Dynamic Edge Processing IoT Edge Services - Configuration Guide Version 2.0 FP01 TABLE OF CONTENTS INTRODUCTION ............................................................................................................................................... 3 ARCHITECTURE .............................................................................................................................................. 3 INSTALLATION OPTIONS ............................................................................................................................... 3 SUPPORTED LINUX VERSIONS ..................................................................................................................... 4 PREREQUISITES .............................................................................................................................................. 4 SQL Anywhere 17 ...................................................................................................................................................4 Java SE Runtime .....................................................................................................................................................5 SAP Streaming Lite ................................................................................................................................................5 Node.js .....................................................................................................................................................................5 Python ......................................................................................................................................................................6 IOT EDGE SERVICES INSTALLATION ........................................................................................................... 6 POSTINSTALLATION SECURITY TASKS ...................................................................................................... 7 MANAGING SAP DYNAMIC EDGE PROCESSING PROCESSES................................................................. 7 SERVICE CREATION ....................................................................................................................................... 8 CUSTOMIZING SSL CONFIGURATION ........................................................................................................ 10 CONNECTING TO THE SAP DYNAMIC EDGE PROCESSING DATABASE .............................................. 11 LOG FILE CONFIGURATION ......................................................................................................................... 12 SYSTEM-WIDE CONFIGURATION ................................................................................................................ 12 ENGINE PLUGIN CONFIGURATION ............................................................................................................. 13 PROTOCOL PLUGIN CONFIGURATION ...................................................................................................... 14 Configuring a Protocol Plugin .................................................................................................................................17 Sending Data to a Protocol Plugin ..........................................................................................................................18 Field Message Action to a Protocol Plugin .............................................................................................................20 Enterprise Plugin Configuration .........................................................................................................................20 Configuring an Enterprise Plugin ............................................................................................................................29 EDGE BUSINESS SERVICES ACTION CONFIGURATION ......................................................................... 30 TROUBLESHOOTING .................................................................................................................................... 30 KNOWN ISSUES ............................................................................................................................................. 31 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC INTRODUCTION SAP Dynamic Edge Processing contains two distinct sets of edge application services. They are installed separately, and can work together or independently. We will refer to these two sets of edge application services as: Edge business services IoT edge services The following definitions explain the main functionality in this product: Term Abbreviation Digital core (or just core) The customers’ core enterprise systems running in their data center or in the cloud including S/4HANA, Business Suite or HANA. Edge The location of customers’ business at the edge of their networks, outside their data centers. Typically this is the location of the IoT sensor. Edge application services The functionality and data exposed through defined interfaces used to enable edge applications (edge business services and IoT edge services). Edge business services Running your business at the edge. IoT edge services Processing your IoT data at the edge. This document focuses on the configuration of IoT edge services. ARCHITECTURE The IoT edge services architecture is shown below. The area within the dashed line “SAP Dynamic Edge Processing Instance” is considered the boundary of IoT edge services. IoT edge services comprise of several processes based on the following technology: Java (IoT Adapter) Node.js (IoT Edge Console) Streaming Lite (Streaming Lite) SQL Anywhere (Database) INSTALLATION OPTIONS You can install IoT edge services either on the same host as edge business services, or on an independent host. IoT edge services can integrate with an edge business services server that is on the same host, or can also 3 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC integrate with an edge business services server on a separate host. IoT edge services can also be installed without an edge business services server in the landscape. In summary, the installation options for IoT edge services are the following: Same host as edge business services. Different host than edge business services. Without edge business services in the landscape. SUPPORTED LINUX VERSIONS Linux is available from several vendors. In addition, a wide variety of Linux installations are possible, which poses a challenge for companies such as SAP who want to maintain an open and flexible approach to supporting Linux, yet require a practical means of identifying which Linux installations they support. Support for Linux is dependent on the IoT edge services pre-requisites support for Linux. For example, if all of the pre-requisites support a specific version of Linux, then theoretically IoT edge services should also support that version of Linux. Please contact your SAP representative for further details. SAP SQL Anywhere for Linux Supported Platforms: https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=448478811 SAP Streaming Lite Platform and Installation: http://help.sap.com/saphelp_hana_options_sds_util/helpdata/en/6d/f3acf1ee9645418dff08f20c864a6a/content.ht m Note: Streaming Lite supports Linux x86 64-bit and Linux ARM 32-bit. Streaming Lite does not support Linux x86 32-bit. Tested Linux distributions: Ubuntu Desktop 16.04 LTS (x86 64-bit) Ubuntu Desktop 14.04 LTS (x86 64-bit) RHEL 7.3 (x86 64-bit) (See Known Issues 1, 2, 3) SUSE 12 (x86 64-bit) (See Known Issues 1, 2, 3) Intel Intelligent Device Platform (IDP) 3.1 - Wind River 7 (x86 64-bit) (See Known Issues 1, 2) Raspbian 4.4.21-v7 (Jessie) (ARM 32-bit) PREREQUISITES IoT edge services require several software packages to already be installed on the host. These must be separately licensed (where applicable). Prerequisites include the following: SAP SQL Anywhere 17 version 17.0.0.1062+ Java SE Runtime version 1.8.0_31+ (this is installed by SQL Anywhere) SAP Streaming Lite 1.0 SP12 (version 5.1.120.0/20160428.1) Node.js version 4.5.0+ (+ dependent modules) Python version 2.7.x The detailed installation requirements are discussed below. SQL Anywhere 17 SAP SQL Anywhere requires a separate download from SAP Service Marketplace. SQL Anywhere supports a “silent install” as documented here: http://dcx.sap.com/index.html#sqla170/en/html/816898fd6ce21014935d9df4a0b792a0.html A SQL Anywhere 17 Advanced Edition license key is required. SQL Anywhere must be installed to /opt/sqlanywhere17 IoT edge services on Linux requires the following SQL Anywhere features: Feature x86 64-bit Package Name Administration Tools admintools64 ARM 32-bit Package Name admintools32 4 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC Feature x86 64-bit Package Name ARM 32-bit Package Name MobiLink Client ml64 mobilink_sqlany32 SQL Anywhere client sqlany_client64 sqlany_client32 SQL Anywhere server sqlany64 sqlany32 UltraLite, MobiLink Server, SQL Remote, documentation, samples and any other features not listed in the above