SAP IQ Cockpit Non-GUI Administration and Monitoring Company

Administration Guide | PUBLIC SAP IQ 16.1 SP 04 Document Version: 1.0.0 – 2020-10-15

THE BEST RUN 2021 SAP SE or an SAP © Content

1 SAP IQ Cockpit Non-GUI Administration and Monitoring...... 9

2 Get Started with SAP IQ Cockpit...... 10 2.1 Start and Stop the SAP IQ Cockpit Server...... 10 Starting and Stopping the SAP IQ Cockpit Server in Windows...... 11 Starting and Stopping the SAP IQ Cockpit Server in UNIX...... 12 Configuring SAP IQ Cockpit Server as a Windows Service...... 13 Configuring SAP IQ Cockpit Server as a UNIX Service...... 15 cockpit Command...... 16

3 Configure SAP IQ Cockpit...... 20 3.1 Configure SQL-Based Monitoring...... 20 3.2 Configure SQL-Based Exploring...... 21 3.3 Configure SQL-Based Alerting...... 21 Download and Start an SAP SQL Anywhere Client...... 21 Create a Technical User for Alerting...... 23 Configure the Email Server for Alerting...... 24 3.4 Configure the Repository...... 25 Connect the Client to the SAP SQL Anywhere Repository Database...... 26 Back Up the Repository Database...... 27 Restore the Repository Database...... 28

4 Monitor SAP IQ...... 29 4.1 SAP IQ Server...... 29 Viewing Overview Statistics...... 30 Viewing All Statistics...... 33 Viewing Engine Statistics...... 34 Viewing Connections Statistics...... 35 Viewing Transaction Statistics...... 36 Viewing Dbspaces Statistics...... 38 Viewing Backup and Dependency Statistics...... 39 Viewing Store I/O Statistics...... 40 Viewing Cache Statistics...... 41 Viewing Table Version Statistics...... 43 Viewing Operations and Requests Statistics...... 44 Viewing Network Statistics...... 45 Viewing Table Page Usage Statistics...... 45 Viewing Table Lock Statistics...... 46

SAP IQ Cockpit Non-GUI Administration and Monitoring 2 PUBLIC Content Viewing Deadlock Statistics...... 47 Viewing RLV Memory Usage Statistics...... 48 Viewing RLV Merge History Statistics...... 48 Viewing the Statistics Chart...... 49 Changing Update Frequency for SAP IQ Server Monitoring...... 51 4.2 Multiplex Servers...... 51 Viewing Multiplex Overview Statistics...... 52 Multiplex Topology Statistics...... 53 Viewing Multiplex Server Statistics...... 53 Viewing Multiplex Connections Statistics...... 54 Viewing Multiplex Transaction Statistics...... 55 Viewing Multiplex Cache Statistics...... 56 Viewing the Statistics Chart...... 57 Changing Update Frequency for Multiplex Monitoring...... 58 4.3 Logical Servers...... 59 Viewing Logical Server Overview Statistics...... 59 Viewing Logical Server Statistics...... 60 Viewing the Statistics Chart...... 61 Changing Update Frequency for Logical Server Monitoring...... 62

5 Administer SAP IQ...... 63 5.1 Executing a SQL Query...... 65 5.2 The SAP IQ Server...... 65 Editing the SAP IQ Server Configuration File...... 66 Starting an SAP IQ Server...... 66 Stopping an SAP IQ Server...... 67 Converting a Multiplex to an SAP IQ Server...... 67 Generating an Administration Script for an SAP IQ Server...... 68 Upgrading an SAP IQ Server Database...... 68 Viewing or Modifying SAP IQ Server Properties...... 69 Server Privilege Summary...... 69 5.3 Multiplex...... 70 Editing the Multiplex Server Configuration File...... 72 Starting a Multiplex Server...... 72 Stopping a Multiplex Server...... 72 Including an Excluded Secondary Server...... 73 Excluding a Secondary Server...... 73 Synchronizing a Secondary Server...... 74 Adding a Secondary Server...... 74 Dropping a Secondary Server...... 75 Generating Administration Scripts for a Multiplex Server...... 75 Upgrading a Multiplex Server...... 75

SAP IQ Cockpit Non-GUI Administration and Monitoring Content PUBLIC 3 Converting an SAP IQ Server to Multiplex...... 76 Reconfiguring a Multiplex Server...... 76 Enabling and Disabling an RLV Store...... 76 Enabling and Disabling High Availability...... 77 Viewing or Modifying Multiplex Properties...... 77 Modifying Multiplex Server Properties...... 78 Failover...... 78 Multiplex Privilege Summary...... 78 5.4 Logical Servers...... 83 Creating a Logical Server...... 84 Deleting a Logical Server...... 85 Configuring Logical Server Node Membership...... 85 Altering a Logical Server Assignment...... 86 Generating DDL Commands for a Logical Server...... 86 Modifying Logical Server Properties...... 86 Logical Server Privilege Summary...... 87 5.5 Logical Server Policies...... 88 Creating a Logical Server Policy...... 89 Deleting a Logical Server Policy...... 89 Generating DDL Commands for a Logical Server Policy...... 90 Modifying Logical Server Policy Properties...... 90 Logical Server Policy Privilege Summary...... 90 5.6 Remote Servers...... 91 Creating a Remote Server...... 92 Testing a Remote Server Connection...... 92 Deleting a Remote Server...... 93 Generating Remote Server DDL Commands...... 93 Modifying Remote Server Properties...... 93 Remote Server Privilege Summary...... 94 5.7 External Logins...... 95 Creating an External Login...... 96 Deleting an External Login...... 96 Generating External Login DDL Commands...... 97 Viewing External Login Properties...... 97 External Login Privilege Summary...... 97 5.8 Databases...... 98 Creating a Database...... 99 Creating a Database Using a CSV File...... 99 Setting Database Options...... 100 Configuring Point-in-Time Recovery Options...... 100 Purging Backup History...... 101

SAP IQ Cockpit Non-GUI Administration and Monitoring 4 PUBLIC Content Modifying Database Properties...... 101 Database Privilege Summary...... 102 5.9 Tables...... 104 Creating an IQ (Catalog) System Store Table...... 106 Creating an IQ Main Store Table with No Partitions...... 107 Creating a Table with a Hash Partition...... 107 Creating a Table with a Range Partition...... 108 Creating a Table with a Hash-Range Partition...... 108 Creating a Global Temporary Table...... 109 Creating a Proxy Table...... 109 Viewing Table Data...... 110 Deleting a Table...... 110 Generating Table DDL Commands...... 111 Moving a Table to Another Dbspace...... 111 Validating an IQ (Catalog) System Store Table...... 111 Setting the Primary Key...... 112 Removing the Primary Key...... 112 Setting a Clustered Index...... 113 Merging Table Data from RLV Store with IQ Main Store...... 113 Calculating the Number of Rows in a Table...... 114 Moving Table Objects to Another Dbspace...... 114 Enabling or Disabling Row-Level Versioning in a Table...... 115 Modifying Base Table Properties...... 115 Modifying Global Temporary Table Properties...... 116 Modifying Proxy Table Properties...... 116 Table Privilege Summary...... 117 Table Columns...... 127 Table Permissions...... 130 Table Constraints...... 134 Table Indexes...... 146 Table Triggers...... 154 Table Partitions...... 158 5.10 Views...... 171 About Views...... 172 Creating a View...... 172 Viewing View Data...... 173 Recompiling and Enabling a View...... 173 Disabling a View...... 174 Deleting a View...... 174 Generating View DDL Commands...... 175 Modifying View Properties...... 175

SAP IQ Cockpit Non-GUI Administration and Monitoring Content PUBLIC 5 View Privilege Summary...... 175 View Permissions...... 178 View Triggers...... 183 5.11 Domains...... 187 Creating a Domain...... 188 Deleting a Domain...... 192 Generating Domain DDL Commands...... 192 Viewing Domain Properties...... 192 Domain Privilege Summary...... 193 5.12 Text Configuration Objects...... 194 Creating a Text Configuration Object...... 194 Deleting a Text Configuration Object...... 195 Generating Text Configuration Object DDL Commands...... 195 Modifying Text Configuration Object Properties...... 195 Text Configuration Privilege Summary...... 196 5.13 Text Indexes...... 198 Creating a Text Index...... 198 Deleting a Text Index...... 199 Refreshing a Text Index...... 199 Truncating a Text Index...... 200 Generating Text Index DDL Commands...... 200 Modifying Text Index Properties...... 200 Text Index Privilege Summary...... 201 5.14 Sequence Generators...... 205 Creating a Sequence Generator...... 206 Deleting a Sequence Generator...... 207 Restarting a Sequence at Start Value...... 207 Generating Sequence Generator DDL Command...... 208 Modifying Sequence Generator Properties...... 208 Granting Sequence Generator USAGE Permission...... 208 Revoking Sequence Generator USAGE Permission...... 209 Sequence Generator Privilege Summary...... 209 5.15 Spatial Support...... 212 Creating a Spatial Reference System...... 213 Deleting a Spatial Reference System...... 213 Generating Spatial Reference System DDL Commands...... 214 Modifying Spatial Reference System Properties...... 214 Spatial Units of Measure...... 214 Spatial Support Privilege Summary...... 217 5.16 Security and User Management...... 219 Role-Based Security...... 220

SAP IQ Cockpit Non-GUI Administration and Monitoring 6 PUBLIC Content Login Mappings...... 316 Login Policies...... 320 LDAP Servers...... 323 5.17 Dbspaces...... 330 Creating a Dbspace...... 331 Deleting a Dbspace...... 331 Preallocating Space for a Dbspace...... 332 Generating Dbspace DDL Commands...... 332 Changing a Dbspace to Read-Only...... 332 Configuring Point-in-Time Recovery Logging Options...... 333 Modifying Dbspace Properties...... 333 Granting Dbspace CREATE Permission...... 334 Revoking Dbspace CREATE Permission...... 334 Dbspace Privilege Summary...... 335 5.18 Dbfiles...... 337 Creating a Dbfile...... 338 Deleting a Dbfile...... 338 Emptying a Dbfile...... 339 Generating Dbfile DDL Commands...... 339 Viewing or Modifying Dbfile Properties...... 339 Dbfile Privilege Summary...... 340 5.19 Events...... 341 Creating an Event...... 342 Deleting an Event...... 343 Disabling an Event...... 343 Enabling an Event...... 344 Triggering an Event...... 344 Generating Event DDL Commands...... 345 Modifying Event Properties...... 345 Event Schedules...... 345 Event Privilege Summary...... 347 5.20 External Environments...... 350 Working in a Java External Environment...... 351 Working in a Perl External Environment...... 357 Working in a PHP External Environment...... 363 Working in a C ESQL External Environment...... 369 Working in a C ODBC External Environment...... 370 Working in a CLR (.NET) External Environment...... 371 5.21 Functions...... 373 Creating a Watcom SQL or Transact-SQL Function...... 374 Creating an External Java Function...... 374

SAP IQ Cockpit Non-GUI Administration and Monitoring Content PUBLIC 7 Creating an External C/C++ Scalar or Aggregate Function...... 375 Deleting a Function...... 375 Generating Function DDL Commands...... 376 Modifying a Function...... 376 Granting Function EXECUTE Permission...... 376 Revoking Function EXECUTE Permission...... 377 Function Privilege Summary...... 377 5.22 Procedures...... 381 Creating a Procedure...... 382 Creating a Remote Procedure...... 382 Creating a Table UDF or TPF...... 382 Executing a Procedure, Table UDF, or TPF using View Data in SQL...... 383 Deleting a Procedure, Table UDF, or TPF...... 383 Generating Procedure, Table UDF, or TPF DDL Commands...... 384 Modifying a Procedure, Table UDF, or TPF...... 384 Granting Procedure EXECUTE Permission...... 385 Revoking Procedure EXECUTE Permission...... 385 Procedure Privilege Summary...... 386 5.23 Web Services...... 390 Creating a Web Service...... 391 Enabling a Web Service...... 391 Disabling a Web Service...... 392 Deleting a Web Service...... 392 Generating Web Service DDL Commands...... 393 Modifying Web Services Properties...... 393 Web Service Privilege Summary...... 393

6 Alerts in SAP IQ...... 395 6.1 Monitor and Resolve Alerts...... 395 6.2 Configuring and Managing KPIs...... 396 Insert Alert Types into the Alert Tables...... 398 Disabling Alerts...... 400 Modify Thresholds...... 401

SAP IQ Cockpit Non-GUI Administration and Monitoring 8 PUBLIC Content 1 SAP IQ Cockpit Non-GUI Administration and Monitoring

The Flash-based SAP IQ Cockpit graphical user interface was removed from SAP IQ Cockpit in the SAP IQ 16.1 SP04 PL08 release.

Use this guide to perform SAP IQ Cockpit monitoring, exploring, and alerting tasks using SQL.

Former SAP IQ Cockpit Tab SQL Equivalent

Monitor tab Connect a SQL client to the SAP IQ database, and execute the SQL commands provided in the Monitor SAP IQ [page 29] section of this guide.

Explore tab Connect a SQL client to the SAP IQ database, and execute the SQL commands provided in the Administer SAP IQ [page 63] section of this guide.

Alert tab Connect an SAP SQL Anywhere client to the repository database in SAP IQ Cockpit's embedded SAP SQL Anywhere server.

Execute the SQL commands provided in the Alerts in SAP IQ [page 395] section of this guide.

SAP IQ Cockpit Non-GUI Administration and Monitoring SAP IQ Cockpit Non-GUI Administration and Monitoring PUBLIC 9 2 Get Started with SAP IQ Cockpit

Start, stop, and configure the SAP IQ Cockpit server.

In this section:

Start and Stop the SAP IQ Cockpit Server [page 10] You can start SAP IQ Cockpit server manually or set the service to start automatically and to restart in case of failure.

2.1 Start and Stop the SAP IQ Cockpit Server

You can start SAP IQ Cockpit server manually or set the service to start automatically and to restart in case of failure.

If you elect to run the SAP IQ Cockpit server manually, you must issue a command every time you want to start or shut down the server. If you elect to run as a service (recommended), you can configure the service to start and restart automatically.

When you install the SAP IQ Cockpit in Windows, the installer offers you the option to set up the cockpit to run as a service. If you want the cockpit to run as a service (daemon) in UNIX, you must set up the service yourself.

Regardless of the start method used, wait at least five minutes after startup to log in to the SAP IQ Cockpit. Startup triggers automatic discovery, technical user verification, and collection jobs. Competing with these processes may cause unexpected behavior. Use the cockpit.bat -status (for Windows) and cockpit.sh -status (for UNIX) commands to check the current cockpit status. For details about these commands, use the cockpit.bat -h (for Windows) and cockpit.sh -h (for UNIX).

In this section:

Starting and Stopping the SAP IQ Cockpit Server in Windows [page 11] When you run SAP IQ Cockpit server manually, issue a command every time you start or shut down.

Starting and Stopping the SAP IQ Cockpit Server in UNIX [page 12] When you run SAP IQ Cockpit server manually, issue a command every time you start or shut down.

Configuring SAP IQ Cockpit Server as a Windows Service [page 13] You can set the service to start automatically and to restart in case of failure. SAP recommends running SAP IQ Cockpit as a service.

Configuring SAP IQ Cockpit Server as a UNIX Service [page 15] You can set the service to start automatically and to restart in case of failure. SAP recommends running SAP IQ Cockpit as a service.

cockpit Command [page 16] Use cockpit.bat (Windows) or cockpit.sh (UNIX) to manually start and stop SAP IQ Cockpit agents and servers and to perform administrative tasks like configuring ports and enabling and disabling services.

SAP IQ Cockpit Non-GUI Administration and Monitoring 10 PUBLIC Get Started with SAP IQ Cockpit 2.1.1 Starting and Stopping the SAP IQ Cockpit Server in Windows

When you run SAP IQ Cockpit server manually, issue a command every time you start or shut down.

Prerequisites

Ensure that your home directory—that is, the home directory of the user who starts SAP IQ Cockpit—is writable from the SAP IQ Cockpit host. If the starting user cannot write to the home directory, SAP IQ Cockpit logs an error and fails to launch. Resetting the user’s HOME environment variable to a writable directory does not solve the problem.

Context

 Note

If you are starting SAP IQ Cockpit server for the first time in Windows 2008, Windows 7, or Windows 8, use the Run as Administrator option so that SAP IQ Cockpit can register its ODBC driver. (This is necessary even if you are logged in as an administrator.)

Procedure

1. To start the SAP IQ Cockpit server, execute:

%SYBASE%\COCKPIT-4\bin\cockpit.bat

2. To stop SAP IQ Cockpit, at the cockpit> prompt, execute:

shutdown

At the prompt, enter a text reason for the shutdown.

 Caution

Do not enter shutdown at a Windows prompt; it shuts down the operating system.

SAP IQ Cockpit Non-GUI Administration and Monitoring Get Started with SAP IQ Cockpit PUBLIC 11 2.1.2 Starting and Stopping the SAP IQ Cockpit Server in UNIX

When you run SAP IQ Cockpit server manually, issue a command every time you start or shut down.

Prerequisites

● Ensure that your home directory—that is, the home directory of the user who starts SAP IQ Cockpit—is writable from the SAP IQ Cockpit host. If the starting user cannot write to the home directory, SAP IQ Cockpit logs an error and fails to launch. Resetting the user’s HOME environment variable to a writable directory does not solve the problem.

Context

You can start the SAP IQ Cockpit server in the foreground or background. When you run SAP IQ Cockpit server in the background, you can use nohup, &, and > to redirect output and system error to a file, and suppress the SAP IQ Cockpit server console.

Procedure

1. Set the environment variables. Do this only once. a. Change to the parent of the SAP IQ Cockpit installation directory. b. Execute one of the following to set environment variables.

Bourne shell:

./SYBASE.sh

C shell:

source SYBASE.csh

2. To start the SAP IQ Cockpit server, do one of:

Option Description

In the fore Execute: ground $SYBASE/COCKPIT-4/bin/cockpit.sh

In the back Execute a command similar to the sample below that matches your shell. The sample command di ground rects output to the file cockpit-console.out. If the output file already exists, you might need to use additional shell operators to append to or truncate the file.

SAP IQ Cockpit Non-GUI Administration and Monitoring 12 PUBLIC Get Started with SAP IQ Cockpit Option Description

Bourne shell (sh) or Bash

nohup ./cockpit.sh 2>&1 > cockpit-console.out &

C shell

nohup ./cockpit.sh >& cockpit-console.out &

3. To stop the SAP IQ Cockpit server:

Option Description

Running in the At the cockpit> prompt, execute: foreground shutdown

At the prompt, enter a text reason for the shutdown.

 Caution Do not enter shutdown at a UNIX prompt; it shuts down the operating system.

Running in the At the UNIX command line, execute: background $SYBASE/COCKPIT-4/bin/cockpit.sh --stop

2.1.3 Configuring SAP IQ Cockpit Server as a Windows Service

You can set the service to start automatically and to restart in case of failure. SAP recommends running SAP IQ Cockpit as a service.

Prerequisites

SAP IQ Cockpit Non-GUI Administration and Monitoring Get Started with SAP IQ Cockpit PUBLIC 13 Context

If you run SAP IQ Cockpit server as a service, you can still manually start and stop the service, as needed. By default, if you install SAP IQ Cockpit to run as a service, the service is configured to automatically start, but not automatically restart. You must configure this manually.

Procedure

1. To configure automatic restart: a. In Windows, open Services. b. Locate “Cockpit” in the Services list. It may be followed by a release number; if the service is for an instance, it is also followed by the instance name. Service names do not distinguish between agents and servers. If the service is running, the Status column displays “Started.” c. Click the Recovery tab and change the First, Second, and Subsequent failures to Restart the Service. d. Click OK. 2. To manually start the service:

Option Description

In the Select the cockpit service and click Start. Services window

At a Execute: com mand net start "Cockpit 4.0" line The Cockpit 4 service is starting...... The Cockpit 4 service was started successfully.

3. To manually stop the service:

Option Description

In the Services window Select the cockpit service and click Stop.

At a command line Execute:

net stop "Cockpit 4.0"

The Cockpit 4 service is stopping...... The Cockpit 4 service was stopped successfully.

SAP IQ Cockpit Non-GUI Administration and Monitoring 14 PUBLIC Get Started with SAP IQ Cockpit 2.1.4 Configuring SAP IQ Cockpit Server as a UNIX Service

You can set the service to start automatically and to restart in case of failure. SAP recommends running SAP IQ Cockpit as a service.

Prerequisites

Context

A UNIX service is a daemon process that starts automatically after the machine is started and runs in the background. UNIX installations of SAP IQ Cockpit server include a shell script, cockpitd, located at /COCKPIT-4/bin, which you can use to configure the SAP IQ Cockpit service. (Some UNIX platforms supply tools that make service configuration easier; Linux chkconfig is an example.)

 Note

SAP recommends that if you are not familiar with setting up services in UNIX, you delegate this task to a system administrator or consult the system administration documentation for your UNIX platform.

Procedure

1. Open cockpitd and make these changes: ○ Change the line that sets the SYBASE variable to the location of your SAP installation (that is, the parent directory of COCKPIT-4, the SAP IQ Cockpit installation directory). By default, this directory is called /opt/Sybase if you installed SAP IQ Cockpit on a machine with an existing SAP product or environment variable; otherwise the default parent directory is /opt/sap. ○ Set the COCKPIT_HOME environment variable to /COCKPIT-4. ○ Copy cockpitd to /etc/init.d. ○ If you are using shared-disk mode to run a single instance whose name is not the host name, or to run multiple instances on the same host, add the instance name to the script name. Change:

SCRIPT_NAME=cockpit.sh

to:

SCRIPT_NAME="cockpit.sh -instance "

SAP IQ Cockpit Non-GUI Administration and Monitoring Get Started with SAP IQ Cockpit PUBLIC 15 2. In Linux: a. Discover the location of chkconfig by running one of these commands:

whereis chkconfig

which chkconfig

b. In Linux, configure the service to run in run levels 2, 3, 4, and 5. Execute:

/sbin/chkconfig --add cockpitd

/sbin/chkconfig cockpitd 2345

You can test the cockpitd script with /sbin/service cockpitd status. (The service command accepts these options: start | stop | status | restart.) For example, to start the Cockpit, enter /sbin/service cockpitd start. 3. In Solaris: a. Create soft links. Locate this directory: ○ /etc/rc.d Where is the run level (for example, 3). Make two soft links in the directory for Solaris and set the links to point to: ○ /etc/init.d/cockpitd: S90cockpitd, and ○ /etc/init.d/cockpitd: K10cockpitd The S90cockpitd link starts the service and the K10cockpitd link stops the service. The two-digit numbers in the links indicate the start and stop priorities of the service. b. Use the S90cockpitd and K10cockpitd links to test starting and stopping the service. The links are called automatically when the machine is started or shut down.

2.1.5 cockpit Command

Use cockpit.bat (Windows) or cockpit.sh (UNIX) to manually start and stop SAP IQ Cockpit agents and servers and to perform administrative tasks like configuring ports and enabling and disabling services.

A single cockpit server can manage other SAP database products if they reside on the same host. The cockpit server shares ports and other resources, and the cockpit command enables all installed plugins.

Use the instance command to manage multiple server instances from the same Cockpit installation directory.

Syntax

cockpit[.bat | .sh] [-a | --address ]

[-b | --bitwidth] [--dbpassword]

[-disable | --disable ]

[-enable | --enable ]

SAP IQ Cockpit Non-GUI Administration and Monitoring 16 PUBLIC Get Started with SAP IQ Cockpit [-h | --help]

[-I | --info []]

[-instance []]

[-m | --message ]

[-password | --password ]

[-p | --port {= |

:=}]

[{-start | --start} | {-stop | --stop}] [-status | --status]

[-user | --user ]

[-v | -version | --version]

Parameters

● -a | --address RMI-service-address The address for the RMI service to use; must be an IP address on this machine or the name of this machine (which is the default). ● -b | --bitwidth Return an informational only string identifying the bit width (32 or 64) of the underlying platform. If you use this option, the cockpit command does not start the SAP IQ Cockpit. ● --dbpassword Change the password of the default dba account provided for the repository database. It prompts you for the new password, validates it, and starts the SAP IQ Cockpit server. This option does not work if you start the SAP IQ Cockpit in the background—it fails to start if there is no console. ● -disable | --disable service-name,service-name... Disable the specified services. This option does not work while SAP IQ Cockpit is running or as part of a command that starts the SAP IQ Cockpit. To use it, shut down the SAP IQ Cockpit, execute cockpit --disable, then restart. See under --ports for service names; separate each service from the next with a comma. ● -enable | --enable service-name,service-name... Enable the specified services. Separate each service from the next with a comma. When you use this option, cockpit does not start SAP IQ Cockpit—use a separate command to start the SAP IQ Cockpit. ● -h | --help Display help and usage information for the cockpit command. If you use this option, cockpit does not start SAP IQ Cockpit. ● -I | --info [information-category] Display the specified categories of information about SAP IQ Cockpit. Separate each category from the next with a comma. The information categories are:

all Returns all the information provided by the sys, ports, and services categories. Default option. sys Returns general information about this instance of SAP IQ Cockpit, including the version, the home (installation) directory, the host machine’s name and IP address, the RMI port number, the messaging level, and details about the platform and Java installation. ports Lists all the ports on which the SAP IQ Cockpit and its services listen, indicates whether each port is in use, and shows the service running on each port. services Lists all the services known to the SAP IQ Cockpit, indicates whether each service is enabled, and lists other services on which each service depends. sysprop Lists all the Java system properties known to the Java VM and their values. env Lists the complete Java VM process environment. ● -instance [instance-name] Use with other options (-start and -stop, for example) to specify an instance in a shared disk deployment. If you do not enter a name for the instance, it defaults to the host name. ● -m | --message message-level Set the amount of detail recorded in system logs; also known as the logging level. Valid values are OFF, FATAL, ERROR, WARN, INFO, DEBUG, and ALL. WARN is the default.

SAP IQ Cockpit Non-GUI Administration and Monitoring Get Started with SAP IQ Cockpit PUBLIC 17 ● -password | --password Specify the password of the user account SAP IQ Cockpit uses to stop servers or query them for status. Use this option with --user. When you enter a command with --user but without --password, the console prompts you to enter a password. ● -p | --port {port-name=port-number | service-name:property-name=port-number} Configure the specified service to run on the specified port. Changing ports is useful if you discover a port conflict between SAP IQ Cockpit and other software on the same system. When you use this option, cockpit does not start SAP IQ Cockpit—use a separate command to start the SAP IQ Cockpit.

Valid port names, service names and property names are:

Port Name Description Service Names Property Names Default Port

db Database port SccSADataserver com.sybase.asa.server.port 4638

Messaging messaging.db.port

Alert alert.database.port

msg Messaging port Messaging messaging.port 4993

rmi RMI port RMI port 4992

tds Tabular Data Stream Tds tdsPort 4998 port (used to communi cate with other SAP da tabase products)

You can also execute cockpit --info ports to display service names and associated property names; they appear in the first two columns of the output.

