containing the sample variant test_variant. Chapter 6. Configuring your environment for basic tasks 63

76 Figure 38. Archive Administration: Create Archive Files window containing the sample variant test_variant 6. Click Maintain. 7. In the Variants: Change Screen Assignment window, select For All Selection Screens and then click the icon. 8. Click Maintain again. 9. In the Maintain Variant window, specify the following information: a. Under Bank Master Data, type AD in the Bank Country field. b. Under Restrictions, clear the Only With Deletion Indicator check box. c. In the Min.No.of Days in the System field, type: 0 d. Under Processing Options, click Production Mode. e. From the Detail Log list, select Complete. f. From the Log Output list, select List. g. In the Archiving Session Note field, type a description. For example, type: Content Collector for SAP Test Figure 39 on page 65 shows what the Maintain Variant window might look like after you completed step Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

77 Figure 39. Maintain Variant window containing the necessary settings 10. Click the Save icon to save your settings. 11. Click the Back icon. 12. To specify when the archiving session is to run, take these steps: a. In the Archive Administration: Create Archive Files window, click Start Date. b. In the Start Time window, click Immediate. c. Click the Save icon at the bottom of the window. Figure 40 on page 66 shows which button to click in the Start Time window. Chapter 6. Configuring your environment for basic tasks 65

78 Figure 40. Start Time window showing which button to click 13. To specify the output device, take these steps: a. In the Archive Administration: Create Archive Files window, click Spool Params. b. In the Background Print Parameters window, specify a suitable printer in the Output Device field. For example, type: LP01 c. Click the Continue icon. Figure 41 shows the Background Print Parameters window containing the sample printer. Figure 41. Background Print Parameters window containing the sample printer LP01 66 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

79 14. In the Archive Administration: Create Archive Files window, click the Execute icon to run the archiving session. 15. Click the Job Overview icon. In the Job Overview window, you see the different jobs that are started for this archiving session, where no stands for the number that is assigned to the job. ARV_FI_BANKS_SUBno ARV_FI_BANKS_WRIno ARV_FI_BANKS_DELno ARV_FI_BANKS_STOno submit write delete store After the STO job finishes and if the Start Automatically check box is selected in the Change View "Customizing View for Archiving": Details window under Place File in Storage System, a request is automatically sent to Content Collector for SAP to archive the file that was generated with SAP. See Figure 35 on page Configuring for archiving data and for protecting archived data and documents by using BC-ILM With WebDAV Storage Interface for SAP NetWeaver Information Lifecycle Management (BC-ILM) 2.0 and BC-ILM 3.0, you can archive data in Tivoli Storage Manager and protect the archived data. With BC-ILM 3.0, you can also protect documents that are archived in FileNet P8 and that are referenced by the archived data. Before you begin: Plan for configuring your environment for the use of BC-ILM. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Figure 42 on page 68 gives an overview of how the life-cycle management of SAP data is integrated with Content Collector for SAP. Chapter 6. Configuring your environment for basic tasks 67

80 Applications XML Archiving Program local archive.. administration XML Archiving.. Program XML Archive API XML DAS Connector local archive administration XML Archive API XML DAS Connector SAP NetWeaver Application Server Java SAP NetWeaver Application Server ABAP http(s) http(s) Archiving system XML Data Administration XML Data Archiving Service (robust) file system Content Collector for SAP Figure 42. Overview of a life-cycle management environment Configuring for archiving and protecting data by using BC-ILM 2.0 SAP Application Server must be installed as a J2EE Engine, or as an ABAP Engine and a J2EE Engine. Figure 43 on page 69 shows which parts of the Content Collector for SAP environment must be configured so that you can use BC-ILM Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

81 Figure 43. Configuration of your Content Collector for SAP environment for using BC-ILM 2.0 In your basic instance configuration, you configured the following parts: v An HTTP connection between the Collector Server instance and SAP. v The logical Tivoli Storage Manager archive for BC-ILM where the data is to be stored. As BC-ILM version, you specified BC-ILM 2.0. In a server configuration profile, you find the following specifications that relate to BC-ILM 2.0: Section in server configuration profile Keyword UI field that supplies the value Global section WEBDAV_AUTH User for ILM-enabled data archiving ARCHIVE STORAGETYPE The selection of BC-ILM 2.0 results in the value TSM_WEBDAV. Where to find the UI field in Configuration Feature Logical Archives > Tivoli Storage Manager for BC-ILM Logical Archives > Logical Tivoli Storage Manager Archive for BC-ILM > General To use BC-ILM 2.0, you must also configure XML Data Archiving Service (XML DAS) and your SAP system. Complete these tasks: , Creating a user for ILM-enabled data archiving, on page , Creating a root collection in the empty logical archive, on page , Creating a destination in XML Data Archiving Service (XML DAS), on page , Creating an archive store in XML Data Archiving Service (XML DAS), on page 78 Chapter 6. Configuring your environment for basic tasks 69

82 , Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page , Creating the home paths for the archiving objects in the logical archive, on page , Assigning the home paths to the archive store, on page Configuring for archiving data and protecting archived data and documents by using BC-ILM 3.0 SAP Application Server must be installed as a J2EE Engine, or as an ABAP Engine and a J2EE Engine. In addition, you need Tivoli Storage Manager and Version 5.2, or later, as repositories. Figure 44 shows which parts of the Content Collector for SAP environment must be configured so that you can use BC-ILM 3.0. Figure 44. Configuration of your Content Collector for SAP environment for using BC-ILM 3.0 In your basic instance configuration, you configured the following parts: v An HTTP connection between the Collector Server instance and SAP. v The logical FileNet P8 archives where the documents are stored. v The logical Tivoli Storage Manager archive for BC-ILM. As BC-ILM version, you specified BC-ILM 3.0. In a server configuration profile, you find the following specifications that relate to BC-ILM 3.0: 70 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

83 Section in server configuration profile Keyword UI field that supplies the value Global section WEBDAV_AUTH User for ILM-enabled data archiving ARCHIVE STORAGETYPE The selection of BC-ILM 3.0 results in the value TSM_WEBDAV_ILM3. Where to find the UI field in Configuration Feature Logical Archives > Tivoli Storage Manager for BC-ILM Logical Archives > Logical Tivoli Storage Manager Archive for BC-ILM > General To use BC-ILM 3.0, you must also configure XML Data Archiving Service (XML DAS) and your SAP system. Complete these tasks: , Creating a user for ILM-enabled data archiving , Creating a root collection in the empty logical archive, on page , Creating a destination in XML Data Archiving Service (XML DAS), on page , Creating an archive store in XML Data Archiving Service (XML DAS), on page , Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page , Creating the home paths for the archiving objects in the logical archive, on page , Assigning the home paths to the archive store, on page Creating a user for ILM-enabled data archiving Create a user who is allowed to archive data by using XML Data Archiving Service (XML DAS). The procedure for creating this user depends on whether the user data is stored in the SAP J2EE database or in the SAP ECC database. You must have the permission to create such a user Creating a user for ILM-enabled data archiving if the user data is stored in the SAP J2EE database Complete these steps if you installed SAP Application Server as a J2EE Engine. Create the sample user XMLDAS. 1. Start the J2EE Engine Visual Administrator. 2. In the navigation pane on the left, click the Cluster tab. 3. Select your server and then select Services > Security Provider. 4. In the content pane, click the Switch to the edit mode icon. 5. Create the user: a. In the content pane, click the User Management tab. b. Click Create User. c. In the Create New User window, type the name of the user. Specify the same name as for the following field in Configuration Feature: Basic Configuration > Logical Archives > Tivoli Storage Manager for BC-ILM > User for ILM-enabled data archiving Chapter 6. Configuring your environment for basic tasks 71

84 For example, type: XMLDAS d. Type a password for the user. Repeat the password in the Confirm password field. Then, click OK. 6. Change a property for the user: a. On the Users page of the User Management page, type XMLDAS in the Name field. Then, click Search. Figure 45 shows how to search for sample user XMLDAS. Figure 45. Visual Administrator window showing where to specify the user name and where to click Search b. Click the user in the search result box. The pane in the middle of the User Management page shows the properties for the selected user. c. Under Authentication, select the No password change required check box. Figure 46 on page 73 reflects step 6b and step 6c. 72 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

85 Figure 46. Visual Administrator window showing how to specify No password change required for sample user XMLDAS 7. Add the user to the necessary security concept: a. Click the Policy Configurations tab. b. Under Components, click sap.com/ tc~techsrv~xml_das*dataarchivingservice. The list might not be sorted alphabetically. c. Click the Security Roles tab. d. Under Security Roles, click XMLDASSecurityRole. e. Under Mappings, next to Users, click Add to add the user to the selected security role. Figure 47 on page 74 shows how to add user XMLDAS to the specified security role. Chapter 6. Configuring your environment for basic tasks 73

86 Figure 47. Visual Administrator window showing how to add sample user XMLDAS to the specified security role What to do next: 6.2.4, Creating a root collection in the empty logical archive, on page Creating a user for ILM-enabled data archiving if the user data is stored in the SAP ECC database Complete these steps if you installed SAP Application Server as an ABAP Engine and a J2EE Engine , Creating a user with CPIC access, on page 4. Note the following specifications: v Specify the same name as for the following field in Configuration Feature: Basic Configuration > Logical Archives > Tivoli Storage Manager for BC-ILM > User for ILM-enabled data archiving For example, specify: XMLDAS v On the Logon data page of the Maintain User window, select System from the User Type list. 2. Start the J2EE Engine Visual Administrator. 3. In the navigation pane on the left, click the Cluster tab. 4. Select your server and then select Services > Security Provider. 5. In the content pane, click the Switch to the edit mode icon. 6. Add the user to the necessary security concept: a. Click the Policy Configurations tab. b. Under Components, click sap.com/ tc~techsrv~xml_das*dataarchivingservice. The list might not be sorted alphabetically. c. Click the Security Roles tab. d. Under Security Roles, click XMLDASSecurityRole. 74 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

87 e. Under Mappings, next to Users, click Add to add the user to the selected security role. See Figure 47 on page 74. What to do next: 6.2.4, Creating a root collection in the empty logical archive Creating a root collection in the empty logical archive Content Collector for SAP supplies a command-line tool for creating a root collection. Before you begin: 6.2.3, Creating a user for ILM-enabled data archiving, on page 71 Procedure: 1. Log on to the operating system with your Content Collector for SAP user ID. 2. On a command line, change to the bin directory of your Collector Server installation. 3. Enter the following command: manage_root_collection port archive_id root_collection_path create port Specify the Collector Server port. Where to find the information in Configuration Feature: Basic Configuration > Communication > Ports > Collector Server port archive_id Specify the logical archive ID of the logical Tivoli Storage Manager archive for BC-ILM. In this logical archive, you create the root collection. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID root_collection_path Specify a path in the following format: /node_1/node_2/.../node_n/ Each node_i is the name of a logical node in the storage hierarchy. If you use a single path, the root node, which is denoted by the slash (/), is sufficient. If you need several paths, make sure that they do not overlap. Example: manage_root_collection 5500 A3 /rootcoll1/ create 4. To remove an existing empty root collection, run the following command: manage_root_collection port archive_id root_collection_path remove The entire path is removed. What to do next: 6.2.5, Creating a destination in XML Data Archiving Service (XML DAS), on page 76 Chapter 6. Configuring your environment for basic tasks 75

88 6.2.5 Creating a destination in XML Data Archiving Service (XML DAS) In the destination, you specify where the data must be archived. Create the sample destination WEBDAV_DEST. Before you begin: 6.2.4, Creating a root collection in the empty logical archive, on page 75 Procedure: 1. Start the J2EE Engine Visual Administrator. 2. In the navigation pane on the left, click the Cluster tab. 3. Select Services > Destinations. 4. In the Destinations pane on the Runtime page, select HTTP. Figure 48 shows where to select HTTP. Figure 48. Visual Administrator window showing where to select HTTP 5. Click New to create a destination. 6. In the window that opens, type a name for the destination, and then click OK. For example, type: WEBDAV_DEST 7. Under Connection Settings, intheurl field, type the fully qualified path to the root collection that you previously created. Use the following format for the path: server Specify the fully qualified host name or the IP address of the system where Collector Server is installed. 76 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

89 port Specify the TCP/IP port through which the web dispatcher gets its requests. Where to find the information in Configuration Feature: Basic Configuration > Communication > HTTP or HTTPS communication with SAP > Web port root_collection_path Specify the path to the root collection. Example: 8. Under Logon Data, select BASIC from the Authentication list. 9. Under Basic Authentication, type the name of the user who is allowed for ILM-enabled data archiving. For example, type: XMLDAS Figure 49 shows the Visual Administrator window containing the sample information and the necessary settings that you specified in step 7 on page 76 through step 9. Figure 49. Visual Administrator window containing the necessary settings for creating a destination 10. Click Save. 11. If necessary, restart the Destinations service so that the new destination can be used. What to do next: 6.2.6, Creating an archive store in XML Data Archiving Service (XML DAS), on page 78 Chapter 6. Configuring your environment for basic tasks 77

90 6.2.6 Creating an archive store in XML Data Archiving Service (XML DAS) Complete these steps to create an archive store. Create the sample archive store WEBDAV_STORE. Before you begin: 6.2.5, Creating a destination in XML Data Archiving Service (XML DAS), on page 76 Procedure: 1. Open XML DAS Administration by using the following web address: J2EE Engine host:http port/dataarchivingservice/das An example web address would be: 2. Log on to XML DAS Administration with the name of the user who is allowed for ILM-enabled data archiving, for example, XMLDAS. 3. Click Archive Store Management. 4. Click Define. 5. Specify the following information: a. In the Archive Store column, type a name for the store. For example, type: WEBDAV_STORE b. Optional: In the Description column, type a description. c. From the list in the Store Type column, select WebDAV System. d. From the list in the Destination column, select the destination that you previously created. For example, select WEBDAV_DEST. e. In the Proxy Port column, type the HTTP port of your proxy server, if necessary. 6. Click OK to create the archive store. Figure 50 shows what your specifications can look like. Figure 50. XMLDASAdministration window containing sample specifications What to do next: 6.2.7, Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

91 6.2.7 Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS) Create an HTTP connection. Create the sample connection XML_SRV_CONN1. Before you begin: 6.2.6, Creating an archive store in XML Data Archiving Service (XML DAS), on page 78 Procedure: 1. In the SAP GUI, enter the transaction code SM59 to open the Configuration of RFC Connections window. 2. In the RFC Connections column, click HTTP Connections to External Server and then click the Create icon. 3. In the RFC Destination field of the RFC Destination window, type a name for the RFC destination. For example, type: XML_SRV_CONN1 4. Under Description, type a description in one or more of the Description fields. For example, type: XML Data Archiving Service 5. Click the Technical Settings tab. 6. Under Target System Settings, inthetarget Host field, type the host name or the IP address of the SAP J2EE Engine. For example, type: sapj2ee 7. In the Path Prefix field, type the relative path to the XML DAS installation. For example, type: /DataArchivingService/DAS Figure 51 on page 80 shows what the RFC Destination window looks like after you completed step 3 through step 7. Chapter 6. Configuring your environment for basic tasks 79