table, are not required. The following command is recommended for a silent installation of SQL Anywhere on x86 64-bit Linux: setup -regkey <your_license_key> -install admintools64,ml64,sqlany_client64,sqlany64 -silent -I_accept_the_license_agreement -name "<your_name>" -company "<your_company>" sqlany-dir /opt/sqlanywhere17 The following command is recommended for a silent installation of SQL Anywhere on ARM 32-bit Linux: setup -regkey <your_license_key> -install admintools32,mobilink_sqlany32,sqlany_client32,sqlany32 -silent -I_accept_the_license_agreement -name "<your_name>" -company "<your_company>" sqlany-dir /opt/sqlanywhere17 Java SE Runtime SAP SQL Anywhere 17 automatically installs the required Java SE Runtime; you need not download and install it separately. Note: If the JAVA_HOME environment variable is not already configured, then the SAP Dynamic Edge Processing control script (dep.sh) correctly sets JAVA_HOME to the SQL Anywhere JRE folder (dep.sh calls the SQL Anywhere sa_config file, which sets the JAVA_HOME environment variable if it is not already configured). SAP Streaming Lite SAP Streaming Lite requires a separate download from SAP Service Marketplace. Streaming Lite must be installed to /opt/streaminglite (exact folder name required). Obtain the correct Streaming Lite tar ball from SAP Service Marketplace (ARM 32-bit or x86 64-bit) The example command lines below assume the Streaming Lite installation file is named SDSLITE_Linux_x86_64.gz: 1. Copy the Streaming Lite installation file to the Linux host. 2. Copy the Streaming Lite installation file to the /opt/streaminglite folder (exact folder name required). Create the /opt/streaminglite folder if it does not exist. sudo mkdir /opt/streaminglite sudo cp SDSLITE_Linux_x86_64.gz /opt/streaminglite/ 3. Extract the Streaming Lite installation file into /opt/streaminglite: cd /opt/streaminglite sudo tar xvf SDSLITE_Linux_x86_64.gz 4. Remove the Streaming Lite installation file: rm SDSLITE_Linux_x86_64.gz 5. Once extracted, verify that the Streaming Lite binaries are in /opt/streaminglite/install/bin (required). Note: STREAMING_HOME environment variable is automatically set by the SAP Dynamic Edge Processing control script (dep.sh). Node.js You can install Node.js in several ways. You can either download it from https://nodejs.org/en/download/releases, or you can install it using the package manager that is local to the Linux distribution (apt, yum, or rpm). You can install Node.js to any recommended directory. 5 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC There are several Node.js modules that are automatically installed, using npm, during the setup of SAP Dynamic Edge Processing. Both Node.js and npm require full user execution privileges when run as sudo and must be included in the PATH environment variable. Python You can install Python either by downloading it from https://www.python.org/downloads/ or by using the package manager local to the Linux distribution (apt, yum, or rpm). Python can be installed to any recommended directory and must be included in the PATH environment variable. IOT EDGE SERVICES INSTALLATION 1. Ensure all prerequisite software is successfully installed. 2. Download IoT edge services from SAP Service Marketplace. 3. If IoT edge services will be running as Linux services, you can install it either as a root user, or a non-root user. Please consult your Linux documentation for more details. 4. If IoT edge services is not running as Linux services, we recommend that you create a non-root user to install and run it. If you use a non-root user, it needs to be in the /etc./sudoers file. 5. Deploy the IoT edge services file (assume named dep_IoT.tar.gz). 6. Copy dep_IoT.tar.gz to the Linux host (assume copy to ~/install/dep_IoT.tar.gz) 7. Un-tar the file as follows: sudo tar -xzf ~/install/dep_IoT.tar.gz -C /opt 8. Preinstall Node.js modules. By default, setup.sh will run npm in order to download, compile, and install the required Node.js modules. In some cases, pre-installing the Node.js modules is desirable, and in some cases it is required: (Optional) As an optimization for bulk deployments (avoiding the same download on every host). (Required) If you are installing SAP Dynamic Edge Processing without an Internet connection. (Required) If you are installing SAP Dynamic Edge Processing where npm is not supported on the Linux host. To pre-install the Node.js modules: a. Copy the /opt/dep_iot_edge/node/node_modules folder from a compatible host where IoT edge services has already been installed to the new IoT edge services host. b. Run setup.sh (in next section) and add command --skip-npm-install. This will instruct the setup program to skip the Node.js module install: sudo ./setup.sh --skip-npm-install 9. Run setup.sh as root user or via sudo (required for Linux user creation). setup.sh requires Internet access to download Node.js modules (unless they were preinstalled in the previous step). setup.sh does the following: Creates a Linux user (streamingliteuser) for Streaming Lite authentication. This user is created with a random password. Streaming Lite uses Linux Pluggable Authentication Modules (PAM) for authentication. If the Linux platform does not support PAM, then you must run setup.sh using the flag --noauth, to skip creating the Linux user. sudo ./setup.sh –noauth o The Linux user (streamingliteuser) user name and encrypted password is written to /opt/dep_iot_edge/store/SLAuth.properties. IoT edge services also reads this file at runtime and uses the credentials when publishing to Streaming Lite. Allows you to delete an existing IoT edge services database. All configuration and IoT data is wiped. Requests the initial password for the IoT Edge Console admin user. Creates a new IoT edge services database and two additional database users, and populates the database with required data. Note: All database user credentials are randomly generated. 6 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC Creates ODBC entries for the IoT edge services database. The SQL Anywhere dbdsn utility obfuscates the database user’s password inside the Data Source Name (DSN). o DEP_IOT_ADMIN: used by IoT edge services Java runtime + admin utilities o DEP_IOT_WEB: used by Node.js. o DEP_IOT_STREAMING: used by Streaming Lite Copies Java libraries from Streaming Lite and SQL Anywhere into /opt/dep_iot_edge/java_lib/ Creates SSL certificates to be used by the built-in plugins: o Node.js web server for HTTPS. o HttpProtocolPlugin to enable HTTPS and WSS o Creates a NodeId (if not supplied) and writes it to: /opt/dep_iot_edge/store/node_sync_config.properties To run setup.sh, execute the following commands: cd /opt/dep_iot_edge/startScripts sudo ./setup.sh Note: The final output of setup.sh, if successful, is Initializing Node Config. POSTINSTALLATION SECURITY TASKS The “/opt/dep_iot_edge/store” folder contains sensitive information, and therefore must be secured via Linux file permissions. Only the user running SAP Dynamic Edge Processing services should have read/write access to this folder and its contents. For example, if running SAP Dynamic Edge Processing as root: chown –R root:root /opt/dep_iot_edge/store chmod 700 /opt/dep_iot_edge/store chmod 600 /opt/dep_iot_edge/store/* The IoT edge services setup program (setup.sh) creates a Linux user (streamingliteuser) for Streaming Lite authentication. This user is created with a random password. Streaming Lite uses Linux PAM for authentication. You can modify either the username or password of this Linux user: 1. Stop IoT edge services. 2. Change the Linux user password (or create a new Linux user). 3. Modify the file containing the user credentials: /opt/dep_iot_edge/store/SLAuth.properties STREAMING_USERNAME=<Linux_User> STREAMING_ AUTHENTICATION =<Password – Base64 encoded> 4. Start IoT edge services. To configure Streaming Lite to support PAM authentication: 1. Log in as root. 2. Create the file /etc/pam.d/sp. The contents of this file determine the type of authentication required. For Linux password authentication, the contents of the file /etc/pam.d/sp should be: auth required pam_permit.so auth required pam_warn.so auth required pam_unix.so MANAGING SAP DYNAMIC EDGE PROCESSING PROCESSES IoT edge services includes processes based on the following technology: 1. Java (IoT Adapter) 2. Node.js (IoT Edge Console) 3. Streaming Lite (Streaming Lite) 4. SQL Anywhere (Database) The command script that manages the SAP Dynamic Edge Processing processes is called dep.sh. 7 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC To run dep.sh, execute the commands as follows: cd /opt/dep_iot_edge/startScripts sudo ./dep.sh <command> <component> The following commands are available: start stop restart status Starts the IoT edge services processes Stops the IoT edge services processes Restarts the IoT edge services processes Shows the status of all IoT edge services processes For example, to list the status of the IoT edge services processes, execute the following commands: cd /opt/dep_iot_edge/startScripts sudo ./dep.sh status The following components are available