susHanaSR.py(7)

💖 susHanaSR.py — like, the whole manual, but make it make sense 💖

okay so. bestie. this is the manual page for susHanaSR.py(7) from the SAPHanaSR fam — it's a hook provider, and by the end of this you're gonna be obsessed. grab a snack 🍓, we're going in.

✨ NAME ✨

susHanaSR.py — the provider for SAP HANA's srHook method srConnectionChanged(). that's the whole vibe.

🌸 DESCRIPTION 🌸

so susHanaSR.py exists so you can hand SAP HANA a script for the srHook method srConnectionChanged(). that's literally its job, and it does it slayfully.

here's the lore: the SAP HANA nameserver ships a Python-based API called "HA/DR providers", and it gets called at the big main-character moments of host auto-failover and system replication takeover. these things are called hooks, and you can use them to do whatever arbitrary operations your heart desires. the method srConnectionChanged() gets called on the master nameserver the moment one of the replicating services loses or establishes the system replication connection. and like — it's called only once. one shot. no reruns. 🎬

what susHanaSR.py actually does: it updates the cluster attribute srHook whenever the HANA system replication status changes. which means this attribute is more reliable than the sync_state attribute (that one gets polled by RA monitors, which is giving secondhand information ngl).

🫶 heads up bestie: this hook script needs to be configured and activated on all HANA nodes. all of them. no skipping.

🎀 SUPPORTED PARAMETERS 🎀

the `ha_dr_provider_sushanasr` section

the "HA/DR providers" API accepts these parameters for the ha_dr_provider_sushanasr section, and here's the section header itself, iconic:

[ha_dr_provider_sushanasr]

provider = susHanaSR — Mandatory. Must not be changed. like, do not touch. 💅
path = /usr/share/SAPHanaSR-angi — Mandatory. Please change only if requested.
execution_order = [ INTEGER ] — Mandatory. the order might depend on other hook scripts, so think about it.

the `trace` section

the "HA/DR providers" API accepts this parameter for the trace section:

[trace]

ha_dr_sushanasr = [ info | debug ] — Optional. Will be added automatically if not set. the script's got you, fr fr.

the CIB side of things

the SAPHanaController RA recognizes the effecting system replication status via attributes in the CIB's SAPHanaSR properties section. the SAP System Identifier (sid) is given in lower case:

hana_${sid}_site_srHook_${site} = [ SOK | SFAIL | SWAIT ]

⭐ Note: SAPHanaSR-ScaleOut comes with a SAPHanaSR.py that provides global attributes. different creature, same ecosystem.

🔥 RETURN CODES 🔥

0 — Successful program execution. we love a win. 👑
>0 — Usage, syntax or execution errors. something went sideways.

🦋 EXAMPLES 🦋

buckle up, there's a lot, and honestly? all of them ate.

example sudoers entry in /etc/sudoers.d/SAPHanaSR:

# SAPHanaSR needs for srHook
ha1adm ALL=(ALL) NOPASSWD: /usr/sbin/crm_attribute -n
hana_ha1_site_srHook_*

example for looking up the sudo permission for the srHook script. All related files (/etc/sudoers and /etc/sudoers.d/*) are scanned. Example SID is HA1.

# sudo -U ha1adm -l | grep "NOPASSWD.*crm_attribute.*hana_ha1"

example for checking HANA's python version. you'd do this before installing HADR provider hook scripts. SID is HA1.

# su - ha1adm -c "python --version"

example entry in the SAP HANA global configuration /hana/shared/$SID/global/hdb/custom/config/global.ini. this file is needed at both sites, and HANA has to be stopped before the files can be edited. 😭

[ha_dr_provider_sushanasr]
provider = susHanaSR
path = /usr/share/SAPHanaSR-angi
execution_order = 1
[trace]
ha_dr_sushanasr = info

example entry in the SAP HANA 2.0 global configuration /hana/shared/$SID/global/hdb/custom/config/global.ini to enable multi-target aware third site. this entry is needed to allow the ocf_suse_SAPHanaController(7) parameter AUTOMATED_REGISTER=true in multi-target environments. HANA has to be stopped before the files can be edited. do not copy the file between nodes. please check SAP HANA documentation for details.

[system_replication]
 ...
register_secondaries_on_takeover = true
 ...

example entry in the SAP HANA 2.0 nameserver configuration /hana/shared/$SID/global/hdb/custom/config/nameserver.ini for two-node scale-out HANA without standby nodes. this entry is needed at both sites that are managed by the Linux cluster. HANA has to be stopped before the files can be edited. do not copy the file between nodes. it might be necessary to un-register and re-register the secondary to make the change effective on the secondary site. please check SAP HANA documentation for details. in this example the master node is suse11, the worker is suse12, the instance number is 00. see also SAPHanaSR-ScaleOut_basic_cluster(7).

[landscape]
 ...
master = suse11:31001
worker = suse11 suse12
active_master = suse11:31001
roles_suse11 = worker
roles_suse12 = worker
 ...

example for checking the system log for srHook setting HANA system replication status in the CIB properties section. run this on the respective HANA primary site's master nameserver.

# grep "sudo.*crm_attribute.*srHook" /var/log/messages

example for checking the HANA tracefiles for srConnectionChanged() events. also on the respective HANA primary site's master nameserver.

# su - sleadm
~> cdtrace
~> grep susHanaSR.srConnectionChanged.*called nameserver_*.trc
~> grep susHanaSR.*crm_attribute nameserver_*.trc
# exit

example for checking the HANA tracefiles for when the hook script has been loaded. run this on both sites' master nameservers.

