To say it upfront, even when SAP servers in a datacenter are typically not connected directly to the public internet and any other measure of security has been optimized, virus scan on this server is still recommended. However, as online scans cause additional load on IO, it may also cause some contention problems if executed with critical part sof the application or Windows O/S.   It’s therefore required to exclude some files or directories from AV scans in order to maintain best performance of a SAP installation. Fortunately, there is quite a bit of reference available what to consider for exclusions. The information below is not specific to a certain AV software but is true for all kinds of AV solutions.

Windows Server 2003 and Windows Server 2008  AV exclusions

%windir%\SoftwareDistribution\Datastore\Datastore.edb
%windir%\SoftwareDistribution\Datastore\Logs\Edb*.log
%windir%\SoftwareDistribution\Datastore\Logs\Edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00001.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00002.jrs
%windir%\security\*.edb
%windir%\security\*.sdb
%windir%\security\*.log
%windir%\security\*.chk
%windir%\softwaredistribution\*.cab
%windir%\system32\ccm\cache\*.cab
%windir%\SoftwareDistribution\Datastore\Logs\Res1.log
%windir%\SoftwareDistribution\Datastore\Logs\Res2.log
%windir%\security\database\*.sdb

%allusersprofile%\NTUser.pol
%Systemroot%\system32\GroupPolicy\**\registry.pol

File Exclusions:

Wsusscan.cab file and the Wsusscn2.cab

Windows Server Failover Cluster Services:
%windir%\Cluster
Q:\ (quorum)

DNS:
%windir%\system32\dns (all subfolders and files)

WINS:
%windir%\system32\wins (all subfolders and files)

Print Servers:
%systemroot\System32\Spool (all subfolders and files)

Microsoft SQL Server 2000/2005/2008 AV exclusions

SQL Server data files:
.mdf
.ldf
.ndf

SQL Server backup files:

.bak
.trn

SAP  AV exclusions

\usr\sap\

\SAPDB\

\SAPDATA1\

\SAP_DB\

NODE0000\*.???????????????

NODE0001\*.???????????????

SAPSprint.exe

lsagent.exe

*.container??????

*.dmp

*.errlog

*.flg

*.INI

*.JAR

*.log

*.lrg

*.node??????

Hyper-V AV exclusions

If the Windows Server is used as Hyper-V server and hosts virtual machines, there are also some considerations for Virus Scan exclusions required. The following files and directories should be excluded from real-time scanning in order to avoid problems:

·       Default virtual machine configuration directory (C:\ProgramData\Microsoft\Windows\Hyper-V)

·       Custom virtual machine configuration directories

·       Default virtual hard disk drive directory (C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks)

·       Custom virtual hard disk drive directories

·       Snapshot directories

·       Vmms.exe

·       Vmwp.exe

Please refer to Microsoft KB article 961804 for more info on Hyper-V AV exclusions

Additional info and references

Virus scanning recommendations for Windows Server 2003 or Windows 2000
https://support.microsoft.com/kb/822158

Guidelines for choosing antivirus software to run on the computers that are running SQL Server
https://support.microsoft.com/kb/309422

Recommended Forefront Client Security file and folder exclusions for Microsoft products

https://support.microsoft.com/kb/943556

Overview of Exchange Server 2003 and antivirus software

https://support.microsoft.com/kb/823166

Guidelines for choosing antivirus software to run on the computers that are running SQL Server

https://support.microsoft.com/kb/309422

Considerations when using antivirus software on ISA Server

https://technet.microsoft.com/en-us/library/cc707727.aspx

- Josef

Public availability is planned for December 2010. Starting immediately customers can apply for participation in a beta program. Shipment of the first beta versions is planned for July 2010. If you are interested, please check out the details on the Connectors SMP Hompage, SAP .NET Connector section, and fill out the beta program application form.

- Juergen

SAP Netweaver Adaptive Computing Controller 7.2 which has finished it’s ramp-up phase in May 2010 brought a very interesting capability for virtualized landscapes. Via a web service client, ACC can now detect and control virtual machines as platforms for its operation. Let’s have a look how this capability can be used for Hyper-V.

SAP Adaptive Computing is an interesting technology available since many years. The basic idea of SAP ACC is to separate a SAP application (or better its technical components) from an operating system. The SAP Adaptive Computing landscape consists of an Adaptive Computing controller, a pool of servers and a storage subsystem. SAP applications are installed into this storage subsystem and can be activated on demand at any pool node. This kind of application virtualization gives a lot of freedom in changing server roles for workload balancing but also for avoiding downtime for maintenance. Migration of server hardware or replacements are literally as easy as pushing a button. This whole concept worked since years with pools of physical servers and has now been extended to work also with virtual machines.