● -start | --start Start the SAP IQ Cockpit. This is the default option—if you execute cockpit with no options, it starts the SAP IQ Cockpit. This option cannot be combined in the same command with options that set ports or enable or disable services; use a separate cockpit command to start the SAP IQ Cockpit. ● -status | --status Display a status message indicating whether the SAP IQ Cockpit is running. ● -stop | --stop Shut down the SAP IQ Cockpit if it is running. ● -user | --user [login-name] Specify the user account SAP IQ Cockpit uses to stop managed servers or query them for status. Use this option with --password. If you do not enter a login name, the console prompts you to enter one. ● -v | -version | --version Display the version of SAP IQ Cockpit software running on this system. If you use this option, cockpit does not start SAP IQ Cockpit.

Examples

Set the RMI port

Each of these commands sets the RMI port to 5992. The first command demonstrates the port name syntax; the second demonstrates the service name:property name syntax:

cockpit --port rmi=5992

cockpit --port RMI:port=5992

SAP IQ Cockpit Non-GUI Administration and Monitoring 18 PUBLIC Get Started with SAP IQ Cockpit Set the RMI port and start SAP IQ Cockpit

These commands set the RMI port to 9996, then start the SAP IQ Cockpit. Two commands (separated by a semicolon here) are needed because cockpit does not start the SAP IQ Cockpit when the command includes any of the port-setting options:

cockpit -p rmi=9996; cockpit

Set all database ports

This command sets all three of the repository database ports (data server, messaging, and database alert) to 3638:

cockpit --port db=3638

Set the TDS port

This command sets the TDS port to 9998:

cockpit --port Tds:tdsPort=9998

Enable a service and start the SAP IQ Cockpit

The first cockpit command enables the TDS service; the second starts the SAP IQ Cockpit. (The two commands are separated by a semicolon.) The second command is needed because cockpit does not start SAP IQ Cockpit when the command includes the -enable option:

cockpit -enable Tds; cockpit

Start an SAP IQ Cockpit instance

This command starts the SAP IQ Cockpit instance called kalamazoo. -start is optional because it is the default:

cockpit -start -instance kalamazoo

Permissions

None required.

SAP IQ Cockpit Non-GUI Administration and Monitoring Get Started with SAP IQ Cockpit PUBLIC 19 3 Configure SAP IQ Cockpit

There are several options available to configure SAP IQ Cockpit.

 Note

These additional options are over and above the minimum configuration described in Get Started with SAP IQ Cockpit.

In this section:

Configure SQL-Based Monitoring [page 20] If you're using a SQL client – such as Interactive SQL – on a Linux or UNIX machine, then no configuration is necessary. Execute SQL commands using your existing client to monitor SAP IQ. This document provides the SQL equivalents for the monitoring capabilities provided by the discontinued SAP IQ Cockpit Monitor tab.

Configure SQL-Based Exploring [page 21] If you're using a SQL client – such as Interactive SQL – on a Linux or UNIX machine, then no configuration is necessary. Use your existing SQL client to monitor SAP IQ by executing SQL commands.

Configure SQL-Based Alerting [page 21] Connect an SAP SQL Anywhere client to the repository database, back up and restore the repository database, create a technical user for alerting, and configure the email server for alerts.

Configure the Repository [page 25] The SAP IQ Cockpit embedded repository stores information related to managed systems, as well as user preference data, operational data, statistics, and alert configuration.

3.1 Configure SQL-Based Monitoring

If you're using a SQL client – such as Interactive SQL – on a Linux or UNIX machine, then no configuration is necessary. Execute SQL commands using your existing client to monitor SAP IQ. This document provides the SQL equivalents for the monitoring capabilities provided by the discontinued SAP IQ Cockpit Monitor tab.

However, if you're using a SQL client on Windows, the SAP SQL Anywhere clients required for alert management cause your existing clients to stop working. For workaround instructions, see SAP SQL Anywhere Clients Best Practices for Windows Users [page 23].

SAP IQ Cockpit Non-GUI Administration and Monitoring 20 PUBLIC Configure SAP IQ Cockpit 3.2 Configure SQL-Based Exploring

If you're using a SQL client – such as Interactive SQL – on a Linux or UNIX machine, then no configuration is necessary. Use your existing SQL client to monitor SAP IQ by executing SQL commands.

This document provides the equivalent SQL commands for the monitoring capabilities provided by the discontinued SAP IQ Cockpit Explore tab.

3.3 Configure SQL-Based Alerting

Connect an SAP SQL Anywhere client to the repository database, back up and restore the repository database, create a technical user for alerting, and configure the email server for alerts.

In this section:

Download and Start an SAP SQL Anywhere Client [page 21] Download SAP SQL Anywhere clients from the free SQL Anywhere Developer Edition trial.

Create a Technical User for Alerting [page 23] SQL-based alerting requires an SAP IQ database technical user.

Configure the Email Server for Alerting [page 24] Using SQL commands, specify the e-mail server for SAP IQ Cockpit to use to send alert notifications.

Related Information

Configure the Repository [page 25]

3.3.1 Download and Start an SAP SQL Anywhere Client

Download SAP SQL Anywhere clients from the free SQL Anywhere Developer Edition trial.

Context

You use an SAP SQL Anywhere Client to issue SQL commands. These clients use ODBC/JDBC to communicate with SAP IQ Cockpit's embedded SAP SQL Anywhere server.

SAP IQ Cockpit Non-GUI Administration and Monitoring Configure SAP IQ Cockpit PUBLIC 21 The SQL commands for managing and monitoring are provided in this document. Use the managing and monitoring SQL commands to manage and monitor SAP IQ now that the Flash-based SAP IQ cockpit graphical user interface has been discontinued.

Procedure

1. Navigate to the SAP SQL Anywhere Developer Edition trial page:

https://www.sap.com/cmp/td/sap-sql-anywhere-developer-edition-free-trial.html 2. Follow the registration steps. 3. Choose the applicable Client-only install package.

The client package is downloaded to your machine. 4. Navigate to the client installation package on your machine. Open the client installation package and run the installation wizard.

The clients are installed on your machine.

Example on Windows:

 Note

Are you a Windows user? See SAP SQL Anywhere Clients Best Practices for Windows Users [page 23].

In this section:

SAP SQL Anywhere Clients Best Practices for Windows Users [page 23] If you already have SAP IQ clients installed, installing SAP SQL Anywhere clients can cause problems.

SAP IQ Cockpit Non-GUI Administration and Monitoring 22 PUBLIC Configure SAP IQ Cockpit 3.3.1.1 SAP SQL Anywhere Clients Best Practices for Windows Users

If you already have SAP IQ clients installed, installing SAP SQL Anywhere clients can cause problems.

Once you install SAP SQL Anywhere clients to your Windows machine, any existing SAP IQ clients on your Windows machine might stop working due to Windows registry issues..

As a workaround, you can use the SAP SQL Anywhere clients to connect to your SAP IQ server. That is, you will have:

● An SAP SQL Anywhere client connected to SAP IQ Cockpit's embedded SAP SQL Anywhere database. ● An SAP SQL Anywhere client connected to the SAP IQ server.

 Note

You cannot use SAP IQ clients to connect to SAP IQ Cockpit's embedded SAP SQL Anywhere database.

3.3.2 Create a Technical User for Alerting

SQL-based alerting requires an SAP IQ database technical user.

Context

The technical user is a database user with the required permissions for data collection, alert fetching, and system table access. Create a technical user if:

● You have a new SAP IQ database. ● You have an existing SAP IQ database, but no technical user exists.

 Tip

Not sure if you already have a technical user? ○ Navigate to the COCKPIT-4/plugins/IQ-CMAP folder. ○ Open tustore.xml.

If credentials exist in tustore.xml, then a technical user already exists.

Procedure

1. At a command prompt, navigate to the SAP IQ Cockpit directory: COCKPIT-4/plugins/IQ-CMAP

SAP IQ Cockpit Non-GUI Administration and Monitoring Configure SAP IQ Cockpit PUBLIC 23 2. Run the cockpit_monitor_role_based_privileges_setup.sql script once for the database:

dbisql -c "uid=DBA;pwd=;eng=" -nogui ./ cockpit_monitor_role_based_privileges_setup.sql

3. Grant execute permissions to the script TechnicalUserCreate.sh:

chmod +x TechnicalUserCreate.sh

4. Run TechnicalUserCreate.sh. Enter these values when prompted:

When Prompted for... Enter this value...

Do you wish to connect to local y database? (y/n)

Enter Host(Enter to select localhost): (Press Enter )

Enter Port: Enter Login: DBA

Enter Password: Do you want to specify charset for a n server? (y/n)

Enter Technical User Login: Example: tu005 Enter Technical User Login: Enter force password change for this n user 9y/n/Enter for default): Enter resource name for which to use this technical user:  Tip

Not sure of your resource name? Run the dblocate command.

The SAP IQ database technical user now exists.

3.3.3 Configure the Email Server for Alerting

Using SQL commands, specify the e-mail server for SAP IQ Cockpit to use to send alert notifications.

Prerequisites

 Note

This procedure assumes you've previously used the Flash-based graphical user interface for email alerting. Email alerting is not supported on brand-new SAP IQ installations of 16.1 SP04 PL08 or later.

SAP IQ Cockpit Non-GUI Administration and Monitoring 24 PUBLIC Configure SAP IQ Cockpit ● You connected an SAP SQL Anywhere client to the repository database in SAP IQ Cockpit's embedded SAP SQL Anywhere server. See Download and Start an SAP SQL Anywhere Client [page 21]. ● An SAP IQ database technical user exists. See Create a Technical User for Alerting [page 23].

Procedure

1. Take a full backup of the Cockpit repository database. See Back Up the Repository Database [page 27]. 2. Check if email servers were already configured. Make sure you really want to modify your email servers:

SELECT

T.TARGET_TYPE_NAME,DRIVER_CLASS_NAME,TARGET_NAME,PARAM_NAME,PARAM_VALUE FROM UAS_TARG_TYPE T,UAS_TARG_INST TAR,UAS_TARG_INST_PRMS P WHERE T.TARGET_TYPE_NAME = TAR.TARGET_TYPE_NAME AND P.TARGET_ID = TAR.TARGET_ID AND TAR.TARGET_TYPE_NAME='JavaMail' AND P.PARAM_NAME IN ('SMTP_SERVER_NAME', 'SMTP_SERVER_PORT')

ORDER BY T.TARGET_TYPE_NAME,TAR.TARGET_NAME

3. Set connection authentication to allow modification to the database:

SET TEMPORARY OPTION CONNECTION_AUTHENTICATION='Company=SAP;Application=Cockpit;Signature=000fa5515 7edb8e14d818eb4fe3db41447146f1571g6eb2a6d2966db36d82642c745d1d1bde020b45b6'

4. Update the settings. Make sure all the updates are in a single transaction.

UPDATE UAS_TARG_INST_PRMS SET PARAM_VALUE='' WHERE param_name = 'SMTP_SERVER_NAME' and param_value= ''

UPDATE UAS_TARG_INST_PRMS SET PARAM_VALUE='' WHERE param_name = '' and param_value=''

5. Verify the result with the statement in step 2. 6. Restart the Cockpit server.

Related Information

Alerts in SAP IQ [page 395]

3.4 Configure the Repository

The SAP IQ Cockpit embedded repository stores information related to managed systems, as well as user preference data, operational data, statistics, and alert configuration.

Use SQL commands to back up the repository, and to restore the repository from backups.

In this section:

Connect the Client to the SAP SQL Anywhere Repository Database [page 26]

SAP IQ Cockpit Non-GUI Administration and Monitoring Configure SAP IQ Cockpit PUBLIC 25 Connect your SAP SQL Anywhere client (either Interactive SQL or SQL Central) to the repository database of SAP IQ Cockpit's underlying SAP SQL Anywhere server.

Back Up the Repository Database [page 27] Some tasks in this document have a prerequisite step asking you to back up SAP IQ Cockpit's SAP SQL Anywhere repository database.

Restore the Repository Database [page 28] Restore SAP IQ Cockpit's SAP SQL Anywhere repository database.

3.4.1 Connect the Client to the SAP SQL Anywhere Repository Database

Connect your SAP SQL Anywhere client (either Interactive SQL or SQL Central) to the repository database of SAP IQ Cockpit's underlying SAP SQL Anywhere server.

Prerequisites

You know your SAP IQ Cockpit password. This password was the one you used when you originally installed SAP IQ Cockpit, or updated with cockpit.sh/cockpit.bat --dbpassword.

Procedure

1. Open either Interactive SQL or SQL Central. This procedure assumes you're using Interactive SQL. 2. Connect the client to the repository database of SAP IQ Cockpit's embedded SQL Anywhere server.

Example of an Interactive SQL connection:

Connection Field Choose or Enter this Value

Authentication Database

User ID DBA

Password The SAP IQ Cockpit password.

Action Connect to a running database on another computer

Host The host name, or IP address, that SAP IQ Cockpit is run ning on.

Port 4638

Server name

Database name repository

SAP IQ Cockpit Non-GUI Administration and Monitoring 26 PUBLIC Configure SAP IQ Cockpit 3.4.2 Back Up the Repository Database

Some tasks in this document have a prerequisite step asking you to back up SAP IQ Cockpit's SAP SQL Anywhere repository database.

Procedure

1. Open a SAP SQL Anywhere SQL client and connect to the repository database. 2. Perform a full database backup. Execute:

backup database directory ''

Related Information

Connect the Client to the SAP SQL Anywhere Repository Database [page 26]

SAP IQ Cockpit Non-GUI Administration and Monitoring Configure SAP IQ Cockpit PUBLIC 27 3.4.3 Restore the Repository Database

Restore SAP IQ Cockpit's SAP SQL Anywhere repository database.

Procedure

1. Stop SAP IQ Cockpit. Stopping Cockpit also shuts down the repository database. 2. Copy the backup images to the database path: $SYBASE/COCKPIT-4/services/Repository/db.

$SYBASE is the installation root folder of the SAP IQ server. 3. Start SAP IQ Cockpit.

Related Information

Starting and Stopping the SAP IQ Cockpit Server in Windows [page 11] Starting and Stopping the SAP IQ Cockpit Server in UNIX [page 12]

SAP IQ Cockpit Non-GUI Administration and Monitoring 28 PUBLIC Configure SAP IQ Cockpit 4 Monitor SAP IQ

You can monitor the availability and performance of an SAP IQ server or multiplex environment.

In this section:

SAP IQ Server [page 29] Statistics allow you to monitor the availability and performance of an SAP IQ server.

Multiplex Servers [page 51] Statistics allow you to monitor the availability and performance of multiplex servers.

Logical Servers [page 59] Statistics allow you to monitor the availability and performance of logical servers.

Related Information

Configure SQL-Based Monitoring [page 20]

4.1 SAP IQ Server

Statistics allow you to monitor the availability and performance of an SAP IQ server.

In this section:

Viewing Overview Statistics [page 30] Display the overall health of the SAP IQ server.

Viewing All Statistics [page 33] See the other topics in this section for SAP IQ server statistics.

Viewing Engine Statistics [page 34] Display engine statistics for the SAP IQ server.

Viewing Connections Statistics [page 35] Display connection details for the SAP IQ server.

Viewing Transaction Statistics [page 36] Display transaction details for the SAP IQ server.

Viewing Dbspaces Statistics [page 38] Display dbspace size and usage details, including shared temporary dbspaces, for the SAP IQ server.

Viewing Backup and Dependency Statistics [page 39] Display backup and dependency details for the SAP IQ server.

Viewing Store I/O Statistics [page 40]

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 29 Display store I/O statistics for the selected SAP IQ server.

Viewing Cache Statistics [page 41] Display cache statistics for the SAP IQ server.

Viewing Table Version Statistics [page 43] Display table version details for the SAP IQ server.

Viewing Operations and Requests Statistics [page 44] Display operation and request details for the SAP IQ server.

Viewing Network Statistics [page 45] Display network statistics for the SAP IQ server.

Viewing Table Page Usage Statistics [page 45] Display page usage details for tables or materialized views for the SAP IQ server. Table Page Usage only applies to system tables in the IQ (catalog) system store.

Viewing Table Lock Statistics [page 46] Display details of locked tables, views or materialized views for the SAP IQ server.

Viewing Deadlock Statistics [page 47] Display deadlock details for the SAP IQ server. You can specify how details are displayed and clear deadlock information.

Viewing RLV Memory Usage Statistics [page 48] Display RLV memory usage information at a system-wide and per-table levels for the SAP IQ server.

Viewing RLV Merge History Statistics [page 48] Display historical details on RLV merges for the SAP IQ server.

Viewing the Statistics Chart [page 49] To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Changing Update Frequency for SAP IQ Server Monitoring [page 51] There is no SQL-side equivalent for this SAP IQ Cockpit task.

4.1.1 Viewing Overview Statistics

Display the overall health of the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 30 PUBLIC Monitor SAP IQ Procedure

1. To view Server statistics, execute:

SELECT

@@version, PROPERTY('ProductName'), PROPERTY('ProductVersion'), PROPERTY('MachineName'), PROPERTY('Platform'), PROPERTY('PlatformVer'), PROPERTY('ServerName'), DB_PROPERTY('Name'), DB_PROPERTY('File'), PROPERTY('PageSize'), DB_PROPERTY('LogName'), PROPERTY('ConsoleLogFile'), PROPERTY('Language'), PROPERTY('CharSet'), DB_PROPERTY('NcharCharSet'), DB_PROPERTY('Collation'), DB_PROPERTY('Capabilities'), PROPERTY('IsNetworkServer'), PROPERTY('IsJavaAvailable'), PROPERTY('DefaultCollation'), PROPERTY('DefaultNcharCollation'), PROPERTY('IsFipsAvailable'), PROPERTY('FipsMode'), PROPERTY('Tempdir'), PROPERTY('ConnsDisabled'), PROPERTY('QuittingTime'), PROPERTY('RememberLastStatement')

select connection_property('ServerPort')

2. To view Activities > CPU statistics, execute:

select

property('ProcessCPUSystem'),property('ProcessCPUUser'),now()

3. To view Activities > Connection statistics, execute:

select

stat_name,stat_value from dbo.sp_iqstatistics() where stat_name = 'ConnectionsActive' or stat_name = 'ConnectionsTotalConnections' or stat_name = 'ConnectionsTotalDisconnections' union select 'MaxConnections' as stat_name,property('MaxConnections') as stat_value order by stat_name

select count(*) from dbo.sp_iqconnection() where MPXServerName is null

4. To view Activities > Threads statistics, execute:

select

stat_name, stat_value, now() from sp_iqstatistics() where stat_name in ('ConnectionsActive', 'ThreadsFree', 'ThreadsInUse') order by

stat_name

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 31 5. To view Activities > Request statistics, execute:

select property('ActiveReq'), property('Req'), property('UnschReq')

6. To view Activities > Transaction statistics, execute:

SELECT

T1.State,T1.MPXServerName,T2.ActiveLoadStatement FROM dbo.sp_iqtransaction() T1, ( SELECT stat_value as ActiveLoadStatement FROM dbo.sp_iqstatistics() WHERE stat_name = 'OperationsActiveLoadTableStatements' ) AS T2 WHERE T1.ConnHandle not in ( SELECT connection_property ( 'Number' ) AS ConnHandle ) select TxnID,TxnCreateTime,now() as TimeNow from dbo.sp_iqtransaction() sptxn where State = 'ACTIVE' and sptxn.ConnHandle not in ( select connection_property ( 'Number' ) as ConnHandle )

order by TxnCreateTime

7. To view Caches > IQ (catalog) system store cache statistics, execute:

select

property('MaxCacheSize') / 1024., property('CurrentCacheSize') / 1024., property('CacheRead'), property('CacheHits'), property('CachePinned'), 100 * property('CachePinned') * property('PageSize') / 1024./ property('CurrentCacheSize') as CachePinnedPercent, cast(property('CurrentCacheSize') as double) / cast(property('MaxCacheSize') as double) * 100 as CacheInUsePercent, 100 * property('CacheFileDirty') * property('PageSize') / 1024./ property('CurrentCacheSize') as DirtyPagesPercent, now()

8. To view IQ main store cache statistics, execute:

select

stat_name, stat_value, now() from dbo.sp_iqstatistics() where stat_name = 'MainCacheCurrentSize' or stat_name = 'MainCacheFinds' or stat_name = 'MainCacheHits' or stat_name = 'MainCachePagesPinned' or stat_name = 'MainCachePagesPinnedPercentage' or stat_name = 'MainCachePagesInUsePercentage' or stat_name = 'MainCachePagesDirtyPercentage' order by

SAP IQ Cockpit Non-GUI Administration and Monitoring 32 PUBLIC Monitor SAP IQ stat_name

9. To view Version Usage > Temporary cache statistics, execute:

select

stat_name, stat_value, now() from dbo.sp_iqstatistics() where stat_name = 'TempCacheCurrentSize' or stat_name = 'TempCacheFinds' or stat_name = 'TempCacheHits' or stat_name = 'TempCachePagesPinned' or stat_name = 'TempCachePagesPinnedPercentage' or stat_name = 'TempCachePagesInUsePercentage' or stat_name = 'TempCachePagesDirtyPercentage' order by stat_name

10. To view Details statistics, execute:

SELECT

@@version, PROPERTY('PlatformVer')

4.1.2 Viewing All Statistics

See the other topics in this section for SAP IQ server statistics.

Context

Related Information

Viewing Overview Statistics [page 30] Viewing Engine Statistics [page 34] Viewing Connections Statistics [page 35] Viewing Transaction Statistics [page 36] Viewing Dbspaces Statistics [page 38] Viewing Backup and Dependency Statistics [page 39] Viewing Store I/O Statistics [page 40] Viewing Cache Statistics [page 41] Viewing Table Version Statistics [page 43] Viewing Operations and Requests Statistics [page 44] Viewing Network Statistics [page 45]

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 33 Viewing Table Page Usage Statistics [page 45] Viewing Table Lock Statistics [page 46] Viewing Deadlock Statistics [page 47] Viewing RLV Memory Usage Statistics [page 48] Viewing RLV Merge History Statistics [page 48]

4.1.3 Viewing Engine Statistics

Display engine statistics for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Engine statistics > CPU statistics, execute:

select

property('ProcessCPUSystem'), property('ProcessCPUUser'),

now()

2. To view Engine statistics > Memory/Thread statistics, execute:

select

stat_name, stat_value, now() from sp_iqstatistics() where stat_name in ( 'MainCacheCurrentSize', 'MemoryAllocated', 'MemoryMaxAllocated', 'TempCacheCurrentSize', 'ConnectionsActive', 'ThreadsFree', 'ThreadsInUse' ) order by

SAP IQ Cockpit Non-GUI Administration and Monitoring 34 PUBLIC Monitor SAP IQ

stat_name

4.1.4 Viewing Connections Statistics

Display connection details for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Active Connections / Connection Details statistics, execute:

select

a.ConnHandle, a.IQconnID, a.Userid, a.Name, a.ConnCreateTime, a.LastReqTime, a.ReqType, a.LastIQCmdTime, a.IQCmdType, a.TempTableSpaceKB, a.TempWorkSpaceKB, a.IQCursors, a.IQthreads, CONNECTION_PROPERTY('NodeAddress', a.ConnHandle) as NodeAddress, b.CmdLine, b.ConnOrCursor, a.INCConnSuspended, c.ConnHandle from dbo.sp_iqconnection() a INNER JOIN dbo.sp_iqcontext() b ON a.ConnHandle = b.ConnHandle LEFT OUTER JOIN dbo.sp_iqmpxsuspendedconninfo() c on a.ConnHandle = c.ConnHandle order by

ConnCreateTime

2. To view Associated Transactions statistics, execute:

select

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 35

Userid, TxnId, VersionID, TxnCreateTime, State from dbo.sp_iqtransaction() where

ConnHandle =

3. To view Connections Statistics statistics, execute:

select

stat_name, stat_value from dbo.sp_iqstatistics() where stat_name = 'ConnectionsActive' or stat_name = 'ConnectionsTotalConnections' or stat_name = 'ConnectionsTotalDisconnections' union select 'MaxConnections' as stat_name, property('MaxConnections') as stat_value order by

stat_name

4.1.5 Viewing Transaction Statistics

Display transaction details for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Transactions – Transactions & Versions statistics, execute:

select

Userid, TxnID, VersionID,

SAP IQ Cockpit Non-GUI Administration and Monitoring 36 PUBLIC Monitor SAP IQ State, TxnCreateTime, MainTableKBCr, MainTableKBDr, TempTableKBCr, TempTableKBDr, CursorCount, IQconnId from dbo.sp_iqtransaction() where ConnHandle not in ( select connection_property ('Number') as ConnHandle ) order by

TxnId

2. To view Transactions – Transaction Details statistics, execute:

select

ConnOrCursor, numIQCursors, IQThreads, ConnOrCurCreateTime, IQGovernPriority, CmdLine from sp_iqcontext() where TxnId = order by

ConnOrCurCreateTime

is the id of the transaction(TxnID) from the query in step 1. 3. To view Transaction Statistics : Active Transactions / Other Statistics statistics, execute:

SELECT

)

select

TxnID, TxnCreateTime, now() as TimeNow from dbo.sp_iqtransaction() sptxn where State = 'ACTIVE'

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 37 and sptxn.ConnHandle not in ( select connection_property ('Number') as ConnHandle ) order by

TxnCreateTime

4.1.6 Viewing Dbspaces Statistics

Display dbspace size and usage details, including shared temporary dbspaces, for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Dbspaces and Dbspaces Details statistics, execute:

select

DBSpaceName, DBSpaceType, Writable, Online, Usage, TotalSize, Reserve, NumFiles, NumRWFiles, Stripingon, StripeSize, OkToDrop from dbo.sp_iqdbspace() order by

DBSpaceName

2. To view DB Files and Db File Details statistics, execute:

select

DBFileName, Path, SegmentType, RWMode,

SAP IQ Cockpit Non-GUI Administration and Monitoring 38 PUBLIC Monitor SAP IQ Online, Usage, DBFileSize, Reserve, StripeSize, OkToDrop from dbo.sp_iqfile() where

DBSpaceName = ''

order by

DBFileName

is the dbspace name from the query in step 1.

4.1.7 Viewing Backup and Dependency Statistics

Display backup and dependency details for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Backups statistics, execute:

select

backup_id, backup_time, backup_type, depends_on_id, creator, backup_size, user_comment, backup_command from sp_iqbackupsummary() ORDER BY

backup_time ASC

2. To view Backup Details statistics, execute:

select

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 39

backup_id, backup_time, backup_type, depends_on_id, dbspace_id, dbspace_name, dbspace_rwstatus, dbspace_createid, dbspace_alterid, dbspace_online, dbspace_size, dbspace_backup_size, dbfile_id, dbfile_name, dbfile_rwstatus, dbfile_createid, dbfile_alterid, dbfile_size, dbfile_backup_size, dbfile_path from

sp_iqbackupdetails()

is the ID of the backup returned in the query in step 1. 3. To view Backup Dependencies statistics, execute:

select

backup_id, backup_time, backup_type, depends_on_id, creator, backup_size, user_comment, backup_command from

sp_iqbackupsummary()

ORDER BY

backup_time ASC

is the depends_on_id value from the query in step 2.