92 Figure 51. RFC Destination window containing the sample settings 8. Click the Logon & Security tab. When the message HTTP connections may not be secure is displayed, press Enter. 9. Under Logon Procedure, click Basic Authentication. Figure 52 shows the Logon & Security page of the RFC Destination window containing the required setting. Figure 52. Logon & Security page of the RFC Destination window containing the required setting 80 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

93 10. When the message Do you want to change the HTTP logon procedure is displayed, click Yes. 11. Click the Special Options tab. 12. Under Status of HTTP Version, select HTTP 1.1. Figure 53 shows the Special Options page of the RFC Destination window containing the required setting. Figure 53. Special Options page of the RFC Destination window containing the required setting 13. Click the Save icon to save your settings. 14. Click Connection Test to verify that the connection can be established. What to do next: 6.2.8, Creating the home paths for the archiving objects in the logical archive Creating the home paths for the archiving objects in the logical archive For each archiving object, create a home path in the empty root collection of the logical archive. Create a home path for sample archiving object BC_SBOOK_X. Before you begin: 6.2.7, Configuring the connection between SAP Web Application Server ABAP and XML Data Archiving Service (XML DAS), on page 79 Procedure: Chapter 6. Configuring your environment for basic tasks 81

94 1. In the SAP GUI, enter the transaction code SARA to open the Archive Administration: Initial Screen window. 2. In the Object Name field, specify the name of the archiving object, for example, BC_SBOOK_X. 3. Click Customizing to open the Data Archiving Customizing window. 4. Under Basis Customizing, double-click Customizing of Home Paths. Figure 54 shows which item to double-click in the Data Archiving Customizing window. Figure 54. Data Archiving Customizing window 5. In the Change View "Customizing View for Archiving": Details window, check whether the Home Path field contains the following entry: /<SYSID>/<CLIENT>/<OBJECT>/ At run time, the individual parameters are replaced as follows: SYSID Is replaced with the system ID of your SAP system. CLIENT Is replaced with for the name of the SAP client. OBJECT Is replaced with for the name of the archiving object. Figure 55 on page 83 shows what the setting must look like. 82 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

95 Figure 55. Change View "Customizing of Home Paths": Details window containing the required setting 6. Click the Back icon twice to return to the Data Archiving Customizing window. 7. Under Basis Customizing, double-click Synchronization of Home Paths. 8. In the Synchronization of Home Paths for XML-Based Archiving window, click Production Mode and then click the Execute icon. If, for example, you are working with SAP client 800 of SAP ID (SID) EC6 and the root collection path is /rootcoll1/, your logical archive then contains the following folder structure: /rootcoll1/ec6/ /rootcoll1/ec6/800/ /rootcoll1/ec6/800/bc_sbook_x What to do next: 6.2.9, Assigning the home paths to the archive store Assigning the home paths to the archive store You must assign the home paths to the archive store that you created in XML Data Archiving Service (XML DAS). Assign the home path for sample archiving object SB_BOOK_X, which is /rootcoll1/ec6/800/bc_sbook_x, to the sample archive store WEBDAV_STORE. Before you begin: 6.2.8, Creating the home paths for the archiving objects in the logical archive, on page Open XML DAS Administration by using the following web address: J2EE Engine host:http port/dataarchivingservice/das An example web address would be: 2. Log on to XML DAS Administration with the name of the user who is allowed for ILM-enabled data archiving, for example, XMLDAS. 3. Click Archive Hierarchy & Store Assignment. 4. Under Archive Paths, you see the contents of the root collection. Expand the folder that shows the system ID of your SAP system until you see the archiving objects. To see the sample archiving object SB_BOOK_X, you would expand ec6 > 800. Chapter 6. Configuring your environment for basic tasks 83

96 5. Click an archiving object. For example, click SB_BOOK_X. 6. Under Archive Path Properties, fromthearchive Store list, select the archive store to which you want to assign the home path. For example, select WEBDAV_STORE. 7. Click Assign. 8. Repeat step 5 through step 7 for each home path that you want to assign. 6.3 Configuring for archiving incoming documents You can archive documents by creating work items in an SAP workflow, by processing their bar codes, or by using simultaneous archiving. Use work items if you want to include the linking process in more complex routing processes. Also, use work items if your scanning application creates a description file and you want to transfer document information from the description file to the SAP workflow. For information about how to configure SAP for simultaneous archiving, see the SAP documentation Configuring for archiving incoming documents by processing their bar codes To archive incoming documents and link them to SAP by processing the bar codes of the documents, you must complete additional configuration steps on SAP Application Server. Figure 56 on page 85 shows which parts of the Content Collector for SAP environment must be configured so that you can archive documents by processing their bar codes. 84 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

97 Figure 56. Configuration of your Content Collector for SAP environment for archiving incoming documents by processing their bar codes In your basic instance configuration, you configured the following parts: v An HTTPS connection between the Collector Server instance and IBM Content Navigator v The logical archives where the incoming documents are to be stored Collector Server sends the bar code directly to SAP. Take these steps in the SAP GUI to configure SAP for archiving documents by processing their bar codes. For more details, refer to the SAP documentation. 1. Assign the various types of bar codes that the documents use, to the individual SAP business objects. Use the transaction code OAC5 for this step. 2. Check the settings for the specified bar-code types. Use the transaction code OAD4 for this step. 3. Enable SAP for archiving documents by processing their bar codes , Enabling the Collector Server instance to archive incoming documents, on page Configuring for archiving incoming documents by creating work items in an SAP workflow When documents are archived, they are also linked to SAP. Only those documents are linked that can be associated with a specific SAP workflow. Figure 57 on page 86 shows which parts of the Content Collector for SAP environment must be configured so that you can archive documents by creating work items in the SAP workflow. Chapter 6. Configuring your environment for basic tasks 85

98 Figure 57. Configuration of your Content Collector for SAP environment for archiving incoming documents by creating work items in an SAP workflow In your basic instance configuration, you configured the following parts: v An HTTPS connection between the Collector Server instance and IBM Content Navigator v At least one Java RFC dispatcher for the communication between the Collector Server instance and SAP v The logical archives where the incoming documents are to be stored Take these steps to complete the configuration of your environment for archiving incoming documents by creating work items in an SAP workflow: Procedure: , Associating documents with a specific SAP workflow , Enabling the Collector Server instance to archive incoming documents, on page Associating documents with a specific SAP workflow When you archive or link incoming documents by creating work items in an SAP workflow, only those documents can be linked to SAP that can be associated with the appropriate SAP workflows. You associate a document with an SAP workflow and thus with an SAP business object by using the document type. The document type groups documents of the same type. 86 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

99 Create at least one document type for each logical archive. If a logical archive contains, or is to contain, documents that must be associated with different SAP workflows, create a document type for each SAP workflow. Procedure: 1. In the SAP GUI, enter the transaction code OAD5 to open the ArchiveLink: Document Type Customizing Wizard. Figure 58 shows what the Start page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 58. Start page of the ArchiveLink: Document Type Customizing Wizard 2. Click Continue. 3. On the Document type page, specify the following information: a. In the Doc.type field, type a name for the group of documents that are to be linked to the same SAP business object. For example, type: FIIINVOICE b. In the Name field, specify a description. For example, type: Incoming invoice w/o verification Figure 59 on page 88 shows what the Document type page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample entries. Chapter 6. Configuring your environment for basic tasks 87

100 Figure 59. Document type page of the ArchiveLink: Document Type Customizing Wizard containing the sample document type and the sample description c. Click Continue. 4. On the Document type template page, proceed as follows: v If you want to use an existing document type as a template, specify this document type in the Doc.type field. Then, click Continue. v If you do not want to use a template, click Continue. For this example, do not specify a template. Figure 60 on page 89 shows what the Document type template page of the ArchiveLink: Document Type Customizing Wizard might look like. 88 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

101 Figure 60. Document type template page of the ArchiveLink: Document Type Customizing Wizard containing no template 5. On the Workflow document type page, select the Workflow document type check box so that the document type can be used by an SAP workflow. Then, click Continue. Figure 61 shows what the Workflow document type page of the ArchiveLink: Document Type Customizing Wizard might look like. Figure 61. Workflow document type page of the ArchiveLink: Document Type Customizing Wizard with selected item Chapter 6. Configuring your environment for basic tasks 89

102 6. On the Document class page, specify the document class, which is the technical format of a document type, in the Doc. class field, and then click Continue. For documents of document type FIIINVOICE, type, for example: FAX 7. On the Object, method and tasks page, associate the document type with an SAP business object type and assign a method and a workflow task to the document type. Then, click Continue. You can use the standard tasks or the workflow templates. The default values for documents of document type FIIINVOICE are as follows: Property Object type Method Task (for entry) Task (for assignment) Value BKPF CREATE TS TS For more details, see the SAP documentation. Figure 62 shows what the Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard might look like with the default values for documents. Figure 62. Object, method and tasks page of the ArchiveLink: Document Type Customizing Wizard containing the default settings for documents of document type FIIINVOICE 8. On the Workflow parameter page, you have the following options: v If you specified an existing document type as a template, leave the offered transaction code as it is and click Continue. v If you did not specify a template, specify a transaction code. For example, specify FB10 for a financial booking. Then, click Continue. 90 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

103 Figure 63 shows what the Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample transaction code. Figure 63. Workflow parameter page of the ArchiveLink: Document Type Customizing Wizard containing the sample transaction code FB10 9. On the Storage system and link table page, specify the following information: a. In the Cont.Rep.ID field, specify the ID of the logical archive that contains, or is to contain, the documents. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID For example, type: A2 b. In the Link field, specify an SAP ArchiveLink link table. For example, select TOA01. Figure 64 on page 92 shows what the Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard might look like with the sample values. Chapter 6. Configuring your environment for basic tasks 91

104 Figure 64. Storage system and link table page of the ArchiveLink: Document Type Customizing Wizard containing the sample content repository A1 and the sample link table TOA01 c. Click Continue. 10. On the Selection from available presettings page, you have the following options: v If you want to add the document type to one or more existing presettings, click the button in front of available presettings, and click Continue. v If you want to create a presetting only, click Continue. For this example, do not select a presetting. Figure 65 on page 93 shows what the Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard might look like. 92 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

105 Figure 65. Selection from available presettings page of the ArchiveLink: Document Type Customizing Wizard without the selection of a presetting 11. On the Create new presettings page, you have the following options: v If you want to create a presetting, specify a 4-digit ID and a name for the presetting. Then, click Continue. v If you do not want to create a presetting, click Continue. To create a sample presetting, type A101 in the first line of the ID column and type Financial booking for A1 in the first line of the Name column. Figure 66 on page 94 shows what the Create new presettings page of the ArchiveLink: Document Type Customizing Wizard might look like with a sample presetting. Chapter 6. Configuring your environment for basic tasks 93

106 Figure 66. Create new presettings page of the ArchiveLink: Document Type Customizing Wizard containing a sample presetting 12. In the Details of presettings page, take these steps: a. Go to the existing presetting that you selected or go to the new presetting by clicking the Next default setting icon. b. In the Obj. Type column, type US for User. c. In the ID column, type the name of the user who owns the Inbox where the work item is to be placed. For example, type: DEMO_US d. Select one or more of the available check boxes. For example, select: v Storing for subsequent entry v Store and enter v Assign then store Figure 67 on page 95 shows the Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings. 94 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

107 Figure 67. Details of presettings page of the ArchiveLink: Document Type Customizing Wizard containing the necessary settings e. Click Continue. 13. Click Complete. 14. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 15. Click the Continue icon Enabling the Collector Server instance to archive incoming documents You must change the instance configuration. In Configuration Feature, take these steps: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Paths. 3. Complete the Archiving base path field. In a server configuration profile, you find the following specification that relates to the archiving of incoming documents: Section in server UI field that supplies the configuration profile Keyword value Global section ARCHIVING_PATH Archiving base path 6.4 Configuring for archiving outgoing documents To archive outgoing documents, you need the basic environment. Chapter 6. Configuring your environment for basic tasks 95

108 Figure 68 shows which parts of the Content Collector for SAP environment must be configured so that you can archive outgoing documents. Figure 68. Configuration of your Content Collector for SAP environment for archiving outgoing documents In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP. v The logical archives where outgoing documents are to be stored No further configuration is needed. 6.5 Configuring for archiving and viewing print lists To archive and view print lists, you need the basic environment. Figure 69 on page 97 shows which parts of the Content Collector for SAP environment must be configured so that you can archive and view print lists. 96 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

109 Figure 69. Configuration of your Content Collector for SAP environment for archiving and viewing print lists In your basic instance configuration, you configured the following parts: v An HTTP connection or an RFC connection between the Collector Server instance and SAP v The logical archives where the print lists are to be stored Perform these tasks to complete the configuration of your environment for archiving and viewing print lists: Procedure: , Defining an archive device , Associating print lists with an SAP business object of type DRAW, on page , Creating an SAP ArchiveLink batch job, on page , Enabling extended ALF viewing, on page , Enabling print-list viewing, on page Defining an archive device Define an archive device where the print lists can be archived. Procedure: 1. In the SAP GUI, enter the transaction code SPAD to open the Spool Administration: Initial Screen window. 2. Click Display next to Output devices. 3. In the Spool Administration: List of Output Devices window, double-click ARCH. Chapter 6. Configuring your environment for basic tasks 97

110 4. In the Spool Administration: Output Device (Display) window, click the Change icon. 5. On the DeviceAttributes page of the Spool Administration: Output Device (Change) window, select ARCHLINK: SAP ArchiveLink Archiver from the Device Type list. 6. From the Device Class list, select Archiving program. Figure 70 shows what the DeviceAttributes page of the Spool Administration: Output Device (Change) window might look like after you completed step 5 and step 6. Figure 70. DeviceAttributes page of the Spool Administration: Output Device (Change) window containing the necessary settings 7. Click the Access Method tab. 8. From the Host Spool Access Method list, select I: Archiving Device. Figure 71 on page 99 shows the DeviceAttributes page of the Spool Administration: Output Device (Change) window containing your selection. 98 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

111 Figure 71. DeviceAttributes page of the Spool Administration: Output Device (Change) window containing your selection 9. Click the Save icon to save your settings. What to do next: 6.5.2, Associating print lists with an SAP business object of type DRAW Associating print lists with an SAP business object of type DRAW When you archive print lists, they must be linked to an SAP business object of type DRAW. To associate a print list with an SAP business object, you must create a document type. Before you begin: 6.5.1, Defining an archive device, on page 97 Create at least one document type for each logical archive. For screen captures, refer to Associating documents with a specific SAP workflow. Procedure: 1. In the SAP GUI, enter the transaction code OAD5 to open the ArchiveLink: Document Type Customizing Wizard. 2. Click Continue. 3. On the Document type page, specify a name of your choice and a description for the document type. 4. On the Document type template page, proceed as follows: v If you want to use an existing document type as a template, specify this document type in the Doc.type field. Then, click Continue. v If you do not want to use a template, click Continue. For this example, do not specify a template. 5. On the Document class page, specify ALF in the Doc. class field and then click Continue. SAP uses the document class to select a suitable viewer application for the print lists. 6. On the Object, method and tasks page, specify DRAW in the Obj. type field. Then, click Continue. Chapter 6. Configuring your environment for basic tasks 99