The basic idea with VM’s is, to allow SAP ACC to determine if there are VM’s available, start, stop or migrate VM’s in a Live Migration environment. At the Hyper-V side, all this functions are available inside the System Center Virtual Machine Manager. While normally these tasks would be executed inside the SCVMM GUI, they are also exposed via PowerShell cmdlets for programmatic use. Here is the point where the ACC Interface to Hyper-V comes into place. This interface is basically a Web Service provider which receives the Web Service calls from SAP ACC and translates them into PowerShell cmdlets being executed. The output of the respective cmdlet is than taken back to SAP ACC. The picture below illustrates this setup.

We plan to make soon a prototype of this interface available. If you want to program your own Web Service provider, you'll need the SAP ACC Web Service API specification (available from SAP) and the SCVMM cmdlet specification available at MSDN.

- Josef

I did download and test the BPA on my Hyper-V test environment and was surprised about the result of my tests. It pointed out to be a very valuable tool which gives information about potential problems in the configuration and setup of the Hyper-V environment. I tried it on several servers and got almost always and instantly information about config problems which I wouldn’t have seen easily otherwise. But let’s go step by step and I’ll describe how to get the toolkit and how to install it.

First open the KB article 977238 at https://support.microsoft.com/kb/977238. This document describes the Best Practice Analyzer and provides a link to the Microsoft Download Center. After downloading the package, it can be installed on the Hyper-V server. In order to perform a scan on the current configuration, open Server Manager and go to the Hyper-V role. Here, at the right hand menu, you’ll find an entry Scan this role

When we examined our setup, we found some amazing hints about potential problems (like old Integration components, Legacy Network adapter in VM's or Dynamic VHD). Examine your system and see what you’ll get but I’m sure it may save you a lot of time whenever problems with Virtual Machines cannot be easily assigned to a root cause.

Have fun with Hyper-V

- Josef

Microsoft Sessions at ASUG/SAPPHIRE:

Date	Time	Session Code	Session
Monday, May 17	12:30 p.m. - 12:50 p.m.	OR11715	Save Providing Invisible Infrastructure with TCO Reductions
Monday, May 17	3:00 p.m. - 4:00 p.m.	2404	SAP and Microsoft: Interoperability and Beyond
Tuesday, May 18	2:00 p.m. - 2:45 p.m.	807	How Microsoft Lowered SAP Landscape Storage Costs with SQL Server
Tuesday, May 18	2:00 p.m. - 2:45 p.m.	2207	In-House Banking and Centralized Accounts Payable at Microsoft
Tuesday, May 18	3:00 p.m. - 3:20 p.m.	OR11972	SAP Interoperability with Microsoft SharePoint Using Duet Enterprise
Tuesday, May 18	3:30 p.m. - 3:50 p.m.	OR12322	Discuss OR11972 SAP Interoperability with Microsoft SharePoint Using Duet Enterprise
Wednesday, May 19	12:00 p.m. - 12:20 p.m.	OR10738	Capture the Value of Duet Enterprise for Microsoft SharePoint and SAP
Wednesday, May 19	1:00 p.m. - 1:45 p.m.	OR11537	Deliver and Sell Digital Content: Maximize Revenue with Consume-to-Cash

- Juergen

• Best Practices for SAP on Hyper-V (posted on this website: https://www.microsoft.com/virtualization/en/us/solution-business-apps.aspx in SAP section)

- Josef

- Juergen

SAP on Hyper-V V2

This session gives an update on the latest version of Hyper-V which delivers excellent performance and scalability, live migration and comprehensive management capabilities for virtualized SAP applications. SAP applications are perfect targets for consolidation and landscape optimization because of the number of middleware components and their requirements. As a matter of fact, server virtualization has been used in the majority of all re-platform or new SAP installations on Windows during the last 12 month. But what is the right architecture between native and virtual installations, what can be virtualized with SAP and what is potentially risky? These questions will be answered by this presentation as well as best practice about how customers used the latest version of Hyper-V for SAP from real customer projects will be provided. Additionally, the operational aspects of SAP infrastructures with Hyper-V will also be covered.

 - Josef

The second paper deals with the log space usage in SAP NetWeaver BI on Microsoft SQL Server 2008. Every customer who intends to install SAP BW is confronted with the sizing question. Part of the task is the estimation of the disk space which will be needed. This includes the SQL Server transaction log. Unfortunately there is no simple formula to calculate the size of the SQL Server transaction log for a SAP BW instance. It completely depends on the tasks within SAP BW which fill up the transaction log. This whitepaper describes these tasks and their impact on the log. The paper is also published in the BI Interoperability area

- Juergen

we just published a new whitepaper about BizTalk Server 2009 and SAP at https://www.microsoft.com/isv/sap/technology/interop/biztalk.aspx. The document describes how to integrate, automate, and simplify business processes using Microsoft BizTalk Server 2009 and SAP. Business scenarios are presented involving SAP interoperability and technical patterns for how their solutions can be implemented with an integration platform like Microsoft BizTalk Server.

We are also working on three new whitepapers about Microsoft BI and SAP and a whitepaper describing the use of SharePoint 2010, Silverlight, and SAP, they should get published in the next weeks.

Juergen