4.1.8 Viewing Store I/O Statistics

Display store I/O statistics for the selected SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 40 PUBLIC Monitor SAP IQ Context

Procedure

1. To view Disk Reads / Disk Writes > IQ (catalog) system store statistics, execute:

select

db_property('PageSize') * db_property('DiskRead') / 1024.as DiskReads,

db_property('PageSize') * db_property('DiskWrite') / 1024.as DiskWrites

2. To view Disk Reads / Disk Writes > IQ main store statistics, execute:

select

stat_name, stat_value from dbo.sp_iqstatistics() where stat_name = 'MainStoreDiskReads' or stat_name = 'MainStoreDiskWrites' order by

stat_name

3. To view Disk Reads / Disk Writes > IQ temporary store statistics, execute:

select

stat_name, stat_value from dbo.sp_iqstatistics() where stat_name = 'TempStoreDiskReads' or stat_name = 'TempStoreDiskWrites' order by

stat_name

4.1.9 Viewing Cache Statistics

Display cache statistics for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 41 Context

Procedure

1. To view Cache Size / Cache Reads / Cache Statistics > IQ (catalog) system store cache statistics, execute:

select

now()

2. To view Cache Size / Cache Reads / Cache Statistics > IQ main store cache statistics, execute:

select

stat_name

3. To view Cache Size / Cache Reads / Cache Statistics > Temporary cache statistics, execute:

select

stat_name

SAP IQ Cockpit Non-GUI Administration and Monitoring 42 PUBLIC Monitor SAP IQ 4.1.10 Viewing Table Version Statistics

Display table version details for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Statistics, execute:

select

Name, Value from dbo.sp_iqstatus() where Name like '%Active Txn Versions:%' select Name, Value from dbo.sp_iqstatus() where

Name like '%Other Versions:%'

2. To view Table Versions statistics, execute:

select

VersionID, Server, IQConnID, WasReported, MinKBRelease, MaxKBRelease from dbo.sp_iqversionuse() order by Server,

VersionID

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 43 4.1.11 Viewing Operations and Requests Statistics

Display operation and request details for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Operations statistics, execute:

select

stat_name, stat_value from dbo.sp_iqstatistics() where stat_name = 'OperationsActive' or stat_name = 'OperationsWaiting' order by

stat_name

2. To view Requests statistics, execute:

select

property('ActiveReq'), property('Req'),

property('UnschReq')

SAP IQ Cockpit Non-GUI Administration and Monitoring 44 PUBLIC Monitor SAP IQ 4.1.12 Viewing Network Statistics

Display network statistics for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. In SAP IQ Cockpit, click the MONITOR workset. 2. To view Network Usage statistics, execute:

select

property('BytesReceived'), property('BytesReceivedUncomp'), property('BytesSent'), property('BytesSentUncomp'), property('FreeBuffers'), property('TotalBuffers'),

now()

4.1.13 Viewing Table Page Usage Statistics

Display page usage details for tables or materialized views for the SAP IQ server. Table Page Usage only applies to system tables in the IQ (catalog) system store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 45 Context

Procedure

To view Tables and Table Page Usage Details, execute:

SELECT

T.table_id, T.creator, T.object_id, T.table_name, U.user_name, T.table_type, P.TablePages, P.PctUsedT, P.IndexPages, P.PctUsedI, P.PctOfFile FROM dbo.sa_table_page_usage() P JOIN SYS.SYSTAB T ON T.table_id = P.TableId JOIN SYS.SYSUSER U ON U.user_id = T.creator ORDER BY T.table_name,

U.user_name

4.1.14 Viewing Table Lock Statistics

Display details of locked tables, views or materialized views for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 46 PUBLIC Monitor SAP IQ Procedure

To view Table Locks and Table Lock Details, execute:

CALL dbo.sa_locks( max_locks = -1 )

4.1.15 Viewing Deadlock Statistics

Display deadlock details for the SAP IQ server. You can specify how details are displayed and clear deadlock information.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

To view Deadlocks and Deadlock Details, execute:

SELECT

a.*,b.table_name,u.user_name FROM dbo.sa_report_deadlocks() a LEFT OUTER JOIN ( SYS.SYSTAB b JOIN SYS.SYSUSER u ON b.creator = u.user_id ) ON a.object_id = b.object_id

ORDER BY a.snapshotId

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 47 4.1.16 Viewing RLV Memory Usage Statistics

Display RLV memory usage information at a system-wide and per-table levels for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

To view RLV memory usage per table statistics, execute:

SELECT

T.table_name, R.fragments, R.total, R.data, R.dictionary, R.bitmap FROM sp_iqrlvmemory() R JOIN SYS.SYSTAB T ON T.table_id = R.table_id Order By

T.table_name

4.1.17 Viewing RLV Merge History Statistics

Display historical details on RLV merges for the SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 48 PUBLIC Monitor SAP IQ Context

Procedure

To view RLV Merge History and RLV Merge History Details, execute:

SELECT

TOP 1000 R.merge_id, T.table_name, R.start_time, R.end_time, R.status, R.return_code, R.merge_type, R.merge_mode, R.merge_detail, R.rows_inserted, R.rows_updated, R.rows_deleted, R.rows_forwarded from SYSIQRLVMERGEHISTORY R JOIN SYS.SYSTAB T ON T.table_id = R.table_id Order By

merge_id DESC

4.1.18 Viewing the Statistics Chart

To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Prerequisites

● You have a SQL client running and connected to the embedded SAP SQL Anywhere repository database (not the SAP IQ database). Historical data is stored in the SAP SQL Anywhere repository database.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 49 Procedure

1. To view the KPI history in the repository database, execute this query to select the target resource:

SELECT

DV.V_RES_ID PARENT_RES_ID, DV.V_RES_NM PARENT_RES_NAME, D.RES_ID CHILD_RES_ID, D.RES_NAME CHILD_RES_NAME FROM RES_DV DV,RES_RESOURCE_D D WHERE DV.V_RES_PRNT_ID = D.RES_ID

ORDER BY 1,3

2. Execute this query to select the KPI/KPA:

select kpaName,kpaDescription, statName ,StatDisplayName

from MON_CLCTN_KPA_STAT_DEFS_V

order by 1,3

3. Specify the time range. Filter the statistics by resourceName, statName, and time range:

select

collectionName, collectionStartTime, collectionEndTime, resourceName, resourceTypeName, resourceTypeVersion, kpaName, statName, statNumericValue, statMeasurementUnit, statDisplayName from STATISTICS_FV

where kpaName=''

and statName = ''

and resourceName = ''

and collectionEndTime between ''

and ''

, , and are from the queries in steps 1 and 2.

and specify the time range. Enter values in ISO datetime format.

Example where clause:

...

where kpaName='IQ Availability Statistics' and statName = 'kpi_iq_cpu_total' and resourceName = 'iqdb004' and collectionEndTime between '2020-09-27 15:05:22.977'

and '2020-09-28 16:08:29.977'

SAP IQ Cockpit Non-GUI Administration and Monitoring 50 PUBLIC Monitor SAP IQ 4.1.19 Changing Update Frequency for SAP IQ Server Monitoring

There is no SQL-side equivalent for this SAP IQ Cockpit task.

Context

4.2 Multiplex Servers

Statistics allow you to monitor the availability and performance of multiplex servers.

 Note

Your login policy governs server access. Use a login ID with access to the SERVER logical server to manage a multiplex. SERVER logical server context requires the ACCESS SERVER LS system privilege. In the SAP IQ documentation, see SAP IQ Administration: Multiplex for details on login policies and logical server configuration.

In this section:

Viewing Multiplex Overview Statistics [page 52] Display the overall health of the SAP IQ multiplex.

Multiplex Topology Statistics [page 53] There is no SQL-side equivalent for this SAP IQ Cockpit task.

Viewing Multiplex Server Statistics [page 53] Display statistics for the servers in the SAP IQ multiplex.

Viewing Multiplex Connections Statistics [page 54] Display connection statistics for all servers in an SAP IQ multiplex.

Viewing Multiplex Transaction Statistics [page 55] Display transaction statistics for all servers in an SAP IQ multiplex.

Viewing Multiplex Cache Statistics [page 56] Display cache statistics for all servers in an SAP IQ multiplex.

Viewing the Statistics Chart [page 57] To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Changing Update Frequency for Multiplex Monitoring [page 58] There is no SQL-side equivalent for this SAP IQ Cockpit task.

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 51 4.2.1 Viewing Multiplex Overview Statistics

Display the overall health of the SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Multiplex > Servers statistics, execute:

SELECT

INFO.server_id, INFO.server_name, INFO.role, INFO.status, INFO.connection_info, SRVR.db_path, INFO.coordinator_failover, INFO.inc_state, INFO.private_connection_info, INFO.mipc_public_state, INFO.mipc_priv_state, PROPERTY('Language'), PROPERTY('CharSet'), AGNT.agent_connection_info, AGNT.agent_user_name FROM sp_iqmpxinfo() INFO LEFT OUTER JOIN sys.SYSIQMPXSERVER SRVR ON INFO.server_id = SRVR.server_id LEFT OUTER JOIN sys.SYSIQMPXSERVERAGENT AGNT ON AGNT.server_id = SRVR.server_id

order by SRVR.server_name

2. To view Multiplex > CPU statistics, execute:

select property('ProcessCPUSystem'), property('ProcessCPUUser'), now()

3. To view Multiplex > Memory statistics, execute:

select property('MaxCacheSize') / 1024.,

property('CurrentCacheSize') / 1024., property('CacheRead'), property('CacheHits'), property('CachePinned'), 100 * property('CachePinned') * property('PageSize') / 1024. / property('CurrentCacheSize') as CachePinnedPercent,

SAP IQ Cockpit Non-GUI Administration and Monitoring 52 PUBLIC Monitor SAP IQ cast(property('CurrentCacheSize') as double) / cast(property('MaxCacheSize') as double) * 100 as CacheInUsePercent,

100 * property('CacheFileDirty') * property('PageSize') / 1024. / property('CurrentCacheSize') as DirtyPagesPercent, now()

4. To view Disk usage statistics, execute this stored procedure

dbo.sp_iqspaceused

See sp_iqspaceused Procedure. 5. To view Version Usage > Statistics information, execute:

select Name, Value from dbo.sp_iqstatus() where Name like '%Other Versions:%'

select Name, Value from dbo.sp_iqstatus() where Name like '%Active Txn Versions:%'

6. To view Version Usage > Multiplex Version Usage statistics, execute:

select

VersionID,Server,IQConnID,WasReported,MinKBRelease,MaxKBRelease from dbo.sp_iqversionuse()

order by Server,VersionID

4.2.2 Multiplex Topology Statistics

There is no SQL-side equivalent for this SAP IQ Cockpit task.

4.2.3 Viewing Multiplex Server Statistics

Display statistics for the servers in the SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 53 Procedure

1. In SAP IQ Cockpit, click the MONITOR workset. 2. To view Multiplex Server statistics, execute:

SELECT

order by SRVR.server_name

4.2.4 Viewing Multiplex Connections Statistics

Display connection statistics for all servers in an SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Connections statistics, execute:

select

a.ConnHandle,

SAP IQ Cockpit Non-GUI Administration and Monitoring 54 PUBLIC Monitor SAP IQ a.IQconnID, a.Userid, a.Name, a.ConnCreateTime, a.LastReqTime, a.ReqType, a. LastIQCmdTime, a.IQCmdType, a.TempTableSpaceKB, a.TempWorkSpaceKB, a.IQCursors, a.IQthreads, CONNECTION_PROPERTY( 'NodeAddress',a.ConnHandle ) as NodeAddress, b.CmdLine, b.ConnOrCursor, a.INCConnSuspended, c.ConnHandle from dbo.sp_iqconnection() a INNER JOIN dbo.sp_iqcontext() b ON a.ConnHandle = b.ConnHandle LEFT OUTER JOIN dbo.sp_iqmpxsuspendedconninfo() c on a.ConnHandle = c.ConnHandle

order by ConnCreateTime

2. To view Active Connections statistics, execute:

select

select count(*) from dbo.sp_iqconnection() where MPXServerName is not null

4.2.5 Viewing Multiplex Transaction Statistics

Display transaction statistics for all servers in an SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 55 Procedure

To view Transactions statistics, execute:

select

Userid, TxnID, VersionID, State, TxnCreateTime, MainTableKBCr, MainTableKBDr, TempTableKBCr, TempTableKBDr, CursorCount, IQconnId from dbo.sp_iqtransaction() where ConnHandle not in (select connection_property ( 'Number' ) as ConnHandle)

order by TxnId

4.2.6 Viewing Multiplex Cache Statistics

Display cache statistics for all servers in an SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view Cache Size / Cache Reads > Catalog Cache statistics, execute:

select

property('MaxCacheSize') / 1024., property('CurrentCacheSize') / 1024., property('CacheRead'), property('CacheHits'), property('CachePinned'), 100 * property('CachePinned') * property('PageSize') / 1024. / property('CurrentCacheSize') as CachePinnedPercent, cast(property('CurrentCacheSize') as double) / cast(property('MaxCacheSize') as double) * 100 as CacheInUsePercent,

SAP IQ Cockpit Non-GUI Administration and Monitoring 56 PUBLIC Monitor SAP IQ 100 * property('CacheFileDirty') * property('PageSize') / 1024. / property('CurrentCacheSize') as DirtyPagesPercent,

now()

2. To view Cache Size / Cache Reads > Main Cache statistics, execute:

select

stat_name,stat_value,now() from dbo.sp_iqstatistics() where stat_name = 'MainCacheCurrentSize' or stat_name = 'MainCacheFinds' or stat_name = 'MainCacheHits' or stat_name = 'MainCachePagesPinned' or stat_name = 'MainCachePagesPinnedPercentage' or stat_name = 'MainCachePagesInUsePercentage' or stat_name = 'MainCachePagesDirtyPercentage'

order by stat_name

3. To view Cache Size / Cache Reads > Temporary Cache statistics, execute:

select

stat_name,stat_value,now() from dbo.sp_iqstatistics() where stat_name = 'TempCacheCurrentSize' or stat_name = 'TempCacheFinds' or stat_name = 'TempCacheHits' or stat_name = 'TempCachePagesPinned' or stat_name = 'TempCachePagesPinnedPercentage' or stat_name = 'TempCachePagesInUsePercentage' or stat_name = 'TempCachePagesDirtyPercentage'

order by stat_name

4.2.7 Viewing the Statistics Chart

To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Prerequisites

● You have a SQL client running and connected to the embedded SAP SQL Anywhere repository database (not the SAP IQ database). Historical data is stored in the SAP SQL Anywhere repository database.

Context

Procedure

1. To view the KPI history in the repository database, execute this query to select the target resource:

SELECT

DV.V_RES_ID PARENT_RES_ID, DV.V_RES_NM PARENT_RES_NAME, D.RES_ID CHILD_RES_ID,

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 57 D.RES_NAME CHILD_RES_NAME FROM RES_DV DV,RES_RESOURCE_D D WHERE DV.V_RES_PRNT_ID = D.RES_ID

ORDER BY 1,3

2. Execute this query to select the KPI/KPA:

select kpaName,kpaDescription, statName ,StatDisplayName

from MON_CLCTN_KPA_STAT_DEFS_V

order by 1,3

3. Specify the time range. Filter the statistics by resourceName, statName, and time range:

select

where kpaName=''

and statName = ''

and resourceName = ''

and collectionEndTime between ''

and ''

, , and are from the queries in steps 1 and 2.

and specify the time range. Enter values in ISO datetime format.

Example where clause:

...

where kpaName='IQ Availability Statistics' and statName = 'kpi_iq_cpu_total' and resourceName = 'iqdb004' and collectionEndTime between '2020-09-27 15:05:22.977'

and '2020-09-28 16:08:29.977'

4.2.8 Changing Update Frequency for Multiplex Monitoring

There is no SQL-side equivalent for this SAP IQ Cockpit task.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 58 PUBLIC Monitor SAP IQ 4.3 Logical Servers

Statistics allow you to monitor the availability and performance of logical servers.

In this section:

Viewing Logical Server Overview Statistics [page 59] Display the overall health of the logical servers in an SAP IQ multiplex.

Viewing Logical Server Statistics [page 60] Display statistics for logical servers in the SAP IQ multiplex.

Viewing the Statistics Chart [page 61] To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Changing Update Frequency for Logical Server Monitoring [page 62] There is no SQL-side equivalent for this SAP IQ Cockpit task.

4.3.1 Viewing Logical Server Overview Statistics

Display the overall health of the logical servers in an SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

1. To view CPU statistics, execute:

select property('ProcessCPUSystem'), property('ProcessCPUUser'), now()

2. To view IQ Memory statistics, execute:

select property('MaxCacheSize') / 1024.,

property('CurrentCacheSize') / 1024., property('CacheRead'), property('CacheHits'),

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 59 property('CachePinned'), 100 * property('CachePinned') * property('PageSize') / 1024. / property('CurrentCacheSize') as CachePinnedPercent, cast(property('CurrentCacheSize') as double) / cast(property('MaxCacheSize') as double) * 100 as CacheInUsePercent,

100 * property('CacheFileDirty') * property('PageSize') / 1024. / property('CurrentCacheSize') as DirtyPagesPercent, now()

4.3.2 Viewing Logical Server Statistics

Display statistics for logical servers in the SAP IQ multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

Procedure

To view Logical Server statistics, execute:

SELECT

order by SRVR.server_name

SAP IQ Cockpit Non-GUI Administration and Monitoring 60 PUBLIC Monitor SAP IQ 4.3.3 Viewing the Statistics Chart

To show performance trends, generate a graph for any set of performance counters over a specified period of time.

Prerequisites

● You have a SQL client running and connected to the embedded SAP SQL Anywhere repository database (not the SAP IQ database). Historical data is stored in the SAP SQL Anywhere repository database.

Context

Procedure

1. To view the KPI history in the repository database, execute this query to select the target resource:

SELECT

DV.V_RES_ID PARENT_RES_ID, DV.V_RES_NM PARENT_RES_NAME, D.RES_ID CHILD_RES_ID, D.RES_NAME CHILD_RES_NAME FROM RES_DV DV,RES_RESOURCE_D D WHERE DV.V_RES_PRNT_ID = D.RES_ID

ORDER BY 1,3

2. Execute this query to select the KPI/KPA:

select kpaName,kpaDescription, statName ,StatDisplayName

from MON_CLCTN_KPA_STAT_DEFS_V

order by 1,3

3. Specify the time range. Filter the statistics by resourceName, statName, and time range:

select

where kpaName=''

and statName = ''

and resourceName = ''

SAP IQ Cockpit Non-GUI Administration and Monitoring Monitor SAP IQ PUBLIC 61 and collectionEndTime between ''

and ''

, , and are from the queries in steps 1 and 2.

and specify the time range. Enter values in ISO datetime format.

Example where clause:

...

where kpaName='IQ Availability Statistics' and statName = 'kpi_iq_cpu_total' and resourceName = 'iqdb004' and collectionEndTime between '2020-09-27 15:05:22.977'

and '2020-09-28 16:08:29.977'

4.3.4 Changing Update Frequency for Logical Server Monitoring

There is no SQL-side equivalent for this SAP IQ Cockpit task.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 62 PUBLIC Monitor SAP IQ 5 Administer SAP IQ

Manage a single-node or multiplex server in the SAP IQ environment.

In this section:

Executing a SQL Query [page 65] Execute an ad hoc SQL query or a stored procedure against one or more SAP IQ servers.

The SAP IQ Server [page 65] Start, or stop a server, view properties, change server configuration, or generate administration scripts.

Multiplex [page 70] Change a multiplex configuration, manage the coordinator, secondary and failover nodes, and configure logical servers, start and stop servers. Statistics let you monitor multiplex availability and performance.

Logical Servers [page 83] A logical server allows you to group a subset of physical hardware resources together as a logical entity that appears as a single multiplex server, when it is actually one or more servers within the physical multiplex.

Logical Server Policies [page 88] A logical server policy is associated with each logical server. Configure logical server policy options to control behavior of all associated logical servers.

Remote Servers [page 91] A remote server allows you to set up access to remote database objects, using external logins, proxy tables and remote procedures.

External Logins [page 95] External logins are alternate login names and passwords to be used when communicating with a remote server (in order to set up access to remote database objects).

Databases [page 98] Create a database and view database options and properties.

Tables [page 104] Create, delete, and display tables (including global temporary tables and proxy tables), and manage their properties, in SAP IQ.

Views [page 171] A view is a computed table defined by the result set of its view definition, expressed as a SQL query. You can use views to show database users exactly the information you want to present, in a format you can control.

Domains [page 187] Domains are user-defined data types. They improve convenience and encourage consistency in the database.

Text Configuration Objects [page 194] Create, delete, generate DDL, and manage the properties of text configuration objects.

Text Indexes [page 198]

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 63 Create, delete, generate DDL, and manage the properties of text indexes and text configuration objects. A text index stores positional information for terms in an indexed column. Text indexes are created using settings stored in a text configuration object.

Sequence Generators [page 205] Sequence generators are used to generate values that are unique across multiple tables, and to generate default values that are something other than the set of natural numbers (1, 2, 3...).

Spatial Support [page 212] A spatial reference system describes where local, regional or global features are located. It defines a specific map projection, as well as transformations between different spatial reference systems.

Security and User Management [page 219] Security encompasses the areas of user, authentication and login management.

Dbspaces [page 330] Add, modify, view properties, or delete a dbspace.

Dbfiles [page 337] Add, modify, view properties, or delete a database file.

Events [page 341] You can automate routine tasks by adding an event to a database, and providing a schedule or conditional trigger for the event. In a multiplex, an event is a global object that is shared across all nodes participating in the multiplex.

External Environments [page 350] Install, delete, update, and modify the components of external development environments.

Functions [page 373] Create, delete, display, and manage the properties of functions in SAP IQ.

Procedures [page 381] Create, delete, display, and manage the properties of procedures in SAP IQ, including remote procedures and table-valued user-defined functions / table parameterized functions.

Web Services [page 390] The IQ (catalog) system store contains a built-in HTTP server that allows you to provide Web services, as well as to access Web services in other databases and over the Internet. You can manage Web services only for IQ (catalog) system store tables.

Related Information

Configure SQL-Based Exploring [page 21]

SAP IQ Cockpit Non-GUI Administration and Monitoring 64 PUBLIC Administer SAP IQ 5.1 Executing a SQL Query

Execute an ad hoc SQL query or a stored procedure against one or more SAP IQ servers.

Context

See SAP IQ Interactive SQL Guide.

5.2 The SAP IQ Server

Start, or stop a server, view properties, change server configuration, or generate administration scripts.

In this section:

Editing the SAP IQ Server Configuration File [page 66] Use the start_iq utility to set SAP IQ server configuration settings including administrative, memory, connection, and debugging settings.

Starting an SAP IQ Server [page 66] Start an SAP IQ server.

Stopping an SAP IQ Server [page 67] Stop an SAP IQ server.

Converting a Multiplex to an SAP IQ Server [page 67] Drop all secondary servers convert a multiplex to an SAP IQ server.

Generating an Administration Script for an SAP IQ Server [page 68] Generate the configuration file and scripts for starting, stopping, and synchronizing an SAP IQ server.

Upgrading an SAP IQ Server Database [page 68] Upgrade a database to the current version.

Viewing or Modifying SAP IQ Server Properties [page 69] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Server Privilege Summary [page 69] A list of the system privileges and object permissions required to complete the various SAP IQ server tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 65 5.2.1 Editing the SAP IQ Server Configuration File

Use the start_iq utility to set SAP IQ server configuration settings including administrative, memory, connection, and debugging settings.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See start_iq Database Server Startup Utility.

5.2.2 Starting an SAP IQ Server

Start an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See Starting and Stopping Databases.

See start_iq Database Server Startup Utility.

SAP IQ Cockpit Non-GUI Administration and Monitoring 66 PUBLIC Administer SAP IQ 5.2.3 Stopping an SAP IQ Server

Stop an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See stop_iq Database Shutdown Utility.

5.2.4 Converting a Multiplex to an SAP IQ Server

Drop all secondary servers convert a multiplex to an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See Dropping a Secondary Server from a Multiplex.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 67 5.2.5 Generating an Administration Script for an SAP IQ Server

Generate the configuration file and scripts for starting, stopping, and synchronizing an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See Configuration Files and Automatic Server Startup.

5.2.6 Upgrading an SAP IQ Server Database

Upgrade a database to the current version.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

See ALTER DATABASE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 68 PUBLIC Administer SAP IQ 5.2.7 Viewing or Modifying SAP IQ Server Properties

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.2.8 Server Privilege Summary

A list of the system privileges and object permissions required to complete the various SAP IQ server tasks.

Editing the SAP IQ Server Configuration File

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Starting or Stopping an SAP IQ Server

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 SERVER OPERATOR system privilege

Converting an SAP IQ to a Multiplex

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 69 Generating an Administration Script for an SAP IQ Server

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Upgrading an SAP IQ Server

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 Not supported

Viewing or Modifying SAP IQ Server Properties

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 View any SAP IQ server property page – none

Modify any SAP IQ server property – DBA authority

SAP IQ 16.1 View any SAP IQ server property page – none

Modify any property on the Configuration or Options property page – SERVER OPERA TOR system privilege

Modify any property on the Request Logging property page – one of:

● MANAGE PROFILING system privilege ● SERVER OPERATOR system privilege

5.3 Multiplex

Change a multiplex configuration, manage the coordinator, secondary and failover nodes, and configure logical servers, start and stop servers. Statistics let you monitor multiplex availability and performance.

 Note

SAP IQ Cockpit Non-GUI Administration and Monitoring 70 PUBLIC Administer SAP IQ In this section:

Editing the Multiplex Server Configuration File [page 72] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Starting a Multiplex Server [page 72] Start a multiplex node.

Stopping a Multiplex Server [page 72] Stop a multiplex node.

Including an Excluded Secondary Server [page 73] Include a previously excluded secondary server when the excluded server's shutdown period is over.

Excluding a Secondary Server [page 73] To save disk space, exclude any secondary server that will be shut down for an extended period.

Synchronizing a Secondary Server [page 74] Synchronization updates a secondary server with respect to the coordinator.

Adding a Secondary Server [page 74] Add a secondary server to the multiplex server.

Dropping a Secondary Server [page 75] Remove a secondary server from a multiplex server. You can drop the designated failover server only if it’s the only secondary server in the multiplex.

Generating Administration Scripts for a Multiplex Server [page 75] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Upgrading a Multiplex Server [page 75] Upgrade an SAP IQ multiplex server to the current version.

Converting an SAP IQ Server to Multiplex [page 76] Add a secondary server to an SAP IQ server to convert it to a multiplex.

Reconfiguring a Multiplex Server [page 76] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Enabling and Disabling an RLV Store [page 76] Enable or disable an RLV store.

Enabling and Disabling High Availability [page 77] High availability must be enabled for every server in the multiplex, to implement high availability.

Viewing or Modifying Multiplex Properties [page 77] View or change the properties for the selected multiplex.

Modifying Multiplex Server Properties [page 78] Change the properties for the selected multiplex server.

Failover [page 78] Manual failover promotes a server to act as the coordinator if there is a coordinator node failure or maintenance shutdown.

Multiplex Privilege Summary [page 78] A list of the system privileges and object permissions required to complete the various multiplex server tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 71 5.3.1 Editing the Multiplex Server Configuration File

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.3.2 Starting a Multiplex Server

Start a multiplex node.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Starting a Multiplex Server.

5.3.3 Stopping a Multiplex Server

Stop a multiplex node.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Stopping Servers.