# su - sleadm
~> cdtrace
~> grep HADR.*load.*susHanaS nameserver_*.trc

example for comparing the Linux cluster srHook attribute with the current HANA SR state. SID is HA1. run on the current HANA primary site.

# SAPHanaSR-showAttr | grep -A4 srHook
# su - ha1adm -c "HDBSettings.sh systemReplicationStatus.py"

potentially dangerous example for manually changing the Linux cluster srHook attribute according to the current HANA SR state. you might want this if the HANA SR state changed while the Linux cluster was completely down. SID is ICE, site is BERG, current HANA SR state is SFAIL.

💀 Note: Understand the impact before trying. like, actually understand it.

# su - iceadm -c "HDBSettings.sh systemReplicationStatus.py"
# cs_clusterstate -i
# crm_attribute -n hana_ice_site_srHook_BERG -v SFAIL -t crm_config -s
SAPHanaSR
# SAPHanaSR-showAttr

example for removing an orphaned global srHook attribute. you'd do this after upgrading from old-style srHook, to avoid confusion caused by different HANA HADR provider API versions. SID is HA1.

# SAPHanaSR-showAttr
# crm configure show SAPHanaSR
# cs_clusterstate -i
# crm_attribute --delete -t crm_config --name hana_ha1_glob_srHook
# crm configure show SAPHanaSR
# SAPHanaSR-showAttr

example for temporarily blocking HANA system replication. this could be done for testing the HA/DR provider hook script integration.

🚨 Blocking the HANA system replication is dangerous. This test should not be done on production systems. Instance number is 00, the resulting network ports are depending on the HANA setup. Please refer to SAP HANA documentation. See also manual page iptables(8). Note: Understand the impact before trying.

Check HANA and Linux cluster for clean idle state.
On secondary, check for used network ports.

# ss -tulpan | grep hdb.*server | grep -v 127.0.0.1 |\
grep -v "\*" | awk '{print $6}' | awk -F: '{print $2}'

On secondary, block HANA system replication, example ports are 4000[1237].

# iptables -I INPUT -p tcp -m multiport --ports
40001,40002,40003,40007 -j ACCEPT

Note: The ACCEPT needs to be replaced by appropriate action.

Check the nameserver tracefile for srConnectionChanged() events, check the system log for crm_attribute calls, check the Linux cluster attributes for srHook status.
On secondary, unblock HANA system replication.

# iptables -D INPUT -p tcp -m multiport --ports
40001,40002,40003,40007 -j DROP

Check the nameserver tracefile for srConnectionChanged() events, check the system log for crm_attribute calls, check the Linux cluster attributes for srHook status.
Check HANA and Linux cluster for clean idle state.

🧚 FILES 🧚

/usr/share/SAPHanaSR-angi/susHanaSR.py — the hook provider, delivered with the RPM. the main character itself.
/hana/shared/$SID/global/hdb/custom/config/global.ini — the on-disk representation of HANA global system configuration.
/hana/shared/$SID/global/hdb/custom/config/nameserver.ini — the on-disk representation of HANA nameserver configuration.
/etc/sudoers , /etc/sudoers.d/* — the sudo permissions configuration.
/usr/sap/$SID/HDB$nr/$HOST/trace — path to HANA tracefiles.
/usr/sap/$SID/HDB$nr/.crm_attribute.$SITE — the internal cache for srHook status changes while the Linux cluster is down. file is owned and read/write by ${sid}adm and must never be touched. 🙈 like, hands off. it's not yours.

💜 REQUIREMENTS 💜

SAP HANA 2.0 SPS05 rev.059.04 or later provides Python 3 as well as the HA/DR provider hook method srConnectionChanged() with multi-target aware parameters. the Python 3 and multi-target aware parameters are needed for the SAPHanaSR-angi package. both. you need both.
No other HADR provider hook script should be configured for the srConnectionChanged() method. hook scripts for other methods, provided in SAPHanaSR-angi, can be used in parallel to susHanaSR.py, if not documented contradictingly. sharing is caring, but only where it's allowed. 🫶
The user ${sid}adm needs execution permission as user root for the command crm_attribute.
The user ${sid}adm needs ownership and read/write permission on the internal cache file /usr/sap/$SID/HDB$nr/.crm_attribute.$SITE and its parent directory.
The hook provider needs to be added to the HANA global configuration — in memory and on disk (in persistence). both. it's giving "don't forget the persistence, bestie".
The srHook script runtime almost completely depends on call-outs to the OS and the Linux cluster. that's just how it is.

⭐ BUGS ⭐

in case of any problem, please use your favourite SAP support process to open a request for the component BC-OP-LNX-SUSE. and please report any other feedback and suggestions to feedback@suse.com. we're listening, fr fr.

👑 AUTHORS 👑

A.Briel, F.Herschel, L.Pinne. legends, honestly.

🎀 COPYRIGHT 🎀

susHanaSR.py comes with ABSOLUTELY NO WARRANTY. For details see the GNU General Public License at http://www.gnu.org/licenses/gpl.html

okay that's the whole page, no skips, no cap 💅 tysm for reading bestie — this was susHanaSR.py(7) from SAPHanaSR, dated 10 Jan 2025, and she's iconic. mwah. 😭💖

📦 where this page comes from

opensuse-leap 16.0: SAPHanaSR-angi 1.3.4-160000.1.1 · GPL-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms