SAP Kernel Upgrade Steps in Linux: Command Generator
This generator writes the ordered Linux commands for an SAP kernel patch on an ABAP system or standalone SAP Web Dispatcher, using sapcontrol, SAPCAR and saproot.sh. Fill in your SID, instance numbers, paths and the archive names you downloaded.
Fill in
Use the exact file name you downloaded; SAP download names include the patch level and a numeric suffix.
Database-dependent part for your database, exact downloaded file name.
File name of igsexe archive, or none.
0. Preparation (as prdadm)
# System PRD, database SAP HANA # List archive contents before touching anything cd /sapmedia/kernel_793_pl200 SAPCAR -tvf SAPEXE.SAR | head -20 SAPCAR -tvf SAPEXEDB.SAR | head -20 df -h /usr/sap/PRD/SYS/exe/uc/linuxx86_64 # Record the current kernel disp+work -v | grep -E 'kernel release|patch number' sapcontrol -nr 00 -function GetVersionInfo sapcontrol -nr 00 -function GetSystemInstanceList
1. Stop the SAP system (as prdadm)
# Stops all instances of PRD (ASCS, PAS, AAS). The SAP HANA database can stay up. sapcontrol -nr 00 -function StopSystem ALL sapcontrol -nr 00 -function WaitforStopped 600 2 sapcontrol -nr 00 -function GetSystemInstanceList # all GRAY # Stop sapstartsrv for every instance on this host so executables are not locked sapcontrol -nr 00 -function StopService sapcontrol -nr 01 -function StopService # Remove leftover IPC objects cleanipc 00 remove cleanipc 01 remove
2. Back up the kernel directory (as prdadm)
cp -rp /usr/sap/PRD/SYS/exe/uc/linuxx86_64 /usr/sap/PRD/SYS/exe/uc/linuxx86_64_bak_$(date +%Y%m%d) ls -ld /usr/sap/PRD/SYS/exe/uc/linuxx86_64_bak_*
3. Extract the new kernel (as prdadm)
cd /usr/sap/PRD/SYS/exe/uc/linuxx86_64 SAPCAR -xvf /sapmedia/kernel_793_pl200/SAPEXE.SAR SAPCAR -xvf /sapmedia/kernel_793_pl200/SAPEXEDB.SAR # Optional IGS: skip if the field says none # SAPCAR -xvf /sapmedia/kernel_793_pl200/none
4. Set ownership and permissions (as root)
cd /usr/sap/PRD/SYS/exe/uc/linuxx86_64 ./saproot.sh PRD ls -l icmbnd sapuxuserchk # owned by root with the set-user-ID bit after saproot.sh
5. Start and verify (as prdadm)
sapcontrol -nr 01 -function StartService PRD sapcontrol -nr 00 -function StartService PRD sapcontrol -nr 00 -function StartSystem ALL sapcontrol -nr 00 -function WaitforStarted 900 5 sapcontrol -nr 00 -function GetSystemInstanceList # all GREEN # Confirm the new patch level disp+work -v | grep -E 'kernel release|patch number' sapcontrol -nr 00 -function GetVersionInfo # Then check SM51 (release notes per server) and SM21 / dev_w0 for errors
Variant: standalone SAP Web Dispatcher (as the Web Dispatcher sidadm)
sapcontrol -nr 10 -function GetVersionInfo sapcontrol -nr 10 -function Stop sapcontrol -nr 10 -function WaitforStopped 300 2 sapcontrol -nr 10 -function StopService # back up and extract the SAPWEBDISP archive into the Web Dispatcher exe directory # run saproot.sh or set icmbnd permissions as root if the archive contains it sapcontrol -nr 10 -function StartService <WDSID> sapcontrol -nr 10 -function Start sapcontrol -nr 10 -function GetVersionInfo
Verify for your landscape: the kernel line and patch you need (SAP Note 2083594 lists kernel versions and patch levels, SAP Note 19466 covers downloading kernel patches), the SAPEXE and SAPEXEDB archive names, and the kernel path (older systems may use /sapmnt/SID/exe). On start, sapcpe copies the central kernel to each instance exe directory. In a Pacemaker or other HA cluster, put the cluster in maintenance mode before stopping instances. Repeat steps on every host that has its own local kernel.
Get the commands checked for your landscape
Send us your SID layout, HA setup and target kernel and we will review the sequence before your window.
Optional. The tool and every export work without this. No spam.
How to use it
Enter the SID, the sidadm user, the PAS and ASCS instance numbers, the central kernel directory and the staging directory that holds the SAR files. Paste the exact SAPEXE and SAPEXEDB file names from your download basket so the extract lines run as written. Run block 0 a day before the window: it lists the archive contents, checks free space and records the current kernel release and patch number for your change ticket. Blocks 1 to 5 are the downtime steps, in order. Each block says which user runs it; only saproot.sh needs root.
- Keep the backup directory until the system has run a full business cycle.
- Patch the database-dependent part (SAPEXEDB) together with SAPEXE.
- Patch application server hosts with local kernels separately.