SAP IQ Cockpit Non-GUI Administration and Monitoring 72 PUBLIC Administer SAP IQ 5.3.4 Including an Excluded Secondary Server

Include a previously excluded secondary server when the excluded server's shutdown period is over.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Including or Excluding a Multiplex Server.

5.3.5 Excluding a Secondary Server

To save disk space, exclude any secondary server that will be shut down for an extended period.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Including or Excluding a Multiplex Server.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 73 5.3.6 Synchronizing a Secondary Server

Synchronization updates a secondary server with respect to the coordinator.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Synchronizing Multiplex Servers.

5.3.7 Adding a Secondary Server

Add a secondary server to the multiplex server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Adding a Secondary Server to a Multiplex.

SAP IQ Cockpit Non-GUI Administration and Monitoring 74 PUBLIC Administer SAP IQ 5.3.8 Dropping a Secondary Server

Remove a secondary server from a multiplex server. You can drop the designated failover server only if it’s the only secondary server in the multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Dropping a Secondary Server from a Multiplex.

5.3.9 Generating Administration Scripts for a Multiplex Server

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.3.10 Upgrading a Multiplex Server

Upgrade an SAP IQ multiplex server to the current version.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 75 Context

To perform this task using SQL, see ALTER DATABASE Statement.

5.3.11 Converting an SAP IQ Server to Multiplex

Add a secondary server to an SAP IQ server to convert it to a multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Converting a Database to a Multiplex.

5.3.12 Reconfiguring a Multiplex Server

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.3.13 Enabling and Disabling an RLV Store

Enable or disable an RLV store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 76 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see ALTER MULTIPLEX SERVER Statement.

5.3.14 Enabling and Disabling High Availability

High availability must be enabled for every server in the multiplex, to implement high availability.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see High Availability.

5.3.15 Viewing or Modifying Multiplex Properties

View or change the properties for the selected multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Altering a Multiplex Server.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 77 5.3.16 Modifying Multiplex Server Properties

Change the properties for the selected multiplex server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Altering a Multiplex Server.

5.3.17 Failover

Manual failover promotes a server to act as the coordinator if there is a coordinator node failure or maintenance shutdown.

To perform this task using SQL, see Coordinator Failure.

5.3.18 Multiplex Privilege Summary

A list of the system privileges and object permissions required to complete the various multiplex server tasks.

Editing the Multiplex Server Configuration File

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring 78 PUBLIC Administer SAP IQ Starting or Stopping a Multiplex Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 SERVER OPERATOR system privilege

Including a Secondary Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● All of these authorities: ○ MULTIPLEX ADMIN authority ○ BACKUP authority

SAP IQ 16.1 All of:

● MANAGE MULTIPLEX system privilege ● SERVER OPERATOR system privilege ● BACKUP DATABASE system privilege

Excluding a Secondary Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Synchronizing a Secondary Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 All of:

● SERVER OPERATOR system privileges ● BACKUP DATABASE system privileges

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 79 Adding a Secondary Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● All of these authorities: ○ MULTIPLEX ADMIN authority ○ SPACE ADMIN authority ○ BACKUP authority

SAP IQ 16.1 All of:

● SERVER OPERATOR system privilege ● MANAGE MULTIPLEX system privilege ● MANAGE ANY DBSPACE system privilege ● BACKUP DATABASE system privilege

Dropping a Secondary Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● All of these authorities: ○ MULTIPLEX ADMIN authority ○ SPACE ADMIN authority ○ BACKUP authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Generating an Administration Script for a Multiplex Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Upgrading a Multiplex Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ Cockpit Non-GUI Administration and Monitoring 80 PUBLIC Administer SAP IQ Database Version Multiplex Privileges Required

SAP IQ 16.1 Not supported

Converting an SAP IQ Server to a Multiplex

Database Version SAP IQ Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Reconfiguring a Multiplex Server

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 Change server name, port or database location – all of:

● MULTIPLEX ADMIN authority ● BACKUP authority

All other changes require DBA authority

SAP IQ 16.1 All of:

● SERVER OPERATOR system privilege ● BACKUP DATABASE system privilege

Enabling and Disabling an RLV Store Node

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 Not supported.

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 81 Enabling and Disabling High Availability

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 Requires one of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Viewing or Modifying Multiplex Server Properties

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 View multiplex properties – none

Modify multiplex properties – one of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 View multiplex properties – none

Modify any property on the Configuration page – all of:

● SERVER OPERATOR system privilege ● BACKUP DATABASE system privilege ● MANAGE MULTIPLEX system privilege

Modify any property on the Options property page – SERVER OPERATOR system privi lege

Modify any property on the Request Logging property page – one of:

● MANAGE PROFILING system privilege ● SERVER OPERATOR system privilege

Modify any property on the High Availability property page – MANAGE MULTIPLEX sys tem privilege and the coordinator is running. The SAP IQ Cockpit agent for the multiplex server for which the Properties page is open must also be running.

SAP IQ Cockpit Non-GUI Administration and Monitoring 82 PUBLIC Administer SAP IQ Viewing or Modifying Multiplex Properties

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 View multiplex properties – none

Modify multiplex properties – one of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 View multiplex properties – none

Modify any property on the Configuration page – MANAGE MULTIPLEX system privi lege

Designating the Failover Node

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 All of:

● MANAGE MULTIPLEX system privilege ● SERVER OPERATOR system privilege ● BACKUP DATABASE system privilege

Performing Coordinator Node Failover

Database Version Multiplex Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

5.4 Logical Servers

A logical server allows you to group a subset of physical hardware resources together as a logical entity that appears as a single multiplex server, when it is actually one or more servers within the physical multiplex.

In the SAP IQ documentation, see SAP IQ Administration: Multiplex > Logical Servers for logical server concepts and logical server policy concepts.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 83 In this section:

Creating a Logical Server [page 84] Create a logical server to group multiple physical multiplex servers into a single logical entity.

Deleting a Logical Server [page 85] Delete a logical server from the database. Deleting a logical server does not delete its component multiplex nodes from the database.

Configuring Logical Server Node Membership [page 85] Add or remove multiplex nodes to or from the logical server.

Altering a Logical Server Assignment [page 86] Add one or more user-defined logical servers to a login policy. A check prevents membership overlap among the logical servers assigned to the login policy.

Generating DDL Commands for a Logical Server [page 86] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Modifying Logical Server Properties [page 86] Change the properties of the multiplex nodes associated with a logical server.

Logical Server Privilege Summary [page 87] A list of the system privileges and object permissions required to complete the various logical server tasks

5.4.1 Creating a Logical Server

Create a logical server to group multiple physical multiplex servers into a single logical entity.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Creating a Logical Server.

SAP IQ Cockpit Non-GUI Administration and Monitoring 84 PUBLIC Administer SAP IQ 5.4.2 Deleting a Logical Server

Delete a logical server from the database. Deleting a logical server does not delete its component multiplex nodes from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Dropping a Logical Server.

5.4.3 Configuring Logical Server Node Membership

Add or remove multiplex nodes to or from the logical server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Altering Membership of a Logical Server.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 85 5.4.4 Altering a Logical Server Assignment

Add one or more user-defined logical servers to a login policy. A check prevents membership overlap among the logical servers assigned to the login policy.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Manage Logical Server Membership.

5.4.5 Generating DDL Commands for a Logical Server

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.4.6 Modifying Logical Server Properties

Change the properties of the multiplex nodes associated with a logical server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 86 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see Manage Resources Through Logical Servers.

5.4.7 Logical Server Privilege Summary

A list of the system privileges and object permissions required to complete the various logical server tasks

Creating a Logical Server

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Deleting a Logical Server

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Configuring Logical Server Node Membership

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 87 Altering a Logical Server Assignment

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Generating DDL Commands for a Logical Server

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Logical Server Properties

Database Version Logical Server Privileges Required

SAP IQ 15.3 and 15.4 View logical server properties – none

Modify logical server properties – one of:

● DBA authority ● MULTIPLEX ADMIN authority

SAP IQ 16.1 View any logical server property page – none

Modify any logical server property – MANAGE MULTIPLEX system privilege

5.5 Logical Server Policies

A logical server policy is associated with each logical server. Configure logical server policy options to control behavior of all associated logical servers.

In this section:

Creating a Logical Server Policy [page 89] Control behavior of all logical servers associated with a new logical server policy.

Deleting a Logical Server Policy [page 89] Delete a logical server policy from the database.

SAP IQ Cockpit Non-GUI Administration and Monitoring 88 PUBLIC Administer SAP IQ Generating DDL Commands for a Logical Server Policy [page 90] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Modifying Logical Server Policy Properties [page 90] Change behavior such as distributed query processing for servers associated with a logical server policy.

Logical Server Policy Privilege Summary [page 90] A list of the system privileges and object permissions required to complete the various logical server policy tasks

5.5.1 Creating a Logical Server Policy

Control behavior of all logical servers associated with a new logical server policy.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE LS POLICY Statement.

5.5.2 Deleting a Logical Server Policy

Delete a logical server policy from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP LS POLICY Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 89 5.5.3 Generating DDL Commands for a Logical Server Policy

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.5.4 Modifying Logical Server Policy Properties

Change behavior such as distributed query processing for servers associated with a logical server policy.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To modify logical server policy properties using SQL, see ALTER LS POLICY Statement.

5.5.5 Logical Server Policy Privilege Summary

A list of the system privileges and object permissions required to complete the various logical server policy tasks

Creating a Logical Server Policy

Database Version Logical Server Policy Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 90 PUBLIC Administer SAP IQ Deleting a Logical Server Policy

Database Version Logical Server Policy Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE MULTIPLEX system privilege

Generating DDL Commands for a Logical Server Policy

Database Version Logical Server Policy Privileges Required

SAP IQ15.3 and 15.4 Not supported

SAP IQ 16.1 None

Viewing or Modifying Logical Server Policy Properties

Database Version Logical Server Policy Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 View any logical server policy property page – none

Modify any logical server policy property – MANAGE MULTIPLEX system privilege

5.6 Remote Servers

A remote server allows you to set up access to remote database objects, using external logins, proxy tables and remote procedures.

For some systems, including SAP IQ and SQL Anywhere, each data source describes a database; therefore, you must define a separate remote server definition for each database.

In this section:

Creating a Remote Server [page 92] Before you can map remote objects to a local proxy table, you must define the remote server where the remote object is located.

Testing a Remote Server Connection [page 92] Test the physical connection to one or more remote servers.

Deleting a Remote Server [page 93] Remove one or more existing Remote Server definitions, along with all associated proxy tables, remote procedures and external login definitions.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 91 Generating Remote Server DDL Commands [page 93] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Modifying Remote Server Properties [page 93] Change the properties of the selected remote server definition.

Remote Server Privilege Summary [page 94] A list of the system privileges and object permissions required to complete the various remote server tasks

5.6.1 Creating a Remote Server

Before you can map remote objects to a local proxy table, you must define the remote server where the remote object is located.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SERVER Statement.

5.6.2 Testing a Remote Server Connection

Test the physical connection to one or more remote servers.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see sp_remote_tables system procedure.

SAP IQ Cockpit Non-GUI Administration and Monitoring 92 PUBLIC Administer SAP IQ 5.6.3 Deleting a Remote Server

Remove one or more existing Remote Server definitions, along with all associated proxy tables, remote procedures and external login definitions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SERVER Statement.

5.6.4 Generating Remote Server DDL Commands

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.6.5 Modifying Remote Server Properties

Change the properties of the selected remote server definition.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 93 Context

To modify remote server properties using SQL, see ALTER SERVER Statement.

5.6.6 Remote Server Privilege Summary

A list of the system privileges and object permissions required to complete the various remote server tasks

Creating a Remote Server

Database Version Remote Server Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 SERVER OPERATOR system privilege

Testing a Remote Server Connection

Database Version Remote Server Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Deleting a Remote Server

Database Version Remote Server Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 SERVER OPERATOR system privilege

Generating Remote Server DDL Commands

Database Version Remote Server Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring 94 PUBLIC Administer SAP IQ Viewing or Modifying Remote Server Properties

Database Version Remote Server Privileges Required

SAP IQ 15.3 and 15.4 View remote server properties – none

Modify remote server properties – DBA authority

SAP IQ 16.1 View any remote server property page – none

Modify any remote server property – SERVER OPERATOR system privilege

5.7 External Logins

External logins are alternate login names and passwords to be used when communicating with a remote server (in order to set up access to remote database objects).

By default, IQ uses the names and passwords of its clients whenever it connects to a remote server or directory access server on behalf of those clients. However, you can override this default by creating external logins.

 Note

You must define a remote server before you can create an external login.

When you create a remote server definition, you have the option of creating an external login for your user ID. Using the Create External Login wizard, you can create external logins for other user IDs

In this section:

Creating an External Login [page 96] Define an alternate login name and password by specifying the remote server to create an external login for, and the local user the external login applies to.

Deleting an External Login [page 96] Delete one or more external login definitions.

Generating External Login DDL Commands [page 97] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Viewing External Login Properties [page 97] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

External Login Privilege Summary [page 97] A list of the system privileges and object permissions required to complete the various external login tasks

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 95 5.7.1 Creating an External Login

Define an alternate login name and password by specifying the remote server to create an external login for, and the local user the external login applies to.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE EXTERNLOGIN Statement.

5.7.2 Deleting an External Login

Delete one or more external login definitions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, seeDROP EXTERNLOGIN Statement .

SAP IQ Cockpit Non-GUI Administration and Monitoring 96 PUBLIC Administer SAP IQ 5.7.3 Generating External Login DDL Commands

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.7.4 Viewing External Login Properties

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.7.5 External Login Privilege Summary

A list of the system privileges and object permissions required to complete the various external login tasks

Creating an External Login

Database Version External Login Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority

SAP IQ 16.1 MANAGE ANY USER system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 97 Deleting an External Login

Database Version External Login Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority

SAP IQ 16.1 MANAGE ANY USER system privilege

Generating External Login DDL Commands

Database Version External Login Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing External Login Properties

Database Version External Login Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

5.8 Databases

Create a database and view database options and properties.

 Note

An SAP IQ server cannot have multiple databases. Attempting to manage, monitor, or administer an SAP IQ server connected to multiple databases may cause unexpected results.

In this section:

Creating a Database [page 99] Create an SAP IQ database.

Creating a Database Using a CSV File [page 99] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Setting Database Options [page 100] Adjust the configurable settings of a database to change the way the database behaves or performs.

SAP IQ Cockpit Non-GUI Administration and Monitoring 98 PUBLIC Administer SAP IQ Configuring Point-in-Time Recovery Options [page 100] Enable or disable point-in-time (PITR) recovery logging and define available options.

Purging Backup History [page 101] Remove select backup events from the backup history log file, including all related details.

Modifying Database Properties [page 101] Modify editable properties for the database.

Database Privilege Summary [page 102] A list of the system privileges and object permissions required to complete the various database tasks.

5.8.1 Creating a Database

Create an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE DATABASE Statement.

5.8.2 Creating a Database Using a CSV File

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 99 5.8.3 Setting Database Options

Adjust the configurable settings of a database to change the way the database behaves or performs.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Set a Database Option.

Related Information

Alphabetical List of Options

5.8.4 Configuring Point-in-Time Recovery Options

Enable or disable point-in-time (PITR) recovery logging and define available options.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Point-in-Time Recovery.

SAP IQ Cockpit Non-GUI Administration and Monitoring 100 PUBLIC Administer SAP IQ 5.8.5 Purging Backup History

Remove select backup events from the backup history log file, including all related details.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Backup History.

5.8.6 Modifying Database Properties

Modify editable properties for the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER DATABASE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 101 5.8.7 Database Privilege Summary

A list of the system privileges and object permissions required to complete the various database tasks.

Creating a Database

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 DBA authority. The account under which the server is running must have write permis sions on the directories where files are created.

SAP IQ 16.1 The account under which the server is running must have write permissions on the di rectories where files are created. No other system privilege is required.

Creating a Database Using CSV File

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 The account under which the server is running must have write permissions on the di rectories where files are created. No other system privilege is required.

Setting Database Options

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 View database options only – none

Modify database options – DBA authority

SAP IQ 16.1 View database options only – none

Modify database options – Depending on the option being modified, one of:

● SET ANY PUBLIC OPTION system privilege ● SET ANY SECURITY OPTION system privilege ● SET ANY SYSTEM OPTION system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 102 PUBLIC Administer SAP IQ Configuring Point-in-Time Recovery Options

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Set PITR database options — SET ANY SYSTEM OPTION system privilege

Set PITR logging options — MANAGE ANY DBSPACE system privilege

Purging Backup History

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 BACKUP DATABASE system privilege

Viewing or Modifying Database Properties

Database Version Database Privileges Required

SAP IQ 15.3 and 15.4 View database license management property page – EXECUTE permission on the sp_iqlmconfig system procedure to display the content of the page.

View any other database property page – none

Modify the following properties on the Settings page:

● Include SQL statement information option – EXECUTE permission on the sa_server_option system procedure to modify this setting. ● Collect Information about deadlocks option – DBA authority ● Clear Deadlock Information Now option – DBA authority

Modify any other database property – DBA authority

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 103 Database Version Database Privileges Required

SAP IQ 16.1 View database license management property page – EXECUTE permission on the sp_iqlmconfig system procedure along with the SERVER OPERATOR system privi lege to display the content of the page.

View any other database property page – none

Modify the following properties on the Settings page:

● Refresh button – SERVER OPERATOR or ALTER DATABASE system privilege ● Collect Information about deadlocks option – SET ANY SYSTEM OPTION system privilege ● Include SQL statement information option – EXECUTE permission on the sa_server_option system procedure along with the SERVER OPERATOR sys tem privilege to modify this setting. ● Clear Deadlock Information Now option – SERVER OPERATOR system privilege

Modify properties on the license management page – SERVER OPERATOR system privi lege

5.9 Tables

Create, delete, and display tables (including global temporary tables and proxy tables), and manage their properties, in SAP IQ.

Tables consist of rows and columns. Each column carries a particular kind of information, such as a phone number or a name, while each row specifies a particular entry.

When a database is first created, the only tables in the database are the system tables, which hold the database schema. You can create new tables to hold your actual data.

In this section:

Creating an IQ (Catalog) System Store Table [page 106] A base table holds persistent data. (The table and its data continue to exist until you explicitly delete the data or drop the table.)

Creating an IQ Main Store Table with No Partitions [page 107] A base table holds persistent data. (The table and its data continue to exist until you explicitly delete the data or drop the table.)

Creating a Table with a Hash Partition [page 107] A table with a hash partition can only reside in the IQ main store.

Creating a Table with a Range Partition [page 108] A table with a range partition can only reside in the IQ main store.

Creating a Table with a Hash-Range Partition [page 108] A table with a hash-range partition can only reside in the IQ main store.

Creating a Global Temporary Table [page 109]

SAP IQ Cockpit Non-GUI Administration and Monitoring 104 PUBLIC Administer SAP IQ Add a global temporary table to the database. A global temporary table definition is kept in the database permanently. (The data disappears when you close the connection.)

Creating a Proxy Table [page 109] A proxy table is a locally named alias, displayed as a table that points to a remote object such as an entire table, a view, a materialized view, or a set of remote table columns. Before you can map remote objects to a local proxy table, you must define the remote server where the remote object is located.

Viewing Table Data [page 110] Execute a SELECT * FROM query and display contents of the table, global temporary table or proxy table.

Deleting a Table [page 110] Delete a table, global temporary table or proxy table from the database.

Generating Table DDL Commands [page 111] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Moving a Table to Another Dbspace [page 111] You can move the table from the current dbspace to another dbspace. This feature is available only for tables in the IQ main store.

Validating an IQ (Catalog) System Store Table [page 111] Check the validity of an IQ (catalog) system store table.

Setting the Primary Key [page 112] Set the primary key to prohibit two or more rows in the table from having identical values for a column or set of columns. You can set the primary key on base tables and global temporary tables only.

Removing the Primary Key [page 112] Remove the primary key from a table.

Setting a Clustered Index [page 113] Set a clustered index on an IQ (catalog) system store table. Using a clustered index increases the chance that two rows from adjacent index entries will appear on the same page in the database. This strategy can lead to performance benefits by reducing the number of times a table page needs to be read into the buffer pool.

Merging Table Data from RLV Store with IQ Main Store [page 113] Read-write data from a table enabled with row-level versioning (RLV) is housed in the RLV store, and periodically merged automatically with the table's data in the IQ main store. However, you can explicitly merge this RLV-enabled table data from the RLV store with the IQ main store data.

Calculating the Number of Rows in a Table [page 114] Calculate an accurate row count for a base or proxy table.

Moving Table Objects to Another Dbspace [page 114] You can move SAP IQ table objects—including indexes, columns, and partitions—from the current dbspace to another dbspace. This feature is available only for tables in the IQ main store.

Enabling or Disabling Row-Level Versioning in a Table [page 115] You can set an IQ main store base table to use row-level versioning (RLV) in order to track row changes for read-write transactions.

Modifying Base Table Properties [page 115] Change the properties of the selected IQ main store or IQ (catalog) system store base table.

Modifying Global Temporary Table Properties [page 116] Change the properties of the selected global temporary table.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 105 Modifying Proxy Table Properties [page 116] Only the Comment property is editable.

Table Privilege Summary [page 117] A list of the system privileges and object permissions required to complete the various table tasks.

Table Columns [page 127] SAP IQ stores data in columns. Add, modify, and delete table columns.

Table Permissions [page 130] Grant or revoke table permissions to users and roles.

Table Constraints [page 134] Constraints help to ensure that the data entered in the table is correct. Constraints also provide information to SAP IQ that boosts performance.

Table Indexes [page 146] You can add multiple indexes to any column in a table to better support the queries you plan to run.

Table Triggers [page 154] A trigger is a special form of stored procedure that executes automatically when a statement that modifies data in a table is executed. Trigger management includes creating, modifying and deleting triggers on a database object.

Table Partitions [page 158] Dividing large tables into more manageable storage objects, called partitions, can improve shorten backup and restore times, provide a finer level of granularity for data validation, and support tiered storage.

5.9.1 Creating an IQ (Catalog) System Store Table

A base table holds persistent data. (The table and its data continue to exist until you explicitly delete the data or drop the table.)

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 106 PUBLIC Administer SAP IQ 5.9.2 Creating an IQ Main Store Table with No Partitions

A base table holds persistent data. (The table and its data continue to exist until you explicitly delete the data or drop the table.)

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

5.9.3 Creating a Table with a Hash Partition

A table with a hash partition can only reside in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 107 5.9.4 Creating a Table with a Range Partition

A table with a range partition can only reside in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

5.9.5 Creating a Table with a Hash-Range Partition

A table with a hash-range partition can only reside in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 108 PUBLIC Administer SAP IQ 5.9.6 Creating a Global Temporary Table

Add a global temporary table to the database. A global temporary table definition is kept in the database permanently. (The data disappears when you close the connection.)

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

5.9.7 Creating a Proxy Table

A proxy table is a locally named alias, displayed as a table that points to a remote object such as an entire table, a view, a materialized view, or a set of remote table columns. Before you can map remote objects to a local proxy table, you must define the remote server where the remote object is located.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 109 5.9.8 Viewing Table Data

Execute a SELECT * FROM query and display contents of the table, global temporary table or proxy table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see SELECT Statement.

5.9.9 Deleting a Table

Delete a table, global temporary table or proxy table from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 110 PUBLIC Administer SAP IQ 5.9.10 Generating Table DDL Commands

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.9.11 Moving a Table to Another Dbspace

You can move the table from the current dbspace to another dbspace. This feature is available only for tables in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TABLE Statement.

5.9.12 Validating an IQ (Catalog) System Store Table

Check the validity of an IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 111 Context

To perform this task using SQL, see VALIDATE Statement.

5.9.13 Setting the Primary Key

Set the primary key to prohibit two or more rows in the table from having identical values for a column or set of columns. You can set the primary key on base tables and global temporary tables only.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.14 Removing the Primary Key

Remove the primary key from a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 112 PUBLIC Administer SAP IQ 5.9.15 Setting a Clustered Index

Set a clustered index on an IQ (catalog) system store table. Using a clustered index increases the chance that two rows from adjacent index entries will appear on the same page in the database. This strategy can lead to performance benefits by reducing the number of times a table page needs to be read into the buffer pool.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER INDEX Statement.

5.9.16 Merging Table Data from RLV Store with IQ Main Store

Read-write data from a table enabled with row-level versioning (RLV) is housed in the RLV store, and periodically merged automatically with the table's data in the IQ main store. However, you can explicitly merge this RLV-enabled table data from the RLV store with the IQ main store data.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 113 5.9.17 Calculating the Number of Rows in a Table

Calculate an accurate row count for a base or proxy table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.18 Moving Table Objects to Another Dbspace

You can move SAP IQ table objects—including indexes, columns, and partitions—from the current dbspace to another dbspace. This feature is available only for tables in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 114 PUBLIC Administer SAP IQ 5.9.19 Enabling or Disabling Row-Level Versioning in a Table

You can set an IQ main store base table to use row-level versioning (RLV) in order to track row changes for read-write transactions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.20 Modifying Base Table Properties

Change the properties of the selected IQ main store or IQ (catalog) system store base table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 115 5.9.21 Modifying Global Temporary Table Properties

Change the properties of the selected global temporary table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.22 Modifying Proxy Table Properties

Only the Comment property is editable.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 116 PUBLIC Administer SAP IQ 5.9.23 Table Privilege Summary

A list of the system privileges and object permissions required to complete the various table tasks.

Creating a Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 Base table to be owned by self – RESOURCE authority with CREATE permission on the IQ main store dbspace in which the table is created.

Base table to be owned by any user – DBA authority

SAP IQ 16.1 Base table to be owned by self –CREATE permission on the dbspace where the table is created, along with one of:

● CREATE TABLE system privilege ● CREATE ANY OBJECT system privilege

Base table to be owned by any user – CREATE permission on the dbspace where the table is created along with one of:

● CREATE ANY TABLE system privilege ● CREATE ANY OBJECT system privilege

Creating a Global Temporary Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 Global temporary table to be owned by self – RESOURCE authority with CREATE per mission on the IQ main store dbspace in which the table is created.

Global temporary table to be owned by any user – DBA authority

SAP IQ 16.1 Global temporary table to be owned by self – CREATE TABLE system privilege

Global temporary table to be owned by any user – one of:

● CREATE ANY TABLE system privilege ● CREATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 117 Creating a Proxy Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 Proxy table to be owned by self – RESOURCE authority with CREATE permission on the IQ main store dbspace in which the table is created.

Proxy table to be owned by any user – DBA authority

SAP IQ 16.1 Proxy table to be owned by self – CREATE PROXY TABLE system privilege

Proxy table to be owned by any user – one of:

● CREATE ANY TABLE system privilege ● CREATE ANY OBJECT system privilege

Viewing Table Data in the Execute SQL Windows

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 For the menu option to be enabled requires one of:

● DBA authority ● SELECT permission on the table ● You own the table

Queries execute with the user's current permissions.

SAP IQ 16.1 For the menu option to be enabled requires one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Queries execute with the user's current privileges.