for the “start” and “restart” commands: all Starts or restarts all IoT edge services allNoAuth Starts or restarts all IoT edge services without Streaming Lite authentication DB Starts or restarts the IoT edge services database IoTAdapter Starts or restarts the IoT edge services IoT Adapter NodeJS Starts or restarts the IoT edge servicesNode.js server StreamingLite Starts or restarts the IoT edge services Streaming Lite server StreamingLiteNoAuth Starts or restarts the IoT edge services Streaming Lite server without authentication The following components are available for the “stop” commands: all Stops all IoT edge services DB Stops the IoT edge services database IoTAdapter Stops the IoT edge services IoT Adapter NodeJS Stops the IoT edge services Node.js server StreamingLite Stops the IoT edge services Streaming Lite server For example, to start all of the IoT edge services processes, execute the following commands: cd /opt/dep_iot_edge/startScripts sudo ./dep.sh start all SERVICE CREATION In a production rollout, configure all IoT edge services processes to run as background processes that start automatically when the Linux instance boots. There are multiple ways to do this; here, we’ll focus on using systemd Linux services. systemd allows you to restart processes in case of failure, define dependencies between services, and more easily configure your system. This section discusses only how to create systemd services for IoT edge services, and deploy and configure them to start automatically. Refer to the systemd documentation for additional information, including details about specific parameters. systemd services are defined by creating "unit" files in the /lib/systemd/system directory. On some Linux distributions such as SUSE Linux Enterprise 12, this directory does not exist; therefore, use the /etc./systemd/system directory instead. If both /lib/systemd/system and /etc./systemd/system are present, use /lib/systemd/system. The unit files specify how to start or stop services, any dependencies, what action to take if the process fails, and, if the service is auto-started while Linux boots, at what point it should be started. Below is the unit file for the SQL Anywhere database used by IoT edge services. Name the file dep_sqlany.service, and copy it to the /lib/systemd/system directory on the Linux system. 8 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC [Unit] Description=dep_sqlany [Service] Type=forking ExecStart=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh start DB' ExecStop=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh stop DB' Restart=always RestartSec=15 [Install] WantedBy=multi-user.target Restart – always restart the process if it is not running. RestartSec – restart the process a specified number of seconds (15 in the example above) after it fails. ExecStart – specifies the start command to execute ExecStop – specifies the stop command to execute Systemd – executes the command specified in ExecStart and monitors the entire process tree that remains. Type=forking – specifies that the command specified in ExecStart executes, launches a background process, and then exits. This process determines whether the service has failed and needs to be restarted WantedBy – specifies at what point in the Linux boot process to start this service Once the unit file is in the required location, execute the following command to get systemd to pick-up the new service definition. You must re-run this command any time you edit any unit file. systemctl daemon-reload The following are standard system commands available to start and stop services: systemctl status <servicename> Display the current status of the service systemctl start <servicename> Start the service manually systemctl stop <servicename> Stop the service manually systemctl enable <servicename> Configure the service to auto-start when Linux boots systemctl disable <servicename> Configure the service to no longer auto-start when Linux boots Below is the unit file for SAP Streaming Lite used by IoT edge services. Name the file dep_streaminglite.service and place it in /lib/systemd/system. [Unit] Description=dep_streaminglite BindsTo=dep_sqlany.service After=dep_sqlany.service [Service] Type=forking ExecStart=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh start StreamingLite' ExecStop=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh stop StreamingLite' Restart=always RestartSec=15 [Install] WantedBy=multi-user.target 9 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC The After parameter specifies that the specified service, dep_streaminglite in this case, should be started after the "dep_sqlany" service has started. The BindsTo service specifies that if the dep_sqlany service stops, then the dep_streaminglite service should also be stopped. The After and BindsTo parameters depend on the dep_sqlany service. All the commands specified for dep_sqlany also apply to the After service. Below is the unit file for Node.js used by IoT edge services. Name the file dep_nodejs.service, and place it in the /lib/systemd/system directory. [Unit] Description=dep_nodejs [Service] Type=forking ExecStart=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh start NodeJS' ExecStop=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh stop NodeJS' Restart=always RestartSec=15 [Install] WantedBy=multi-user.target Below is the unit file for IoT Adapter. Name the file dep_IoTadapter.service and place it in /lib/systemd/system. If you are planning on using MQTT for ingesting data and are running a MQTT broker such as Mosquito on the same Linux instance, you can also add a dependency on the MQTT broker service in this unit file. [Unit] Description=dep_IoTadapter BindsTo=dep_sqlany.service BindsTo=dep_streaminglite.service BindsTo=dep_nodejs.service After=dep_sqlany.service After=dep_streaminglite.service After=dep_nodejs.service [Service] Type=forking ExecStart=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh start IoTAdapter' ExecStop=/bin/bash -c 'cd /opt/dep_iot_edge/startScripts && ./dep.sh stop IoTAdapter' Restart=always RestartSec=15 [Install] WantedBy=multi-user.target CUSTOMIZING SSL CONFIGURATION The IoT edge services setup (setup.sh) generates self-signed SSL certificates for use by: Node.js web server for HTTPS HttpProtocolPlugin to enable HTTPS and WSS This section describes how you can replace the following self-signed certificates, if you want: Node.js Private Key: ${DEP_INSTALL_DIRECTORY}/node/key.pem Node.js Public Certificate: ${DEP_INSTALL_DIRECTORY}/node/cert.pem HttpProtocolPlugin Java keystore: ${DEP_INSTALL_DIRECTORY}/store/HttpProtocolPluginKeyStore.jks 10 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC By default, the IoT edge services setup (setup.sh) uses OpenSSL to generate a 2048-bit RSA private key that is encrypted with triple DES. It then generates an x509 certificate with a validity period of 10,000 days signed by the private key. The key and certificate are then combined into a PKCS #12 file that is imported into the HttpProtocolPluginKeyStore.jks under the alias httpprotocolplugin. Once imported, the PKCS #12 file is deleted. The key.pem and cert.pem files are used by the IoT edge services Node.js web server for HTTPS. The HttpProtocolPlugin Java keystore is used by the HttpProtocolPlugin to enable HTTPS and WSS. If the certificate being placed in this keystore is not a trusted certificate (for example, if it is self-signed), then it should be the same as the one used by Node.js, so that the WebSocket communication used by the emulated device on the real-time sensor monitoring page works without requiring you to go to the web server hosted by HttpProtocolPlugin and manually accepting the untrusted certificate in the browser. If the certificate is trusted by the browser, it can be a different key and certificate than the one used by Node.js. The keytool used by IoT edge services is in /opt/sqlanywhere17/bin64/jre180/bin/keytool, and the cacerts file is in /opt/sqlanywhere17/bin64/jre180/lib/security/cacerts. Note: To connect to a secured enterprise endpoint using RESTEnterprisePlugin or WebSocketEnterprisePlugin and default configuration, the required certificates must be put into this cacerts keystore. To add a certificate to the cacerts keystore, use the following command: /opt/sqlanywhere17/bin64/jre180/bin/keytool -import -alias $certificate_alias keystore /opt/sqlanywhere17/bin64/jre180/lib/security/cacerts -file $your_certificate_file To generate the private key with OpenSSL, use the following command: openssl genrsa -des3 -passout pass:$your_password -out server.enc.key 2048 To generate a certificate signing request with OpenSSL, use the following command: openssl req -subj '/C=CA/ST=Ontario/L=Waterloo/CN=dep.sap.com' -new -key server.enc.key -passin pass:$your_password -out server.csr To generate a .pem private key file without password protection using OpenSSL, use the following command: openssl rsa -in server.enc.key -passin pass:$your_password -out $private_key_filename To generate the x509 certificate file using OpenSSL, use the following command: openssl x509 -req -days 10000 -in server.csr -signkey key.pem -out $certificate_filename To generate a PKCS12 file from a certificate and private key using OpenSSL, use the following command: openssl pkcs12 -inkey $private_key_filename -in $certificate_filename -export -out $pkcs12_filename -passout pass: $pkcs12_password To import the PKCS12 file into the keystore, use the following command: sudo keytool -importkeystore -srcalias "1" -srckeystore $pkcs12_filename srcstorepass $pkcs12_password -srcstoretype PKCS12 -destalias "httpprotocolplugin" -destkeystore $javakeystore_file -deststorepass $javakeystore_password -noprompt CONNECTING TO THE SAP DYNAMIC EDGE PROCESSING DATABASE The IoT edge services database uses the following authorized database users: DEP_Admin – DBA database user DEP_Web – database user for Node.js DEP_Streaming – database user for Streaming Lite These authorized database users all have randomly generated passwords created by the IoT edge services setup program. The IoT edge services setup program also creates ODBC DSNs for each of these database users: DEP_IOT_ADMIN – for DEP_Admin 11 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC DEP_IOT_WEB – for DEP_Web DEP_IOT_STREAMING – for DEP_Streaming Note: The SQL Anywhere dbdsn utility obfuscates the database user’s password inside the DSN. To run SQL statements against the SAP Dynamic Edge Processing database from the Linux host, open a command prompt and complete the following: Source the SQL Anywhere sa_config.sh file source /opt/sqlanywhere17/bin64/sa_config.sh Execute the desired SQL as follows: dbisql -c "DSN=DEP_IOT_ADMIN" "<SQL Statement>" For example: dbisql -c "DSN=DEP_IOT_ADMIN" "SELECT * FROM DEP_Admin.NODE_SETTING" Note: To connect to the database from a different computer, a dedicated database user must be created where the password is known. For more information, see the SQL Anywhere documentation for the GRANT command. LOG FILE CONFIGURATION All IoT edge services log files are stored in /opt/dep_iot_edge/log/ The following is a summary of the log files generated by IoT edge services. File Name Description HttpProtocolPlugin.log Logging for the HTTP plugin. IoTAdapter.log Logging for the main IoT edge services process – IoTAdapter. misc_rootLogger.log This is the log4j root log file. MQTTPlugin.log Logging for the MQTT Protocol plugin. nodejs.log The Node.js log file – stout and sterr are redirected to this file. RESTEnterprisePlugin.log Logging for the REST Enterprise plugin. StreamingLite.log The Streaming Lite log file – stout and sterr are redirected to this file. StreamingLitePlugin.log Logging for the Streaming Lite Engine plugin. WebSocketEnterprisePlugin.log Logging for the Web Socket Enterprise plugin. All files except nodejs.log and StreamingLite.log roll over when they reach a size of 5MB. When a file has rolled over five times, the oldest file begins to be overwritten. The configuration of the logging level is stored in the IoT edge services database. See System-Wide Configuration for instructions about changing the global logging level. Additionally, each plugin can have its own log level that overrides the global value for that plugin. See the appropriate plugin Configuration section for instructions about changing a protocol or enterprise plugin log level. SYSTEM-WIDE CONFIGURATION The IoT Edge Console does not include any screens for viewing system-wide configuration. All system-wide configuration must be performed at the Linux command line using the dbisql command line interface. These properties apply system-wide to the Java portion of IoT edge services and are stored in IoT edge services in the Node Configuration Table. Settings for Node Configuration Table (NODE_SETTING) Setting Name Description <CONFIG_NAME> log.level Controls the default verbosity of logging. This setting also controls the verbosity of IoTAdapter. Each plugin may opt to allow individual overriding of this, if desired. Sample Value <CONFIG_VALUE> INFO 12 IOT EDGE SERVICES – CONFIGURATION GUIDE reconnect.interval.minutes Available log levels, from most to least logging: - TRACE - DEBUG - INFO - WARN - ERROR - FATAL - OFF Frequency, in minutes, at which plugin connection status and reconnection attempts will are made. Attempts to reconnect are initiated only if a plugin reports itself as being disconnected. PUBLIC 3 To view the current configuration, run the following command via dbisql: SELECT * FROM DEP_Admin.v_node_setting To update the current configuration, run the following command via dbisql: CALL DEP_Admin.sp_UpsertNodeSetting (<CONFIG_NAME>, <CONFIG_VALUE>, 1) To delete a configuration item, run the following command via dbisql: CALL DEP_Admin.sp_DeleteNodeSetting (<CONFIG_NAME>) ENGINE PLUGIN CONFIGURATION The IoT Edge Console does not include plugin configuration. You must perform all plugin configuration at the Linux command line using the dbisql command line interface. The Streaming Lite Engine plugin is enabled on a deployed SAP Dynamic Edge Processing instance. This is the only engine plugin supported by SAP Dynamic Edge Processing. Each engine plugin supports a unique set of properties, and these properties are stored in IoT edge services in the Engine Plugin Configuration Table. Settings for Engine Plugin Configuration Table (LOCAL_PLUGIN_CONFIGURATION) Plugin Setting Name Description Sample Value <CONFIG_NAME> <CONFIG_VALU E> Streaming LOGGER_LEVEL Controls the verbosity of logging within INFO LitePlugin plugin. Available log levels from most to least logging: - TRACE - DEBUG - INFO - WARN - ERROR - FATAL - OFF PUBLISHING_CORE_PO The number of threads to always have 1 OL_SIZE running for the purposes of publishing sensor readings. PUBLISHING_MAX_POO The maximum number of threads that can 10 L_SIZE be running for the purposes of publishing sensor readings. 13 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLISHING_POOL_KEE P_ALIVE_TIME_SECOND S PUBLISHING_WORK_QU EUE_FAIRNESS PUBLISHING_WORK_QU EUE_CAPACITY PUBLISHING_PUBLISHE R_POOL_SIZE The number of seconds to keep alive any threads exceeding PUBLISHING_CORE_POOL_SIZE if the thread has no publishing queue item to handle. If true, sensor readings are published in a first in, first out order. If false, ordering is not guaranteed. The maximum number of outstanding sensor readings that may be queued up at any one time. If this capacity is reached, any further sensor readings are dropped. The number of publisher connections to have open with Streaming Lite. Each publisher can be used by only one publishing thread at a time. PUBLIC 10 true 256 10 To view or update the Engine plugin configuration, see Protocol Plugin Configuration. PROTOCOL PLUGIN CONFIGURATION The IoT Edge Console does not include plugin configuration. You must perform all plugin configuration at the Linux command line using the dbisql command line interface. Initially, only the HTTP Protocol plugin is enabled on a deployed SAP Dynamic Edge Processing instance. No other protocol plugins are enabled. The following Protocol plugin types are supported by IoT edge services: HTTP: supports REST inbound and WebSocket Server (bi-directional) MQTT Custom (created following the instructions in the Developer Guide) Each Protocol plugin supports a unique set of properties, and these properties are stored in IoT edge services in the Protocol Plugin Configuration Table. Note: To obfuscate password properties that can optionally be obfuscated using Jetty, run the command java -cp jetty-all-9.2.17.v20160517.jar org.eclipse.jetty.util.security.Password $password from the IoT edge services java_lib directory, replacing $password with the desired password. The obfuscated version of the password produced by the command can be identified by the OBF: prefix. When using the obfuscated password, you must include the OBF: prefix. Settings for Protocol Plugin Configuration Table (LOCAL_PLUGIN_CONFIGURATION) Plugin Setting Name Description Sample Value <CONFIG_NAME> <CONFIG_VALUE> HTTP EXCLUDE_CIPHER_SUI List of Cipher Suites that are ignored SSL_RSA_WITH_DES_CBC TES when selecting the SSL certificate. _SHA,SSL_DHE_RSA_WITH (optional) _DES_CBC_SHA,SSL_DHE _DSS_WITH_DES_CBC_SH A HOST Network address on which the HTTP 0.0.0.0 (optional) server listens; enter 0.0.0.0 (the default value) for it to listen on all network addresses on the machine. KEY_STORE_ The password for the configured OBF:1umm1y851z0f1sw61so AUTHENTICATION keystore. May optionally be x1vno1z0f1vne1sot1svs1z0f1 (required) obfuscated using Jetty. y7t1uvk KEY_STORE_IN_SECU If true, the plugin prepends the path true RE_CONFIG_DIRECTO of the secure configuration directory RY to the configured 14 IOT EDGE SERVICES – CONFIGURATION GUIDE (required) KEY_STORE_PATH (required) LOGGER_LEVEL (required) PORT (optional) SECURE_HOST (optional) SECURE_PORT (optional) CERT_ALIAS (optional) TRUST_STORE_PATH (optional) TRUST_STORE_ AUTHENTICATION (optional) KEY_MANAGER_ AUTHENTICATION (optional) KEY_STORE_PATH. If false, the plugin uses the raw value for the KEY_STORE_PATH setting for the path. The path for the Java keystore. Value can be the file name or the path, depending on the value of KEY_STORE_IN_SECURE_CONFI G_DIRECTORY Controls the verbosity of logging within plugin. Available log levels from most to least logging: - TRACE - DEBUG - INFO - WARN - ERROR - FATAL - OFF Port on which the web server listens for HTTP. Defaults to 6474 Network address to which the HTTPS server listens. If not supplied, then HOST property is used. Port on which the web server listens for HTTPS. Defaults to 6443 Key for selecting which certificate to use from the keystore. If not provided, an attempt is made to find the best matching certificate and key in the keystore. Keystores use lowercase aliases; therefore, this value must also be lowercase. The path for the Java keystore to use as the truststore. This value must be the full path to the file. If not provided, the configured keystore (KEY_STORE_PATH) is also used as the truststore. The password for the configured truststore. May optionally be obfuscated using Jetty. The password for the configured CERT_ALIAS or best matching certificate and key in the keystore. This is the password set using the keypass flag when imported using keytool. If not set, KEY_STORE_ AUTHENTICATION is used. As a result, the keypass must either be the same as the password or no keypass must be set. PUBLIC HttpProtocolPluginKeyS tore.jks or /opt/dep_iot_edge/stor e/CustomKeyStore.jks INFO 6474 0.0.0.0 6443 httpprotocolplugin /opt/dep_iot_edge/stor e/CustomTrustStore.jks OBF:1umm1y851z0f1sw61so x1vno1z0f1vne1sot1svs1z0f1 y7t1uvk OBF:1umm1y851z0f1sw61so x1vno1z0f1vne1sot1svs1z0f1 y7t1uvk 15 IOT EDGE SERVICES – CONFIGURATION GUIDE MQTT SECURE_ONLY (optional) CLEAN_SESSION_ON_ RECONNECT (optional) PERSISTENCE_METHO D (required, when CLEAN_SESSION_ON_ RECONNECT is false) PERSISTENCE_DIRECT ORY_PATH (required, when PERSISTENCE_METHO D is file) HOST (required) LOGGER_LEVEL (required) PUBLISHING_TOPIC (required) QOS (optional) RECONNECT_ATTEMP T_INTERVAL (optional) May optionally be obfuscated using Jetty. Flag to indicate HTTP and HTTPS or HTTPS only. Defaults to false. Flag for whether the MQTT client should be run with or without maintaining state information when a new session is started. If not supplied, defaults to true. Determines how to store state information across sessions. Used when CLEAN_SESSION_ON_RECONNE CT is set to false. Options are: - memory - file If set to file, then the PERSISTENCE_DIRECTORY_PAT H is required. The full path to where state information is saved. PUBLIC false true memory /opt/dep_iot_edge/tmp MQTT server address tcp://localhost:1883 Controls the verbosity of logging within plugin. Available log levels from most to least logging: - TRACE - DEBUG - INFO - WARN - ERROR - FATAL - OFF The topic to which the MQTT plugin publishes. Field messages routed to MQTTPlugin go out over this topic. Quality of service level set for publishing a topic. If not supplied, defaults to 0. - 0 - At most once - 1 - At least once - 2 - Exactly once Refer to: http://www.hivemq.com/blog/mqttessentials-part-6-mqtt-quality-ofservice-levels Interval, in milliseconds, to wait until next reconnection attempt by MQTT client. If not supplied, defaults to 10000. INFO depEvent 0 3000 16 IOT EDGE SERVICES – CONFIGURATION GUIDE RECONNECT_ATTEMP T_LIMIT (optional) SUBSCRIBING_TOPIC (required) USER (required) PUBLIC Maximum number of times the MQTT client attempts to reconnect. Once the maximum number of tries is reached, no more attempts are made. If not supplied, defaults to 0, meaning it does not try to reconnect. Topic to which the MQTT client subscribes. Sensor reading input should come in over this topic. Unique identifier that MQTT client uses to connect to broker. 10 depMessage com.sap.dep.protocolplugin. mqtt.MQTTPlugin Configuring a Protocol Plugin The HTTP and MQTT protocol plugins are already provisioned in IoT edge services; however, you must provision any additional Custom Protocol plugins. To view the current list of provisioned Protocol plugins, and to retrieve the LOCAL_PLUGIN_ID values, run the following command via dbisql: SELECT * FROM DEP_Admin.v_local_plugin To add a Custom Protocol plugin to IoT edge services, run the following command via dbisql: CALL DEP_Admin.sp_UpsertLocalPlugin (<LOCAL_PLUGIN_ID>, <PLUGIN_NAME>, <ISFIELD-PLUGIN>) Parameter <LOCAL_PL UGIN_ID> Type Varchar(128) <PLUGIN_N AME> <ISFIELDPLUGIN> Varchar(128) Bit Description ID of plugin, canonical name of the class that implements IProtocolPlugin Name of plugin Example com.sap.dep.protocolplugin.mqtt.MQTTP lugin Whether plugin supports field messages that are sent to it - MQTTPlugin 1 - can handle Field Message output. 0 - cannot handle field message output. To delete a Custom Protocol plugin from IoT edge services, run the following command via dbisql. Deleting a plugin automatically deletes all associated configuration and routing. CALL DEP_Admin.sp_DeleteLocalPlugin (<LOCAL_PLUGIN_ID>) 1. View and update current configuration for the Protocol plugin. To view the current configuration of all Protocol plugins, run the following command via dbisql: SELECT * FROM DEP_Admin.v_local_plugin_configuration To view the current configuration of a specific Protocol plugin, run the following command via dbisql: SELECT * FROM DEP_Admin.v_local_plugin_configuration WHERE LOCAL_PLUGIN_ID = <LOCAL_PLUGIN_ID> To update the current configuration of a specific Protocol plugin, run the following command via dbisql: CALL DEP_Admin.sp_UpsertLocalPluginConfig (<LOCAL_PLUGIN_ID>, <CONFIG_NAME>, <CONFIG_VALUE>) Parameter Type Description Example 17 IOT EDGE SERVICES – CONFIGURATION GUIDE <LOCALPLUGIN-ID> <CONFIGNAME> <CONFIGVALUE> Varchar (128) Varchar (128) Long Varchar ID of plugin PUBLIC Name of property com.sap.dep.protocolplugin.mqtt.M QTTPlugin LOGGERLEVEL Value of property DEBUG For example, to change the logging level of the HTTP plugin to WARN, use the following command: CALL DEP_Admin.sp_ UpsertLocalPluginConfig (com.sap.dep.protocolplugin.http.HttpProtocolPlugin, loggerLevel, WARN) To delete the configuration of a specific Protocol plugin, run the following command via dbisql: CALL DEP_Admin.sp_DeleteLocalPluginConfig (<LOCAL_PLUGIN_ID>, <CONFIG_NAME>) Protocol plugin routing controls the routing of incoming messages. Each Protocol plugin must contain a routing entry to the Streaming Lite plugin com.sap.dep.engineplugin.sl.StreamingLitePlugin. There must also be a routing entry from the Streaming Lite plugin to the Protocol plugin. To view the routing of a Protocol plugin, run the following command via dbisql: SELECT * FROM DEP_Admin.v_local_plugin_routing To add the routing of a Protocol plugin, run the following command via dbisql: CALL DEP_Admin.sp_AddLocalPluginRouting (<SENDING_PLUGIN_ID>, <TARGET_PLUGIN_ID>) Parameter <SENDINGPLUGIN-ID> <TARGETPLUGIN-ID> Type Varchar (128) Varchar (128) Description ID of sending plugin ID of target plugin Example com.sap.dep.protocolplugin.mqtt.MQTTP lugin com.sap.dep.engineplugin.sl.StreamingL itePlugin For example, to set the MQTT plugin to Streaming Lite (and vice versa, respectively), use the following commands: CALL DEP_Admin.sp_AddLocalPluginRouting (com.sap.dep.protocolplugin.mqtt.MQTTPlugin, com.sap.dep.engineplugin.sl.StreamingLitePlugin) CALL DEP_Admin.sp_AddLocalPluginRouting (com.sap.dep.engineplugin.sl.StreamingLitePlugin, com.sap.dep.protocolplugin.mqtt.MQTTPlugin) To delete the routing of a Protocol plugin, run the following command via dbisql: CALL DEP_Admin.sp_DeleteLocalPluginRouting (<SENDING_PLUGIN_ID>, <TARGET_PLUGIN_ID>) 2. Restart the SAP Dynamic Edge Processing services for the updates to the Protocol plugin configuration to take effect. Sending Data to a Protocol Plugin Both the HTTP and MQTT Protocol plugins use the following schema for input values: JSON Key Description JSON Value 18 IOT EDGE SERVICES – CONFIGURATION GUIDE deviceId (required) deviceTag (optional) timestamp (optional) readings (required) context (optional) sensorId (optional) sensorTag (optional) sensorProfileId (optional*) sensorProfileName (optional*) readingValue (required) timestamp (optional) The device ID of the sensor reading. Used for rule evaluation. Value is not validated by SAP Dynamic Edge Processing. The device tag of the sensor reading. Arbitrarily groups devices for rule scoping/filtering. Value is not validated by SAP Dynamic Edge Processing. The “device-level” timestamp of the readings, in an ISO 8601 formatted string. If “device-level” timestamp is not provided, the current SAP Dynamic Edge Processing host time is used when the reading is received. An array of sensor readings. A minimum of one sensor reading is required. Free-form text that is passed to custom rules for processing. The unique ID of the sensor. Used for rule evaluation. Value is not validated by SAP Dynamic Edge Processing. The sensor tag of the sensor reading. Arbitrarily groups sensors for rule scoping/filtering. Value is not validated by SAP Dynamic Edge Processing. The ID (in SAP Dynamic Edge Processing) of the sensor profile. Must match an enabled, configured sensor profile in SAP Dynamic Edge Processing. Either sensorProfileId or