Essential comparison

Some of this tasks are defined as "Excluded Tasks" which you may think they are unimportant and not business critical. But if you ask any of your architects, security officers or SAP basis colleagues they will tell you that the sizing, monitoring and patching of the server infrastructure (VM) / OS is more than important for a stable operating system. The customer is responsible for this tasks!

Now the question is why SAP is not offering such services as standard when this tasks are so important? At first they only apply to additional server instances to run non-SAP applications. This may only apply to a very small group of customers who need this.

But why the mentioned tasks are so important?

1. Sizing

If the sizing of your instance does not fit to your workload needs, you will end up in a resource bottleneck which can lead to wait times or in the worst case to a failure due to OOM (Out of memory).

   2. OS patches and security updates / antivirus pattern updates

Since NIS2 is a omnipresent topic, these aspects fall under it. It is important that the systems are kept up to date and regularly maintained to close known security gaps. For essential establishments, fines of up to 10 million euros or 2% of annual worldwide turnover (whichever is greater) may be imposed. You'd think that should be important, right? In comparison to the systems running SAP applications, SAP is not offering an OS or AV pattern patching.

   3. OS Monitoring

The as for the patching is valid for the OS monitoring of non-SAP applications. It is an excluded task which is in the responsibilities of the customer! But how the customer with a cloud only strategy can monitor this? A lot of effort on customer side or another MSP which takes this as his responsibility.

Summary

For all customers consuming the standard service of running ERP or S/4HANA with RISE some standard monitoring is included. But please take into account that every special metric or KPI might be a special request for SAP and everyone understand a different depth when talking about monitoring. It can mean a 5s or a 60s sampling. What does it mean to monitor the disk or network utilization? IOPS? service time? throughput? package size? number of packages? Please be specific and compare apples to apples. Don't be surprised if you get not what you expected because you will get what you signed and paid for if you not ask for details.