Deleting a Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the table

SAP IQ 16.1 One of:

● DROP ANY TABLE system privilege ● DROP ANY OBJECT system privilege ● You own the table

SAP IQ Cockpit Non-GUI Administration and Monitoring 118 PUBLIC Administer SAP IQ Generating Table DDL Commands

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Moving a Table to Another Dbspace

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority ● You own the table and have CREATE permission on the target dbspace

SAP IQ 16.1 One of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY DBSPACE system privilege ● ALTER permission on the table and CREATE permission on the target dbspace ● You own the table and have CREATE permission on the target dbspace

Validating a IQ (Catalog) System Store Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● VALIDATE authority

SAP IQ 16.1 VALIDATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 119 Setting the Primary Key

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER and REFERENCE permission on the table ● You own the table

SAP IQ 16.1 To create a new or modify an existing primary key – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace where the table resides ● ALTER and REFERENCE permission on the table ● You own the table

To modify the name only of an existing primary key – ALTER ANY INDEX system privi lege

Setting a Clustered Index

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the table ● You own the table

SAP IQ 16.1 One of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● ALTER and REFERENCE permission on the table ● You own the table

Moving Table Data from RLV Store to IQ Main Store

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 120 PUBLIC Administer SAP IQ Calculating the Number of Rows in a Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SELECT permission on the table ● You own the table

SAP IQ 16.1 One of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Moving Table Objects to Another Dbspace

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 CREATE permission on the target dbspace along with one of:

● DBA authority ● RESOURCE authority with ALTER permission on the table ● You own the table

SAP IQ 16.1 CREATE permission on the target dbspace along with one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY DBSPACE system privilege ● You own the table

Enabling Row-Level Versioning in a Table

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 121 Viewing or Modifying Base Table Properties

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 View any property page of a base table owned by self – none

View any property page of a base table owned by any user – none needed except for the Data page, which requires one of:

● DBA authority ● SELECT permission on the table ● You own the table

Modify any property on the General page – one of:

● DBA authority ● ALTER permission on the table ● You own the table

Modify any property on the Miscellaneous page – one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

For privileges needed to modify other table properties, see:

● Table Column Privilege Summary [page 128] ● Table Permissions Privilege Summary [page 134] ● Table Constraints Privilege Summary [page 140] ● Table Index Privilege Summary [page 151] ● Table Trigger Privilege Summary [page 157] ● Table Partition Privilege Summary [page 165]

SAP IQ Cockpit Non-GUI Administration and Monitoring 122 PUBLIC Administer SAP IQ Database Version Table Privileges Required

SAP IQ 16.1 View any property page of a base table owned by self – none.

View any property page of a base table owned by any user – none needed except for the Data page, which requires one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Modify the table name on the General page – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● You own the table

Use the Calculate button on the Miscellaneous page – one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Modify any other property on the Miscellaneous page for an IQ (catalog) system store table – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table ● You own the table

Modify a comment on the General page – one of:

● CREATE ANY TABLE system privilege ● ALTER ANY TABLE system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the table

For privileges needed to modify other table properties, see:

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 123 Viewing or Modifying Global Temporary Table Properties

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 View any property page of a global temporary table owned by self – none

View any property page of a global temporary table owned by any user – none needed except for the Data page, which requires one of:

● DBA authority ● SELECT permission on the table ● You own the table

Modify any property on the General page – one of:

● DBA authority ● ALTER permission on the table ● You own the table

Modify any property on the Miscellaneous page – one of:

● SELECT permission on the table ● You own the table

For permissions needed to modify other table properties, see:

SAP IQ Cockpit Non-GUI Administration and Monitoring 124 PUBLIC Administer SAP IQ Database Version Table Privileges Required

SAP IQ 16.1 View any property page of a global temporary table owned by self – none

View any property page of a global temporary table owned by any user – none needed except for the Data page, which requires one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Modify the table name on the General page – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● You own the table

Use the Calculate button on the Miscellaneous page – one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the table ● You own the table

Modify any other property on the Miscellaneous page for an IQ (catalog) system store table – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table ● You own the table

Modify a comment on the General page – one of:

For privileges needed to modify other table properties, see:

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 125 Viewing or Modifying Proxy Table Properties

Database Version Table Privileges Required

SAP IQ 15.3 and 15.4 View any property page of a proxy table owned by self – none needed except for the Data page, which requires SELECT permission on the base table on the remote server.

View any properties of a proxy table owned by any user – none needed except for the Data page, which requires SELECT permission on the base table on the remote server along with one of:

● DBA authority ● SELECT permission on the table

Modify any property on the General or Miscellaneous page – one of:

● DBA authority ● You own the table

For privileges needed to modify other table properties, see:

● Table Column Privilege Summary [page 128] ● Table Trigger Privilege Summary [page 157]

SAP IQ 16.1 View any property page of a proxy table owned by self – none needed except for the Data page, which requires SELECT permission on the base table on the remote server.

View any property page of a proxy table owned by any user – none needed except for the Data page, which requires one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the proxy table ● SELECT permission on the base table ● You own the table

Use the Calculate button on the Miscellaneous page – one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the proxy table ● You own the table

Modify a comment on the General page – one of:

For privileges needed to modify other table properties, see:

● Table Column Privilege Summary [page 128] ● Table Trigger Privilege Summary [page 157]

SAP IQ Cockpit Non-GUI Administration and Monitoring 126 PUBLIC Administer SAP IQ 5.9.24 Table Columns

SAP IQ stores data in columns. Add, modify, and delete table columns.

In this section:

Adding a Column [page 127] Add a column to a base table or global temporary table.

Deleting a Column [page 127] Delete a column from the table. If the table has only one column, you cannot delete it.

Modifying Column Properties [page 128] Change the properties of the columns of the selected table.

Table Column Privilege Summary [page 128] A list of the system privileges and object permissions required to complete the various table column tasks.

5.9.24.1 Adding a Column

Add a column to a base table or global temporary table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.24.2 Deleting a Column

Delete a column from the table. If the table has only one column, you cannot delete it.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 127 Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.24.3 Modifying Column Properties

Change the properties of the columns of the selected table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.24.4 Table Column Privilege Summary

A list of the system privileges and object permissions required to complete the various table column tasks.

Adding a Column

Database Version Table Column Privileges Required

SAP IQ 15.3 and 15.4 Create a column without a primary key or unique constraint – you must have one of:

● DBA authority ● Both ALTER permission on the table ● You own the underlying table

Create a column with a primary key or unique constraint – you must have one of:

● DBA authority ● Both ALTER and REFERENCE permission on the table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring 128 PUBLIC Administer SAP IQ Database Version Table Column Privileges Required

SAP IQ 16.1 Create a column without a primary key or unique constraint – you must have one of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace along with one of the following: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the underlying table ○ You own the underlying table

Create a column with a primary key or unique constraint – you must have one of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace along with one of the following: ○ ALTER ANY TABLE system privilege ○ Both ALTER and REFERENCE permission on the underlying table ○ You own the underlying table

Deleting a Column

Database Version Table Column Privileges Required

SAP IQ 15.3 and 15.4 Deleting a column without a primary key or unique constraint – you must have one of:

● DBA authority ● Both ALTER permission on the table ● You own the underlying table

Deleting a column with a primary key or unique constraint – you must have one of:

● DBA authority ● Both ALTER and REFERENCE permission on the table ● You own the underlying table

SAP IQ 16.1 Deleting a column without a primary key or unique constraint – you must have one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the underlying table ● You own the underlying table

Deleting a column with a primary key or unique constraint – you must have one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● Both ALTER and REFERENCE permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 129 Viewing or Modify Column Properties

Database Version Table Column Privileges Required

SAP IQ 15.3 and 15.4 View any table column property page – none

Modify the Primary key property on the General page – you must have one of:

● DBA authority ● Both ALTER and REFERENCE permission on the table ● You own the table

Modify any other table column property – you must have one of:

● DBA authority ● ALTER permission on the table ● You own the table

SAP IQ 16.1 View any table column property page – none

Modify the Primary key property on the General page – you must have one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● Both ALTER and REFERENCE permission on the table ● You own the table

Modify a table column comment – you must have one of:

Modify any other table column property – you must have one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table ● You own the table

5.9.25 Table Permissions

Grant or revoke table permissions to users and roles.

In this section:

About the Tables Permissions List [page 131] There's no SQL-side equivalent for the tables permission list.

Following the Table Permissions Grant Trail [page 131]

SAP IQ Cockpit Non-GUI Administration and Monitoring 130 PUBLIC Administer SAP IQ Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

Granting Permissions on a Table [page 131] Grant table permissions to users and roles.

Removing Permissions from a Table [page 132] Remove table permissions from users and roles.

Adding Administrative Rights to a Granted Table Permission [page 132] Add administrative rights only to a granted table permission.

Removing Administrative Rights Only from a Table Permission [page 133] Remove administrative rights only from a granted table permission.

Manage Permissions on a Proxy Table [page 133] The ability to grant object-level permissions at the proxy table level is not implemented in this release of SAP IQ Cockpit. You can, however, grant these permissions at the user or role level.

Table Permissions Privilege Summary [page 134] A list of the system privileges and object permissions required to complete the various table permission tasks.

5.9.25.1 About the Tables Permissions List

There's no SQL-side equivalent for the tables permission list.

5.9.25.2 Following the Table Permissions Grant Trail

Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

To perform this task using SQL, see List Object-Level Privileges Granted to a User.

5.9.25.3 Granting Permissions on a Table

Grant table permissions to users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 131 Context

To perform this task using SQL, see Grant and Revoke Object-Level Privileges.

5.9.25.4 Removing Permissions from a Table

Remove table permissions from users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Grant and Revoke Object-Level Privileges.

5.9.25.5 Adding Administrative Rights to a Granted Table Permission

Add administrative rights only to a granted table permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Grant and Revoke Object-Level Privileges.

SAP IQ Cockpit Non-GUI Administration and Monitoring 132 PUBLIC Administer SAP IQ 5.9.25.6 Removing Administrative Rights Only from a Table Permission

Remove administrative rights only from a granted table permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Grant and Revoke Object-Level Privileges.

5.9.25.7 Manage Permissions on a Proxy Table

The ability to grant object-level permissions at the proxy table level is not implemented in this release of SAP IQ Cockpit. You can, however, grant these permissions at the user or role level.

This means that you cannot grant proxy table permissions to multiple users and roles at the same time. They must be granted one user or role at a time.

At the SQL level, execute a GRANT object-level permissions statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 133 5.9.25.8 Table Permissions Privilege Summary

A list of the system privileges and object permissions required to complete the various table permission tasks.

Grant and Revoke Permissions on a Table

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You have administrative rights (with grant option) to the permission ● You own the database object

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights (with grant option) to the permission ● You own the database object

Adjust Administration Permissions on a Table

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights to the permission being modified ● You own the database object

5.9.26 Table Constraints

Constraints help to ensure that the data entered in the table is correct. Constraints also provide information to SAP IQ that boosts performance.

SAP IQ does not allow the creation of a check constraint that it cannot evaluate, such as those composed of user-defined functions, proxy tables, or non-SAP IQ tables. Constraints that cannot be evaluated are detected the first time the table on which the check constraint is defined is loaded or modified.

SAP IQ Cockpit Non-GUI Administration and Monitoring 134 PUBLIC Administer SAP IQ  Note

SAP IQ does not allow check constraints containing:

● Subqueries ● Expressions specifying a host language parameter, a SQL parameter, or a column as the target for a data value ● Set functions ● Invocations of nondeterministic functions or functions that modify data

In this section:

Creating a Column Check Constraint [page 136] A column check constraint enforces a specified condition on a column.

Creating a Foreign Key Constraint [page 136] A foreign key constraint enforces a restriction on a column specifying how the data in one table relates to the data in another table, or the same table.

Creating a Table Check Constraint [page 137] A table check constraint ensures that no row in a table violates the constraint, which may include more than one column in its specification.

Creating a Unique Constraint [page 137] The unique constraint specifies that one or more columns uniquely identify each row in the table.

Deleting a Table or Column Check Constraint [page 138] Delete a table or column check constraint from a table.

Deleting a Primary, Foreign, or Unique Key Constraint [page 138] Delete a primary, foreign, or unique key constraint from a table.

Rebuilding a Unique, Primary or Foreign Key Constraint [page 139] Rebuild a unique, primary, or foreign key constraint on an IQ (catalog) system store table.

Validating a Unique, Primary or Foreign Key Constraint [page 139] Check the validity of unique, primary, or foreign key constraint on IQ (catalog) system store table.

Generating Constraint DDL Commands [page 140] There's no SQL-side equivalent for this task.

Modifying Constraint Properties [page 140] View constraint details or change the constraint details and constraint definition of an existing constraint.

Table Constraints Privilege Summary [page 140] A list of the system privileges and object permissions required to complete the various table constraints tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 135 5.9.26.1 Creating a Column Check Constraint

A column check constraint enforces a specified condition on a column.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

5.9.26.2 Creating a Foreign Key Constraint

A foreign key constraint enforces a restriction on a column specifying how the data in one table relates to the data in another table, or the same table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

SAP IQ Cockpit Non-GUI Administration and Monitoring 136 PUBLIC Administer SAP IQ 5.9.26.3 Creating a Table Check Constraint

A table check constraint ensures that no row in a table violates the constraint, which may include more than one column in its specification.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

5.9.26.4 Creating a Unique Constraint

The unique constraint specifies that one or more columns uniquely identify each row in the table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 137 5.9.26.5 Deleting a Table or Column Check Constraint

Delete a table or column check constraint from a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

5.9.26.6 Deleting a Primary, Foreign, or Unique Key Constraint

Delete a primary, foreign, or unique key constraint from a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

SAP IQ Cockpit Non-GUI Administration and Monitoring 138 PUBLIC Administer SAP IQ 5.9.26.7 Rebuilding a Unique, Primary or Foreign Key Constraint

Rebuild a unique, primary, or foreign key constraint on an IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

5.9.26.8 Validating a Unique, Primary or Foreign Key Constraint

Check the validity of unique, primary, or foreign key constraint on IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 139 5.9.26.9 Generating Constraint DDL Commands

There's no SQL-side equivalent for this task.

Context

5.9.26.10 Modifying Constraint Properties

View constraint details or change the constraint details and constraint definition of an existing constraint.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table and Column Constraints.

5.9.26.11 Table Constraints Privilege Summary

A list of the system privileges and object permissions required to complete the various table constraints tasks.

Creating a Column Check Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring 140 PUBLIC Administer SAP IQ Database Version Table Constraint Privileges Required

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● You have ALTER permission on the underlying table ● You own the underlying table

Creating a Foreign Key Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the derived table ● You own the derived table

In addition, if you do not have DBA authority, you must also have one of:

● REFERENCE permission on the base table ● You own the base table

Finally, if you do not have DBA authority, you must also have one of:

● REFERENCE permission on the derived table (to index it) ● You own the derived table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace the table is defined on, along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the derived table ○ You own the derived table

You must also have one of:

● CREATE ANY INDEX system privilege ● CREATE ANY OBJECT system privilege ● REFERENCE permission on the base table

Creating a Table Check Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 141 Database Version Table Constraint Privileges Required

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● You have ALTER permission on the underlying table ● You own the underlying table

Creating a Unique Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER and REFERENCE permission on the underlying table ● You own the underlying table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace the table is defined on, along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER and REFERENCE permission on the underlying table ○ You own the underlying table

Deleting a Table or Column Check Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring 142 PUBLIC Administer SAP IQ Deleting a Unique, Primary or Foreign Key Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER and REFERENCE permission on the underlying table ● You own the underlying table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER and REFERENCE permission on the underlying table ● You own the underlying table

Rebuilding a Unique, Primary or Foreign Key Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● REFERENCE permission on the underlying table ● You own the underlying table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY INDEX system privilege ● REFERENCE permission on the underlying table ● You own the underlying table

Validating a Constraint

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● VALIDATE authority

SAP IQ 16.1 VALIDATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 143 Generating Constraint DDL Commands

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Constraint Properties

Database Version Table Constraint Privileges Required

SAP IQ 15.3 and 15.4 View table constraint properties – none

Modify comment on foreign key or unique constraint – one of:

● DBA authority ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring 144 PUBLIC Administer SAP IQ Database Version Table Constraint Privileges Required

SAP IQ 16.1 View any table constraint property page – none

Modify the comment on a foreign or primary key constraint – one of:

Modify the comment on a unique key constraint – one of:

● CREATE ANY INDEX system privilege ● ALTER ANY INDEX system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the table

Modify the definition of a table or column check constraint – one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER permission on the table ● You own the table

Modify any foreign key constraint property on the Action page – one of:

● CREATE ANY OBJECT system privilege ● CREATE ANY INDEX system privilege

You must also have one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER permission on the underlying table ● You own the table

Modify any other property of a primary, foreign or unique key, table check or column check constraint – one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER permission on the underlying table ● You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 145 5.9.27 Table Indexes

You can add multiple indexes to any column in a table to better support the queries you plan to run.

It is more efficient to create all the indexes needed before you insert any data into your database. You can drop any of the optional indexes later if you decide you do not need them.

Indexes can greatly improve the performance of searches on the indexed columns. However, indexes take up space within the database and slow down insert, update, and delete operations. This section helps you determine when you should create an index and how to achieve maximum performance from your index.

There are many situations in which creating an index improves the performance of a database. An index provides an ordering of a table's rows based on the values in some or all of the columns. An index allows the database server to find rows quickly. It permits greater concurrency by limiting the number of database pages accessed. An index also affords the database server a convenient means of enforcing a uniqueness constraint on the rows in a table.

In this section:

Column Index Types [page 147] Each type of column index is designed to speed processing of a certain kind of data.

Creating an Index on an IQ (Catalog) System Store Table [page 148] Create an index on an IQ (catalog) system store table.

Creating an Index on an IQ Main Store Table [page 148] Create an index on an IQ main store table.

Deleting a Table Index [page 149] Unused indexes take up space in your database. Delete a table index if you do not require it.

Rebuilding a Table Index [page 149] As data is modified in the underlying tables that the indexes operate on, the indexes become fragmented. Rebuild fragmented indexes on tables to improve performance.

Validating an IQ (Catalog) System Store Table Index [page 150] Validate an index on an IQ (catalog) system store table. You cannot validate indexes on tables in the IQ main store.

Moving a Table Index [page 150] Move an index from the current dbspace to another dbspace. This action is only applicable to tables in the IQ main store.

Generating Table Index DDL Commands [page 151] There's no SQL-side equivalent for this task.

Modifying Table Index Properties [page 151] Display and edit the properties for the selected table index.

Table Index Privilege Summary [page 151] A list of the system privileges and object permissions required to complete the various index tasks on tables.

SAP IQ Cockpit Non-GUI Administration and Monitoring 146 PUBLIC Administer SAP IQ 5.9.27.1 Column Index Types

Each type of column index is designed to speed processing of a certain kind of data.

These index types are unique to column-based IQ data and cannot be applied to tables in the IQ (catalog) system store.

SAP IQ assumes you add an HG index to every column mentioned in a WHERE clause and in a GROUP BY clause.

When you designate a column or set of columns as either a PRIMARY KEY or UNIQUE, the database server automatically creates a High_Group index for it. Choose one PRIMARY KEY from all UNIQUE constraints for the table. Neither PRIMARY KEY nor UNIQUE constraints allow nulls; however, a unique index does allow them. UNIQUE constraints also provide hints on column constraints to the query optimizer.

The database server always uses the fastest index available for the current query or join predicate. If you have not created the index types the query optimizer would ideally use for a column, the server can still resolve queries involving the column, but response time may be slower than it would be with the correct index type or types.

Table 1: Index Types Index Type Purpose

Compare (CMP) Stores the binary comparison (<, >, =, <=, >=, or NE) of any two columns with identical data types, precision, and scale.

DATE An index on columns of data type DATE used to process queries involving date quantities.

Datetime (DTTM) An index on columns of data type DATETIME or TIMESTAMP used to process queries involving datetime quantities.

High_Group (HG) An enhanced B-tree index to process equality and group by operations on high-cardinality data. Recommended only for more than 1,000 distinct values or for a table with less than 25,000 rows.

High_Non_Group (HNG) A nonvalue-based bitmap index ideal for most high-cardinal ity DSS operations involving ranges or aggregates.

 Note

The HG index provides better performance. We recom mend migrating HNG indexes to HG.

Low_Fast (LF) An HG index provides better performance than an LF index. Therefore, use HG indexes instead.

TIME An index on columns of data type TIME used to process queries involving time quantities.

WD Used to index keywords by treating the contents of a CHAR, VARCHAR, or LONG VARCHAR column as a delimited list.

Text Used to index terms (words) and their positions. Provides ability to search for individual terms, phrases, pairs of terms within specified distances and given order, as well as combi nations of these conditions.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 147 5.9.27.2 Creating an Index on an IQ (Catalog) System Store Table

Create an index on an IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Creating Indexes.

5.9.27.3 Creating an Index on an IQ Main Store Table

Create an index on an IQ main store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Creating Indexes.

SAP IQ Cockpit Non-GUI Administration and Monitoring 148 PUBLIC Administer SAP IQ 5.9.27.4 Deleting a Table Index

Unused indexes take up space in your database. Delete a table index if you do not require it.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Removing Indexes.

5.9.27.5 Rebuilding a Table Index

As data is modified in the underlying tables that the indexes operate on, the indexes become fragmented. Rebuild fragmented indexes on tables to improve performance.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see sp_iqrebuildindex Procedure.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 149 5.9.27.6 Validating an IQ (Catalog) System Store Table Index

Validate an index on an IQ (catalog) system store table. You cannot validate indexes on tables in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see VALIDATE Statement.

5.9.27.7 Moving a Table Index

Move an index from the current dbspace to another dbspace. This action is only applicable to tables in the IQ main store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER INDEX Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 150 PUBLIC Administer SAP IQ 5.9.27.8 Generating Table Index DDL Commands

There's no SQL-side equivalent for this task.

Context

5.9.27.9 Modifying Table Index Properties

Display and edit the properties for the selected table index.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER INDEX Statement.

5.9.27.10 Table Index Privilege Summary

A list of the system privileges and object permissions required to complete the various index tasks on tables.

Creating a Table Index

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 CREATE permission on the specified dbspace along with one of:

● DBA authority ● REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 151 Database Version Table Index Privileges Required

SAP IQ 16.1 CREATE permission on the specified dbspace along with one of:

● CREATE ANY INDEX system privilege ● CREATE ANY OBJECT system privilege ● REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

Deleting a Table Index

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority with REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ 16.1 One of:

● DROP ANY INDEX system privilege ● DROP ANY OBJECT system privilege ● REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

Rebuilding a Table Index

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority with REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ 16.1 One of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ Cockpit Non-GUI Administration and Monitoring 152 PUBLIC Administer SAP IQ Validating a Table Index

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority with ALTER permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ 16.1 VALIDATE ANY OBJECT system privilege.

Moving a Table Index

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority ● CREATE permission on the target dbspace, along with one of: ○ You own the underlying table ○ You have REFERENCE permission on the underlying table

SAP IQ 16.1 One of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY DBSPACE system privilege ● You own the underlying table of the index ● REFERENCE permission on the table along with one of: ○ CREATE ANY OBJECT system privilege ○ CREATE permission on the target dbspace

Generating Index DDL Commands

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 153 Viewing or Modifying Index Properties

Database Version Table Index Privileges Required

SAP IQ 15.3 and 15.4 View table index fragmentation property page – EXECUTE permission on the sp_iqindexfragmentation system procedure to display the content of the page.

View any other table index property page – none.

Modify any index property – one of:

● DBA authority ● RESOURCE authority with REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

SAP IQ 16.1 View table index fragmentation property page – EXECUTE permission on the sp_iqindexfragmentation system procedure along with the MANAGE ANY DBSPACE system privilege to display the content of the page.

View any other table index property page – none.

Modify a table index comment – one of:

 Note

ALTER permission on the table is not required to modify the comment only.

Modify any other table index property – one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY INDEX system privilege ● REFERENCE permission on the underlying table of the index ● You own the underlying table of the index

5.9.28 Table Triggers

A trigger is a special form of stored procedure that executes automatically when a statement that modifies data in a table is executed. Trigger management includes creating, modifying and deleting triggers on a database object.

In this section:

Creating a Table Trigger [page 155]

SAP IQ Cockpit Non-GUI Administration and Monitoring 154 PUBLIC Administer SAP IQ Create a new trigger on a table in the IQ (catalog) system store.

Deleting a Table Trigger [page 155] Delete triggers from a table.

Generating Table Trigger DDL Commands [page 156] There's no SQL-side equivalent for this task.

Modifying Table Trigger Properties [page 156] Change trigger properties on a table, including the comment and the underlying SQL statement of the trigger.

Table Trigger Privilege Summary [page 157] A list of the system privileges and object permissions required to complete the various table trigger tasks on database objects.

5.9.28.1 Creating a Table Trigger

Create a new trigger on a table in the IQ (catalog) system store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TRIGGER statement.

5.9.28.2 Deleting a Table Trigger

Delete triggers from a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 155 Context

To perform this task using SQL, see DROP TRIGGER statement.

5.9.28.3 Generating Table Trigger DDL Commands

There's no SQL-side equivalent for this task.

Context

5.9.28.4 Modifying Table Trigger Properties

Change trigger properties on a table, including the comment and the underlying SQL statement of the trigger.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, seeALTER TRIGGER statement .

SAP IQ Cockpit Non-GUI Administration and Monitoring 156 PUBLIC Administer SAP IQ 5.9.28.5 Table Trigger Privilege Summary

A list of the system privileges and object permissions required to complete the various table trigger tasks on database objects.

Creating a Table Trigger

Database Version Table Trigger Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority, along with one of: ○ ALTER permission on the underlying table of the trigger ○ You own the underlying table of the trigger

SAP IQ 16.1 One of:

● CREATE ANY TRIGGER system privilege ● CREATE ANY OBJECT system privilege

You must also have one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● ALTER permission on the underlying table of the trigger ● You own the underlying table of the trigger

Deleting a Table Trigger

Database Version Table Trigger Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority, along with one of: ○ ALTER permission on the underlying table of the trigger ○ You own the underlying table of the trigger

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TABLE system privilege ● You own the underlying table of the trigger

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 157 Generating Table Trigger DDL Commands

Database Version Table Trigger Privileges Required

SAP IQ 15.3 and 15.4 None.

SAP IQ 16.1 None.

Viewing or Modifying Table Trigger Properties

Database Version Table Trigger Privileges Required

SAP IQ 15.3 and 15.4 View any trigger property page – none.

Modify any trigger property – one of:

● DBA authority ● RESOURCE authority, along with one of: ○ ALTER permission on the underlying table of the trigger ○ You own the underlying table of the trigger

SAP IQ 16.1 View any trigger property page – none.

Modify a trigger comment – one of:

● CREATE ANY TRIGGER system privilege ● ALTER ANY TRIGGER system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege

 Note

ALTER permission on the table is not required to modify a comment.

Modify any other trigger property – one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TRIGGER system privilege, along with one of: ○ ALTER ANY TABLE system privilege ○ You own the underlying table of the trigger

5.9.29 Table Partitions

Dividing large tables into more manageable storage objects, called partitions, can improve shorten backup and restore times, provide a finer level of granularity for data validation, and support tiered storage.

Partitions share the logical attributes of the parent table. Manage partitions individually by placing them in separate dbspaces.