112 7. On the Storage system and link table page, specify the following information: a. In the Cont.Rep.ID field, specify the ID of the logical archive that contains, or is to contain, the documents or the print lists. Where to find the information in Configuration Feature: Logical Archives > Overview > Logical Archive ID For example, type: A2 b. In the Link field, specify a link table. For example, select TOA01. c. Click Continue. 8. Click Complete. 9. In the Prompt for Workbench request window, select a request in the Request field. If a request does not exist yet, click the Create icon to create a request. 10. Click the Continue icon. What to do next: 6.5.3, Creating an SAP ArchiveLink batch job Creating an SAP ArchiveLink batch job Create an SAP ArchiveLink batch job to archive spooled print lists automatically. Before you begin: 6.5.2, Associating print lists with an SAP business object of type DRAW, on page 99 Procedure: 1. In the SAP GUI, enter the transaction code SM36 to open the Define Background Job window. 2. In the Job name field, type a name of your choice. For example, type: ARCHIVELINK 3. In the Job class field, leave C as value. Figure 72 on page 101 shows what the Define Background Job window might look like after you completed step 2 and step Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

113 Figure 72. Define Background Job window containing your specifications 4. Click the Start condition icon. 5. In the Start Time window, click Date/Time. 6. In the fields that become available, specify a schedule, and then click the Save icon at the bottom of the window. Figure 73 on page 102 shows the Start Time window containing a sample schedule specification. Chapter 6. Configuring your environment for basic tasks 101

114 Figure 73. Start Time window containing a sample schedule You are returned to the Define Background Job window, which shows the specified schedule under Job start. 7. Click the Step icon. 8. In the Create Step 1 window, click ABAP program. 9. Under ABAP program, inthename field, type the name of the ABAP program. For example, type: ILQBATCH Figure 74 on page 103 shows the Create Step 1 window containing a sample ABAP program name. 102 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

115 Figure 74. Create Step 1 window containing the sample ABAP program name ILQBATCH 10. Click the Save icon at the bottom of the window. The Step List Overview window opens. It contains the ABAP program that you specified. What to do next: 6.5.4, Enabling extended ALF viewing Enabling extended ALF viewing Complete these steps to enable extended ALF viewing. Before you begin: 6.5.3, Creating an SAP ArchiveLink batch job, on page 100 Procedure: 1. In the SAP GUI, enter the transaction code RZ10 to open the Edit Profiles window. 2. In the Profile field, specify the name of an existing profile. For example, select DEFAULT. 3. Under Edit Profile, click Extended maintenance and then click the Change icon. Figure 75 on page 104 shows what the Edit Profiles window might look like after you completed step 2 and step 3. Chapter 6. Configuring your environment for basic tasks 103

116 Figure 75. Edit Profiles window containing your specifications 4. In the Maintain Profile window, click the Create icon. 5. In the Parameter name field, type: rspo/archive_format 6. In the Parameter val. field, type: 2 Figure 76 shows what the Edit Profiles window might look like after you completed step 5 and step 6. Figure 76. Maintain Profile window containing your specifications 7. Click the Exit icon. 8. When the message The parameter was changed. Do you want to save the changes? is displayed, click Yes. 9. In the Edit Profiles window, click the Save icon. 10. When prompted, click Yes to activate the profile. What to do next: 6.5.5, Enabling print-list viewing, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

117 6.5.5 Enabling print-list viewing To enable the viewing of print lists, you must adapt SAP ArchiveLink protocol. Adapt the sample protocol HTTP1. Before you begin: 6.5.4, Enabling extended ALF viewing, on page 103 Procedure: 1. In the SAP GUI, enter the transaction code OAA3 to open the ArchiveLink: Communications Interface Administration window. 2. Double-click the SAP ArchiveLink protocol. For example, double-click HTTP1. 3. In the ArchiveLink Protocols: Overview of Protocol window, double-click Display Stored Document. Figure 77 shows which item to double-click in the ArchiveLink Protocols: Overview of Protocol window. Figure 77. ArchiveLink Protocols: Overview of Protocol window showing which item to double-click 4. Under Document classes, click the radio button next to ALF and click the Change icon. Figure 78 on page 106 shows which radio button and which icon to click in the ArchiveLink Protocols: Overview of Protocol window. Chapter 6. Configuring your environment for basic tasks 105

118 Figure 78. ArchiveLink Protocols: Overview of Protocol window showing which radio button and which icon to click 5. In the Communication Type field of the small window that opens, specify R/3 and then click the Continue icon. Figure 79 shows what the ArchiveLink Protocols: Overview of Protocol window might look like after you specify the communication type. Figure 79. ArchiveLink Protocols: Overview of Protocol window showing the necessary communication type 6. Click the Continue icon to confirm your specifications and to close the window. 7. Click the Save icon to save your settings. 6.6 Configuring for viewing archived documents with the SAP GUI To view archived documents with the SAP GUI, you need only the basic environment. Figure 80 on page 107 shows which parts of the Content Collector for SAP environment must be configured so that you can view archived documents with the SAP GUI. 106 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

119 Figure 80. Configuration of your Content Collector for SAP environment for viewing archived documents with the SAP GUI In your basic instance configuration, you configured the following parts: v An HTTP connection between Collector Server and SAP. For print lists, an HTTP connection or a Remote Function Call (RFC) connection. v The logical archives where the documents that are to be viewed are stored. For information about how to set up the document viewer in SAP, see the SAP help document Customizing for the Document Viewer. Chapter 6. Configuring your environment for basic tasks 107

120 108 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

121 Chapter 7. Configuring your environment for more or advanced tasks To use specific functions, to automate the start of Collector Server, or to increase the performance, you must further configure your environment. Before you begin: 1. Chapter 1, Preparing your environment, on page Chapter 2, Configuring Tivoli Storage Manager for use with Content Collector for SAP, on page Chapter 3, Configuring IBM Content Navigator, on page Fix Pack 1 Chapter 4, Configuring a daemon, on page Chapter 5, Configuring Collector Server, on page 33. It is assumed that you completed a basic instance configuration. In Configuration Feature, you completed all mandatory fields, and you configured the appropriate communication with SAP and IBM Content Navigator. In addition, you defined the logical archives for your repository. 7.1 Setting timeouts for the RFC or Java RFC dispatcher and the agents You can ensure that, after a specific period of inactivity, the RFC dispatcher, the Java RFC dispatcher, or the agent closes the network connection to the SAP Gateway or to the repository. By setting timeouts, the connections between the involved components remain intact until the timeout is reached. Timeouts have the following advantages: v If you have several SAP systems and the connection to one SAP system fails, the RFC dispatcher or the Java RFC dispatcher automatically establishes a working connection to another SAP system. You do not need to restart your Collector Server instance. v You can make sure that the connection to the repository remains active for the specified period. Without a timeout setting, Tivoli Storage Manager closes the network connection after each request. As a result, the tape drive is mounted and unmounted for each request. You can specify a timeout for the RFC dispatcher or the Java RFC dispatcher and a different timeout for each agent. If you do not set timeouts, Collector Server uses the following default settings: Component Value in seconds TSM agent 0 CM agent (1 day) P8 agent (1 day) OD agent (1 day) RFC dispatcher or Java RFC dispatcher (1 day) Copyright IBM Corp. 2010,

122 7.1.1 Setting the timeout for the RFC or Java RFC dispatcher To specify a timeout for the RFC dispatcher or the Java RFC dispatcher, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to SAP System > General. 3. In the Timeout field, specify a value. In a server configuration profile, you find the following specification that relates to the timeout of the dispatchers: Section in server configuration profile Keyword DESTINATION TIMEOUT Timeout UI field that supplies the value Setting the timeout period for the agents To specify a timeout period for an agent, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical Tivoli Storage Archive id > Miscellaneous > General. 3. In the Timeout field, specify a value. 4. Repeat steps 2 and 3 for each logical archive that you want to specify a timeout for. In a server configuration profile, you find the following specification that relates to the timeout of the dispatchers: Section in server configuration profile Keyword ARCHIVE TIMEOUT Timeout UI field that supplies the value 7.2 Assigning fixed ports to the client dispatchers When the API of Content Collector for SAP is to communicate with a Collector Server instance, you can start several client dispatchers to run parallel connections. In the instance configuration, you can specify the Collector Server port. However, the ports for the client dispatchers are assigned dynamically. A dynamic assignment can pose a problem, for example, if the API is behind a firewall. To solve this problem, you can assign fixed port numbers to the client dispatchers. The client dispatchers are then assigned a fixed range of consecutive port numbers that immediately follows the port numbers that are used by a Collector Server instance. You must ensure, however, that this fixed range of port numbers is not used by any other process. Assume, for example, that you specified 5500 as Collector Server port number in the instance configuration, that you started three client dispatchers, and that you 110 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

123 want to assign fixed ports to the client dispatchers. In this example, Collector Server would use the ports 5500 and 5501 and the client dispatchers would be assigned the ports 5502, 5503, and You must ensure that the port numbers are not used by any other process. To use fixed ports, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Communication > Ports and select the Use fixed port numbers check box. In a server configuration profile, you find the following specification that relates to fixed ports: Section in server configuration profile Keyword UI field that supplies the value Global section CLIENT_ALL_PORTS_FIXED The selection of the Use fixed port numbers check box results in the value YES. 7.3 Configuring for preprocessing outgoing documents Content Collector for SAP provides a preprocessor user exit. By using this user exit, you can change outgoing documents with a preprocessor before the documents are archived. To include preprocessors in the archiving process, you must change the instance configuration The preprocessor user exit The preprocessor user exit supports one preprocessor per MIME type. The preprocessor user exit checks the MIME type of a document that is sent by SAP and that was created by using create or mcreate operations. If a document consists of more than one component, the preprocessor user exit checks the MIME type of only the first component. After the user exit reads all components of a document, it calls the preprocessor that you defined for this MIME type in the instance configuration. The preprocessor can run as an executable file or as a Java class. The preprocessor user exit of Content Collector for SAP currently supports the following types of preprocessing: v Changing the format of a document, for example, from TIFF to PDF. v Merging a document that consists of several single-page components into a document with a multi-page component. In this way, you can merge, for example, single-page documents in TIFF format into one multi-page TIFF document. The preprocessor user exit does not support the following tasks: v Linking files to a processed document v Changing or deleting the document ID or the component ID v Processing a document with several preprocessors Chapter 7. Configuring your environment for more or advanced tasks 111

124 7.3.2 Requirements for running a preprocessor You can run the preprocessor as an executable file or as a Java class. To run the preprocessor as an executable file, the command to start the preprocessor must look as follows: preprocessor_command> <input_file> <result_file To run the preprocessor as a Java class, you must provide a Java class that implements the following interface: public interface ACPreprocessor { public ResultSection execute(string archivefilename); } The input for the preprocessor is created by Content Collector for SAP. You are responsible for creating the preprocessor that produces a result that Content Collector for SAP can evaluate The input for the preprocessor Content Collector for SAP creates the following input for your preprocessor: an input file and an extended input file. The name of the input file is the temporary file name of the outgoing document. If the document consists of more than one component, the name of the input file is the temporary file name of the first component. The extended input file contains the temporary files of all components of the document, including the name of the input file. The temporary file names ensure that the individual components are uniquely identified during preprocessing even if several SAP requests are processed in parallel. The extended input file can contain the following sections: [Data] Contains the temporary file names of all components that are not annotations or descriptions. If you want to transform several single-page documents into one multi-page document, this section contains the temporary file names of all pages. [Note] Contains the temporary file name of an annotation. [Desc] Contains the temporary file name of a description. This section is specified only for documents of MIME type application/x-alf. If a specific component type does not exist, the corresponding section is omitted. For example, if there is no annotation, the extended input file does not contain the [Note] section. Notes: v Except for the file name extension, the file name of the input file is identical to the file name of the extended input file. The extended input file has always the extension.input. v The name of the input file is included as the first file name in the [Data] section of the extended input file. v The extended input file lists the file names in the order in which the components are to be preprocessed. v The name of the input file is passed to the preprocessor. The name of the extended input file is not passed to the preprocessor. Preprocessors that can handle an extended input file must check for its existence. 112 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

125 The result from the preprocessor Depending on whether you run your preprocessor as an executable file or as a Java class, the preprocessor produces a result file or a result object. This result file or result object must have specific characteristics and a specific format. The result file or result object must meet the following requirements: v The result file or result object contains one file name only, that is, the name of the output file. This means that the preprocessor returns only one component and deletes any additional components. In this way, a document with several components is merged into a document with one component. v The result file or result object and the input file can contain different MIME types. In this way, you can change a TIFF document to a PDF document. The MIME type must be specified in the result file or result object if it differs from the MIME type in the input file. v The result file or result object can contain additional indexes. The index fields and their values must be added to the attribute list in the result file or result object. Content Collector for SAP does not check the document after it is changed by the preprocessor. Ensure that the document can be accessed and used by SAP The format of the result file: If the preprocessor runs as an executable file, a result file is produced. The format of the result file is similar to the format of a server configuration profile. The order of the individual sections and the order of the parameters within each section is arbitrary. The result file must contain a GLOBAL section. It can also contain an INDEX section. The following example shows the various sections and the parameters that you can specify: [GLOBAL] File=output_file_name DocType=new_mimetype [INDEX] index_field1=index_value1 index_field2=index_value2 Explanation of the parameters: Parameter Description Mandatory or optional File DocType [INDEX] section The name of the output file that contains the document and that is created by the preprocessor. You can specify one file name only. The MIME type of the document after it is changed by the preprocessor. The list of attributes that are returned by the preprocessor in the format index_field=index_value Mandatory Mandatory if different from the input file Optional Notes: Chapter 7. Configuring your environment for more or advanced tasks 113

126 v v v The file name that you specify for the File parameter can be enclosed in quotation marks. The web dispatcher removes the quotation marks. Blanks are not allowed before or after the equal (=) sign. Content Collector for SAP evaluates all parameters in the result file The format of the result object: If the preprocessor runs as a Java class, a result object is produced. The format of the result object must meet specific requirements. The result object that is to be returned by the preprocessor must look as follows: public class ResultSection { private GlobalEntries globalentries; private Map indexvalues; } The GlobalEntries class must contain the following parameters: public class GlobalEntries { private List filenames; private String documentclass; private String documenttype; private String[] links; } Content Collector for SAP evaluates the following parameters. Any additional parameters are ignored. Parameter Description Mandatory or optional filenames The name of the output file that contains the Mandatory document and that is created by the preprocessor. documenttype You can specify one file name only. The MIME type of the document after it is changed by the preprocessor. Mandatory if different from the input file The preprocessor You are responsible for creating a preprocessor that can handle the input that Content Collector for SAP creates, that produces the result that can be used by Content Collector for SAP, and that changes the documents as supported by the preprocessor user exit of Content Collector for SAP. In addition to the input and result requirements, keep in mind the following information when you create a preprocessor: v The preprocessor must remove any temporary files that it creates. v The preprocessor does not have to remove the input after preprocessing is completed. The input file and all files that are listed in the extended input file are deleted by Content Collector for SAP. Important: The existence of the result file or result object is the only indicator that the preprocessor ran successfully. Therefore, ensure that the creation of the result file or result object is the last preprocessing step Including the preprocessors in the archiving process To include one or more preprocessors, you must change the instance configuration. You can specify one preprocessor per MIME type. 114 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