sensorProfileName is required. The name (in SAP Dynamic Edge Processing) of the sensor profile. Must match an enabled, configured sensor profile in SAP Dynamic Edge Processing. Either sensorProfileId or sensorProfileName is required. The sensor reading value. Can be integer or float for numeric sensors, or can be text values for stateful sensors. The timestamp of the reading, in an ISO 8601 formatted string. If provided, this value overrides the “device-level” timestamp value provided at the device level. PUBLIC Machine901 RooftopAirConditioner 2016-10-11T14:48:33.627Z 42 TEMP1001X1 OutsideTempSensor c0697ecc-8f6d-11e6-8000c42095598621 TMP36 85.9 2016-10-11T14:48:33.627Z The following command is an example of a valid JSON input string: {"deviceId":"Machine901","deviceTag":"OutsideTemperature","timestamp":"2016-10- 19 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC 11T14:48:33.627Z","readings":[{"context":"42","sensorId":"TEMP1001X1","sensorTag":" ","sensorProfileId":"c0697ecc-8f6d-11e6-8000-c42095598621","readingValue":85.9}]} Field Message Action to a Protocol Plugin Both the HTTP and MQTT Protocol plugins handle the field message action. The MQTT Protocol plugin sends a message to the configured topic, and the HTTP Protocol plugin sends a message to all currently connected WebSocket clients. Both plugins send the same schema for field message actions: JSON Key Description JSON Value deviceId The device ID of the sensor Machine901 reading. deviceTag The device tag of the sensor RooftopAirConditioner (nullable) reading that triggered the event. sensorProfileId In SAP Dynamic Edge Processing, c0697ecc-8f6d-11e6-8000the ID of the sensor profile. c42095598621 sensorProfileName In SAP Dynamic Edge Processing, TMP36 the name of the sensor profile. sensorId The unique ID of the sensor that TEMP1001X1 (nullable) triggered the event. sensorTag The sensor tag of the sensor OutsideTempSensor (nullable) reading that triggered the event. Timestamp The timestamp for when the event 2016-10-11T14:48:33.627Z was generated. sourceRuleId The ID of the rule that generated cdda5a2c-8f6d-11e6-8000this event. The rule ID is generated c42095598621 by SAP Dynamic Edge Processing when the rule is created. sourceRuleName The name of the rule that Temp Too High generated this event. The rule name is entered in SAP Dynamic Edge Processing when the rule is created. Instruction Free-form text entry that is Temp too high – urgent service required configured in the Action Configuration screen. parameters An array of parameters that are "sampleParam1":"somevalue","samplePa configured in the Action ram2":"somevalue2" Configuration screen. The following command is an example of a valid JSON message string: {"deviceId":"Machine901","deviceTag":"RooftopAirConditioner","sensorProfileId":"c06 97ecc-8f6d-11e6-8000c42095598621","sensorProfileName":"TMP36","sensorId":"","sensorTag":"","timestamp": "2016-10-11T11:17:12.909-04:00","sourceRuleId":"cdda5a2c-8f6d-11e6-8000c42095598621","sourceRuleName": "Temp Too High","instruction":"Temp too high – urgent service required","parameters":{"sampleParam1":"somevalue","sampleParam2":"somevalue2"}} Enterprise Plugin Configuration The IoT Edge Console does not include plugin configuration. You must perform all plugin configuration at the Linux command line using the dbisql command line interface. Initially, there are no configured enterprise plugins for a deployed SAP Dynamic Edge Processing instance. The following Enterprise plugin types are supported by IoT edge services: RESTPlugin: outbound WebsocketPlugin (Client): outbound to WebSocket server Custom (created by following the instructions in the Developer Guide) 20 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC Every configured Enterprise plugin must be listed in the Enterprise Plugin Table. There is no limit on the number of Enterprise plugins of a certain type. For example, you can configure multiple REST Enterprise plugins to send data to different enterprise REST endpoints. The configuration of an Enterprise plugin is contained in both the Enterprise Plugin Table and the Enterprise Plugin Configuration Table. Note: To obfuscate password properties that can optionally be obfuscated, run the command java -cp jetty-all-9.2.17.v20160517.jar org.eclipse.jetty.util.security.Password $password from the IoT edge services java_lib directory and replace $password with the desired password. The obfuscated version of the password produced by the command can be identified by the OBF: prefix. When using the obfuscated password, you must include the OBF: prefix. Enterprise Plugin Table (ENTERPRISE_PLUGIN) This table contains one row for each configured Enterprise plugin. Setting Name Description ENTERPRISE_PLUGIN_I Unique name of plugin: used in the Admin D UI. (required) PLUGIN_CLASS The plugin type to use: either for REST (required) communication or for WebSocket communication. Sample Value RESTPluginToHana1 com.sap.dep.enterpriseplugin.r est.RESTEnterprisePlugin OR DESCRIPTION (required) PROCESS_IN_ORDER (required) Description of the plugin. THREADS (required) The number of threads to use when processing enterprise events for this plugin. The maximum number of attempts to handle each enterprise event. When the maximum number has been reached, no more attempts are made. This retry count is unique to each event that occurs. The delay, in seconds, between each attempt to handle an enterprise event. Whether an error message is logged when a message failure occurs. - 0 (false) – no message logged. - 1 (true) – error messages are logged. RETRY_COUNT (required) RETRY_DELAY (required) LOG_MESSAGE_ON_FA IL (required) This field ensures that the Enterprise Events are processed in order. The options for this value are: - 0 (false) – events are processed by the number of threads that have been set. - 1 (true) – only 1 thread is used, regardless of the value specified in the THREADS setting com.sap.dep.enterpriseplugin. WebSocket.WebSocketEnterp risePlugin REST plugin configured to send to Hana1 server 0 1 5 5 1 Enterprise Plugin Configuration Table (ENTERPRISE_PLUGIN_CONFIGURATION) This table contains one row for each configured Enterprise plugin setting. Plugin Setting Name Description Sample Value 21 IOT EDGE SERVICES – CONFIGURATION GUIDE RESTPlugin <CONFIG_NAME> ENTERPRISE_EVENT_ URI (required*) ENTERPRISE_TEMPLA TE (optional) ENTERPRISE_EVENT_ PROXY_HOST (optional) ENTERPRISE_EVENT_ PROXY_PORT (optional) ENTERPRISE_EVENT_ CONTENT_TYPE (optional) ENTERPRISE_EVENT_ AUTH_TYPE (optional) ENTERPRISE_EVENT_ USERNAME (optional) ENTERPRISE_EVENT_ AUTHENTICATION (optional) ENTERPRISE_EVENT_ BASIC_AUTH_REALM (optional) ENTERPRISE_EVENT_ OAUTH_TOKEN (optional) URI for sending events to the Enterprise plugin. The template for the payload to send to the server. The host portion of the proxy to use for enterprise event output. A proxy port must also be provided. The port portion of the proxy to use for enterprise event output. A proxy host must also be provided. The value to use for the ContentType header on requests. Defaults to application/json The type of authorization to use for requests. - Basic – ENTERPRISE_EVENT_U SERNAME, ENTERPRISE_EVENT_ AUTHENTICATION, and ENTERPRISE_EVENT_B ASIC_AUTH_REALM are required. - oAuth – ENTERPRISE_EVENT_O AUTH_TOKEN is required. If this setting isn’t configured, no authentication mechanism is configured. The user name to use for BASIC authentication challenges. PUBLIC <CONFIG_VALUE> https://hana.ondemand. com/... For both the RESTPlugin and the WebSocketPlugin, you must specify either the ENTERPRISE_EVENT_ URI or the FIDELITY_URI, or both. If neither is specified, the plugin instance doesn’t start. hana.ondemand.com 80 application/json basic dep_IoT The password to use for BASIC authentication challenges. password The realm to use for BASIC authentication challenges. example_realm The bearer token to set as the value for the authentication header. Automatically prefixed with “Bearer “. a73b15c7d42f272e6212 c7010b438317ae198b4 a 22 IOT EDGE SERVICES – CONFIGURATION GUIDE ENTERPRISE_EVENT_ KEY_STORE_IN_SECU RE_CONFIG_DIRECTO RY (optional) ENTERPRISE_EVENT_ KEY_STORE_PATH (optional) ENTERPRISE_EVENT_ KEY_STORE_ AUTHENTICATION (optional) ENTERPRISE_EVENT_ TRUST_STORE_PATH (optional) ENTERPRISE_EVENT_ TRUST_STORE_ AUTHENTICATION (optional) ENTERPRISE_EVENT_ EXCLUDE_CIPHER_SUI TES (optional) ENTERPRISE_EVENT_ KEY_MANAGER_ AUTHENTICATION (optional) ENTERPRISE_EVENT_ CERT_ALIAS (optional) - PUBLIC True - the plugin prepends the path of the secure configuration directory to the configured KEY_STORE_PATH. - False - the plugin uses the raw value of the KEY_STORE_PATH setting for the path. The path for the Java keystore. Value can be the file name or the path, depending on the value of ENTERPRISE_EVENT_KEY_ST ORE_IN_SECURE_CONFIG_DIR ECTORY. Defaults to $JAVA_HOME/lib/secure/cacerts The password for the configured keystore. May optionally be obfuscated using Jetty. true The path for the Java keystore to use as the truststore. Value must be the full path to the file. If not provided, the configured keystore (ENTERPRISE_EVENT_KEY_ST