SAP IQ Cockpit Non-GUI Administration and Monitoring 158 PUBLIC Administer SAP IQ Three are three types of partitions: hash, range, and hash-range. Only a range partition can be added to an existing table in the IQ main store. Hash and hash-range partitions can only be added during the initial creation of the IQ main store table. Range partitioning can be added to both new and existing tables. For tables with existing range or hash-range partitioning, additional range subpartitions can be added as needed.

You cannot partition an IQ (catalog) system store table.

In this section:

Creating a Range Partition on an Existing Table [page 160] You can add range partitioning to an existing unpartitioned table or add additional range partitions to a table that is already range partitioned.

Creating a Range Subpartition to an Existing Hash-Range Partitioned Table [page 160] On an existing table with hash-range partitioning, you can add additional range subpartitions. You cannot add Hash-range partitioning to an existing unpartitioned table.

Deleting a Range Partition or Subpartition [page 161] Remove one or more range partitions or subpartitions from a table. You cannot delete the last remaining partition on a table. Use Unpartition instead.

Unpartitioning a Table [page 161] Remove all partitioning from a table, preserving the data in the table.

Rebuilding a Hash or Hash-Range Partitioned Table [page 162] Once a table with hash or hash-range partitioning is unpartitioned, it can only be repartitioned by range. Hash and hash-range partitioning on an existing table is not supported.

Merging Partitions [page 162] Merge adjacent range partitions or subpartitions in a table.

Splitting a Partition [page 163] Split a range or hash-range partition in a table.

Moving a Partition [page 163] Move a range or hash-range partition to another dbspace.

Managing Column Storage in a Table Partition [page 164] Store data for individual columns in a range or hash-range partition separately from the dbspace for the partition. You can add, delete and move columns within the partition to specific dbspaces.

Modifying Table Partition Properties [page 164] Change the table partition details and definition of an existing table partition.

Table Partition Privilege Summary [page 165] A list of the system privileges and object permissions required to complete the various table partition tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 159 5.9.29.1 Creating a Range Partition on an Existing Table

You can add range partitioning to an existing unpartitioned table or add additional range partitions to a table that is already range partitioned.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Range Partitions.

5.9.29.2 Creating a Range Subpartition to an Existing Hash- Range Partitioned Table

On an existing table with hash-range partitioning, you can add additional range subpartitions. You cannot add Hash-range partitioning to an existing unpartitioned table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Hash-Range Partitions.

SAP IQ Cockpit Non-GUI Administration and Monitoring 160 PUBLIC Administer SAP IQ 5.9.29.3 Deleting a Range Partition or Subpartition

Remove one or more range partitions or subpartitions from a table. You cannot delete the last remaining partition on a table. Use Unpartition instead.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.29.4 Unpartitioning a Table

Remove all partitioning from a table, preserving the data in the table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 161 5.9.29.5 Rebuilding a Hash or Hash-Range Partitioned Table

Once a table with hash or hash-range partitioning is unpartitioned, it can only be repartitioned by range. Hash and hash-range partitioning on an existing table is not supported.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.29.6 Merging Partitions

Merge adjacent range partitions or subpartitions in a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 162 PUBLIC Administer SAP IQ 5.9.29.7 Splitting a Partition

Split a range or hash-range partition in a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.29.8 Moving a Partition

Move a range or hash-range partition to another dbspace.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 163 5.9.29.9 Managing Column Storage in a Table Partition

Store data for individual columns in a range or hash-range partition separately from the dbspace for the partition. You can add, delete and move columns within the partition to specific dbspaces.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

5.9.29.10 Modifying Table Partition Properties

Change the table partition details and definition of an existing table partition.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TABLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 164 PUBLIC Administer SAP IQ 5.9.29.11 Table Partition Privilege Summary

A list of the system privileges and object permissions required to complete the various table partition tasks.

Creating a Hash Partition

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 Table owned by self – none.

Table owned by other users – one of:

● DBA authority ● ALTER permission on the table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the table ○ You own the table

Creating a Range Partition

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● CREATE permission on the dbspaces where the partitions are being created

You must also have one of:

● ALTER permission on the table ● You own the table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspaces along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the table ○ You own the table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 165 Creating a Hash-Range Partition

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority, along with one of: ○ ALTER permission on the table ○ You own the table

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the table ○ You own the table

Deleting a Partition

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 Table owned by self – none.

Table owned by other users – one of:

● DBA authority ● ALTER permission on the table

SAP IQ 16.1 Table owned by self – none.

Table owned by other users – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table

Unpartitioning a Table

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 Table owned by self – none.

Table owned by other users – one of:

● DBA authority ● ALTER permission on the table

SAP IQ Cockpit Non-GUI Administration and Monitoring 166 PUBLIC Administer SAP IQ Database Version Table Partition Privileges Required

SAP IQ 16.1 Table owned by self – none.

Table owned by other users – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table

Merging Partitions

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 Table owned by self – none.

Table owned by other users – one of:

● DBA authority ● ALTER permission on the table

SAP IQ 16.1 Table owned by self – none.

Table owned by other users – one of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table

Splitting Partitions

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 Table owned by self – none.

Table owned by other users – one of:

● DBA authority ● ALTER permission on the table ● SELECT permission on the table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 167 Database Version Table Partition Privileges Required

SAP IQ 16.1 One of:

● SELECT ANY TABLE system privilege ● SELECT permission on table

You must also have one of:

● ALTER ANY OBJECT system privilege ● CREATE permission on the dbspace along with one of: ○ ALTER ANY TABLE system privilege ○ ALTER permission on the table ○ You own the table

Moving Partitions

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority ● CREATE permission on the dbspace to which the partition is being moved along with one of: ○ ALTER permission on the underlying table ○ You own the table

SAP IQ 16.1 One of:

● ALTER ANY TABLE system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY DBSPACE system privilege ● One of the following: ○ CREATE ANY OBJECT system privilege ○ CREATE permission on the dbspace to which the partition is being moved ○ Along with one of: ○ ALTER permission on the underlying table ○ You own the underlying table

SAP IQ Cockpit Non-GUI Administration and Monitoring 168 PUBLIC Administer SAP IQ Managing Column Storage in a Table Partition

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 View any table partition property page – none.

Modify any table partition property pertaining to moving partition location or separate column storage for a partition – one of:

Modify any other table partition property:

● Table owned by self – none. ● Table owned by other users – one of: ○ DBA authority ○ ALTER permission on the table

SAP IQ 16.1 View any table partition property page – none.

Modify any table partition property pertaining to moving partition location or separate column storage for a partition – one of:

Modify any other table partition property:

● Table owned by self – none. ● Table owned by other users – one of: ○ ALTER ANY TABLE system privilege ○ ALTER ANY OBJECT system privilege ○ ALTER permission on the table

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 169 Viewing or Modifying Table Partition Properties

Database Version Table Partition Privileges Required

SAP IQ 15.3 and 15.4 View any table partition property page – none.

Modify any table partition property pertaining to moving partition location or separate column storage for a partition – one of:

Modify any other table partition property:

● Table owned by self – none. ● Table owned by other users – one of: ○ DBA authority ○ ALTER permission on the table

SAP IQ 16.1 View any table partition property page – none.

Modify any table partition property pertaining to moving partition location or separate column storage for a partition – one of:

Modify any other table partition property:

● Table owned by self – none. ● Table owned by other users – one of: ○ ALTER ANY TABLE system privilege ○ ALTER ANY OBJECT system privilege ○ ALTER permission on the table

SAP IQ Cockpit Non-GUI Administration and Monitoring 170 PUBLIC Administer SAP IQ 5.10 Views

A view is a computed table defined by the result set of its view definition, expressed as a SQL query. You can use views to show database users exactly the information you want to present, in a format you can control.

A regular view describes a view that is recomputed each time you reference the view, and the result set is not stored on disk. This is the most commonly used type of view.

A materialized view describes a view whose result set is precomputed and materialized on disk similar to the contents of a base table. Materialized views are useful in data warehousing scenarios, where frequent queries of the actual base tables can be extremely expensive.

In this section:

About Views [page 172] A view is a computed table that may be useful for security purposes, and for tailoring the appearance of database information to make data access straightforward. SAP IQ provides views that allow you to give names to frequently executed SELECT commands, saving you from having to repeatedly type them.

Creating a View [page 172] Create a new regular view.

Viewing View Data [page 173] Execute a SELECT * FROM view.

Recompiling and Enabling a View [page 173] Recompile and enable a disabled view to make it available for use by the database server. Enabling a view changes the definition of the view but does not change data inside the view.

Disabling a View [page 174] Disabling a view makes it unusable, but retains the definition of the view in the database. You can enable and recompile the disabled view at a later time. Disabling a view changes the definition of the view but does not change data inside the view.

Deleting a View [page 174] Delete an enabled or disabled view to remove it from the database. Deleting a view deletes the definition of the view. All data related to the view are virtual, and remain in the underlying tables after deletion.

Generating View DDL Commands [page 175] There's no SQL-side equivalent for this task.

Modifying View Properties [page 175] Change view properties including the comment, SQL view definition (including the column definition), and permissions. Modifying a view changes the definition of the view but does not change data inside the view.

View Privilege Summary [page 175] A list of the system privileges and object permissions required to complete the various view tasks.

View Permissions [page 178] Grant or revoke view permissions to users and roles.

View Triggers [page 183]

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 171 Trigger management includes the creation, modification and deletion of triggers on a database object. A trigger is a special form of stored procedure that executes automatically when a statement that modifies data displayed in a view is executed.

5.10.1 About Views

A view is a computed table that may be useful for security purposes, and for tailoring the appearance of database information to make data access straightforward. SAP IQ provides views that allow you to give names to frequently executed SELECT commands, saving you from having to repeatedly type them.

Think of views as computed tables. You can use any SELECT command in a view definition except commands containing ORDER BY. Views can use GROUP BY clauses, subqueries, and joins. Disallowing ORDER BY in the commands that make up a view is consistent with the fact that rows of a table in a relational database are not stored in any particular order. When you use the view, you can specify an ORDER BY.

For example, if you frequently need to list a summary of employees and their departments, create a view called emp_dept that looks just like any other table in the iqdemo database. You can list everything in a view just as you do from a table.

The information in a view is not stored separately in the database. Each time you refer to a view, SQL executes the associated SELECT statement to find the appropriate data.

This also means that if someone modifies the employee table or the department table, the information in the emp_dept view is automatically up to date. However, if the SELECT command is complicated, it may take a long time for SQL to find the correct information every time you use the view.

You can also use views in more complicated queries, such as queries using joins:

SELECT LastName, dept_head_id

FROM emp_dept, department

WHERE emp_dept.Department = department.dept_name

5.10.2 Creating a View

Create a new regular view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 172 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see CREATE VIEW Statement.

5.10.3 Viewing View Data

Execute a SELECT * FROM view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see SELECT Statement.

5.10.4 Recompiling and Enabling a View

Recompile and enable a disabled view to make it available for use by the database server. Enabling a view changes the definition of the view but does not change data inside the view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER VIEW Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 173 5.10.5 Disabling a View

Disabling a view makes it unusable, but retains the definition of the view in the database. You can enable and recompile the disabled view at a later time. Disabling a view changes the definition of the view but does not change data inside the view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER VIEW Statement.

5.10.6 Deleting a View

Delete an enabled or disabled view to remove it from the database. Deleting a view deletes the definition of the view. All data related to the view are virtual, and remain in the underlying tables after deletion.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 174 PUBLIC Administer SAP IQ 5.10.7 Generating View DDL Commands

There's no SQL-side equivalent for this task.

Context

5.10.8 Modifying View Properties

Change view properties including the comment, SQL view definition (including the column definition), and permissions. Modifying a view changes the definition of the view but does not change data inside the view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER VIEW Statement.

5.10.9 View Privilege Summary

A list of the system privileges and object permissions required to complete the various view tasks.

Creating a View

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority with SELECT permission on the tables in the view definition to create a view owned by you.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 175 Database Version View Privileges Required

SAP IQ 16.1 View to be owned by self – CREATE VIEW system privilege along with one of:

● SELECT ANY TABLE system privilege ● SELECT object permission on the underlying tables of the view

View to be owned by any user – one of:

● CREATE ANY VIEW system privilege ● CREATE ANY OBJECT system privilege

You must also have one of:

● SELECT object permission on the underlying tables of the view ● SELECT ANY TABLE system privilege

Viewing View Data in the Execute SQL Window

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 None. Queries execute with the user's current permissions.

SAP IQ 16.1 None. Queries execute with the user's current permissions.

Recompiling and Enabling a View

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the view and have SELECT permission on the underlying tables of the view

SAP IQ 16.1 One of:

● ALTER ANY VIEW system privilege ● ALTER ANY OBJECT system privilege ● You own the view

You must also have one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the underlying tables of the view

SAP IQ Cockpit Non-GUI Administration and Monitoring 176 PUBLIC Administer SAP IQ Disabling a View

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the view

SAP IQ 16.1 One of:

● ALTER ANY VIEW system privilege ● ALTER ANY OBJECT system privilege ● You own the view

Deleting a View

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the view

SAP IQ 16.1 One of:

● DROP ANY VIEW system privilege ● DROP ANY OBJECT system privilege ● You own the view

Generating View DDL Commands

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 None.

SAP IQ 16.1 None.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 177 Viewing or Modifying View Properties

Database Version View Privileges Required

SAP IQ 15.3 and 15.4 View any view property page – none.

Modify view permissions – one of:

● DBA authority ● PERMS ADMIN authority ● Administrative rights over the permission ● You own the database object

Modify any other view property except those relating to triggers – one of:

● DBA authority ● You own the view

For privileges relating to triggers, see View Trigger Privilege Summary [page 186].

SAP IQ 16.1 View any view property page – none.

Modify view permissions – one of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights (with grant option) to the permission ● You own the database object

Modify a view comment – one of:

● CREATE ANY VIEW system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY VIEW system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the view

Modify any other view property, except those relating to triggers – one of:

● ALTER ANY VIEW system privilege ● ALTER ANY OBJECT system privilege ● You own the view

For privileges relating to triggers, see View Trigger Privilege Summary [page 186].

5.10.10 View Permissions

Grant or revoke view permissions to users and roles.

In this section:

About the View Permissions List [page 179] The View permissions list displays details on the specific object permissions directly granted to users or roles for a single view.

SAP IQ Cockpit Non-GUI Administration and Monitoring 178 PUBLIC Administer SAP IQ Following the View Permission Grant Trail [page 180] Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

Granting View Permissions [page 181] Grant view permissions to users and roles.

Removing Permissions from a View [page 181] Remove view permissions from users and roles.

Adding Administrative Rights to a Granted View Permission [page 182] Add administrative rights only to a granted view permission.

Removing Administrative Rights Only from a View Permission [page 182] Remove administrative rights only from a granted view permission.

View Permissions Privilege Summary [page 183] A list of the system privileges and object permissions required to complete the various view permission tasks.

5.10.10.1 About the View Permissions List

The View permissions list displays details on the specific object permissions directly granted to users or roles for a single view.

There are four object permissions for views or materialized views, which you can grant with or with out administrative rights:

● SELECT ● INSERT ● DELETE ● UPDATE

You can grant object permissions in several ways:

● You own the object. ● You are granted the MANAGE ANY OBJECT PRIVILEGE system privilege. ● You are indirectly granted specific permissions through membership in a role to which permissions are directly or indirectly granted. ● You are directly granted specific permissions.

Users or roles with object ownership or the MANAGE ANY OBJECT PRIVILEGE system privilege are automatically granted all possible object permissions with administrative rights.

You can grant object permissions with or without administrative rights. The grantee can perform authorized tasks requiring the permission, but cannot in turn grant the permission to another user or role when granted without administrative rights. The grantee can do both when granted with administrative rights (With grant option).

The permissions list only lists those permissions granted directly to users or roles. The list indicates to whom the permissions are granted (grantee), by whom (grantor), and the permissions and their corresponding administrative rights. The permissions list does not list object permissions obtained through ownership, the MANAGE ANY SYSTEM OBJECT system privilege, or role membership.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 179 All members of the role inherit permissions granted to a role, including administrative rights. The role, not the users indirectly granted the permissions through inheritance, appears on the permissions list.

The REVOKE command applies to the database object permission itself, not to any administrative right granted on the permission. Therefore, to remove the administrative right only and leave the database object permission intact, do not click Revoke. Rather, regrant the specific permission without administrative rights. Only the original grantor can remove the administrative rights only from a granted permission. If another grantor regrants the same permission without administrative rights, a new permission without administrative rights is granted, but the original permission with administrative rights remains and takes precedence over any other non-administrative grants of the same permission to the same user or role.

If multiple permissions are granted, you can revoke some or all of the permissions. However, if you revoke a permission granted administrative rights, and the grantee has granted the permission to other users, who in turn have granted it to other users, and so on, every grantee in the chain who has received the permission indirectly, with or without administrative rights, also has their permission revoked. For example, UserA is granted the SELECT permission with the With grant option. UserA grants SELECT to UserB with the With grant option. UserB grants SELECT to UserC and UserD without administrative rights and to UserE with administrative rights. When you revoke the SELECT permission from UserA, it is also revoked for UserB, UserC, UserD and UserE.

Permissions can be granted on the same view or materialized view, to the same grantee, by multiple grantors, resulting in the same grantee appearing multiple times on the list. If the same permission is granted to the same grantee, with and without administrative rights, the grant with the administrative right takes precedence.

When you revoke a permission granted multiple times, the permission is revoked from all instances, regardless of administrative rights. For example, Manager1 grants User2 INSERT with administrative rights. User1 also grants INSERT to User2, without administrative rights. Both instances of INSERT are revoked for User2, regardless of which instance of INSERT is revoked.

5.10.10.2 Following the View Permission Grant Trail

Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see List Object-Level Privileges Granted to a User.

SAP IQ Cockpit Non-GUI Administration and Monitoring 180 PUBLIC Administer SAP IQ 5.10.10.3 Granting View Permissions

Grant view permissions to users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT Object-Level Privilege Statement.

5.10.10.4 Removing Permissions from a View

Remove view permissions from users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE Object-Level Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 181 5.10.10.5 Adding Administrative Rights to a Granted View Permission

Add administrative rights only to a granted view permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT SET USER Privilege Statement.

5.10.10.6 Removing Administrative Rights Only from a View Permission

Remove administrative rights only from a granted view permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 182 PUBLIC Administer SAP IQ 5.10.10.7 View Permissions Privilege Summary

A list of the system privileges and object permissions required to complete the various view permission tasks.

Grant and Revoke Permissions on a View

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● Administrative rights over the permission ● You own the database object

SAP IQ One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights (with grant option) to the permission ● You own the database object

Adjust Administration Permissions on a View

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights to the permission being modified ● You own the database object

5.10.11 View Triggers

Trigger management includes the creation, modification and deletion of triggers on a database object. A trigger is a special form of stored procedure that executes automatically when a statement that modifies data displayed in a view is executed.

Triggers can only fire against IQ (catalog) system store tables, but a view can reference multiple tables from the IQ main store or IQ (catalog) system store. Therefore, triggers that references tables from both stores will fire, but only against IQ (catalog) system store tables.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 183 In this section:

Creating a View Trigger [page 184] Create a new trigger on a view in the IQ (catalog) system store.

Deleting a View Trigger [page 184] Delete triggers from a view.

Generating View Trigger DDL Commands [page 185] There's no SQL-side equivalent for this task.

Modifying View Trigger Properties [page 185] Change trigger properties on a view, including the comment and the underlying SQL statement of the trigger.

View Trigger Privilege Summary [page 186] A list of the system privileges and object permissions required to complete the various view trigger tasks on database objects.

5.10.11.1 Creating a View Trigger

Create a new trigger on a view in the IQ (catalog) system store.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TRIGGER statement.

5.10.11.2 Deleting a View Trigger

Delete triggers from a view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 184 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see DROP TRIGGER statement.

5.10.11.3 Generating View Trigger DDL Commands

There's no SQL-side equivalent for this task.

Context

5.10.11.4 Modifying View Trigger Properties

Change trigger properties on a view, including the comment and the underlying SQL statement of the trigger.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TRIGGER statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 185 5.10.11.5 View Trigger Privilege Summary

A list of the system privileges and object permissions required to complete the various view trigger tasks on database objects.

Creating a View Trigger

Database Version View Trigger Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority and you own the underlying view of the trigger

SAP IQ 16.1 One of:

● CREATE ANY TRIGGER system privilege ● CREATE ANY OBJECT system privilege

You must also have one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY VIEW system privilege ● You own the underlying view of the trigger

Deleting a View Trigger

Database Version View Trigger Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the underlying view of the trigger

SAP IQ 16.1 One of:

● ALTER ANY OBJECT system privilege ● ALTER ANY VIEW system privilege ● You own the underlying view of the trigger

This gives you ALTER permission on the underlying view of the trigger.

Generating View Trigger DDL Commands

Database Version View Trigger Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ Cockpit Non-GUI Administration and Monitoring 186 PUBLIC Administer SAP IQ Database Version View Trigger Privileges Required

SAP IQ 16.1 None

Viewing or Modifying View Trigger Properties

Database Version View Trigger Privileges Required

SAP IQ 15.3 and 15.4 View trigger properties only – none.

Modify trigger comment or properties – one of:

● DBA authority ● RESOURCE authority and you own the underlying view of the trigger

SAP IQ 16.1 View any trigger property page – none

Modify a trigger comment – one of:

● CREATE ANY TRIGGER system privilege ● ALTER ANY TRIGGER system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege

 Note

ALTER permission on the view is not required to modify a comment.

Modify any other trigger property – one of:

● ALTER ANY OBJECT system privilege ● ALTER ANY TRIGGER system privilege, along with one of: ○ ALTER ANY VIEW system privilege ○ You own the underlying view of the trigger

5.11 Domains

Domains are user-defined data types. They improve convenience and encourage consistency in the database.

Domains allow you to define columns on the same data type automatically throughout a database. Domains can have the same NULL or NOT NULL condition, with the same DEFAULT setting and the same CHECK condition.

In this section:

Creating a Domain [page 188] Use the CREATE DOMAIN statement to create an SAP IQ domain.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 187 Deleting a Domain [page 192] Delete a domain to remove it from the database.

Generating Domain DDL Commands [page 192] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Viewing Domain Properties [page 192] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Domain Privilege Summary [page 193] A list of the system privileges and object permissions required to complete the various domain tasks.

5.11.1 Creating a Domain

Use the CREATE DOMAIN statement to create an SAP IQ domain.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE DOMAIN Statement.

In this section:

Constraints and Defaults with Domains [page 188] Many of the attributes associated with columns, such as allowing NULL values, having a DEFAULT value, and so on, can be built into a user-defined data type.

Compatibility Considerations for Domains [page 189] Ensure compatibility with SQL Anywhere and Adaptive Server Enterprise when you create domains.

5.11.1.1 Constraints and Defaults with Domains

Many of the attributes associated with columns, such as allowing NULL values, having a DEFAULT value, and so on, can be built into a user-defined data type.

Any column that is defined on the data type automatically inherits the NULL setting, CHECK condition, and DEFAULT values. This allows uniformity to be built into columns with a similar meaning throughout a database.

SAP IQ Cockpit Non-GUI Administration and Monitoring 188 PUBLIC Administer SAP IQ For example, many primary key columns in the demo database are integer columns holding ID numbers. The following statement creates a data type that may be useful for such columns:

CREATE DOMAIN id INT

NOT NULL DEFAULT AUTOINCREMENT

CHECK( @col > 0 )

Any column created using the data type id is not allowed to hold NULLs, defaults to an autoincremented value, and must hold a positive number. Any identifier could be used instead of in the <@col> variable.

The attributes of the data type can be overridden if needed by explicitly providing attributes for the column. A column created on data type id with NULL values explicitly allowed does allow NULLs, regardless of the setting in the id data type.

5.11.1.2 Compatibility Considerations for Domains

Ensure compatibility with SQL Anywhere and Adaptive Server Enterprise when you create domains.

NULL in Columns

For compatible treatment of NULL:

● SQL Anywhere and SAP IQ assume that columns can be null unless NOT NULL is stated in the column definition. You can change this behavior by setting the database option ALLOW_NULLS_BY_DEFAULT to the Transact-SQL compatible setting OFF. ● SQL Anywhere and SAP IQ assume that BIT columns cannot be NULL. ● Adaptive Server Enterprise assumes that columns cannot be null unless NULL is stated.

Check Constraints

SAP IQ enforces check constraints on base, global temporary, and local temporary tables, and on user-defined data types. Users can log check integrity constraint violations and specify the number of violations that can occur before a LOAD statement rolls back.

● Subqueries ● Expressions specifying a host language parameter, a SQL parameter, or a column as the target for a data value

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 189 ● Set functions ● Invocations of nondeterministic functions or functions that modify data

Adaptive Server Enterprise and SQL Anywhere enforce CHECK constraints. SQL Anywhere allows subqueries in check constraints.

SAP IQ supports user-defined data types that allow constraints to be encapsulated in the data type definition.

Referential Integrity Constraints

Actions for enforcing integrity are supported as follows:

● SAP IQ supports all ANSI actions: SET NULL, CASCADE, DEFAULT, RESTRICT. ● Adaptive Server Enterprise supports two of these actions: SET NULL, DEFAULT.

 Note

You can achieve CASCADE in Adaptive Server Enterprise by using triggers instead of referential integrity.

● SAP IQ supports the RESTRICT action only. ● SAP IQ does not support NOT NULL FOREIGN KEY. ● SAP IQ has the restriction that a column cannot be both a candidate key and a foreign key at the same time.

Default Values in a Column

Default value support differs as follows:

● Adaptive Server Enterprise and SQL Anywhere support specifying a default value for a column. ● Only SQL Anywhere supports DEFAULT UTC TIMESTAMP. ● SAP IQ supports specifying a default value for a column, except for the special values DEFAULT UTC TIMESTAMP and DEFAULT CURRENT UTC TIMESTAMP. SAP IQ also ignores settings for the DEFAULT_TIMESTAMP_INCREMENT database option.

Identity Columns

Identity column support differs as follows:

● SAP IQ supports IDENTITY or DEFAULT AUTOINCREMENT as a default value. SAP IQ supports identity columns of any numeric type with any precision and scale 0, and the column can be NULL. SAP IQ identity

SAP IQ Cockpit Non-GUI Administration and Monitoring 190 PUBLIC Administer SAP IQ columns must be positive and are limited by the range of the data type. SAP IQ supports a single identity column per table, and requires database option IDENTITY_INSERT set to a table name for explicit inserts and updates. To drop a table with an IDENTITY column, you cannot have IDENTITY_INSERT set to that table. The table can contain data when adding an identity column. Tables derived using SELECT INTO do not have Identity/Autoincrement columns. SAP IQ views cannot contain IDENTITY/DEFAULT AUTOINCREMENT columns. ● SQL Anywhere supports the AUTOINCREMENT default value. SQL Anywhere supports identity columns of any numeric type with any allowable scale and precision. The identity column value can be positive, negative, or zero, limited by the range of the data type. SQL Anywhere supports any number of identity columns per table, and does not require identity_insert for explicit inserts, drops, and updates. The table must be empty when adding identity columns. SQL Anywhere identity columns can be altered to be nonidentity columns, and vice versa. You can add or drop AUTOINCREMENT columns from SQL Anywhere views. ● Adaptive Server Enterprise supports a single identity column per table. Adaptive Server Enterprise identity columns are restricted to only numeric data type scale 0, maximum precision 38. They must be positive, are limited by the range of the data type, and cannot be null. Adaptive Server Enterprise requires identity_insert for explicit inserts and drops, but not for updates to the identity column. The table can contain data when you add an identity column. Adaptive Server Enterprise users cannot explicitly set the next value chosen for an identity column. Adaptive Server Enterprise views cannot contain IDENTITY/ AUTOINCREMENT columns. When using SELECT INTO under certain conditions, Adaptive Server Enterprise allows Identity/Autoincrement columns in the result table if they were in the table being selected from.

