Documentation
What it takes to install it
An overview of the documentation that comes with SUPtime. The full version, with scripts and step-by-step procedures, ships with the installation.
Requirements
The server
Reference: the installation SUPtime is developed and verified on.
| Component | Version | Notes |
|---|---|---|
| Linux | Ubuntu Server 25.10 | Any recent distribution |
| Python | 3.13 | FastAPI backend |
| Node.js | 20 LTS, with Yarn 1.22 | To build the interface |
| MongoDB | 7 or later | Local, listening on 127.0.0.1 only |
| SAP NW RFC SDK | 7.50 or later | Required: without it, no RFC function answers |
| Resources | 2 vCPU, 4 GB of RAM | For about ten monitored systems |
Access to SAP systems
Read-only users, documented object by object
RFC user
A Z role copied from SAP_BC_BASIS_MONITORING, with what an RFC caller needs: function module execution and table read.
Security Audit Log
Reading SM20 needs the S_RFC group RSAU_LOG, and the log must be active in SM19.
Operating system
Four standard read-only modules for ST06 and ST02, granted one by one rather than by group: SMON holds the commands to the collector and STUB holds SAPTUNE_RESET_BUFFER, which empties the buffers. Without them the tab says so and the OS rules are not evaluated.
Never SXPG_COMMAND_EXECUTE
It would turn a monitoring user into command execution on the SAP host.
Optional HANA user
HANA's standard predefined monitoring role, plus catalog read. XS jobs need a dedicated grant.
Installation
The steps, in order
- 01
MongoDB
Installed on the server and listening locally only.
- 02
SAP NW RFC SDK
Downloaded from SAP and made available to the backend.
- 03
Backend
Python environment with its dependencies, including pyrfc and hdbcli.
- 04
Configuration
A token signing key of at least 32 characters and a credential encryption key: without them, the service does not start.
- 05
Interface
Build of the React frontend.
- 06
Services
Backend and interface as systemd services.
- 07
First login
Log in as administrator and set up SAP systems, the SMTP server and alert rules.
- 08
Check
Each system's connection test calls RFC_SYSTEM_INFO and reports SID and release.
Security
How it is protected
Encrypted credentials
SAP and SMTP passwords encrypted at rest, with a key kept in the server configuration.
Authentication everywhere
Signed tokens on every endpoint and admin, operator and viewer roles. MFA optional, required for admins or for everyone; sessions are revocable, so a disabled user is signed out at once rather than when the token expires.
Rate limiting and headers
Request limits and HTTP security headers.
Audit trail
A hash-chained log, with chain verification in Settings.
Database not exposed
MongoDB listens locally only.
Upgrades
A documented upgrade procedure.
Declared limits
What the documentation says it does not cover
- The SM21 system log, which is not readable over RFC: SM20 takes its place.
- The standard users check only sees the client of the connection: covering all of them needs one user per client.
- Users per instance only for the instance SUPtime is connected to, and no CPU per instance.
- SMLG response time is a system-wide value, not per group.
- XS Advanced is detected, but not monitored.
Want the full documentation?
We will send it with the demo, together with the user scripts.