127 In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical Tivoli Storage Archive id. 3. Complete the Preprocessors section. 4. Repeat steps 2 and 3 for each logical archive that is to use one or more preprocessors. In a server configuration profile, you find several of the following specifications that relate to the preprocessing of outgoing documents: Section in server configuration profile Keyword ARCHIVE PREPROC_MIMETYPE MIME type PREPROC_EXEC File PREPROC_CLASS Class name PREPROC_CLASSPATH Class path UI field that supplies the value 7.4 Integrating Content Collector for SAP into the SAP Solution Manager You can integrate Content Collector for SAP into the SAP Solution Manager by registering Content Collector for SAP with the SAP System Landscape Directory (SLD). Procedure: 1. Change to the directory of your Collector Server installation. The default installation directory is as follows: v Linux UNIX InstallHome/server v Windows InstallHome\server 2. Open the file slddata.xml in a text editor. This file is in the installation directory. 3. Replace all occurrences of the word HOSTNAME with the fully qualified name of the host where Collector Server is installed. 4. Copy the modified file slddata.xml to a directory on the system where the SAP Solution Manager is installed. 5. Run the sldreg tool to upload the information that is contained in the modified slddata.xml file to the SLD. For a description of the sldreg tool, open the SAP Help Portal and search for Configuring sldreg and transferring data to SLD. Chapter 7. Configuring your environment for more or advanced tasks 115

128 116 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

129 Chapter 8. Running a Collector Server instance You must start the Collector Server instance before you can create any task profiles for it in Administration Feature or before you can run any of the Content Collector for SAP tasks. Before you begin: 1. Plan for running Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 5, Configuring Collector Server, on page Optional: Chapter 6, Configuring your environment for basic tasks, on page Optional: Chapter 7, Configuring your environment for more or advanced tasks, on page Creating and updating options files On Linux and UNIX, you must update the client-system options file (dsm.sys). On Windows, you must create a client options file (dsm.sys) for each Tivoli Storage Manager server that is specified in the instance configuration. A client options file ensures that a Collector Server instance connects to the correct server. Procedure: 1. Copy the dsm.opt file, which is packaged with Tivoli Storage Manager, to a directory that does not contain the server configuration profile. Collector Server must have write access to this directory. 2. Open the file with a text editor, delete its contents, and then save it as an empty file under the same name. 3. Continue with the steps for your operating system: v Linux UNIX Add an entry with the address of each Tivoli Storage Manager library server to the dsm.sys file. The dsm.sys file contains all Tivoli Storage Manager parameters for connecting to the specified server. v Windows a. Make as many copies of the original dsm.opt file as there are Tivoli Storage Manager library servers specified in the instance configuration. Save these copies to the directory that contains the empty dsm.opt file. Name each copy server_name.opt server_name stands for the name of the Tivoli Storage Manager library server as specified in the instance configuration. b. Open each copy with an editor and replace the value for the tcpserveraddress parameter with the address of the Tivoli Storage Manager library server. Copyright IBM Corp. 2010,

130 8.2 Starting a Collector Server instance You start a Collector Server instance from the command line. Starting with Fix Pack 1, start an instance directly from IBM Content Navigator. Before you begin: 8.1, Creating and updating options files, on page Starting a Collector Server instance from IBM Content Navigator Fix Pack 1 To start a Collector Server instance from IBM Content Navigator, you must change the instance configuration. Before you begin: v Chapter 4, Configuring a daemon, on page 27. Ensure that the daemon is running. v Ensure that the paths that you specified in the instance configuration do not contain any environment variables or shell expansions. Replace paths that contain environment variables or shell expansions with fully qualified paths. In Configuration Feature, take these steps: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration and complete the Instance Control section. 3. Click Save. Then, click Start. You are prompted for the passwords of the SSL keystore, the SSL truststore, and all users that are specified in the instance configuration. You are prompted even if you already specified that information on a command line. All passwords are stored in the password file. The Collector Server instance uses them the next time that it is started. In addition, the master key is generated if it does not exist yet. The paths that you specified in the instance configuration are created if they do not exist. The server configuration profile is stored on the system where Collector Server is installed. If, in the instance configuration, you specified the file name of the server configuration profile without a path, the server configuration profile is stored in the instance path. If you specified a fully qualified file name, the server configuration profile is stored in the path that you specified as part of the fully qualified file name. What to do next: , Configuring the server authentication on the web application server, on page Starting a Collector Server instance from a command line To start a Collector Server instance from a command line, you must first make the instance configuration available on the system where Collector Server is installed. Then, you must use the archpro command. Before you begin: Ensure that all paths that you specified in the instance configuration exist. Content Collector for SAP does not create any paths. 118 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

131 Procedure: , Making an instance configuration available for use by Collector Server , Starting a Collector Server instance with the archpro command, on page Making an instance configuration available for use by Collector Server To run a Collector Server instance, the instance configuration must be available as a server configuration profile on the system where Collector Server is installed. You can use Configuration Feature to export the instance configuration to a server configuration profile. Then, you can move the server configuration profile to the server where Collector Server is installed. Use this manual procedure at least for making the instance configuration available for the first time. Alternatively, you can download the instance configuration with the archcmd program. You run this program from a command line on the system where Collector Server is installed. If your instance configurations change frequently, you can automate the download Exporting the instance configuration from Configuration Feature: When you make an instance configuration available for the first time, export it from Configuration Feature. Procedure: 1. Open a web browser and then open the IBM Content Navigator desktop for the Collector Server administrator, by typing the following URL: protocol://hostname:portnumber/context_root/?desktop=desktop_id You must have access to this desktop. For example, type: 2. Log on as Collector Server administrator. 3. In the plug-in pane on the left, click the IBM Content Collector for SAP Applications Configuration Feature icon. 4. On the Manage Collector Server Instances page, open the instance configuration that you want to export. 5. Click Export. The instance configuration is converted to a server configuration profile. The Export Configuration to Server Configuration Profile window shows the file name and the contents of the server configuration profile. Below the contents, you find the command that you can use to download the instance configuration with the archcmd program. Make a note of this command if you want to use this program. 6. Click OK. Then, save the server configuration profile. 7. Move or copy the saved server configuration profile to the system where Collector Server is installed. You can store the profile in a directory of your choice. It does not have to be stored in the instance directory. What to do next: , Starting a Collector Server instance with the archpro command, on page 120 Chapter 8. Running a Collector Server instance 119

132 Downloading the instance configuration with the archcmd command: Instead of exporting the instance configuration from Configuration Feature each time the instance configuration changes, you can download it from a command line on the system where Collector Server is installed. For this purpose, Content Collector for SAP supplies the archcmd program. This program is based on the Java utilities that are supplied with Content Collector for SAP as part of the IBM Java Runtime Environment (JRE). Before you begin: , Exporting the instance configuration from Configuration Feature, on page 119. Complete at least step 1 on page 119 through step 5 on page 119. You would typically use the archcmd program if you must frequently change your instance configurations and you want to automate the synchronization of the server configuration profile on Collector Server with the instance configuration in the IBM Content Navigator database. Procedure: 1. Open a command line on the system where Collector Server is installed. If, in the instance configuration, you specified the file name of the server configuration profile without a path, open a command line in the directory that the server configuration profile is to be downloaded to. If you specified a fully qualified file name, the server configuration profile is downloaded to the path that you specified as part of the fully qualified file name. Alternatively, open the command line in a directory of your choice and, in step 2, add the filename parameter to the archcmd command. 2. Enter the command that you noted down in step 5 on page 119. For more information about the archcmd command, see the topic archcmd in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Optional: Schedule the archcmd program to automate the download. A server configuration profile with the latest instance configuration is created on the system where you ran the command. What to do next: , Starting a Collector Server instance with the archpro command Starting a Collector Server instance with the archpro command When you start a Collector Server instance for the first time, you must enter specific information. Before you begin: v , Making an instance configuration available for use by Collector Server, on page 119. v Windows If you run several Content Collector for SAP versions on one Windows system, check the PATH environment variable on a command prompt. The archpro command, which is used to start a Collector Server instance, can be issued from any directory. In addition to the command, you must specify the fully qualified file name of the server configuration profile. You are prompted for all 120 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

133 other information that the Collector Server instance needs to start. To reduce the number of prompts, you can specify the appropriate parameters for the command. The fully qualified file name of the server configuration profile can be omitted if both of the following conditions are met: v v You enter the command from the directory that contains the server configuration profile. The server configuration profile has the name archint.ini. The procedures in the following topics are based on these assumptions: v The server configuration profile is in the instance directory. v The server configuration profile has the name archint.ini. v You enter the archpro command from the instance directory. The following topics give an overview of the parameters that you most likely have to provide with the archpro command. For the full list of parameters, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Starting a Collector Server instance that uses Tivoli Storage Manager, with the archpro command: Complete these steps to start a Collector Server instance with the archpro command when you use Tivoli Storage Manager as repository. Procedure: 1. Open a command line and change to the instance directory. 2. Generate the master key, which encrypts the password file and the SAP certificates. Enter the following command: archpro -f masterkey You must have read and write access for the fully qualified path to the master key file, which contains the master key. Ideally, you are the owner of this file and no other user has access to this file. Linux and UNIX systems check the permissions for this file. Content Collector for SAP creates a master key and saves it under the fully qualified file name that you specified in the instance configuration. Where to find the file name: Basic Configuration > Security > General > Master key file MASTER_KEYFILE keyword 3. If the Collector Server instance must log on to an SAP system, enter the following command: v If the instance is to log on to a specific SAP client, enter the following command: archpro -f r3passwd sap_client sap_user v sap_user stands for the name of the CPIC user that the Collector Server instance uses to log on to SAP client sap_client. You are prompted for the password of the specified CPIC user. If the instance is to log on to all SAP clients that are linked as logical systems, enter the following command: Chapter 8. Running a Collector Server instance 121

134 archpro -f r3passwd You are prompted for the password of each CPIC user and each SAP client that are linked as logical systems to the Collector Server instance. Notes: v Type the password exactly as you specified it for the CPIC user. v You must enter this command each time you want to change the SAP password. 4. The Collector Server instance must access your repository. Enter the following command if you use the PASSWORDACCESS PROMPT option. Skip this step if you use the PASSWORDACCESS GENERATE option. For more information, see 2.5, Setting the password options, on page 21. archpro -f serverpasswd server repos_user password server Specify the library server that you specified in the instance configuration. Where to find the information: Logical Archives > Logical Tivoli Storage Manager Archive id > General > Server SERVER keyword repos_user Specify the Tivoli Storage Manager node that you registered with Content Collector for SAP. Where to find the user ID: Logical Archives > Logical Tivoli Storage Manager Archive id > General > Node ADSMNODE keyword password Specify the password of the node. 5. IBM Content Navigator must access the Collector Server instance. Enter the following commands: v archpro -f keystore_passwd You are prompted for the password of the SSL keystore. v archpro -f truststore_passwd You are prompted for the password of the SSL truststore. Note: The keystore and the truststore are also used for an HTTPS communication with an SAP system. You must specify the commands and the passwords only once. 6. If you configured your instance for archiving data by using WebDAV Storage Interface for SAP NetWeaver Information Lifecycle Management (BC-ILM), enter the following command: archpro -f webdavpasswd password password stands for the password of the user who is to archive data by using XML Data Archiving Service (XML DAS). 7. Enter archpro to start the Collector Server instance. All passwords that you specified are stored in the password file. The Collector Server instance uses them the next time that it is started. 122 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

135 What to do next: , Configuring the server authentication on the web application server, on page Stopping a Collector Server instance At any time, you can stop a Collector Server instance. Collector Server waits until all jobs are finished and then shuts down. Before you begin: 8.2, Starting a Collector Server instance, on page 118 You stop a Collector Server instance from the command line. Starting with Fix Pack 1, stop the instance directly from IBM Content Navigator. Complete these steps to stop a Collector Server instance: v Fix Pack 1 To stop it from IBM Content Navigator, take these steps in Configuration Feature: 1. In the Manage Collector Server Instances page, select the Collector Server instance that you want to stop. 2. Click Stop. You can stop one instance at a time. v To stop it from a command line, take these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archstop -i profile profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. When the archpro program receives the archstop command, it first stops all child processes and then it stops itself. For more information about this command and the parameters that you can specify, see the topic archstop in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Restarting a Collector Server instance At any time, you can change the configuration of a Collector Server instance. If the affected instance is running, the changes take effect after the restart of the instance. Before you begin: 8.2, Starting a Collector Server instance, on page 118 To apply changes to a running Collector Server instance, complete these steps: 1. In Configuration Feature, change the instance configuration. Then, click Save. 2. Continue as follows: v Fix Pack 1 To restart the instance from IBM Content Navigator, you are asked whether you want to apply your changes to the running instance. Click Stop to Restart to stop the instance and then restart it with the changed configuration. If you added users, keystores, or truststores to the instance configuration, you are prompted for their passwords. If a password changed, you are prompted for the new password. v To restart the instance from a command line, take these steps: Chapter 8. Running a Collector Server instance 123

136 a. 8.3, Stopping a Collector Server instance, on page 123. b , Starting a Collector Server instance from a command line, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

137 Chapter 9. Running a Collector Server instance as a Windows service On Windows, you can run a Collector Server instance as a service. As a service, an instance runs continuously even if all users are logged off. This is useful, for example, if you want to use monitoring tools. 9.1 Installing a Collector Server instance as a service and starting the service You use the archservice program to install a Collector Server instance as a service and to start the service. Starting with Fix Pack 1, you can use the daemon to complete those tasks Installing a Collector Server instance as a service and running the service from IBM Content Navigator Fix Pack 1 The daemon must have the permission to create a Windows service and to start and stop a service. Before you begin: Chapter 4, Configuring a daemon, on page 27 In Configuration Feature, take these steps: 1. To install a Collector Server instance as a service and to start the service, proceed as follows: a. Open the configuration of the instance that you want to run as a service. If the instance is running, stop it. b. Go to Basic Configuration and complete the Instance Control section. c. Save the instance configuration and then click Start. The Collector Server instance is installed as a service and the service is started. In addition, the archpro program is started, which in turn starts other related programs. The service checks every few seconds if the archpro program is still running. If the service detects that this program stopped, it waits for 1 minute and then tries to restart it. 2. To stop the service, select or open the Collector Server instance and then click Stop. The service is stopped, together with the archpro program and the programs that were started by the archpro program. 3. To restart the service, select or open the Collector Server instance and then click Start Installing a Collector Server instance as a service and running the service from a command line The user who installs the Collector Server instance as a Windows service needs the right to change the Windows registry and, thus, must be an administrator. Copyright IBM Corp. 2010,

138 Before you begin: If the Collector Server instance that is to be installed as a service is still running, stop it. Open a command prompt as an administrator, then take these steps: 1. To install a Collector Server instance as a service, enter the following command: archservice install -i profile -n suffix profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. suffix stands for the suffix that is appended to the default name iccsap.for example, if you specify -n instance1, the service is named iccsap_instance1. The service is installed, and the Windows Services window lists the service. 2. To start or restart the service, use either of the following ways: v At the command prompt that you open as an administrator on the system where Collector Server is installed, enter the following command: archservice start v Right-click the appropriate service in the Services window, and click the menu item to start the service. The service is started. In addition, the archpro program is started, which in turn starts other related programs. The service checks every few seconds if the archpro program is still running. If the service detects that this program stopped, it waits for 1 minute and then tries to restart it. 3. To stop the service, use either of the following ways: v At the command prompt that you open as an administrator on the system where Collector Server is installed, enter the following command: archservice stop v Select the appropriate service in the Services window and then click Action > All Tasks > Stop. The service is stopped, together with the archpro program and the programs that were started by the archpro program. For more information, see the topic archservice in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Running several instances of Collector Server as services You can run several Collector Server instances as services on one system, for example, to improve the performance. Before you begin: Windows The instances must belong to the same Content Collector for SAP version. Procedure: 1. Install and start the services as follows: v Fix Pack , Installing a Collector Server instance as a service and running the service from IBM Content Navigator, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

139 9.2 Uninstalling a service v 9.1.2, Installing a Collector Server instance as a service and running the service from a command line, on page 125. When you install the Collector Server instance as a service, specify a unique name by using the -n parameter , Assigning fixed ports to the client dispatchers, on page 110. You use the archservice program to uninstall a service. Procedure: 1. If the service is still running, stop it. 2. Open a command prompt as an administrator. Then, enter the following command: archservice remove -i profile -n name Important: If you installed a Collector Server instance with the archservice command and you did not specify the -n parameter, specify the archservice remove command without the -n parameter. For more information, see the topic archservice in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Hints and tips If a problem occurs when you run a Collector Server instance as a service, the following hints and tips might help you solve the problem. v v v Install a Collector Server instance as a service only after the instance is started for the first time, and if you do not get any error messages or warnings. Check whether dynamic tracing is enabled. By using dynamic tracing, the start of the instance is traced. Tracing stops automatically after the instance is fully initialized. Where to find the information in Configuration Feature: Go to Basic Configuration > Logging and Tracing > Tracing and check whether Dynamic is selected for Tracing. You can restart tracing by using the archadmin program. Starting with Fix Pack 1, you can restart tracing also from IBM Content Navigator. Remember, however, that tracing affects the performance of Content Collector for SAP. Therefore, stop tracing again when you do not need it any more. For more information about the archadmin program and the parameters that you can specify, see the topic archadmin in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH For more information about controlling tracing from IBM Content Navigator, see the topic Viewing logs and traces and controlling tracing from IBM Content Navigator. Record all messages that are issued when the instance is run as a service. For this purpose, you must change the instance configuration. In Configuration Feature, take these steps in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Basic Configuration > Logging and Tracing > Tracing 3. In the Service trace file field, and specify a fully qualified file name. Chapter 9. Running a Collector Server instance as a Windows service 127

140 In a server configuration profile, you find the following specification that relates to this trace file: Section in server configuration profile UI field that supplies the value Keyword Global section SERVICE_TRACEFILE Service trace file v If the number of RFC dispatchers is greater than 0, the paths that are set as basic path and archive path are probably unavailable when you start the service. However, an instance starts only if all paths are available. Where to find the basic path and archive path in Configuration Feature: Basic Configuration > Communication > RFC Communication with SAP 128 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

141 Part 2. Security Get familiar with the security concept that is provided by Content Collector for SAP before you complete any of the security tasks. For more information, see the topic Security concept provided by Content Collector for SAP in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH The master key is created when you start a Collector Server instance for the first time. For a secure communication between a Collector Server instance and the API of Content Collector for SAP or between a Collector Server instance and SAP, you must complete more steps. Copyright IBM Corp. 2010,

142 130 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

143 Chapter 10. Changing the master key You create the master key when you start the Collector Server instance for the first time. You can create a new master key each time you start the instance. Before you begin: 8.2, Starting a Collector Server instance, on page 118 v Fix Pack 1 If you start a Collector Server instance from IBM Content Navigator, select the Generate master key check box in the Start Instance window. v If you use a command line to start a Collector Server instance, complete these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archpro -i profile -f masterkey profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. The master key is stored in the master key file that you specified in the instance configuration. Where to find the path to the master key file: Basic Configuration > Security > General > Master key file MASTER_KEYFILE keyword 3. Enter archpro to start the Collector Server instance. Related information: archpro Copyright IBM Corp. 2010,

144 132 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

145 Chapter 11. Changing the passwords in the password file All passwords that a Collector Server instance needs are stored in the password file. You add the passwords to the password file when you start the Collector Server instance. If the password of a user or keystore changes, for example, because your company policy requires that passwords are changed at regular intervals, you must also change it in the password file. Before you begin: 8.2, Starting a Collector Server instance, on page 118 You can add passwords to, or change them in, the password file when you start the Collector Server instance. Use either of these procedures: v Fix Pack 1 If you start a Collector Server instance from IBM Content Navigator, specify the new or changed passwords in the Start Instance window. v If you use a command line to start a Collector Server instance, complete these steps: 1. Open a command line and change to the instance directory. 2. Enter the following command: archpro -i profile -f parameters profile stands for the fully qualified file name of the server configuration profile. If you enter the command from the directory that contains the server configuration profile and if the server configuration profile has the default name archint.ini, -i profile is optional. parameters stands for the parameter or parameters that you must specify to change a specific password in the password file. For example, to change the password the of CPIC user that Collector Server uses to log on to an SAP client, enter the following command: archpro -f r3passwd You are prompted for the new password. 3. Enter the appropriate command for each password that you want to change in the password file. For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Enter archpro to start the Collector Server instance. Copyright IBM Corp. 2010,

146 134 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

147 Chapter 12. Setting up a secure communication with the API Set up a secure communication between the API of Content Collector for SAP and a Collector Server instance if you want to use one or more external applications, such as IBM Datacap. Before you begin: 1. Plan for a secure communication between the API and one Collector Server. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Install the add-ons package on the system where the external application runs. For more information, see the corresponding topic in the Installing part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Content Collector for SAP supplies a script file that uses Global Secure ToolKit (GSKit) commands to create the necessary keystores and the certificates and to register the certificates as trusted certificates. The script file has the following fully qualified file name: v Linux UNIX InstallHome/server/bin/client_key_gen.sh v Windows InstallHome\server\bin\client_key_gen.bat The script file executes several GSKit commands. The most important tasks can be completed by running the script file once, namely: v Create the server keystore. v Create the specified number of client keystores. v Create a self-signed certificate in each created keystore. v v Export the self-signed certificate, including the public key, from the server keystore and import it into all created client keystores. Export the self-signed certificates, including the public keys, from all created client keystores and import them into the server keystore. The following tasks show how to set up a secure connection to the API. The commands and specifications are based on the assumption that you use the default names for the keystores. For the complete functional scope of this script file, see the topic client_key_gen in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Tip: The tasks reflect an environment where the API is installed on a system with only a few users. You might have a much more complex environment with many applications and many users, where users share certificates and new users must be added from time to time. It is good practice to document the keystore names, the locations of the keystores, and the number of client keystores that you already created. Also, document which certificate belongs to which user and which certificates are shared by which users. Procedure: , Setting up a secure connection on Collector Server, on page 136 Copyright IBM Corp. 2010,

148 , Setting up a secure connection on the system with the API, on page Optional: 12.3, Setting up a secure communication between the API and several Collector Server instances, on page Setting up a secure connection on Collector Server You must create the server keystore and the client keystores on the Collector Server instance that communicates with the API. In addition, you must enable Collector Server for connecting to the API. Procedure: , Creating the keystores , Enabling the Collector Server instance to communicate with the API, on page Creating the keystores Create the server keystore and the client keystores. Procedure: 1. Open a command line and change to the directory where the folders for the keystores are to be stored. Tip: It is good practice to create the folders in a subdirectory of the instance directory. For example, create it in the following path: v Linux UNIX /home/iccsapadmin/instance1/security/server_clients v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\instance1\ security\server_clients 2. Enter the following command: v Linux UNIX client_key_gen.sh -c -p password -n number_clients v Windows client_key_gen.bat -c -p password -n number_clients password stands for the password of the server keystore. number_clients stands for the number of client keystores that are to be created. Create as many client keystores as you need certificates: v If the system with the API is used by several users and if each user must have their own certificate, create as many client keystores as there are users. v If you want to organize the users in groups, where each group is to share one certificate, create one client keystore for each group. For example, to create the server keystore and two client keystores and to encrypt the server keystore with the password secure, enter the following command. client_key_gen.sh -c -p secure -n 2 In the directory where you entered the command, the following folders are created: server, client_1, and client_2. The name of the server keystore is server.kdb. The names of the client keystores are client_1.kdb and client_2.kdb. The server keystore contains the certificates clientcert_1.crl and clientcert_2.crl. The client keystores contain the certificate servercert.crl. The server keystore is encrypted with the password secure. 3. At any time, you can add more client keystores. Enter the following command: 136 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

149 v Linux UNIX client_key_gen.sh -p password -n number_clients -i n+1_clients v Windows client_key_gen.bat -p password -n number_clients -i n+1_clients password stands for the password of the server keystore. number_clients stands for the number of client keystores that must be added. n+1_clients stands for the start number for the client keystores that are to be added. For example, to add another client keystore to two existing client keystores, you would enter the following command on a Linux or UNIX system: client_key_gen.sh -p secure -n 1 -i 3 The additional folder client_3 is created. What to do next: , Enabling the Collector Server instance to communicate with the API Enabling the Collector Server instance to communicate with the API Enable the Collector Server instance to use the server keystore and to communicate with the API. Before you begin: , Creating the keystores, on page 136 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication. c. Complete the Communication with the API section , Restarting a Collector Server instance, on page 123. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f dll_keystore_passwd password In a server configuration profile, you find the following specifications that relate to the communication with the API: Section in server configuration profile UI field that supplies the value Keyword Global section ARCHWINS Client dispatchers DLL_KEYSTORE_FILE Server keystore What to do next: 12.2, Setting up a secure connection on the system with the API 12.2 Setting up a secure connection on the system with the API You must copy the client keystores that you created on the system where the Collector Server instance runs, to the system where the API is installed. In addition, you must configure the client configuration profile for each user of this system. Chapter 12. Setting up a secure communication with the API 137

150 Before you begin: 12.1, Setting up a secure connection on Collector Server, on page 136 The sample client configuration profile csclient_sample.ini is installed together with Content Collector for SAP. You find it in the following path: v Linux UNIX InstallHome/api v Windows InstallHome\api Procedure: 1. On the system where the API is installed, create the following path in the env_var_appdata directory of each user on the system who is allowed to use the API: IBM\iccsap\security 2. Copy the sample client configuration profile to each env_var_appdata\ibm\ iccsap path and rename the file to csclient.ini. 3. Copy the folders that contain the client keystores (client_x) and that you created on the system where the Collector Server instance runs, to the system with the API. Use one of the scenarios, depending on your setup. Tip: Because the client keystores and the certificates are not protected by a password, it is good practice to place them in a subdirectory of the UserHome directory of a user, preferably in the env_var_appdata\ibm\iccsap\security directory. In the following scenarios, it is assumed that you use the env_var_appdata\ibm\iccsap\security directory for the client keystores. v , Scenario 1: One user uses the API v v v , Scenario 2: Several users where each user has a certificate, on page , Scenario 3: One certificate for several users in a private directory, on page , Scenario 4: One certificate for several users in a public directory, on page 140 What to do next: If you decide to connect your API with several Collector Server instances, continue with 12.3, Setting up a secure communication between the API and several Collector Server instances, on page Scenario 1: One user uses the API The system with the API is used by one user, or only one user on this system is allowed to use the API. Assume, for example, that the user who needs a certificate is cuser1 and the client_1 folder contains the client keystore with the certificate. Procedure: 1. Copy the client_1 folder to a directory that is accessible by cuser1. For example: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 2. Open the csclient.ini file that you copied to the env_var_appdata\ibm\iccsap directory of the user, in a text editor. 138 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

151 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. For example: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Scenario 2: Several users where each user has a certificate Several users on the system are allowed to use the API, and a certificate is required for each user. Assume, for example, that the system is used by cuser1 and cuser2. In addition, assume that the client_1 folder contains the client keystore with the certificate for cuser1 and that the client_2 folder contains the client keystore with the certificate for cuser2. Procedure: 1. Copy the client_1 folder to a directory that is accessible by cuser1. In addition, copy client_2 folder to a directory that is accessible by cuser2. Example path to the client_1 folder for example user cuser1: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 Example path to the client_2 folder for example user cuser2: C:\Users\cuser2\AppData\Roaming\IBM\iccsap\security\client_2 2. Open the csclient.ini files that you copied to the env_var_appdata\ibm\ iccsap directories of the users, in a text editor. 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Example keystore setting in csclient.ini for example user cuser1: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Example keystore setting in csclient.ini for example user cuser2: keystore=c:\users\cuser2\appdata\roaming\ibm\iccsap\security\client_2\ client_2.kdb Scenario 3: One certificate for several users in a private directory Several users or all users on the system are allowed to use the API, and these users are to share one certificate. For each user, the same certificate is to be stored in a directory that can be accessed by this user only. Assume, for example, that the client_1 folder contains the client keystore with the certificate for the users cuser1 and cuser2. Procedure: 1. Copy the client_1 folder twice. Place one copy in a directory that is accessible by user cuser1 only, and place the other copy in a directory that is accessible by user cuser2 only. Example path to the client_1 folder for example user cuser1: C:\Users\cuser1\AppData\Roaming\IBM\iccsap\security\client_1 Example path to the client_1 folder for example user cuser2: C:\Users\cuser2\AppData\Roaming\IBM\iccsap\security\client_1 2. For each user, open the csclient.ini file that you copied to the env_var_appdata\ibm\iccsap directory of this user, in a text editor. Chapter 12. Setting up a secure communication with the API 139

152 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Example keystore setting in csclient.ini for example user cuser1: keystore=c:\users\cuser1\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Example keystore setting in csclient.ini for example user cuser2: keystore=c:\users\cuser2\appdata\roaming\ibm\iccsap\security\client_1\ client_1.kdb Scenario 4: One certificate for several users in a public directory Several users or all users on the system are allowed to use the API, and these users are to share one certificate. The folder that contains the client keystore with the appropriate certificate is to be placed in a directory that is accessible by all users who share the certificate. In this case, ensure that all users who share the certificate have read access for this directory and that read access is restricted to those users only. Assume, for example, that the client_1 folder contains the client keystore with the certificate for the users cuser1 and cuser2. Procedure: 1. Copy the client_1 folder to a directory that is accessible by both users. Both users must have read access for the client_1 folder. Example path to the client_1 folder: C:\Users\security\client_1 2. Open one of the csclient.ini files that you copied to the env_var_appdata\ IBM\iccsap directory of the client users, in a text editor. For example, open the file for cuser1. 3. Set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for both users. For example: keystore=c:\users\security\client_1\client_1.kdb 4. Copy the updated csclient.ini file to the env_var_appdata\ibm\iccsap directory of all other users who share the certificate. In this example, copy it to the appropriate directory of user cuser2. Overwrite the existing csclient.ini file Setting up a secure communication between the API and several Collector Server instances If you want to the API to communicate with several Collector Server instances, you must secure all connections. Before you begin: v.plan for a secure communication between the API and several Collector Server instances. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH v It is assumed that you already set up at least one secure client connection and you are thus familiar with the client_key_gen script file. See Chapter 12, Setting up a secure communication with the API, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

153 To set up secure communication with several Collector Server instances, you use the script file client_key_gen again. In addition, you use the script file that is installed with the add-ons package and has the following fully qualified file name: InstallHome\api\register_server.bat For the complete functional scope of this script file, see the topic register_server in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH The following procedure shows how to set up secure connections between the API and two Collector Server instances. It is based on the following example situation: v v v The API is installed on a system with two users who are supposed to share a certificate. Therefore, you need only one client keystore. The users are called cuser1 and cuser2 in this example. The API is to communicate with two Collector Server instances, which are called myservera and myserverb in this example. Therefore, you need two server keystores, one on myservera and one on myserverb. The server keystores are to be encrypted with the passwords securea and secureb. For this example, it is also assumed that you decide to create the required client keystore on myservera and that you use the default names for the keystores. Tip: Keep a record of all names and labels that you assign, the location of the keystores, and the number of the client keystores that you already created on each Collector Server instance. Also, document which certificate belongs to which user and which certificates are shared by which users. Procedure: 1. On myservera, create a server keystore, a client keystore, and the certificates. Use the client_key_gen script file. a. Open a command line and change to the directory where the folder for the server keystore is to be stored. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -c -p securea -n 1 v Windows client_key_gen.bat -c -p securea -n 1 In the directory where you entered the command, the following folders are created: server and client_1. The name of the server keystore is server.kdb. The name of the client keystore is client_1.kdb. The server keystore contains the certificate clientcert_1.crl. The client keystores contain the certificate servercert.crl. The server keystore is encrypted with the password securea. 2. Copy the client_1 folder from myservera to the system where the API is installed. You can paste the folder to a directory of your choice. 3. On myserverb, create a server keystore and the certificate for myserverb. Use the client_key_gen script file. a. Open a command line and change to the directory where the folder for the server keystore is to be stored. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -c -p secureb Chapter 12. Setting up a secure communication with the API 141

154 v Windows client_key_gen.bat -c -p secureb In the directory where you entered the command, the following folder is created: server. The name of the server keystore is server.kdb. The server keystore contains the certificate servercert.crl. The server keystore is encrypted with the password secureb. 4. Copy the server certificate servercert.crl of myserverb to the system where the API is installed. You can paste the certificate to a directory of your choice. 5. Add the server certificate of myserverb to the client keystore. Use the register_server.bat script file from the add-ons package. a. Open a command line and change to any directory. When you run the script file, you can specify the relative path to the client keystore and to the server certificate. b. Enter the following command: register_server.bat -add -cdb relative_path\client_1.kdb -scert relative_path\servercert.crl -sl new_certificate_label relative_path stands for the path that is relative to the directory where you entered the command. new_certificate_label is the new label for the server certificate that is added. A new label is necessary because both server certificates have the same default name servercert.crl. Assume, for example, that you copied the client_1 folder and the servercert.crl to the C:\security directory and that you want to issue the command from the C: directory. Also, assume that the server certificate that is to be added should receive the label servercert_b. Your command would then look as follows: register_server.bat -add -cdb security\client_1\client_1.kdb -scert security\servercert.crl -sl servercert_b 6. Copy the client certificate clientcert_1.crl to myserverb. You can paste the certificate to a directory of your choice. 7. Add the client certificate to the server keystore for myserverb. Use the client_key_gen script file. a. Open a command line and change to any directory. When you run the script file, you can specify the relative path to the server keystore and to the client certificate. In addition, you can specify a different label for the client certificate. b. Enter either of the following commands, depending on your operating system: v Linux UNIX client_key_gen.sh -add -sdb relative_path/ server.kdb -p secureb -ccert relative_path/clientcert_1.crl -cl new_certificate_label v Windows client_key_gen.gen -add -sdb relative_path\server.kdb -p secureb -ccert relative_path\clientcert_1.crl -cl new_certificate_label 8. On the system where the API is installed, copy the client_1 folder, which contains the certificate that is to be shared by both users on the system, to either of the following locations: v v UserHome directory of each user, such as the env_var_appdata\ibm\iccsap\ security directory A directory that is accessible by both users. Ensure that both users have read access for this directory. 142 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

155 Important: In any case, strictly control the access to the client folder and to the directory where the client folder is stored. Content Collector for SAP does not protect the client keystore and its contents with a password. 9. Enable each Collector Server instance to use its server keystore by changing each instance configuration. In Configuration Feature, take these steps: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication. c. Complete the Communication with the API section , Restarting a Collector Server instance, on page 123. To restart the instances from a command line, you use the archpro command with the following parameters: archpro -i profile -f dll_keystore_passwd password In a server configuration profile, you find the following specifications that relate to the communication with the API: Section in server configuration profile UI field that supplies the value Keyword Global section ARCHWINS Client dispatchers DLL_KEYSTORE_FILE Server keystore 11. Update the client configuration profile for each user: open the csclient.ini file in a text editor and set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. Open the csclient.ini file in a text editor and set the keystore parameter to the fully qualified file name of the client keystore that contains the certificate for the user. If you decided to place the client_1 folder into a directory that is accessible by both users, your specification might look as in the following example: keystore=c:\users\security\client_1\client_1.kdb Chapter 12. Setting up a secure communication with the API 143

156 144 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

157 Chapter 13. Setting up an HTTPS communication with SAP If an SAP communicates with a Collector Server instance by using HTTP, you might want to secure this connection with server authentication and client authentication. Client authentication can be configured only in addition to server authentication. Before you begin: Plan for an HTTPS connection between the Collector Server instance and SAP. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH After the configuration of the authentication methods, insecure HTTP connections are still possible. If you want to ensure that all data can be accessed only with an HTTPS connection, you must enforce the use of HTTPS. Procedure: , Configuring the server authentication 2. Optional: 13.2, Configuring the client authentication, on page Optional: 13.3, Securing the communication with an entire Collector Server instance or with specific logical archives only, on page Configuring the server authentication You must configure the server authentication on Collector Server and in SAP Configuring server authentication on Collector Server Create an SSL keystore and a certificate for the Collector Server instance, configure the Collector Server instance for server authentication, and export the certificate to SAP. If you already created a server certificate for the communication with IBM Content Navigator, you must use this certificate for the HTTPS communication with SAP. In this case, skip the following procedure and continue with , Configuring the server authentication in SAP, on page 150. Procedure: , Creating an SSL keystore and a certificate for the Collector Server instance 2. Optional: , Having the certificate signed by a certificate authority, on page , Enabling the Collector Server instance for the server authentication, on page , Exporting the server certificate, on page Creating an SSL keystore and a certificate for the Collector Server instance Use the Java Keytool or the IBM Key Management Utility (IKEYMAN) to create the SSL keystore, the private key, and the public key and to associate the public key with a certificate. Copyright IBM Corp. 2010,

158 The Java Keytool and IKEYMAN are both delivered with Content Collector for SAP as part of the IBM JRE and have the following fully qualified file names: v The Java Keytool: Linux UNIX InstallHome/java/jre/bin/keytool Windows InstallHome\java\jre\bin\keytool.exe v IKEYMAN: Linux UNIX InstallHome/java/jre/bin/ikeyman Windows InstallHome\java\jre\bin\ikeyman.exe To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Open a command line on the system where the server instance runs. 2. Enter the following command on one line: keytool -genkeypair -keyalg key_algorithm -keysize keysize -sigalg signature_algorithm -alias name -validity number_of_days -keystore ssl_keystore_file key_algorithm Specify the algorithm that is to be used to generate the key pair. Specify RSA. keysize Specify the size of the keys that are to be generated. signature_algorithm Specify the algorithm that is to be used to sign the certificate. Specify SHA256withRSA or SHA512WithRSA. name Specify a name of your choice for the certificate chain and the private key that are created with this command. The name must be unique in the keystore. number_of_days Specify for how many days the certificate is to be valid. ssl_keystore_file Specify a fully qualified file name for the SSL keystore. Tip: Because an SSL keystore is required for each instance of Collector Server, it is good practice to create the SSL keystore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ keystore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\keystore.jks Example: 146 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

159 keytool -genkeypair -keyalg RSA -keysize sigalg SHA256withRSA -alias iccsap_instance1 -validity 365 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks Important: Ensure that your SAP system can handle the level of cryptography that you specify for the keys, such as the keysize parameter. To be on the safe side, install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files on your SAP system. 3. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 4. Enter an answer for each prompt for your organization information. For example: What is your first and last name? [Unknown]: server_name What is the name of your organizational unit? [Unknown]: Myunit What is the name of your organization? [Unknown]: Myorg What is the name of your City or Locality? [Unknown]: Mycity What is the name of your State or Province? [Unknown]: Mystate What is the two-letter country-code for this unit? [Unknown]: US Is <CN=myserver.com, OU=Myunit, O=Myorg, L=Mycity, ST=Unknown, C=US> correct? [no]: yes Enter key password for server_name (Press Enter if you want to use the same password as for the keystore) For server_name, specify the fully qualified host name or the IP address of the system where Collector Server is installed. A self-signed server certificate is created. What to do next: , Having the certificate signed by a certificate authority Having the certificate signed by a certificate authority A certificate authority might have to sign the self-signed certificate. The signed certificate must have a key algorithm and a signature algorithm that are, by default, enabled in IBM JRE and that are supported by the installed SAP Cryptographic Library. Before you begin: , Creating an SSL keystore and a certificate for the Collector Server instance, on page 145 Complete these steps to have a certificate signed and to include the signed certificate: 1. Open a command line on the system where the server instance runs. Chapter 13. Setting up an HTTPS communication with SAP 147

160 2. Generate a Certificate Signing Request (CSR) by entering the following command on one line: keytool -certreq -file certreq_file -alias name -keystore ssl_keystore_file For name and ssl_keystore_file, specify the same values as in the keytool -genkeypair command. See step 2 on page 146. For certreq_file, specify the fully qualified file name of the CSR. Example: keytool -certreq -file /home/iccsapadmin/instance1/security/https/certreq.csr -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks 3. Enter the keystore password when you are prompted for it. For example, enter icc4sap 4. Send the CSR (certreq.csr) to a certificate authority. The certificate authority must return a certificate reply. A certificate reply is a file that contains, as a minimum, the certificate that is signed by the certificate authority. The contents depends on your chain of trust. 5. Import the certificate reply into the keystore by entering the following command on one line: keytool -importcert -file CA_reply -alias name -keystore ssl_keystore_file -trustcacerts For name and ssl_keystore_file, specify the same values as in step 2. For CA_reply, specify the fully qualified path to the certificate reply. Assume, for example, that the file name of the certificate reply is CA_reply_iccsap.txt and that you stored it in the /home/iccsapadmin/instance1/security/https directory. Your command would then look as follows: keytool -importcert -file /home/iccsapadmin/instance1/security/https/ca_reply_iccsap.txt -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks -trustcacerts 6. Enter a password when you are prompted by this message: Enter keystore password: For example, enter: icc4sap 7. Enter YES if you get the following response:... is not trusted. Install reply anyway? [no]: You get the following final response: Certificate reply was installed in keystore What to do next: , Enabling the Collector Server instance for the server authentication Enabling the Collector Server instance for the server authentication You must enable the Collector Server to use Secure Socket Layer (SSL) and the SSL keystore that you created. 148 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

161 Before you begin: , Having the certificate signed by a certificate authority, on page 147 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication > HTTP or HTTPS Communication with SAP. c. Select the Use an HTTPS connection checkbox, then complete the SSL web port field. d. Go to the HTTP and HTTPS Settings section and complete the SSL keystore field , Restarting a Collector Server instance, on page 123. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f keystore_passwd In a server configuration profile, you find the following specifications that relate to the server authentication: Section in server configuration profile UI field that supplies the value Keyword Global section SSL_WEBPORT SSL web port KEYSTORE_FILE SSL keystore What to do next: , Exporting the server certificate Exporting the server certificate Use Java Keytool or the IBM Key Management Utility (IKEYMAN) to export the certificate from the SSL keystore. Before you begin: , Enabling the Collector Server instance for the server authentication, on page 148 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Open a command line on the system where the server instance runs. 2. Enter the following command on one line: keytool -exportcert -file certificate_file -alias name -keystore ssl_keystore_file certificate_file Specify a fully qualified file name for the server certificate. If you omit the path, the certificate is stored in the current directory. name Specify the name that you assigned to the keystore entry when you created the SSL keystore and the server certificate. Chapter 13. Setting up an HTTPS communication with SAP 149

162 ssl_keystore_file Specify the fully qualified file name of the SSL keystore. Example: keytool -exportcert -file /home/iccsapadmin/instance1/security/https/iccsap_instance1.cer -alias iccsap_instance1 -keystore /home/iccsapadmin/instance1/security/https/keystore.jks What to do next: , Configuring the server authentication in SAP Configuring the server authentication in SAP On each SAP system, you must add the server certificate to SSL client SSL Client (Standard) Personal Security Environment (PSE). In addition, you must enable the content repositories for HTTPS. Before you begin: v The SSL client SSL Client (Standard) Personal Security Environment (PSE) must exist. v , Configuring server authentication on Collector Server, on page 145. Procedure: , Importing the Collector Server certificate into SAP , Enabling SSL support for the content repositories, on page Importing the Collector Server certificate into SAP You must import the server certificate into the SSL client SSL Client (Standard) Personal Security Environment (PSE). Procedure: 1. In the SAP GUI, enter the transaction code STRUST to open the Trust Manager window. 2. In the navigation pane, double-click SSL client SSL Client (Standard). 3. Under Certificate, click the Import certificate icon. Figure 81 on page 151 shows which items you must click in the Trust Manager window in step 2 and step Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