Computed Columns

Computed column support differs as follows:

● SQL Anywhere supports computed columns that can be indexed. ● Adaptive Server Enterprise and SAP IQ do not.

Temporary Tables

You can create a temporary table by placing a pound sign (#) without an owner specification in front of the table name in a CREATE TABLE statement. These temporary tables are SAP IQ-declared temporary tables and are available only in the current connection.

Locating Tables

Physical placement of a table is carried out differently in Adaptive Server Enterprise and SAP IQ. SAP IQ supports the ON clause, but refers to an SAP IQ dbspace.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 191 5.11.2 Deleting a Domain

Delete a domain to remove it from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

5.11.3 Generating Domain DDL Commands

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

5.11.4 Viewing Domain Properties

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 192 PUBLIC Administer SAP IQ 5.11.5 Domain Privilege Summary

A list of the system privileges and object permissions required to complete the various domain tasks.

Creating a Domain

Database Version Domain Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority

SAP IQ 16.1 One of:

● CREATE DATATYPE system privilege ● CREATE ANY OBJECT system privilege

Deleting a Domain

Database Version Domain Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● DROP DATATYPE system privilege ● DROP ANY OBJECT system privilege ● You own the domain

Generating Domain DDL Commands

Database Version Domain Privileges Required

SAP IQ15.3 and 15.4 None

SAP IQ 16.1 None

Viewing Domain Properties

Database Version Domain Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 193 Database Version Domain Privileges Required

SAP IQ 16.1 None

5.12 Text Configuration Objects

Create, delete, generate DDL, and manage the properties of text configuration objects.

For detailed information on text configuration objects, in the SAP IQ documentation, see SAP IQ Administration: Unstructured Data Analytics.

In this section:

Creating a Text Configuration Object [page 194] Create a text configuration for use with a text index.

Deleting a Text Configuration Object [page 195] Remove one or more text configuration objects.

Generating Text Configuration Object DDL Commands [page 195] Generate data description language for one or more text configuration objects. The DDL code can be a useful reference and training tool.

Modifying Text Configuration Object Properties [page 195] Display and change the properties of a text configuration object for a text index.

Text Configuration Privilege Summary [page 196] A list of the system privileges and object permissions required to complete the various text configuration tasks.

5.12.1 Creating a Text Configuration Object

Create a text configuration for use with a text index.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE TEXT CONFIGURATION Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 194 PUBLIC Administer SAP IQ 5.12.2 Deleting a Text Configuration Object

Remove one or more text configuration objects.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP TEXT CONFIGURATION Statement .

5.12.3 Generating Text Configuration Object DDL Commands

Generate data description language for one or more text configuration objects. The DDL code can be a useful reference and training tool.

Context

5.12.4 Modifying Text Configuration Object Properties

Display and change the properties of a text configuration object for a text index.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 195 Context

To perform this task using SQL, see ALTER TEXT CONFIGURATION Statement.

5.12.5 Text Configuration Privilege Summary

A list of the system privileges and object permissions required to complete the various text configuration tasks.

Creating a Text Configuration Object

Database Version Text Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Text configuration object to be owned by self – RESOURCE authority

Text configuration object to be owned by any user – DBA authority

SAP IQ 16.1 Text configuration object to be owned by self – CREATE TEXT CONFIGURATION system privilege

Text configuration object to be owned by any user – one of:

● CREATE ANY TEXT CONFIGURATION system privilege ● CREATE ANY OBJECT system privilege

You must also have one of:

● ALTER ANY TEXT CONFIGURATION system privilege ● ALTER ANY OBJECT system privilege

Deleting a Text Configuration Object

Database Version Text Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Text configuration object owned by self – none

Table configuration object owned by any user – DBA authority

SAP IQ 16.1 Text configuration object owned by self – none

Table configuration object owned by any user – one of:

● DROP ANY TEXT CONFIGURATION system privilege ● DROP ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 196 PUBLIC Administer SAP IQ Generating Text Configuration Object DDL Commands

Database Version Text Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Text Configuration Object Properties

Database Version Text Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 View any text object configuration property page – none

Modify any text object configuration property – one of:

● DBA authority ● You own the text configuration object

SAP IQ 16.1 View any text object configuration property page – none

Modify a text configuration object term breaker or external prefilter property – CREATE ANY EXTERNAL REFERENCE system privilege. You must also have one of:

● ALTER ANY TEXT CONFIGURATION system privilege ● ALTER ANY OBJECT system privilege ● You own the text configuration object

Modify a text configuration object comment – one of:

● CREATE ANY TEXT CONFIGURATION system privilege ● ALTER ANY TEXT CONFIGURATION system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the text configuration

Modify any other text configuration object properties – one of:

● ALTER ANY TEXT CONFIGURATION system privilege ● ALTER ANY OBJECT system privilege ● You own the text configuration object

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 197 5.13 Text Indexes

Create, delete, generate DDL, and manage the properties of text indexes and text configuration objects. A text index stores positional information for terms in an indexed column. Text indexes are created using settings stored in a text configuration object.

Text indexes significantly speed up full-text searching. You must configure a text index for a table before it is subjected to a full-text search.

Each text index requires a text configuration object. SAP provides two default text configuration objects, one for CHAR collation, one for NCHAR collation. When you set up a text index, you can use one of the default text configuration objects or create a custom text configuration object.

In the SAP IQ documentation, see SAP IQ Administration: Unstructured Data Analytics for detailed information on text indexes.

In this section:

Creating a Text Index [page 198] Set up a text index for a table.

Deleting a Text Index [page 199] Remove one or more text indexes.

Refreshing a Text Index [page 199] Refresh a text index for an IQ (catalog) system store table to bring it up to date when the underlying data has changed.

Truncating a Text Index [page 200] Truncate a text index for an IQ (catalog) system store table.

Generating Text Index DDL Commands [page 200] There's no SQL-side equivalent for this task.

Modifying Text Index Properties [page 200] Change the properties of a text index for an IQ main store or IQ (catalog) system store table.

Text Index Privilege Summary [page 201] A list of the system privileges and object permissions required to complete the various text index tasks.

5.13.1 Creating a Text Index

Set up a text index for a table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 198 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see CREATE TEXT INDEX Statement.

5.13.2 Deleting a Text Index

Remove one or more text indexes.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

5.13.3 Refreshing a Text Index

Refresh a text index for an IQ (catalog) system store table to bring it up to date when the underlying data has changed.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REFRESH TEXT INDEX Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 199 5.13.4 Truncating a Text Index

Truncate a text index for an IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see TRUNCATE TEXT INDEX Statement.

5.13.5 Generating Text Index DDL Commands

There's no SQL-side equivalent for this task.

Context

5.13.6 Modifying Text Index Properties

Change the properties of a text index for an IQ main store or IQ (catalog) system store table.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER TEXT INDEX Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 200 PUBLIC Administer SAP IQ 5.13.7 Text Index Privilege Summary

A list of the system privileges and object permissions required to complete the various text index tasks.

Creating a Text Index

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● REFERENCE permission on the underlying table being indexed along with CREATE permission on the dbspace where the index is being created ● You own the underlying table being indexed along with CREATE permission on the dbspace where the index is being created

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes.

SAP IQ 16.1 One of:

● CREATE ANY INDEX system privilege along with CREATE permission on the dbspace where the index is being created ● CREATE ANY OBJECT system privilege

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes:

● MANAGE ANY STATISTICS system privilege ● CREATE ANY INDEX system privilege ● ALTER ANY INDEX system privilege ● DROP ANY INDEX system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● DROP ANY OBJECT system privilege

Deleting a Text Index

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● REFERENCE permission on the underlying table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 201 Database Version Text Index Privileges Required

SAP IQ 16.1 One of:

● DROP ANY INDEX system privilege ● DROP ANY OBJECT system privilege ● REFERENCE permission on the underlying table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes:

Refreshing a Text Index

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● REFERENCE permission on the underlying table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes.

SAP IQ 16.1 One of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● REFERENCE permission on the underlying table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes:

SAP IQ Cockpit Non-GUI Administration and Monitoring 202 PUBLIC Administer SAP IQ Truncating a Text Index

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● ALTER permission on the table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes.

SAP IQ 16.1 One of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● ALTER permission on the table being indexed ● You own the underlying table being indexed

You must also have EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes:

Generating Text Index DDL Commands

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 None required to generate DDL commands; however, you must have EXECUTE permis sion on the sa_text_index_stats system procedure to display a list of existing text indexes.

SAP IQ 16.1 None required to generate DDL commands; however, you must also have EXECUTE per mission on the sa_text_index_stats system procedure to display a list of exist ing text indexes:

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 203 Viewing or Modifying Text Index Properties

Database Version Text Index Privileges Required

SAP IQ 15.3 and 15.4 EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes.

View text index properties – none

Rename a text index – one of:

● DBA authority ● REFERENCE permission on the underlying table ● You own the underlying table being indexed

Move a text index – one of:

● DBA authority ● SPACE ADMIN authority ● You own the underlying table being indexed and have CREATE permission on the target dbspace

Modify comment on a text index – one of:

● DBA authority ● You own the underlying table being indexed

SAP IQ Cockpit Non-GUI Administration and Monitoring 204 PUBLIC Administer SAP IQ Database Version Text Index Privileges Required

SAP IQ 16.1 EXECUTE permission on the sa_text_index_stats system procedure to display a list of existing text indexes along with one of:

View any text index property page – none

Rename a text index – one of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● REFERENCE permission on the underlying table ● You own the underlying table being indexed

Move a text index – one of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY DBSPACE ● One of the following: ○ You own the underlying table being indexed ○ REFERENCE permission on the table along with one of the following: ○ CREATE ANY OBJECT system privilege ○ CREATE permission on the target dbspace

Modify a text index comment – MANAGE ANY STATISTICS system privilege along with one of:

● ALTER ANY INDEX system privilege ● ALTER ANY OBJECT system privilege ● CREATE ANY OBJECT system privilege ● CREATE ANY INDEX system privilege ● COMMENT ANY OBJECT system privilege ● You own the underlying table being indexed

5.14 Sequence Generators

Sequence generators are used to generate values that are unique across multiple tables, and to generate default values that are something other than the set of natural numbers (1, 2, 3...).

In this section:

Creating a Sequence Generator [page 206]

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 205 Create a sequence generator on a specified system.

Deleting a Sequence Generator [page 207] Delete one or more sequence generators.

Restarting a Sequence at Start Value [page 207] Restart the sequence generator at the start value defined.

Generating Sequence Generator DDL Command [page 208] There's no SQL-side equivalent for this task.

Modifying Sequence Generator Properties [page 208] Change the properties of a sequence generator.

Granting Sequence Generator USAGE Permission [page 208] Grant sequence generator usage permission to users and roles.

Revoking Sequence Generator USAGE Permission [page 209] Remove sequence generator usage permission from users and roles.

Sequence Generator Privilege Summary [page 209] A list of the system privileges and object permissions required to complete the various sequence generator tasks.

5.14.1 Creating a Sequence Generator

Create a sequence generator on a specified system.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SEQUENCE statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 206 PUBLIC Administer SAP IQ 5.14.2 Deleting a Sequence Generator

Delete one or more sequence generators.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SEQUENCE statement.

5.14.3 Restarting a Sequence at Start Value

Restart the sequence generator at the start value defined.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER SEQUENCE statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 207 5.14.4 Generating Sequence Generator DDL Command

There's no SQL-side equivalent for this task.

Context

5.14.5 Modifying Sequence Generator Properties

Change the properties of a sequence generator.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER SEQUENCE statement.

5.14.6 Granting Sequence Generator USAGE Permission

Grant sequence generator usage permission to users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 208 PUBLIC Administer SAP IQ 5.14.7 Revoking Sequence Generator USAGE Permission

Remove sequence generator usage permission from users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, seeREVOKE System Privilege Statement .

5.14.8 Sequence Generator Privilege Summary

A list of the system privileges and object permissions required to complete the various sequence generator tasks.

Creating a Sequence Generator

Database Version Sequence Generator Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● RESOURCE authority

SAP IQ 16.1 One of:

● CREATE ANY SEQUENCE system privilege ● CREATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 209 Deleting a Sequence Generator

Database Version Sequence Generator Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the sequence generator

SAP IQ 16.1 One of:

● DROP ANY SEQUENCE system privilege ● DROP ANY OBJECT system privilege ● You own the sequence generator

Restarting a Sequence at Start Value

Database Version Sequence Generator Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the sequence generator

SAP IQ 16.1 One of:

● ALTER ANY SEQUENCE system privilege ● ALTER ANY OBJECT system privilege ● You own the sequence generator

Generating Sequence Generator DDL Commands

Database Version Sequence Generator Privileges Required

SAP IQ 15.3 and 15.4 None.

SAP IQ 16.1 None.

SAP IQ Cockpit Non-GUI Administration and Monitoring 210 PUBLIC Administer SAP IQ Viewing or Modifying Sequence Generator Properties

Database Version Sequence Generator Permissions

SAP IQ 15.3 and 15.4 View sequence generator properties – none.

Modify a sequence comment – one of:

● DBA authority ● RESOURCE authority ● You own the sequence generator

Modify sequence permissions – one of:

● DBA authority ● PERMS ADMIN authority ● You own the sequence generator

Modify any other sequence property – one of:

● DBA authority ● You own the sequence generator

SAP IQ 16.1 View any sequence property page – none.

Modify a sequence comment – one of:

● CREATE ANY SEQUENCE system privilege ● ALTER ANY SEQUENCE system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege

Modify sequence permissions – one of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the sequence generator

Modify any other sequence property – one of:

● ALTER ANY SEQUENCE system privilege ● ALTER ANY OBJECT system privilege ● You own the sequence generator

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 211 Granting and Revoking Sequence Generator USAGE Permission

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You own the sequence generator

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the sequence generator

5.15 Spatial Support

A spatial reference system describes where local, regional or global features are located. It defines a specific map projection, as well as transformations between different spatial reference systems.

Spatial reference systems only support IQ (catalog) system store tables. For more information on Spatial Support, in the SAP IQ documentation, see SAP IQ Administration: Spatial Data.

In this section:

Creating a Spatial Reference System [page 213] Create a spatial reference system on a specified system.

Deleting a Spatial Reference System [page 213] Delete one or more spatial reference systems.

Generating Spatial Reference System DDL Commands [page 214] There's no SQL-side equivalent for this task.

Modifying Spatial Reference System Properties [page 214] Change the properties of a spatial reference system.

Spatial Units of Measure [page 214] You can add predefined spatial units of measure (UOM) or create custom units of measure.

Spatial Support Privilege Summary [page 217] A list of the system privileges and object permissions required to complete the various spatial support tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring 212 PUBLIC Administer SAP IQ 5.15.1 Creating a Spatial Reference System

Create a spatial reference system on a specified system.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SPATIAL REFERENCE SYSTEM Statement.

5.15.2 Deleting a Spatial Reference System

Delete one or more spatial reference systems.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SPATIAL REFERENCE SYSTEM Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 213 5.15.3 Generating Spatial Reference System DDL Commands

There's no SQL-side equivalent for this task.

Context

5.15.4 Modifying Spatial Reference System Properties

Change the properties of a spatial reference system.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER SPATIAL REFERENCE SYSTEM Statement.

5.15.5 Spatial Units of Measure

You can add predefined spatial units of measure (UOM) or create custom units of measure.

By default, five units of measure are available. Additional predefined units of measure can be added. Each default and predefined unit of measure has a unit type and conversion factor assigned. These values cannot be modified during creation, but can be modified after the fact.

You can also create a custom unit of measure, assigning a name, unit type and conversion factor during the creation process.

In this section:

Creating a Custom Spatial Unit of Measure [page 215] Create a custom unit of measure for the spatial reference system.

Adding a Predefined Spatial Unit of Measure [page 215] Add a predefined unit of measure for the spatial reference system.

Deleting a Spatial Unit of Measure [page 216]

SAP IQ Cockpit Non-GUI Administration and Monitoring 214 PUBLIC Administer SAP IQ Delete one or more spatial units of measure.

Generating Spatial Unit of Measure DDL Commands [page 216] There's no SQL-side equivalent for this task.

Modifying Spatial Unit of Measure Properties [page 216] Change the properties of a spatial unit of measure.

5.15.5.1 Creating a Custom Spatial Unit of Measure

Create a custom unit of measure for the spatial reference system.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SPATIAL UNIT OF MEASURE Statement.

5.15.5.2 Adding a Predefined Spatial Unit of Measure

Add a predefined unit of measure for the spatial reference system.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Installing additional predefined units of measure.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 215 5.15.5.3 Deleting a Spatial Unit of Measure

Delete one or more spatial units of measure.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SPATIAL UNIT OF MEASURE Statement.

5.15.5.4 Generating Spatial Unit of Measure DDL Commands

There's no SQL-side equivalent for this task.

Context

5.15.5.5 Modifying Spatial Unit of Measure Properties

Change the properties of a spatial unit of measure.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SPATIAL UNIT OF MEASURE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 216 PUBLIC Administer SAP IQ 5.15.6 Spatial Support Privilege Summary

A list of the system privileges and object permissions required to complete the various spatial support tasks.

Creating a Spatial Reference System

Database Version Spatial Reference System Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ 16.1 One of:

● MANAGE ANY SPATIAL OBJECT system privilege ● CREATE ANY OBJECT system privilege

Deleting a Spatial Reference System

Database Version Spatial Reference System Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ 16.1 One of:

● MANAGE ANY SPATIAL OBJECT system privilege ● DROP ANY OBJECT system privilege

Generating Spatial Reference System DDL Commands

Database Version Spatial Reference System Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 217 Viewing or Modifying Spatial Reference System Properties

Database Version Spatial Reference System Privileges Required

SAP IQ 15.3 and 15.4 View spatial reference system properties – none

Modify spatial reference system properties or comments – one of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ 16.1 View spatial reference system properties – none

Modify spatial reference system properties – one of:

● MANAGE ANY SPATIAL OBJECT system privilege ● ALTER ANY OBJECT system privilege

Modify spatial reference system comment – one of:

● COMMENT ANY OBJECT system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY SPATIAL OBJECT system privilege

Creating a Spatial Unit of Measure

Database Version Spatial Unit of Measure Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ 16.1 One of:

● CREATE ANY OBJECT system privilege ● MANAGE ANY SPATIAL OBJECT system privilege

Deleting a Spatial Unit of Measure

Database Version Spatial Unit of Measure Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ Cockpit Non-GUI Administration and Monitoring 218 PUBLIC Administer SAP IQ Database Version Spatial Unit of Measure Privileges Required

SAP IQ 16.1 One of:

● MANAGE ANY SPATIAL OBJECT system privilege ● DROP ANY OBJECT system privilege

Generating Spatial Unit of Measure DDL Commands

Database Version Spatial Unit of Measure Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Spatial Unit of Measure Properties

Database Version Spatial Unit of Measure Privileges Required

SAP IQ 15.3 and 15.4 View spatial unit of measure properties – none

Modify spatial unit of measure properties or comments – one of:

● DBA authority ● You are a member of the SYS_SPATIAL_ADMIN_ROLE group

SAP IQ 16.1 View any spatial unit of measure property page – none

Modify a spatial unit of measure comment – one of:

● COMMENT ANY OBJECT system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● MANAGE ANY SPATIAL OBJECT system privilege

Modify any other spatial unit of measure property – one of:

● MANAGE ANY SPATIAL OBJECT system privilege ● ALTER ANY OBJECT system privilege

5.16 Security and User Management

Security encompasses the areas of user, authentication and login management.

SAP IQ Cockpit administration supports SAP IQ Cockpit database versions 15.3 or later. Security for versions 15.3 and 15.4 uses authority-based security, while 16.1 uses role-based security.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 219 Authority-Based and Role-Based and their sub items appear in the EXPLORE workset regardless of the selected system. However, the functionality of the underlying items is dependent on the version of the system. If the selected item is not supported by the system version, the right pane remains empty. For example, if the system is version 16.1 and you select IQ Server Security Authority-Based Groups , nothing appears in the right pane.

In this section:

Role-Based Security [page 220] Add, change, and delete users and roles and grant or revoke database system roles to same.

Login Mappings [page 316] Map a Windows user profile or a Kerberos principal to an existing user in the database to maintain a single user ID for database connections, operating system logins, and network logins.

Login Policies [page 320] Login policies govern only the rules for user login and are separate from authorities and permissions.

LDAP Servers [page 323] The SAP IQ LDAP server configuration object allows LDAP user authentication with SAP IQ.

5.16.1 Role-Based Security

Add, change, and delete users and roles and grant or revoke database system roles to same.

Role-based security is supported with database version 16.1 only.

In this section:

Role Types [page 221] In role-based security, there are several types of roles.

Role-Based Users [page 221] Add, change, and delete role-based users.

Security Implications of the Managing Grantees and Managing Roles Options [page 233] A role can be granted to another role as a grantee (member) or as an underlying role. Each grant type has different security inheritance implications.

User-Extended Roles [page 234] Add, change, and delete user-extended roles.

Standalone Roles [page 254] Add, change, and delete standalone roles.

Role-Based Object Permissions on Users and Roles [page 268] Permissions on database objects can be granted and revoked to role-based users, user-extended roles, and standalone roles, with or without administrative rights

System Roles [page 283] System roles are automatically created in each newly created or database and have been granted specific system privileges.

Compatibility Roles [page 293]

SAP IQ Cockpit Non-GUI Administration and Monitoring 220 PUBLIC Administer SAP IQ Compatibility roles are automatically created in each newly created or database and has been granted specific system privileges.

System Privileges [page 298] System privileges control the rights of users to perform authorized database tasks.

5.16.1.1 Role Types

In role-based security, there are several types of roles.

● User-defined role – can be granted privileges on other objects. Membership to a user-defined role can be granted to users or other user-defined roles. User-defined roles include: ○ Standalone role – an independent database object without login privileges, which can own objects. You cannot convert a standalone role to a user-extended role, and vice versa ○ User-extended role – a user ID that has been extended to act as a role. If an original user has login privileges, a user-extended role inherits the login privileges. ● System roles – are automatically created in each newly created or upgraded database and are granted specific system privileges. System roles cannot be dropped and cannot own objects. They do not follow any specific naming conventions. ● Compatibility Roles – are automatically created in each newly created or upgraded database and are granted specific system roles and privileges. Compatibility roles can be migrated and dropped under specific conditions and use a naming convention that begin with SYS_AUTH_ and end with _ROLE. Also called predefined roles, they are created for backward compatibility with earlier versions of SAP IQ.

5.16.1.2 Role-Based Users

Add, change, and delete role-based users.

In this section:

Creating a Role-Based User [page 222] Add a new role-based user to the database.

Deleting a Role-Based User [page 223] Delete a role-based user from the database.

Converting a Role-Based User to a User-Extended Role [page 223] Change an existing user to act as a role. The user-extended role retains membership roles already granted to the user.

Adding a Role to a Role-Based User [page 224] Add a role-based user a member of a role. The user inherits all underlying system privileges and roles of the granted role.

Changing a Role-Based User's Administrative Rights on a Role [page 224] Change a role-based user's ability to manage a role.

Removing a Role from a Role-Based User [page 225] Remove a role-based user's membership in a role.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 221 Adding a System Privilege to a Role-Based User [page 225] Allows a role-based user to perform privileged tasks associated with a system privilege.

Changing a User's Administrative Rights on a System Privilege [page 226] Changes a user's ability to manage a system privilege.

Removing a System Privilege from a Role-Based User [page 226] Remove a system privilege from a role-based user.

Modifying Role-Based User Options [page 227] Change database option settings assigned to a user.

Generating Role-Based User DDL Commands [page 227] There's no SQL-side equivalent for this task.

Modifying Role-Based User Properties [page 227] Change user properties such as password, login policy and database object permissions.

Changing a Role-Based User Password [page 228] Change the password for another role-base user.

Forcing a Role-Based User to Change their Password [page 228] Force a role-based user to change their password the next time he or she logs in.

Unlocking a Role-Based User Account [page 229] Unlock a locked role-based user account.

Changing a Role-Based User Login Policy [page 229] Assign a role-based user a different login policy

Role-Based User Privilege Summary [page 230] A list of the system privileges and object permissions required to complete the various role-based user tasks.

5.16.1.2.1 Creating a Role-Based User

Add a new role-based user to the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE USER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 222 PUBLIC Administer SAP IQ 5.16.1.2.2 Deleting a Role-Based User

Delete a role-based user from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP USER Statement.

5.16.1.2.3 Converting a Role-Based User to a User-Extended Role

Change an existing user to act as a role. The user-extended role retains membership roles already granted to the user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Converting an Existing User to a User-Extended Role.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 223 5.16.1.2.4 Adding a Role to a Role-Based User

Add a role-based user a member of a role. The user inherits all underlying system privileges and roles of the granted role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.2.5 Changing a Role-Based User's Administrative Rights on a Role

Change a role-based user's ability to manage a role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 224 PUBLIC Administer SAP IQ 5.16.1.2.6 Removing a Role from a Role-Based User

Remove a role-based user's membership in a role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.2.7 Adding a System Privilege to a Role-Based User

Allows a role-based user to perform privileged tasks associated with a system privilege.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 225 5.16.1.2.8 Changing a User's Administrative Rights on a System Privilege

Changes a user's ability to manage a system privilege.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.2.9 Removing a System Privilege from a Role-Based User

Remove a system privilege from a role-based user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 226 PUBLIC Administer SAP IQ 5.16.1.2.10 Modifying Role-Based User Options

Change database option settings assigned to a user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Database Options.

5.16.1.2.11 Generating Role-Based User DDL Commands

There's no SQL-side equivalent for this task.

Context

5.16.1.2.12 Modifying Role-Based User Properties

Change user properties such as password, login policy and database object permissions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Users.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 227 5.16.1.2.13 Changing a Role-Based User Password

Change the password for another role-base user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Changing a User's Password.

5.16.1.2.14 Forcing a Role-Based User to Change their Password

Force a role-based user to change their password the next time he or she logs in.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 228 PUBLIC Administer SAP IQ 5.16.1.2.15 Unlocking a Role-Based User Account

Unlock a locked role-based user account.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

5.16.1.2.16 Changing a Role-Based User Login Policy

Assign a role-based user a different login policy

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 229 5.16.1.2.17 Role-Based User Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based user tasks.

Creating a Role-Based User

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Create a user – MANAGE ANY USER system privilege

Grant a role during the user creation process – you must have one of:

● Administrative rights over the role being granted (role administrator) ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

Grant a system privilege during user creation – you must have administrative rights over the system privilege being granted.