ORE_PATH) is also used as the truststore. The password for the configured truststore. May optionally be obfuscated using Jetty. /opt/dep_iot_edge/ store/CustomTrustS tore.jks List of Cipher Suites that are ignored when selecting the SSL certificate. SSL_RSA_WITH_DES_ CBC_SHA,SSL_DHE_R SA_WITH_DES_CBC_ SHA,SSL_DHE_DSS_ WITH_DES_CBC_SHA OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk The password for the configured ENTERPRISE_EVENT_CERT_AL IAS or best matching certificate and key in the keystore. This is the password set using the keypass flag when imported using keytool. If not set, ENTERPRISE_EVENTKEY_STO RE_ AUTHENTICATION is used. As a result, the keypass must either be the same or no keypass must be set. May optionally be obfuscated using Jetty. Key for selecting which certificate to use from the keystore. If not provided, an attempt is made to find the best matching certificate RESTEnterprisePlug in.jks or /opt/dep_iot_edge/ store/CustomKeySto re.jks OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk restpluginenterpriseeve nt 23 IOT EDGE SERVICES – CONFIGURATION GUIDE FIDELITY_URI (required*) FIDELITY_TEMPLATE (optional) FIDELITY_PROXY_HOS T (optional) FIDELITY_PROXY_POR T (optional) FIDELITY_CONTENT_T YPE (optional) FIDELITY_AUTH_TYPE (optional) FIDELITY_USERNAME (optional) FIDELITY_ AUTHENTICATION (optional) FIDELITY_BASIC_AUTH _REALM (optional) FIDELITY_OAUTH_TOK EN (optional) in the keystore. Keystores use lowercase aliases; therefore, this value must also be lowercase. URI for sensor readings that are created by a sensor fidelity rule as configured in the IoT Edge Console. The template for the payload to send to the server. The host portion of the proxy to use for fidelity reading output. A proxy port must also be provided. The port portion of the proxy to use for fidelity reading output. A proxy host must also be provided. The value to use for the ContentType header on requests. Defaults to application/json The type of authorization to use for requests. Options are: - Basic – FIDELITY_USERNAME, FIDELITY_ AUTHENTICATION, and FIDELITY_BASIC_AUTH _REALM are required. - oAuth – FIDELITY_OAUTH_TOKE N is required. If this setting isn’t configured, no authentication mechanism will be configured. The user name to use for BASIC authentication challenges. The password to use for BASIC authentication challenges. PUBLIC https://hana.ondemand. com/... For both the RESTPlugin and the WebSocketPlugin, you must specify either the ENTERPRISE_EVENT_ URI or the FIDELITY_URI, or both. If neither is specified, the plugin instance doesn’t start. hana.ondemand.com 80 application/json Basic dep_IoT Password The realm to use for BASIC authentication challenges. example_realm The bearer token to set as the value for the authentication header. Automatically prefixed with “Bearer “. a73b15c7d42f272e6212 c7010b438317ae198b4 a 24 IOT EDGE SERVICES – CONFIGURATION GUIDE FIDELITY_KEY_STORE _IN_SECURE_CONFIG_ DIRECTORY (optional) FIDELITY_KEY_STORE _PATH (optional) FIDELITY_KEY_STORE _ AUTHENTICATION (optional) FIDELITY_TRUST_STO RE_PATH (optional) FIDELITY_TRUST_STO RE_ AUTHENTICATION (optional) FIDELITY_EXCLUDE_CI PHER_SUITES (optional) FIDELITY_KEY_MANAG ER_ AUTHENTICATION (optional) FIDELITY_CERT_ALIAS (optional) WebSocketP lugin ENTERPRISE_EVENT_ URI - True - the plugin prepends the path of the secure configuration directory to the configured KEY_STORE_PATH. - False - the plugin uses the raw value of the KEY_STORE_PATH setting for the path. The path for the Java keystore. Value can be the file name or the path, depending on the value of FIDELITY_KEY_STORE_IN_SEC URE_CONFIG_DIRECTORY. Defaults to $JAVA_HOME/lib/secure/cacerts The password for the configured keystore. May optionally be obfuscated using Jetty. The path for the Java keystore to use as the truststore. Value must be the full path to the file. If not provided, the configured keystore (FIDELITY_KEY_STORE_PATH) is also used as the truststore. The password for the configured truststore. May optionally be obfuscated using Jetty. List of Cipher Suites that are ignored when selecting the SSL certificate, The password for the configured FIDELITY_CERT_ALIAS or best matching certificate and key in the keystore. This is the password set using the -keypass flag when imported using keytool. If not set, FIDELITY_KEY_STORE_ AUTHENTICATION is used. As a result, the keypass must either be the same or no keypass must be set. May optionally be obfuscated using Jetty. Key for selecting which certificate to use from the keystore. If not provided, an attempt is made to find the best matching certificate in the keystore. Keystores use lowercase aliases; therefore, this value must also be lowercase. URI for sending events to the enterprise. PUBLIC True RESTEnterprisePlug in.jks or /opt/dep_iot_edge/ store/CustomKeySto re.jks OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk /opt/dep_iot_edge/ store/CustomTrustS tore.jks OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk SSL_RSA_WITH_DES_ CBC_SHA,SSL_DHE_R SA_WITH_DES_CBC_ SHA,SSL_DHE_DSS_ WITH_DES_CBC_SHA OBF:1umm1y851z0f1s w61sox1vno1z0f1vne1s ot1svs1z0f1y7t1uvk Restpluginfidelity ws://localhost:1337 25 IOT EDGE SERVICES – CONFIGURATION GUIDE (required*) ENTERPRISE_TEMPLA TE (optional) ENTERPRISE_EVENT_ PROXY (optional) ENTERPRISE_EVENT_ AUTH_TYPE (optional) ENTERPRISE_EVENT_ USERNAME (optional) ENTERPRISE_EVENT_ AUTHENTICATION (optional) ENTERPRISE_EVENT_ OAUTH_TOKEN (optional) ENTERPRISE_EVENT_ CONTENT_TYPE (optional) FIDELITY_URI (required*) FIDELITY_TEMPLATE (optional) PUBLIC The template for the payload to send to the server. For both the RESTPlugin and the WebSocketPlugin, you must specify either the ENTERPRISE_EVENT_ URI or the FIDELITY_URI, or both. If neither is specified, the plugin instance doesn’t start. The full URL of the proxy to use for Enterprise event output. http://proxy.example.co m:8080 The type of authorization to use for requests. Options are: - Basic ENTERPRISE_EVENT_U SERNAME and ENTERPRISE_EVENT_ AUTHENTICATION are required. - oAuth ENTERPRISE_EVENT_O AUTH_TOKEN is required. Basic If this setting isn’t configured, no authentication mechanism will be configured. The user name to use for BASIC authentication challenges. dep_IoT The password to use for BASIC authentication challenges. Password The bearer token to set as the value for the authentication header. Automatically prefixed with “Bearer “. The value to use for the ContentType header on Enterprise event requests. Defaults to application/json URI for sending sensor readings to Enterprise specified by fidelity rule. The template for the payload to send to the server. a73b15c7d42f272e6212 c7010b438317ae198b4 a application/json ws://localhost:1337 For both the RESTPlugin and the WebSocketPlugin, you must specify either the ENTERPRISE_EVENT_ URI or the FIDELITY_URI, or both. 26 IOT EDGE SERVICES – CONFIGURATION GUIDE FIDELITY _PROXY (optional) FIDELITY _AUTH_TYPE (optional) FIDELITY _USERNAME (optional) FIDELITY _AUTHENTICATION (optional) FIDELITY _OAUTH_TOKEN (optional) FIDELITY_CONTENT_T YPE (optional) The full URL of the proxy to use for fidelity reading output. The type of authorization to use for requests. Options are: - Basic - FIDELITY _USERNAME and FIDELITY _ AUTHENTICATION are required. - oAuth - FIDELITY _OAUTH_TOKEN is required. If this setting isn’t configured, no authentication mechanism will be configured. The username to use for BASIC authentication challenges. The password to use for BASIC authentication challenges. The bearer token to set as the value for the Authentication header. Automatically prefixed with “Bearer “. The value to use for the ContentType header on fidelity reading requests. Defaults to application/json. PUBLIC If neither is specified, the plugin instance doesn’t start. http://proxy.example.co m:8080 basic dep_IoT password a73b15c7d42f272e6212 c7010b438317ae198b4 a application/json For both the RESTPlugin and the WebSocketPlugin, you must specify either the ENTERPRISE_EVENT_URI or the FIDELITY_URI, or both. If neither is specified, the plugin instance doesn’t start. ENTERPRISE_TEMPLATE The possible values for the Enterprise Template include the following: JSON Key Description JSON Value deviceId The device ID of the sensor Machine901 reading. deviceTag The device tag of the sensor RooftopAirConditioner (nullable) reading that triggered the event. sensorProfileId In SAP Dynamic Edge Processing, c0697ecc-8f6d-11e6-8000the ID of the sensor profile. c42095598621 sensorProfileName In SAP Dynamic Edge Processing, TMP36 the name of the sensor profile. sensorId The unique ID of the sensor that TEMP1001X1 (nullable) triggered the event. sensorTag The sensor tag of the sensor OutsideTempSensor (nullable) reading that triggered the event. sourceRuleType The type of rule that generated this event. 