163 Figure 81. Trust Manager window showing which items to click 4. In the File path field of the Import Certificate window, specify the fully qualified file name of the server certificate that you created, and press Enter. 5. In the Trust Manager window, click. See Figure Click the Save icon. What to do next: , Enabling SSL support for the content repositories Enabling SSL support for the content repositories Complete these steps to enable Secure Socket Layer (SSL) support for your content repositories. Before you begin: , Importing the Collector Server certificate into SAP, on page 150 Procedure: 1. In the SAP GUI, enter the transaction code OAC0 to open the Display Content Repositories: Overview window. 2. Double-click a content repository. For example, double-click LP. 3. In the Display Content Repositories: Detail window, click the Display/Change icon. Chapter 13. Setting up an HTTPS communication with SAP 151

164 4. In the SSL Port Number field, type the value of the SSL_WEBPORT keyword, which you specified when you enabled Collector Server for the server authentication. For example, type: In the field in the toolbar, type: %https Figure 82 shows what the Change Content Repositories: Detail window might look like after you completed step 4 and step 5. Figure 82. Change Content Repositories: Detail window containing the necessary entries 6. Press Enter. The following fields become available: v HTTPS on frontend v HTTPS on backend Figure 83 on page 153 shows the Change Content Repositories: Detail window containing these fields. 152 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

165 Figure 83. Change Content Repositories: Detail window containing the fields HTTPS on frontend and HTTP on backend 7. Select HTTPS required in both fields. Figure 84 shows what the Change Content Repositories: Detail window might look like with your selection. Figure 84. Change Content Repositories: Detail window showing your selection What to do next: 13.2, Configuring the client authentication, on page 154 Chapter 13. Setting up an HTTPS communication with SAP 153

166 13.2 Configuring the client authentication You must export the SAP certificate with the trust manager of SAP and import it into the SSL truststore of the Collector Server instance. In addition, you must enable the Collector Server instance for client authentication. Before you begin: 13.1, Configuring the server authentication, on page 145 Procedure: , Exporting the SAP certificate , Importing the SAP certificate into the SSL truststore, on page , Enabling the Collector Server instance for the client authentication, on page Exporting the SAP certificate You must export the certificate from the SSL client SSL Client (Standard) Personal Security Environment (PSE). Procedure: 1. In the SAP GUI, enter the transaction code STRUST to open the Trust Manager window. 2. In the navigation pane, double-click SSL client SSL Client (Standard). 3. Under Own Certificate, double-click the certificate in the Owner field. The certificate is displayed under Certificate. 4. Under Certificate, click the Export certificate icon. Figure 85 on page 155 shows which items you must click in the Trust Manager window in step 2 through step Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

167 Figure 85. Trust Manager window showing which items to click 5. In the File path field of the Export Certificate window, specify a fully qualified file name for the SAP certificate. 6. Click Base64 as file format. Then, press Enter. 7. In the SAP GUI Security window, click Allow. What to do next: , Importing the SAP certificate into the SSL truststore Related information Configuring the SAP Application Server for Using SSL SAP Application Server notes and Importing the SAP certificate into the SSL truststore You must import the SSL client SSL Client (Standard) certificate into the SSL truststore on Collector Server. You use Java Keytool or the IBM Key Management Utility (IKEYMAN) for this task. Before you begin: , Exporting the SAP certificate, on page 154 To use IKEYMAN, start the ikeyman program. To use the Java Keytool, take these steps: Procedure: 1. Copy the exported SAP certificate to the system where Collector Server runs. 2. Open a command line on the system where the server instance runs. Chapter 13. Setting up an HTTPS communication with SAP 155

168 3. Enter the following command on one line: keytool -importcert -file certificate_file -alias name -keystore ssl_truststore_file certificate_file Specify the fully qualified file name of the SAP certificate. name Specify a name of your choice for the certificate. The name must be unique in the truststore that is to contain the certificate. truststore_name Specify a fully qualified file name for the SSL truststore. Tip: Because an SSL truststore must not be shared by several instances of Collector Server, it is good practice to create the truststore in the instance directory. For example, specify: v Linux UNIX /home/iccsapadmin/instance1/security/https/ truststore.jks v Windows C:\Users\iccsapadmin\AppData\Roaming\IBM\iccsap\ instance1\security\https\truststore.jks Example: keytool -importcert -file /home/iccsapadmin/sapsystem1.cer -alias sapsystem1 -keystore /home/iccsapadmin/instance1/security/https/truststore.jks What to do next: , Enabling the Collector Server instance for the client authentication Enabling the Collector Server instance for the client authentication You must enable the Collector Server instance to use the SAP certificates. Before you begin: , Importing the SAP certificate into the SSL truststore, on page 155 Procedure: 1. Change the instance configuration. In Configuration Feature, take these steps in Extended settings view: a. Open the instance configuration that you want to change. b. Go to Basic Configuration > Communication > HTTP or HTTPS Communication with SAP. c. Select the Use client authentication checkbox. d. Go to the HTTP and HTTPS Settings section and complete the SSL truststore field , Restarting a Collector Server instance, on page 123. To restart the instance from a command line, you use the archpro command with the following parameters: archpro -i profile -f truststore_passwd 156 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

169 In a server configuration profile, you find the following specifications that relate to the client authentication: Section in server configuration profile Keyword UI field that supplies the value Global section SSL_CLIENTAUTH The selection of the Use client authentication check box results in the value YES. TRUSTSTORE_FILE SSL truststore What to do next: 13.3, Securing the communication with an entire Collector Server instance or with specific logical archives only 13.3 Securing the communication with an entire Collector Server instance or with specific logical archives only After the configuration of server authentication, client authentication, or both authentication methods, insecure HTTP requests are still processed. You can disable the processing of HTTP requests for specific logical archives only, or you can disable the processing of all HTTP requests. In either case, you must change the instance configuration. Before you begin: 13.2, Configuring the client authentication, on page 154 v To disable the processing of HTTP requests for specific logical archives only, complete these steps in Configuration Feature in Extended settings view: 1. Open the instance configuration that you want to change. 2. Go to Logical Archives > Logical repository Archive id > Document Protection. 3. Select the Accept only HTTPS requests from SAP check box. 4. Repeat steps 2 and 3 for each logical archive that is not to receive any HTTP requests , Restarting a Collector Server instance, on page 123. In a server configuration profile, you find the following specification that relates to the disabling of HTTP requests for specific logical archives only: Section in server configuration profile Keyword UI field that supplies the value ARCHIVE SSL The selection of the Accept only HTTPS requests from SAP check box results in the value YES. v To disable the processing of all HTTP requests, ensure in the Communication pane of Configuration Feature that the Use an HTTP connection check box is not selected. In a server configuration profile, you find the following specification that relates to the disabling of all HTTP requests: Chapter 13. Setting up an HTTPS communication with SAP 157

170 Section in server configuration profile Keyword UI field that supplies the value Global section WEBPORT If the Use an HTTP connection check box is not selected, the value is set to Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

171 Chapter 14. Configuring Content Collector for SAP for US government security standards Content Collector for SAP meets the security requirements that are defined by the US government. For more information, see the National Institute of Standards and Technology website. Content Collector for SAP now supports all of the following security standards: FIPS Federal Information Processing Standards (FIPS) that specify requirements on cryptographic modules. SP A standard that requires longer encryption keys and stronger algorithms. This standard allows for a transition configuration where a mixture of FIPS and SP settings can be used until you move to a strict enforcement of SP If you use a transition configuration, check the timeframe for the transition period. Suite B A cryptographic algorithm policy for national security applications that is required by the National Security Agency (NSA). This policy is similar to SP but allows for disabling specific cryptographic algorithms. Complete these steps to implement one of the security standards: 1. Enable Collector Server to use the security standard: a. Open the server configuration profile of each Collector Server instance in a text editor. b. Add the JAVA_OPTIONS keyword, which is a global keyword, and specify one of the following values, depending on the security standard that you want to enforce: Security standard FIPS SP Suite B Values com.ibm.jsse2.usefipsprovider=truefalse com.ibm.jsse2.sp =transitionstrictoff com.ibm.jsse2.suiteb=128192false For example, to enforce the use of SP , your specification would look as follows: JAVA_OPTIONS -Dcom.ibm.jsse2.sp =strict If you already use this keyword, add the value and separate the values with a blank. c. Save the server configuration profile, and restart Collector Server for the changes to take effect. 2. Change the java.security file, which is included in the Java runtime environment (JRE) that is delivered with Content Collector for SAP. The file is in the following directory: v Linux UNIX InstallHome/java/jre/lib/security Copyright IBM Corp. 2010,

172 v Windows InstallHome\java\jre\lib\security Change the file depending on the security standard: Security standard FIPS SP Suite B Follow the description in the following topics of the Java documentation: Enabling FIPS Mode in the IBMJSSE2 Provider SP A Compliance Suite B Profile for Transport Layer Security (TLS) - RFC Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

173 Part 3. Monitoring With Content Collector for SAP, you can monitor the connection between Collector Server and the repositories. If you have IUVU licenses for users who use Content Collector for SAP infrequently, you can also monitor document retrieval requests by using the IUVU tool. Copyright IBM Corp. 2010,

174 162 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

175 Chapter 15. Monitoring the connection between Collector Server and the repositories If a Collector Server instance communicates with SAP by using HTTP or HTTPS, you might want to ensure from time to time that HTTP or HTTPS requests can be successfully routed through your Content Collector for SAP environment. You use the archcheck Java API to monitor the connection. Alternatively, you can monitor the connection directly from IBM Content Navigator Monitoring the connection between Collector Server and the repositories from IBM Content Navigator IBM Content Navigator shows whether the logical archives that are specified in a Collector Server instance, can be accessed. In addition, it shows, for each logical archive, the messages that were logged when a request was routed through your Content Collector for SAP environment. Before you begin: 5.2.3, Configuring the communication with IBM Content Navigator, on page 47 To monitor the connection, complete these steps 1. In Operation Feature, click Connection Monitoring in the navigation pane on the left. 2. To view more connection details for a Collector Server instance and its logical archives, double-click the Collector Server instance. 3. Fix Pack 1 In the Status Details window, you can also view traces and logs. For more information, see the topic Logs and traces available from IBM Content Navigator in the Troubleshooting and support part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Monitoring the connection between Collector Server and the repositories by using the archcheck Java API Content Collector for SAP supplies the archcheck Java API, which allows for simulating an SAP system that sends an HTTP request or an HTTPS request to a repository. For the HTTPS request, server authentication or client authentication can be used. The request is routed through the Content Collector for SAP environment like an HTTP or HTTPS request from SAP. When the connection to the repository is checked, no write operation is performed that would change the state of the repository. Figure 86 on page 164 shows how the archcheck program is integrated in your Content Collector for SAP environment. Copyright IBM Corp. 2010,

176 Figure 86. archcheck in your Content Collector for SAP environment The classes for the archcheck Java API are defined in the archcheck.jar file. The API can be invoked in either of the following ways: v v From a command line. The archcheck.jar file contains the necessary executable class, which is called archcheck program in this information. From a Java application. Content Collector for SAP supplies the ArchcheckAPISample.java file, which contains an example of how to call the Java API. You can monitor each logical archive that is defined in the instance configuration, at intervals of your choice. In addition, the archcheck.jar file can run on any system that has access to the Collector Server instance. The archcheck.jar file is in the following directory: v Linux UNIX InstallHome/server/bin v Windows InstallHome\server\bin Important: The archcheck program requires Java Version 6 or later Calling the archcheck Java API from a command line by using the archcheck program The archcheck program is an executable class in the archcheck.jar file to call the archcheck Java API from command line. If you verify an HTTPS connection, you must configure the server authentication and, optionally, the client authentication first. Procedure: 164 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

177 1. If you want to verify an HTTP connection, skip this step and start with step 2. If you want to verify an HTTPS connection, you must configure the server authentication. Complete these steps: a , Exporting the server certificate, on page 149 b. Import the certificate into the truststore on the system where the archcheck program is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page 155. c. If you want to verify an HTTPS connection with client authentication, complete the following extra steps: 1) Create a certificate for the system where the archcheck program is to run. 2) Export the certificate to a file. Use the procedure that is described in , Exporting the server certificate, on page ) Import the certificate into the SSL truststore on the system where Collector Server is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page Copy the archcheck.jar file to the system where you want to run the archcheck program. 3. If you want to verify an HTTPS connection, you can store the passwords for the truststore and, optionally, for the keystore in a password file. Create this file in a directory of your choice and specify the passwords in the file as follows: truststorepassword=truststore_password keystorepassword=keystore_password truststore_password and keystore_password stands for the passwords for the truststore and for the keystore. All characters after the equal sign are considered part of the password, including any leading and trailing white spaces. If you do not create this file, you are prompted for the passwords. The passwords are not displayed while you enter them. 4. Open a command line on the system where the archcheck program runs. 5. Enter the appropriate command depending on whether you want to verify an HTTP connection or an HTTPS connection. For a detailed description of the commands, see the topic archcheck in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH A log file that records the progress of the request is automatically generated in the checklogs folder of the instance directory of Collector Server. The log file has the following default name: archive_id_yyyy_mm_dd_hh_mm_ss_ms.log A log file is created each time the archcheck program is run. A history of log files is useful, for example, if Collector Server cannot connect to an archive any more and you want to investigate when this problem occurred for the first time. If you prefer to record the progress of only the last request, add the following parameter to your command: -log file_name file_name stands for the name of the log file. You cannot change the path to the log file. The log file is overwritten each time the archcheck program is run. Chapter 15. Monitoring the connection between Collector Server and the repositories 165

178 If the archcheck program ran successfully, it returns exit code 0 and writes the following message to the console: The connection_type request for archive archive_id was processed successfully. connection_type stands for HTTP or HTTPS. If the archcheck program did not run successfully, it returns an exit code greater than 0 and writes a message to the console: v v v v v 1 The connection_type request for archive archive_id failed with response code number: (text). 2 The connection_type request for archive archive_id failed. The request was sent to Collector Server but Collector Server did not return a response. 3 The connection_type request for archive archive_id failed. A connection to Collector Server could not be established. 4 The command is not valid. 5 For this exit code, no message is shown. Instead, the version of, and the help information about, the archcheck command is displayed. What to do next: For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Calling the archcheck Java API from a Java application Content Collector for SAP supplies the sample file ArchcheckApiSample.java, which shows how to invoke the archcheck Java API from a Java application. The sample file is in the following directory: v Linux UNIX InstallHome/samples v Windows InstallHome\samples The list of parameters that you can set by using the setter methods is the same as for the archcheck program. Procedure: 1. Copy the archcheck.jar file to the system where you want to run the archcheck Java API. 2. If you want to verify an HTTP connection, skip this step and start with step 3 on page 167. If you want to verify an HTTPS connection, you must configure the server authentication. Complete these steps: a , Exporting the server certificate, on page 149 b. Import the certificate into the truststore on the system where the archcheck Java API is to run. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page 155. c. If you want to verify an HTTPS connection with client authentication, complete the following additional steps: 1) Create a certificate for the system where the archcheck Java API is to run. 2) Export the certificate to a file. Use the procedure that is described in , Exporting the server certificate, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