Where the kernel lives
On current NetWeaver systems the central kernel is in /usr/sap/SID/SYS/exe/uc/linuxx86_64, which is usually a link into /sapmnt/SID/exe. Each instance has its own exe directory under /usr/sap/SID/<instance>/exe, filled by sapcpe from the central directory when the instance starts. That is why you only extract into the central directory and why sapstartsrv must be stopped: it runs from the instance copy and holds files open. sapcontrol talks to sapstartsrv on port 5<nr>13, so StopService is the last sapcontrol call that works until you start the service again.
Worked example
System PRD has ASCS 01 and PAS 00 on one host with HANA as the database. After block 0 shows kernel release 793 and the current patch, StopSystem ALL stops ABAP instances and WaitforStopped 600 2 polls every 2 seconds for up to 600 seconds. GetSystemInstanceList should show every instance GRAY before you stop the services. The backup is a dated copy of the kernel directory. Both archives are extracted into the kernel directory, root runs saproot.sh PRD, and StartService plus StartSystem ALL bring PRD back. disp+work -v must now show the new patch number.
Gotchas and how to check the result
The most common failure is a missing saproot.sh run: icmbnd then cannot bind ports below 1024 and ICM fails. The second is extracting SAPEXE without the matching SAPEXEDB, which leaves an old database library. If an instance does not start, look in the work directory (dev_disp, dev_w0, sapstart.log) and compare against the backup. To roll back, stop again, move the backup directory into place and restart. After the start, check SM51 for the release on every server, SM21 for errors and transaction SICK.
Frequently Asked Questions
What are the SAP kernel upgrade steps in Linux?
Check the current kernel with disp+work -v, stop the system with sapcontrol StopSystem ALL and wait for it, stop sapstartsrv per instance, back up the kernel directory, extract SAPEXE and SAPEXEDB with SAPCAR -xvf, run saproot.sh SID as root, then start the services and the system and verify the new patch level.
Do I need to stop the database for a kernel patch?
Normally no. The kernel patch replaces SAP executables, and StopSystem ALL stops the SAP instances, not a separate HANA, Oracle or Db2 database. Stop the database only if you are also patching the database client or the database itself, or if your vendor documentation says so.
How do I upgrade the SAP Web Dispatcher kernel?
Stop the Web Dispatcher instance with sapcontrol -nr <wd> -function Stop, stop its sapstartsrv with StopService, back up its exe directory, extract the SAPWEBDISP archive there, fix icmbnd permissions as root, then StartService and Start. Confirm with GetVersionInfo. The Web Dispatcher is patched independently of the ABAP kernel.
Why does my instance not start after the kernel upgrade?
Check dev_disp, dev_w0 and sapstart.log in the instance work directory. Typical causes are a skipped saproot.sh, a missing SAPEXEDB extract, a kernel line not supported for your NetWeaver release, or sapstartsrv still running the old binary. Restore the backup directory to get running again while you investigate.
If you want your Basis team to ask your SAP landscape questions such as kernel levels or failed jobs in plain English on your own servers, we can set that up.
Related Tools
SAP Kernel Upgrade Checklist
A checklist for planning, staging, replacing and verifying an SAP kernel update, with backup and rollback steps called out.
SAPSAP HANA Backup SQL Statement Generator (Data, Delta, Catalog)
Builds BACKUP DATA statements for a tenant (complete, differential, incremental, to file or Backint), queries to review the backup catalog and its size, and the catalog housekeeping statement.
Developer ToolsSAP GUI Scripting Script Generator (Python win32com)
Builds a runnable Python script that drives SAP GUI for Windows through the SAP GUI Scripting API: connect, log on to a client, call a transaction, set a field and capture the result.
SAPSAP HANA Memory Usage SQL Generator (Used, Resident, Heap)
Builds five monitoring queries for a HANA tenant: used memory against the allocation limit per service, host resident memory, top heap allocators, top column tables and daily used-memory history.
More SAP tools
See all- SAP Transport Return Codes Reference (tp RC 0, 4, 8, 12, 16)
- SAP Transport Request Tables Reference (E070, E071, E07T)
- How to Transport Variants, SO10 Texts, Table Entries and Layouts in SAP
- SAP Work Process Types and SM50 Status Reference
- SAP GUI Connection Error Codes Reference (88, 10054, 10061)
- SAP NetWeaver Release to SAP_BASIS and Kernel Reference
- SAP Gateway OData Transaction Codes Reference (SEGW, /IWFND/)
- SAP ABAP Extended Memory and Heap Sizing Calculator
- SAP Gateway OData Service Activation and Transport Checklist
Keep exploring
Free tools
- SAP NetWeaver Release to SAP_BASIS and Kernel ReferenceWhich SAP_BASIS release belongs to each NetWeaver and ABAP Platform release, which products run on it, which kernel lines apply and how to check your own system.
- SAP Kernel Upgrade ChecklistA checklist for planning, staging, replacing and verifying an SAP kernel update, with backup and rollback steps called out.
- ABAP Selection Screen and SELECT-OPTIONS GeneratorBuilds a complete ABAP report with a framed selection screen, two SELECT-OPTIONS, a parameter, radio buttons that hide a field, event blocks, validation, an optional option restriction and an ALV output.