27 IOT EDGE SERVICES – CONFIGURATION GUIDE sourceRuleId sourceRuleName sensorInformation dateCreated objectType The ID of the rule that generated this event. The rule ID is generated by SAP Dynamic Edge Processing when the rule is created. The name of the rule that generated this event. Enter the rule name in SAP Dynamic Edge Processing when you create the rule. Contextual information based on the sensor data that generated the event. The content of the text is specific to the rule type. The timestamp of when the event was generated. Fixed value in SAP Dynamic Edge Processing. PUBLIC cdda5a2c-8f6d-11e6-8000c42095598621 Temp Too High Examples: Value Monitoring - the average sensor reading over the configured window. Timed State - the current state value. Watchdog - the time, in milliseconds, since last reading. Event Chaining - a string containing both rules. Custom - as configured by the custom rule. 2016-10-11T14:48:33.627Z EnterpriseEvent By default, the payload for Enterprise events contains all possible substitution values (for example, ${deviceId}) and is configured as follows: { "deviceId": "${deviceId}", "deviceTag": "${deviceTag}", "sensorProfileId": "${sensorProfileId}", "sensorProfileName": "${sensorProfileName}", "sensorId": "${sensorId}", "sensorTag": "${sensorTag}", "sourceRuleType": "${sourceRuleType}", "sourceRuleId": "${sourceRuleId}", "sourceRuleName": "${sourceRuleName}", "sensorInformation": "${sensorInformation}", "dateCreated": "${dateCreated}", "objectType": "EnterpriseEvent" } You can specify a different payload by setting the ENTERPRISE_PAYLOAD setting. At runtime, the configurable properties specified in the payload are substituted with the actual values in the Enterprise event. FIDELITY_TEMPLATE The possible values for the fidelity event template include the following: JSON Key Description JSON Value deviceId The device ID of the sensor Machine901 reading. deviceTag The device tag of the sensor RooftopAirConditioner (nullable) reading that triggered the event. sensorProfileId In SAP Dynamic Edge Processing, c0697ecc-8f6d-11e6-8000the ID of the sensor profile. c42095598621 sensorProfileName In SAP Dynamic Edge Processing, TMP36 the name of the sensor profile. sensorId The unique ID of the sensor that TEMP1001X1 (nullable) triggered the event. sensorTag The sensor tag of the sensor OutsideTempSensor (nullable) reading that triggered the event. sensorReadingValue The sensor reading value. 99.5 context The context of the sensor reading ReadingQuality=GOOD (nullable) that triggered the event. dateCreated The timestamp of when the event 2016-10-11T14:48:33.627Z was generated. 28 IOT EDGE SERVICES – CONFIGURATION GUIDE objectType PUBLIC The fixed value in SAP Dynamic Edge Processing. SensorFidelityEvent By default, the payload for fidelity events contains all possible substitution values (for example, ${deviceId}) and is configured as follows: { "deviceId": "${deviceId}", "deviceTag": "${deviceTag}", "sensorProfileId": "${sensorProfileId}", "sensorProfileName": "${sensorProfileName}", "sensorId": "${sensorId}", "sensorTag": "${sensorTag}", "sensorReadingValue": "${sensorReadingValue}", "context": "${context}", "dateCreated": "${dateCreated}", "objectType": "SensorFidelityEvent" } You can specify a different payload by setting the FIDELITY_PAYLOAD setting. At runtime, the configurable properties specified in the payload are substituted with the actual values in the fidelity event. Configuring an Enterprise Plugin 1. View and update the existing configured Enterprise plugin. To view the existing Enterprise plugin configuration, run the following command via dbisql: SELECT * FROM DEP_Admin.v_enterprise_plugin To configure an Enterprise plugin, run the following command via dbisql: CALL DEP_Admin.sp_UpsertEnterprisePlugin (<ENTERPRISE_PLUGIN_ID>, <PLUGIN_CLASS>, <DESCRIPTION>, <PROCESS_IN_ORDER>, <THREADS>, <RETRY_COUNT>, <RETRY_DELAY>, <LOG_MESSAGE_ON_FAIL>) To delete an Enterprise plugin, run the following command via dbisql: CALL DEP_Admin.sp_DeleteEnterprisePlugin (<ENTERPRISE_PLUGIN_ID>) 2. View and update the current configuration for the Enterprise plugin. To view the configuration of an Enterprise plugin, run the following command via dbisql: SELECT * FROM DEP_Admin.v_enterprise_plugin_configuration To configure an Enterprise plugin, run the following command via dbisql: CALL DEP_Admin.sp_UpsertEnterprisePluginConfig (<ENTERPRISE_PLUGIN_ID>, <CONFIG_NAME>, <CONFIG_VALUE>) Parameter <ENTERPRISEPLUGIN-ID> <CONFIG-NAME> <CONFIG-VALUE> Type Varchar(128) Example com.sap.dep.protocolplugin.mqtt.MQTTPlugin Varchar(128) Long Varchar LOGGERLEVEL DEBUG In order to delete the configuration of an Enterprise plugin, run the following via dbisql: CALL DEP_Admin.sp_DeleteEnterprisePluginConfig (<ENTERPRISE_PLUGIN_ID>, <CONFIG_NAME>) 3. (Optional) To connect to a secured enterprise endpoint using RESTEnterprisePlugin or WebSocketEnterprisePlugin, you must place the required certificates into the cacerts keystore. The keytool used by IoT edge services is in /opt/sqlanywhere17/bin64/jre180/bin/keytool, and the cacerts file is in /opt/sqlanywhere17/bin64/jre180/lib/security/cacerts. 29 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC 4. Restart SAP Dynamic Edge Processing services for the updates to the Enterprise plugin configuration to take effect. EDGE BUSINESS SERVICES ACTION CONFIGURATION To support the Create Work Order action, IoT edge services requires the configuration of the edge business services host. 1. Update the edge business services configuration file in /opt/dep_iot_edge/store/c2e_config.properties: c2ehostname: the name of the edge business services server (fully-qualified domain name). c2ePort: the port of the edge business services server. UserNamePwInBase64: the edge business services user and password in the following format (converted to Base64): username:password 2. Restart all SAP Dynamic Edge Processing services. TROUBLESHOOTING If you have problems using SAP Dynamic Edge Processing, start your troubleshooting process by checking the following items: Issue Solution Ensure JAVA_HOME is Ensure the JAVA_HOME environment variable is set correctly. set At a command line type: set JAVA_HOME Ensure Ensure the STREAMING_HOME environment variable is set correctly. STREAMING_HOME is At a command line type: set STREAMING_HOME /opt/streaminglite/install set Inspect java_libs folder Inspect the java_libs folder located at: /opt/dep_iot_edge/java_lib/ Check all SAP Dynamic Edge Processing components are running Check all SAP Dynamic Edge Processing logs Check Protocol plugin configuration Check Enterprise plugin configuration Ensure there are no duplicate libraries by looking for multiple versions of the following: WebSocketEnterprisePlugin StreamingLitePlugin RESTEnterprisePlugin MQTTPlugin IoTAdapter HttpProtocolPlugin DEPPluginClient Run sudo ./dep.sh status. View SAP Dynamic Edge Processing logs in /opt/dep_iot_edge/log/. SELECT * FROM "DEP_Admin".”v_local_plugin"; SELECT * FROM “DEP_Admin”.”v_local_plugin_configuration”; SELECT * FROM "DEP_Admin"."v_local_plugin_routing"; SELECT * FROM "DEP_Admin".”v_enterprise_plugin”; SELECT * FROM "DEP_Admin".”v_enterprise_plugin_configuration”; 30 IOT EDGE SERVICES – CONFIGURATION GUIDE PUBLIC KNOWN ISSUES The following error messages are known issues. If required, use the suggested commands as workarounds. Issue # 1 2 Description NPM – failure to install Node.js SQL Anywhere package Streaming Lite – lack of PAM authentication support Symptom: You see the following message in StreamingLitePlugin.log in the log folder: StreamingLite plugin is not able to connect and fails with error javax.security.auth.login.LoginException: Server error (4) :Authorization failed: 3 Streaming Lite – missing library files Symptom: /opt/streaminglite/install/bin/streamingproje ct: error while loading shared libraries: libicui18n.so.44: cannot open shared object file: No such file or directory /opt/streaminglite/install/bin/streamingproje ct: error while loading shared libraries: libicuuc.so.44: cannot open shared object file: No such file or directory /opt/streaminglite/install/bin/streamingproje ct: error while loading shared libraries: libicudata.so.44: cannot open shared object file: No such file or directory 4 SQL Anywhere – missing library files when attempting to use dbisql Workaround Use --skip-npm flag and copy the node_modules folder from a working platform. For more info, see IoT edge services Installation. Use: dep.sh start allNoAuth rather than: dep.sh start all Or use: dep.sh start StreamingLiteNoAuth rather than: dep.sh start StreamingLite links ln -s /opt/streaminglite/install/lib/libicui 18n.so.44.1 /opt/streaminglite/install/lib/libicui 18n.so.44 ln -s /opt/streaminglite/install/lib/libicuu c.so.44.1 /opt/streaminglite/install/lib/libicuu c.so.44 ln -s /opt/streaminglite/install/lib/libicud ata.so.44.1 /opt/streaminglite/install/lib/libicud ata.so.44 ln -s /opt/streaminglite/install/lib/libsasl 2.so.2.0.22 /opt/streaminglite/install/lib/libsasl 2.so.2 SUSE 12 Install the missing libraries using: zypper search libxtst libxi libXi6 31 IOT EDGE SERVICES – CONFIGURATION GUIDE www.sap.com PUBLIC © 2016 SAP SE or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated companies’ strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions. 32
* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project
advertisement