179 3) Import the certificate into the SSL truststore on the system where Collector Server runs. Use the procedure that is described in , Importing the SAP certificate into the SSL truststore, on page Use the ArchcheckApiSample.java file to implement the archcheck Java API call in your Java application. Then, execute your Java application. The archcheck Java API call returns a result object, which contains the status of the connection verification. For details about the status that can be returned, see , Calling the archcheck Java API from a command line by using the archcheck program, on page 164. What to do next: For more information, see the topic archpro in the Reference part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 15. Monitoring the connection between Collector Server and the repositories 167

180 168 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

181 Chapter 16. Monitoring the compliance with the license agreements You must ensure that the users of Content Collector for SAP have an AUVU license or an IUVU license. In addition, you must ensure that your IUVU users comply with the IUVU license agreements. Before you begin: 1. Plan for the compliance with the license agreements. For more information, see the corresponding topic in the Planning part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Chapter 5, Configuring Collector Server, on page 33 Content Collector for SAP supplies the IUVU tool, which records all document retrieval requests of all users against your IBM repositories during a period of 12 months. If you cannot use this tool, determine the number of users who have access to the SAP authorization object S_WFAR_OBJ Monitoring document retrieval requests with the IUVU tool Recording starts when the first retrieval request is issued for an IBM repository from the SAP GUI. Each retrieval request is recorded in an SAP table regardless of whether the document is successfully retrieved or whether the request fails. It is recorded for all users, whether they are users with an IUVU license (IUVU) or users with a full license (AUVU users). Print lists that are retrieved with several GET requests are considered one document. All requests that are issued by one user within 15 minutes are counted as one request. At the end of a 12-month period, a new 12-month period is recorded, where counting starts at 1 again. Up to five periods are recorded. After the fifth period, the oldest record is deleted. Before you begin: Deploy the IUVU tool. For more information, see the corresponding topic in the Deploying part of IBM Knowledge Center or of IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Procedure: , Configuring the IUVU tool , Monitoring the document retrieval requests, on page Configuring the IUVU tool To use the IUVU tool, you must activate it Activating the IUVU tool To activate the IUVU tool, you must create two entries in the SAP user-exit table TOAEX. Procedure: Copyright IBM Corp. 2010,

182 1. In the SAP GUI, enter the transaction code SE11 to open the ABAP Dictionary: Initial Screen window. 2. In the Database table field, type TOAEX and then click Display. Figure 87 shows the ABAP Dictionary: Initial Screen window with the name of the database table. Figure 87. ABAP Dictionary: Initial Screen window containing the name of the database table 3. In the Dictionary: Display Table window, click the Contents icon. 4. In the Data Browser: Table TOAEX: Selection Screen window, click the Execute icon. 5. In the Data Browser: Table TOAEX Select Entries window, check whether the table contains two entries with the following EXIT_ID: OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01. v If these table entries exist, check whether the value in the EXIT_FUB column is /IBMECM/RECORDACCESS for both entries. If the value differs, decide whether you can change the value. You can use the IUVU tool only if you can set the value to /IBMECM/RECORDACCESS. To change the value of EXIT_FUB, complete these steps: a. Select the check box in front of the OA_DISPLAYJAVA_01 entry and then click the Change icon. b. In the Table TOAEX Change window, type /IBMECM/RECORDACCESS in the EXIT FUB field. c. Ensure that the ACTIVE field contains the value X. Otherwise, the IUVU tool is inactive. d. Repeat the steps 5a to 5c for OA_OBJECTDISPLAY_01. v If these table entries do not exist, complete these steps: 170 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

183 a. Return to the Dictionary: Display Table window. b. Click Utilities > Table Contents > Create Entries. c. In the Table TOAEX Insert window, type OA_DISPLAYJAVA_01 in the EXIT ID field. d. In the ACTIVE field, type X to activate the IUVU tool. e. In the EXIT FUB field, type: /IBMECM/RECORDACCESS f. Click the Save icon. Figure 88 shows the Table TOAEX Insert window containing your specifications. Figure 88. Table TOAEX Insert window containing your specifications g. Repeat the steps 4a to 4f to create the entry with the EXIT_ID OA_OBJECTDISPLAY_01. The Data Browser: Table TOAEX Select Entries window shows your specifications. Figure 89 shows the Data Browser: Table TOAEX Select Entries window containing the entries that are necessary to use the IUVU tool. Figure 89. Data Browser: Table TOAEX Select Entries window containing the entries that are necessary to use the IUVU tool Chapter 16. Monitoring the compliance with the license agreements 171

184 The IUVU tool is ready for use. This means that when the first document is retrieved from an IBM archive for viewing, the start time stamp of the 12-month period is set. In addition, entries are added to the SAP tables that were created during the installation of the tool. The start time stamp applies to all users for which a retrieval request against an IBM archive is recorded within the 12-month period, even if they issue their first request days or weeks later. What to do next: , Monitoring the document retrieval requests Deactivating the IUVU tool To deactivate the IUVU tool, you must remove the OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01 entries from the TOAEX table or change their EXIT FUB value. Procedure: 1. In the SAP GUI, enter the transaction code SE11 to open the ABAP Dictionary: Initial Screen window. 2. In the Database table field, type TOAEX and then click Display. See Figure 87 on page In the Dictionary: Display Table window, click the Contents icon. 4. In the Data Browser: Table TOAEX: Selection Screen window, click the Execute icon. 5. Decide whether you want to remove the entries or change the EXIT FUB values: v To remove the entries, complete these steps: a. In the Data Browser: Table TOAEX Select Entries window, right-click the OA_DISPLAYJAVA_01 entry and then click Delete. b. In the Table TOAEX Delete window, click Delete Entry. The entry is deleted. You are not asked to confirm the deletion. c. Repeat these steps for the entry OA_OBJECTDISPLAY_01. v To change the EXIT FUB values, complete these steps: a. In the Data Browser: Table TOAEX Select Entries window, select the check box in front of the OA_DISPLAYJAVA_01 entry and then click the Change icon. b. In the Table TOAEX Change window, specify another value in the EXIT FUB field. c. Press Enter to save your specification. d. Repeat these steps for the entry OA_OBJECTDISPLAY_ Monitoring the document retrieval requests Monitoring and thus recording starts when the first document retrieval request is issued against an IBM repository. A retrieval request is recorded for each user who retrieves, or tries to retrieve, a document for viewing. You can create an IUVU report that provides an overview of the monitoring results. Before you begin: , Activating the IUVU tool, on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

185 The SAP tables containing the retrieval requests: Overview The retrieval requests are recorded in the SAP tables that were created during the installation of the IUVU tool. The following SAP tables are available: Name Data List (/IBMECM/NAMEDATA) Contains an entry for each SAP client from which document retrieval requests against IBM repositories were issued, and shows the start time stamp of the first 12-month period. The start time stamp is created when the first document retrieval request is issued against an IBM repository. The start time stamp is the same for all SAP clients even if users of one or more SAP clients retrieve their first document days or weeks later. Content Repository Data (/IBMECM/DEPOTSET) Lists all repositories against which a retrieval request is issued from the SAP GUI since the activation of the IUVU tool. In addition, it shows whether a repository is an IBM repository. User Data (/IBMECM/USERSET) Contains an entry for each SAP client and user that issued a retrieval request and shows the number of retrieval requests within a 12-month period. The table can contain up to five entries for an SAP client/user combination to cover up to five periods. When the sixth period starts, the oldest entry is deleted. Important: v Do not delete any of the tables. v Time stamps are shown in Coordinated Universal Time (UTC) format. To view a table, complete the following steps: 1. In the SAP GUI, enter the transaction code SE16 to open the Data Browser: Initial Screen window. 2. In the Table Name field, type the table name. For example, type: /IBMECM/USERSET 3. Click the Table Contents icon. 4. In the Data Browser: Table name: Selection Screen window, click the Execute icon Creating an IUVU report regularly You can set up an SAP batch job to create an IUVU report regularly. Procedure: 1. In the SAP GUI, enter the transaction code SM36 to open the Define Background Job window. 2. In the Define Background Job window, complete these steps: a. In the Job name field, type a name of your choice. For example, type: IUVU report b. In the Job class field, leave C as value. c. Click the Start condition icon. Chapter 16. Monitoring the compliance with the license agreements 173

186 Figure 90 shows the Define Background Job window containing the specifications. Figure 90. Define Background Job window containing the sample job name and the job class 3. In the Start Time window, take these steps: a. Click Date/Time. b. In the Scheduled start field that becomes available, specify a schedule and then click Period values. 4. In the Period Values window, specify the interval at which the report is to be generated. For example, click monthly. Click the Save icon. 5. In the Start Time window, click the Save icon. You are returned to the Define Background Job window, which shows the specified schedule under Job start and Job frequency. The Define Background Job window should look similar to Figure 91 on page Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

187 Figure 91. Define Background Job window containing the sample job name, the job class, and the sample schedule 6. Click the Step icon. 7. In the Create Step 1 window, continue as follows: a. Under Program values, click ABAP program. b. Under ABAP program, inthename field, type the name of the ABAP program, namely: /IBMECM/REPORTUSAGE c. Click the Print specifications icon. Figure 92 on page 176 shows the Create Step 1 window containing your specifications. Chapter 16. Monitoring the compliance with the license agreements 175

188 Figure 92. Create Step 1 window containing the ABAP program name 8. In the Background Print Parameters window, under Number of pages, click Print all. Then click Properties. 9. In the Spool Request Attributes window, complete these steps: a. Under General Properties, ensure that Print out immediately is selected for Time of printing. b. Expand Spool request. c. Double-click Name. IntheName field that becomes available, type /IBMECM/IUVU and then press Enter. d. Double-click Title. IntheTitle field that becomes available, type IUVU report and then press Enter. Figure 93 on page 177 shows the Spool Request Attributes window after you entered Steps 9c and 9d. 176 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

189 Figure 93. Spool Request Attributes window containing the name and the title of the spool request e. Expand Output Options and double-click Storage Mode. Fromthe Storage Mode list that becomes available, select Archive only or Print and archive. More fields become available. f. In the Object Type field, type DRAW. g. In the Document Type field, type D01 or another document type for a print list. h. In the Information field, type UVU. You can use the value later to find the IUVU reporting print lists in the associated content repository. i. In the Text field, type IUVU report. Then click the Continue icon. Figure 94 on page 178 shows the Spool Request Attributes window after you entered Steps 9f through 9i. Chapter 16. Monitoring the compliance with the license agreements 177

190 Figure 94. Spool Request Attributes window containing the name and the title of the spool request j. Click the Continue icon. You are returned to the Background Print Parameters window. The Background Print Parameters window should look similar to Figure 95. Figure 95. Background Print Parameters window containing your specifications 10. In the Background Print Parameters window, click the Continue icon. 11. In the Create Step 1 window, click the Check input icon and then click the Save icon. The Step List Overview window shows the new step. 178 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

191 Figure 96 shows the Step List Overview window containing the defined step. Figure 96. Step List Overview window containing the defined step 12. Click the Back icon to return to the Define Background Job window. 13. Click the Save icon to release the job. The Define Background Job window should look similar to Figure 97. Figure 97. Define Background Job window with the messages that one step is defined and the job is released The IUVU reports are created every month, starting on the planned start date, and are placed in the SAP ArchiveLink storage queue. What to do next: To archive the reports automatically, create an SAP ArchiveLink batch job. For more information, see Creating an SAP ArchiveLink batch job. To view a report, complete these steps: Chapter 16. Monitoring the compliance with the license agreements 179

192 1. Enabling print-list viewing. 2..View archived print lists. For more information, see the corresponding topic in IBM Knowledge Center or in IBM Content Collector for SAP Applications: Installation, Configuration, and User's Guide, SH Creating an IUVU report at your request From time to time, you might want to get an overview of the retrieval requests that were recorded so far in the current 12-month period. You can view the retrieval requests in a report and print and archive the report. Procedure: 1. In the SAP GUI, use the transaction code /IBMECM/IUVU030 to open the IUVU Report window. Prefix the transaction code with /n or /o, for example, /n/ibmecm/iuvu030 The IUVU Report window shows the monitoring results as collected up to the date and time at which you requested the report. Figure 98 shows a report example. Figure 98. IUVU Report window containing a report example 2. To print, archive, or print and archive the report, take these steps: a. In the IUVU Report window, click the Print icon. b. In the Print ALV List window, click Properties. c. In the Spool Request Attributes window, make your specifications and then click the Continue icon. For more information about the specifications, see 9 on page 176. d. In the Print ALV List window, click the Continue icon. You are returned to the IUVU Report window, which displays a message regarding your spool request. 3. At any time, you can sort the individual columns of the IUVU report by clicking the column header. You can also change its layout. Restriction: Print or archive the report as it is displayed after you enter the /IBMECM/IUVU030 transaction code. 180 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

193 The IUVU report: Description: The IUVU report provides all the information that you need to assess whether your users comply with the IUVU license agreement. Figure 98 on page 180 shows a report example. The first row of an IUVU report contains the name of the SAP user who created the report and the creation date and time of the report. The Access Count column shows whether the IUVU tool is configured correctly. If it contains the number 2, the SAP user-exit table TOAEX contains the two required entries: OA_DISPLAYJAVA_01 and OA_OBJECTDISPLAY_01. The columns of all other rows contain the following monitoring information: Client The system number of the SAP client. User Name The name of the SAP user. Expiry Date / Expiry Time The date and time at which the current 12-month period expires. Start Date / Start Time The date and time at which the current 12-month period started. Access Count The number of times that the SAP user issued a document retrieval request since the start of the current 12-month period. Access Date / Access Time / Time Fraction The date and time of the last request. Note: Time stamps are shown in Coordinated Universal Time (UTC) format Determining the S_WFAR_OBJ users The users with access to the SAP authorization object S_WFAR_OBJ also have access to the documents that were archived and linked by using Content Collector for SAP. You can determine the total number of users with access to this object. Procedure: 1. In the SAP GUI, enter the transaction code SUIM to open the User Information System window. 2. Expand User Information System > User > Users by Complex Selection Criteria and then click the Transaction Code icon in front of Users by Complex Selection Criteria. Figure 99 on page 182 shows which item to select in the User Information System window. Chapter 16. Monitoring the compliance with the license agreements 181

194 Figure 99. User Information System window showing which item to select in the navigation tree 3. In the Users by Complex Selection Criteria window, under Selection by authorizations, specify S_WFAR_OBJ in the Authorization object field, and then click the Execute icon. Figure 100 on page 183 shows the Users by Complex Selection Criteria window containing your specification. 182 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring

195 Figure 100. Users by Complex Selection Criteria window containing your specification The No. of users selected field contains the number of users who have access to the S_WFAR_OBJ object, as shown in Figure 101 on page 184. Chapter 16. Monitoring the compliance with the license agreements 183

196 Figure 101. Users by Complex Selection Criteria window containing the number of users with access to the S_WFAR_OBJ object 184 Content Collector for SAP: Configuring for use with Tivoli Storage Manager, securing and monitoring