Deleting a Role-Based User

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

Converting a Role-Based User to a User Extended Role

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ROLES system privilege

Adding and Removing a User from a Role

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ Cockpit Non-GUI Administration and Monitoring 230 PUBLIC Administer SAP IQ Database Version Role-Based User Privileges Required

SAP IQ 16.1 You must have one of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Adding and Removing System Privileges from a User

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 You must have administrative rights over the system privilege

Viewing or Modifying Role-Based User Options

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 View the list of options – none.

Modify any option – Depending on the option being modified, requires one of:

● SET ANY PUBLIC OPTION system privilege ● SET ANY SECURITY OPTION system privilege ● SET ANY SYSTEM OPTION system privilege

Generating Role-Based User DDL Commands

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None.

Viewing or Modifying Role-Based User Properties

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 231 Database Version Role-Based User Privileges Required

SAP IQ 16.1 View any user property page – none.

Modify a password – CHANGE PASSWORD system privilege

Modify a login policy, comment, or refresh DN – MANAGE ANY USER system privilege

Refresh LDAP DN - MANAGE ANY USER system privilege

For privileges relating to user permissions, see Role-Based Database Object Permis sions Privilege Summary [page 281]

Changing a Role-Based User Password

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

Forcing a Role-Based User Password Change

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 CHANGE PASSWORD system privilege

Unlocking a Role-Based User Account

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

Changing a Role-Based User Login Policy

Database Version Role-Based User Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 232 PUBLIC Administer SAP IQ 5.16.1.3 Security Implications of the Managing Grantees and Managing Roles Options

A role can be granted to another role as a grantee (member) or as an underlying role. Each grant type has different security inheritance implications.

Grantees are members granted directly to a role. A grantee can be either a user or another role. Granting membership in a role allows grantees to inherit all system privileges and underlying roles of the role.

When granting a role to another role, the role can be granted as a grantee (member)) or as an underlying role.

When a role is granted as a member, each member of the role being granted (the child role) becomes a grantee of the receiving role (the parent role). Each new grantee inherits all system privileges and roles already granted to the parent role, while still retaining all system privileges and roles from the child role. Existing members of the parent role do not inherit any system privileges and roles from the child role.

When a role is granted as an underlying role, all system privileges and roles of the underlying role (child role) are inherited by all members of the receiving role (parent role). However, members of the child role do not become members of the parent role.

Consider the following:

● There are three users: User1, User2, User3. ● There are five roles: Role1, Role2, Role3, Role4, Role5. ● There are three system privileges: Priv1, Priv2, Priv3.

Grant a role as a member:

● Role1 is granted Priv1 and Role4. ● User1 and User2 are members of Role1. ● Role2 is granted Priv2 and Role5. ● User3 is a member of Role2. ● Role1 is made a member of Role2 (Manage Grantee). ● As members of Role1, User1 and User2 (indirectly) become members of Role2 and inherit Priv2. Since Role4 is also a member of Role1, they also (indirectly) inherit all system privileges and roles granted to Role4. ● As a member of Role2, User3 does not inherit Priv1 from Role1, or any system privileges or roles of Role4.

Grant a role as an underlying role:

● Role1 is granted Priv1 and Role4. ● User1 and User2 are members of Role1.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 233 ● Role2 is granted Priv2 and Role5. ● User3 is a member of Role2. ● Role1 is made an underlying role of Role2 (Manage Roles). ● As a member of Role2, User3 inherits the following from Role1: Priv1 and (indirectly) all system privileges and roles of Role4. ● As members of Role1, User1 and User2 do not become members of Role2 and do not inherit Priv2 or any system privileges and roles granted to Role4.

As you can see, there is a significant difference in how system privileges and roles of a child role are inherited by the parent role and by whom. Use of the wrong grant method can lead to unexpected behavior and potential security concerns.

5.16.1.4 User-Extended Roles

Add, change, and delete user-extended roles.

In this section:

Creating a User-Extended Role [page 235] Add a new user-extended role to the database.

Deleting a User-Extended Role [page 236] Delete a user-extended role from the database.

Converting a User-Extended Role to a User [page 236] Change a user-extended role back to a regular user.

Adding a Grantee to a User-Extended Role [page 237] Add a user or role as a member (grantee) of a user-extended role. Grantee inherits all underlying system privileges and roles of the user-extended role.

Changing a Grantee's Administrative Rights on a User-Extended Role [page 237] Change a member's (grantee's) ability to manage a user-extended role.

Removing a Grantee From a User-Extended Role [page 238] Remove a user or role as a member (grantee) of a user-extended role. Grantees lose the ability to use any underlying system privileges or roles of the user-extended role.

Adding a Role to a User-Extended Role [page 238] Add a role as an underlying role of a user-extended role. Members of the user-extended role inherit all system privileges and roles of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the user-extended role.

Changing Administrative Rights on an Underlying Role of a User-Extended Role [page 239] Changes a member's (grantee's) ability to manage an underlying role of a user-extended role.

Removing a Role from a User-Extended Role [page 239] Remove a role as an underlying role of a user-extended role. Members of the user-extended role lose the ability to use any system privileges of the underlying role.

Adding a System Privilege to a User-Extended Role [page 240] Add the ability of a user-extended role to perform privileged tasks associated with a system privilege.

Changing Administrative Rights on a User-Extended Role Granted Privilege [page 240]

SAP IQ Cockpit Non-GUI Administration and Monitoring 234 PUBLIC Administer SAP IQ Change the administrative rights on a system privilege granted to a user-extended role.

Removing a System Privilege from a User-Extended Role [page 241] Remove a system privilege from a user-extended role.

Modifying Role-Based User-Extended Role Options [page 241] Change database option settings assigned to a user.

Manage Role Administrators of a User-Extended Role [page 242] Role administrators are responsible for granting and revoking user-extended roles to users and other roles. You can add and remove role administrators as needed.

Manage Global Role Administrators of a User-Extended Role [page 244] A global role administrator is any user granted the MANAGE ROLES system privilege. However, not all roles can be managed by global role administrators.

Generating User-Extended Role DDL Commands [page 246] There's no SQL-side equivalent for this task.

Modifying User-Extended Role Properties [page 246] View or change user-extended role properties such as password, login policy and database object permissions.

Changing a User-Extended Role Password [page 247] Change the password for another role-base user-extended role.

Forcing a User-Extended Role to Change their Password [page 247] Force a role-based user-extended role to change their password the next time he or she logs in.

Unlocking a User-Extended Role Account [page 248] Unlock a locked role-based user-extended role account.

Changing a User-Extended Role Login Policy [page 248] Assign a role-based user-extended role a different login policy.

Role-Based User-Extended Role Privilege Summary [page 249] A list of the system privileges and object permissions required to complete the various role-based user- extended role tasks.

5.16.1.4.1 Creating a User-Extended Role

Add a new user-extended role to the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 235 Context

To perform this task using SQL, see CREATE ROLE Statement.

5.16.1.4.2 Deleting a User-Extended Role

Delete a user-extended role from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP ROLE Statement.

5.16.1.4.3 Converting a User-Extended Role to a User

Change a user-extended role back to a regular user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 236 PUBLIC Administer SAP IQ 5.16.1.4.4 Adding a Grantee to a User-Extended Role

Add a user or role as a member (grantee) of a user-extended role. Grantee inherits all underlying system privileges and roles of the user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE ROLE Statement.

5.16.1.4.5 Changing a Grantee's Administrative Rights on a User-Extended Role

Change a member's (grantee's) ability to manage a user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 237 5.16.1.4.6 Removing a Grantee From a User-Extended Role

Remove a user or role as a member (grantee) of a user-extended role. Grantees lose the ability to use any underlying system privileges or roles of the user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.4.7 Adding a Role to a User-Extended Role

Add a role as an underlying role of a user-extended role. Members of the user-extended role inherit all system privileges and roles of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 238 PUBLIC Administer SAP IQ 5.16.1.4.8 Changing Administrative Rights on an Underlying Role of a User-Extended Role

Changes a member's (grantee's) ability to manage an underlying role of a user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.4.9 Removing a Role from a User-Extended Role

Remove a role as an underlying role of a user-extended role. Members of the user-extended role lose the ability to use any system privileges of the underlying role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 239 5.16.1.4.10 Adding a System Privilege to a User-Extended Role

Add the ability of a user-extended role to perform privileged tasks associated with a system privilege.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.4.11 Changing Administrative Rights on a User- Extended Role Granted Privilege

Change the administrative rights on a system privilege granted to a user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 240 PUBLIC Administer SAP IQ 5.16.1.4.12 Removing a System Privilege from a User- Extended Role

Remove a system privilege from a user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

5.16.1.4.13 Modifying Role-Based User-Extended Role Options

Change database option settings assigned to a user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Database Options.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 241 5.16.1.4.14 Manage Role Administrators of a User-Extended Role

Role administrators are responsible for granting and revoking user-extended roles to users and other roles. You can add and remove role administrators as needed.

There are two types of role administrators:

● Role administrator – users or roles designated to administer a role. ● Global role administrator – any user granted the MANAGE ROLES system privilege.

When you create a new role, you can appoint one or more role administrators to manage the role (grant and revoke membership in the role). If no role administrator is specified during the creation process, the MANAGE ROLES system privilege is automatically granted to the role with the Administrative Only privilege, which creates the global role administrator for a role. However, if at least one administrator is specified during the creation process, the MANAGE ROLES system privilege is not granted to the role and global role administrators will be unable to manage the role. For this reason, it is recommended that role administrators not be specified when creating a new role. They should be added after the fact. This ensures that every role can be successfully managed by both role and global role administrators.

A role administrator can add or remove other role administrators from a role, including global role administrators. Both role administrators and global role administrators can grant, revoke, and drop roles. A role administrator does not require the MANAGE ROLES system privilege to administer a role.

By default, at least one role administrator or global role administrator with a login password must exist at all times for each role. This minimum requirement is validated before you can remove the global role administrator or role administrator from a role, or remove a role administrator's administrative rights on a role. The minimum requirement is a configurable database option (MIN_ROLE_ADMINS).

In this section:

Adding a Role Administrator to an Existing User-Extended Role [page 243] Add a new role administrator to an existing user-extended role.

Removing a Role Administrator from a User-Extended Role [page 243] Remove a role administrator from an existing user-extended role.

Modifying a User-Extended Role Administrator's Administrative Rights [page 244] Modify whether a role administrator can administer a role only or can also use the underlying system privileges and roles of the role being administered.

SAP IQ Cockpit Non-GUI Administration and Monitoring 242 PUBLIC Administer SAP IQ 5.16.1.4.14.1 Adding a Role Administrator to an Existing User- Extended Role

Add a new role administrator to an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Adding a User-Defined Role to a User or Role.

5.16.1.4.14.2 Removing a Role Administrator from a User- Extended Role

Remove a role administrator from an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Removing Members from a User-Defined Role.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 243 5.16.1.4.14.3 Modifying a User-Extended Role Administrator's Administrative Rights

Modify whether a role administrator can administer a role only or can also use the underlying system privileges and roles of the role being administered.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.4.15 Manage Global Role Administrators of a User- Extended Role

A global role administrator is any user granted the MANAGE ROLES system privilege. However, not all roles can be managed by global role administrators.

When creating a new role, if you specify at least one role administrator, global role administrators will be unable to manage the role. This is because the MANAGE ROLES system privilege is not automatically granted to the role during creation.

For this reason, it is recommended that role administrators not be specified when creating a new role. They should be added after the fact. This ensures that every role can be successfully managed by both role and global role administrators.

In this section:

DBA User or Global Role Administrator Cannot Manage a User-Extended Role [page 245] The Delete or Manage Grantee menu options are unavailable for a user-extended role.

Adding the Global Role Administrator to a User-Extended Role [page 245] Add the global role administrator to an existing user-extended role.

Removing the Global Role Administrator from a User-Extended Role [page 246] Remove the global role administrator from an existing user-extended role.

SAP IQ Cockpit Non-GUI Administration and Monitoring 244 PUBLIC Administer SAP IQ 5.16.1.4.15.1 DBA User or Global Role Administrator Cannot Manage a User-Extended Role

The Delete or Manage Grantee menu options are unavailable for a user-extended role.

These menu options are unavailable if the MANAGE ROLES system privilege has not been granted to the role as a grantee, and the user has not been designated as a role administrator of the role.

To allow these users to manage the role, either:

● Grant the MANAGE ROLES system privilege to the role as a grantee with Administrative only rights, or ● Make the user a role administrator of the role.

The first option is the recommended solution as it allows any user with the MANAGE ROLES system privilege to act as a global role administrator of the role, not just the DBA user.

 Note

SAP strongly recommends that role administrators not be specified when creating a new role. They should be added after the fact. This ensures that all roles can be managed by both role and global role administrators.

5.16.1.4.15.2 Adding the Global Role Administrator to a User- Extended Role

Add the global role administrator to an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Adding the Global Role Administrator to an Existing Role.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 245 5.16.1.4.15.3 Removing the Global Role Administrator from a User-Extended Role

Remove the global role administrator from an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Removing a Role Administrator from a Role.

5.16.1.4.16 Generating User-Extended Role DDL Commands

There's no SQL-side equivalent for this task.

Context

5.16.1.4.17 Modifying User-Extended Role Properties

View or change user-extended role properties such as password, login policy and database object permissions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 246 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see Users.

5.16.1.4.18 Changing a User-Extended Role Password

Change the password for another role-base user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Passwords.

5.16.1.4.19 Forcing a User-Extended Role to Change their Password

Force a role-based user-extended role to change their password the next time he or she logs in.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 247 5.16.1.4.20 Unlocking a User-Extended Role Account

Unlock a locked role-based user-extended role account.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

5.16.1.4.21 Changing a User-Extended Role Login Policy

Assign a role-based user-extended role a different login policy.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER USER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 248 PUBLIC Administer SAP IQ 5.16.1.4.22 Role-Based User-Extended Role Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based user- extended role tasks.

Creating a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Create a role – both the MANAGE ANY USER and MANAGE ROLES system privileges.

Grant a role during user-extended role creation – one of:

● Administrative rights over the role being granted (role administrator) ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

Grant a system privilege during user-extended role creation – administrative rights over the system privilege being granted

Deleting a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

Converting a User-Extended Role to a Role-Based User

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the role being converted

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 249 Adding and Removing Grantees to and from a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Changing Administrative Rights of a Grantee of a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Adding and Removing Underlying Roles to and from a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Enable the Manage Roles option – one of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Add an underlying system role – MANAGE ROLES system privilege

Add an underlying user-defined or compatibility role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

Changing Administrative Rights on an Underlying Role of a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ Cockpit Non-GUI Administration and Monitoring 250 PUBLIC Administer SAP IQ Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 16.1 Enable the Manage Roles option – one of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Add an underlying system role – MANAGE ROLES system privilege

Add an underlying user-defined or compatibility role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

Adding and Removing System Privileges to and from a User-Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the system privilege. Administrative rights on the role are not required.

Changing Administrative Rights on a System Privileges Granted to a User- Extended Role

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the system privilege. Administrative rights on the role are not required.

Viewing or Modifying User-Extended Role Options

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 View user-extended role options only – none

Modify user-extended role options – depending on the option being modified, one of:

● SET ANY PUBLIC OPTION system privilege ● SET ANY SECURITY OPTION system privilege ● SET ANY SYSTEM OPTION system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 251 Managing Role Administrators of a User-Extended Role

Database Version Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role being managed ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

Adding the Global Role Administrator to a User-Extended Role

Database Version Global Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported.

SAP IQ 16.1 Administrative rights over the role being managed

Removing the Global Role Administrator from a User-Extended Role

Database Version Global Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported.

SAP IQ 16.1 One of:

● Administrative rights over the role being managed ● MANAGE ROLES system privilege

Generating User-Extended Role DDL Commands

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring 252 PUBLIC Administer SAP IQ Viewing or Modifying User-Extended Role Properties

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 View any user-extended role property page – none

Modify a password – CHANGE PASSWORD system privilege

Modify a login policy, or refresh LDAP DN – MANAGE ANY USER system privilege

Modify a user-extended role comment – one of:

● MANAGE ROLES system privilege ● Administrative rights over the role begin commented

For privileges relating to user permissions, see Role-Based Database Object Permis sions Privilege Summary [page 281]

Changing a User-Extended Role Password

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 CHANGE PASSWORD system privilege

Forcing a User-Extended Role Password Change

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

Unlocking a User-Extended Role Account

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 253 Changing a User-Extended Role Login Policy

Database Version Role-Based User-Extended Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY USER system privilege

5.16.1.5 Standalone Roles

Add, change, and delete standalone roles.

In this section:

Creating a Standalone Role [page 255] Add a new standalone role to the database.

Deleting a Standalone Role [page 255] Delete a standalone role from the database.

Adding a Grantee to a Standalone Role [page 256] Add a user or role as a member (grantee) of a standalone role. Grantee inherits all underlying system privileges and roles of the standalone role.

Changing a Grantee's Administrative Rights on a Standalone Role [page 256] Changes a member's (grantee's) ability to manage a standalone role.

Removing a Grantee from a Standalone Role [page 257] Remove a user or role as a member (grantee) of a standalone role. Grantees lose the ability to use any underlying system privileges or roles of the standalone role.

Adding a Role to a Standalone Role [page 257] Add a role as an underlying role of a standalone role. Members of the standalone role inherit all system privileges and roles of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the standalone role.

Changing Administrative Rights on an Underlying Role of a Standalone Role [page 258] Changes a member's (grantee's) ability to manage an underlying role of a standalone role.

Removing a Role from a Standalone Role [page 258] Remove an underlying role from a standalone role. Grantees of the standalone role lose the ability to use any system privileges of the underlying role or administer the underlying role.

Adding a System Privilege to a Standalone Role [page 259] Add a system privilege to a standalone role.

Changing Administrative Rights on a Privilege Granted to a Standalone Role [page 259] Change the administrative rights on a system privilege granted to a standalone role.

Removing a System Privilege from a Standalone Role [page 260] Remove a system privilege from a standalone role.

Manage Standalone Role Administrators [page 260] Role administrators are responsible for granting and revoking standalone roles to users and other roles. You can add and remove role administrators as needed.

SAP IQ Cockpit Non-GUI Administration and Monitoring 254 PUBLIC Administer SAP IQ Manage Global Role Administrators of a Standalone Role [page 262] A global role administrator is any user granted the MANAGE ROLES system privilege. However, not all roles can be managed by global role administrators.

Generating Standalone Role DDL Commands [page 264] There's no SQL-side equivalent for this task.

Modifying Standalone Role Properties [page 264] There's no SQL-side equivalent for this task.

Role-Based Standalone Role Privilege Summary [page 265] A list of the system privileges and object permissions required to complete the various role-based standalone role tasks.

5.16.1.5.1 Creating a Standalone Role

Add a new standalone role to the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE ROLE Statement.

5.16.1.5.2 Deleting a Standalone Role

Delete a standalone role from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 255 Context

To perform this task using SQL, see DROP ROLE Statement.

5.16.1.5.3 Adding a Grantee to a Standalone Role

Add a user or role as a member (grantee) of a standalone role. Grantee inherits all underlying system privileges and roles of the standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.5.4 Changing a Grantee's Administrative Rights on a Standalone Role

Changes a member's (grantee's) ability to manage a standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 256 PUBLIC Administer SAP IQ 5.16.1.5.5 Removing a Grantee from a Standalone Role

Remove a user or role as a member (grantee) of a standalone role. Grantees lose the ability to use any underlying system privileges or roles of the standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.5.6 Adding a Role to a Standalone Role

Add a role as an underlying role of a standalone role. Members of the standalone role inherit all system privileges and roles of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 257 5.16.1.5.7 Changing Administrative Rights on an Underlying Role of a Standalone Role

Changes a member's (grantee's) ability to manage an underlying role of a standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Changing Administrative Rights on an Underlying Role of a Standalone Role [page 258].

5.16.1.5.8 Removing a Role from a Standalone Role

Remove an underlying role from a standalone role. Grantees of the standalone role lose the ability to use any system privileges of the underlying role or administer the underlying role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Removing a Role from a Standalone Role [page 258].

SAP IQ Cockpit Non-GUI Administration and Monitoring 258 PUBLIC Administer SAP IQ 5.16.1.5.9 Adding a System Privilege to a Standalone Role

Add a system privilege to a standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.5.10 Changing Administrative Rights on a Privilege Granted to a Standalone Role

Change the administrative rights on a system privilege granted to a standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 259 5.16.1.5.11 Removing a System Privilege from a Standalone Role

Remove a system privilege from a standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

5.16.1.5.12 Manage Standalone Role Administrators

Role administrators are responsible for granting and revoking standalone roles to users and other roles. You can add and remove role administrators as needed.

There are two types of role administrators:

● Role administrator – users or roles designated to administer a role. ● Global role administrator – any user granted the MANAGE ROLES system privilege.

In this section:

SAP IQ Cockpit Non-GUI Administration and Monitoring 260 PUBLIC Administer SAP IQ Adding a Role Administrator to an Existing Standalone Role [page 261] Add a new role administrator to an existing user-extended role.

Removing a Role Administrator from a Standalone Role [page 261] Remove a role administrator from an existing user-extended role.

Modifying a Standalone Role Administrator's Administrative Rights [page 262] Modify whether a role administrator can administer a role only or is also granted the underlying system privileges of the role being administered

5.16.1.5.12.1 Adding a Role Administrator to an Existing Standalone Role

Add a new role administrator to an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.5.12.2 Removing a Role Administrator from a Standalone Role

Remove a role administrator from an existing user-extended role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 261 Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.5.12.3 Modifying a Standalone Role Administrator's Administrative Rights

Modify whether a role administrator can administer a role only or is also granted the underlying system privileges of the role being administered

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.5.13 Manage Global Role Administrators of a Standalone Role

A global role administrator is any user granted the MANAGE ROLES system privilege. However, not all roles can be managed by global role administrators.

In this section:

DBA User or Global Role Administrator Cannot Manage a Standalone Role [page 263]

SAP IQ Cockpit Non-GUI Administration and Monitoring 262 PUBLIC Administer SAP IQ The Delete or Manage Grantee menu options are unavailable for a standalone role.

Adding the Global Role Administrator to a Standalone Role [page 263] Add the global role administrator to an existing standalone role.

Removing the Global Role Administrator from a Standalone Role [page 264] Remove the global role administrator from an existing standalone role.

5.16.1.5.13.1 DBA User or Global Role Administrator Cannot Manage a Standalone Role

The Delete or Manage Grantee menu options are unavailable for a standalone role.

These menu options are unavailable if the MANAGE ROLES system privilege has not been granted to the role as a grantee, and the user has not been designated as a role administrator of the role.

To allow these users to manage the role, either:

● Grant the MANAGE ROLES system privilege to the role as a grantee with Administrative only rights, or ● Make the user a role administrator of the role.

The first option is the recommended solution as it allows any user with the MANAGE ROLES system privilege to act as a global role administrator of the role, not just the DBA user.

 Note

5.16.1.5.13.2 Adding the Global Role Administrator to a Standalone Role

Add the global role administrator to an existing standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 263 5.16.1.5.13.3 Removing the Global Role Administrator from a Standalone Role

Remove the global role administrator from an existing standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.5.14 Generating Standalone Role DDL Commands

There's no SQL-side equivalent for this task.

Context

5.16.1.5.15 Modifying Standalone Role Properties

There's no SQL-side equivalent for this task.

Context

SAP IQ Cockpit Non-GUI Administration and Monitoring 264 PUBLIC Administer SAP IQ 5.16.1.5.16 Role-Based Standalone Role Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based standalone role tasks.

Creating a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Create a role – MANAGE ROLES system privilege

Grant a role during standalone role creation – one of:

● Administrative rights over the role being granted (role administrator) ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

Grant a system privilege during standalone creation – administrative rights over the system privilege being granted

Deleting a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role being deleted ● MANAGE ROLES system privilege if the role being deleted has a global role admin istrator

Adding and Removing Grantees to and from a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 265 Changing a Grantee's Administrative Rights on a User-Extended Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Adding and Removing Underlying Roles to and from a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Enable the Manage Roles option – one of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Add an underlying system role – MANAGE ROLES system privilege

Add an underlying user-defined or compatibility role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

Changing Administrative Rights on an Underlying Role of a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Enable the Manage Roles option – one of:

● Administrative rights over the role (role administrator) ● MANAGE ROLES system privilege if the role has a global role administrator

Add an underlying system role – MANAGE ROLES system privilege

Add an underlying user-defined or compatibility role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

SAP IQ Cockpit Non-GUI Administration and Monitoring 266 PUBLIC Administer SAP IQ Adding and Removing System Privileges to and from a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the system privilege. Administrative rights on the role are not required.

Changing Administrative Rights on a System Privileges Granted to a Standalone Role

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the system privilege. Administrative rights on the role are not required.

Managing Role Administrators of a Standalone Role

Database Version Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● Administrative rights over the role being managed ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

Adding the Global Role Administrator to a Standalone Role

Database Version Global Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported.

SAP IQ 16.1 Administrative rights over the role being managed

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 267 Removing the Global Role Administrator from a Standalone Role

Database Version Global Role Administrator Privileges Required

SAP IQ 15.3 and 15.4 Not supported.

SAP IQ 16.1 One of:

● Administrative rights over the role being managed ● MANAGE ROLES system privilege

Generating Standalone Role DDL Commands

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

Viewing or Modifying User-Extended Role Properties

Database Version Role-Based Standalone Role Privileges Required

SAP IQ 15.3 and 15.4 Not Supported

SAP IQ 16.1 View any standalone role property page – none

Modify a standalone role comment – one of:

● Administrative rights over the role being commented ● MANAGE ROLES system privilege if the role being granted has a global role admin istrator

For privileges relating to user permissions, see Role-Based Database Object Permis sions Privilege Summary [page 281]

5.16.1.6 Role-Based Object Permissions on Users and Roles

Permissions on database objects can be granted and revoked to role-based users, user-extended roles, and standalone roles, with or without administrative rights

In this section:

Role-Based Table or Column Permissions [page 269] Permissions on tables and columns can be granted and revoked to role-based users and roles, with or without administrative rights.

SAP IQ Cockpit Non-GUI Administration and Monitoring 268 PUBLIC Administer SAP IQ Role-Based View or Materialized View Permissions [page 273] Grant permissions on a view or materialized view to a user, user-extended role, or standalone role.

Role-Based Procedure or Function Permission [page 277] Grant and revoke execute permission on a function, procedure, dbspace, or sequence generator for a user, user-extended role, or standalone role.

Role-Based Dbspace Permission [page 279] Grant and revoke create permission on a dbspace for a user, user-extended role, or standalone role.

Role-Based Sequence Generator Permission [page 280] Grant and revoke usage permission on a sequence generator for a user, user-extended role, or standalone role.

Role-Based Database Object Permissions Privilege Summary [page 281] A list of the system privileges and object permissions required to complete the various role-based user, user-extended role, or standalone role tasks relating to database objects.

5.16.1.6.1 Role-Based Table or Column Permissions

Permissions on tables and columns can be granted and revoked to role-based users and roles, with or without administrative rights.

In this section:

About the User or Role Table Permissions List [page 270] The Tables permissions list displays permission details the tables and column directly granted to a user, user-extended role, or standalone role.

Following the User or Role Table Permissions Grant Trail [page 271] Before revoking a grantee's permission, you must identify grantees directly or indirectly granted the permission from the original grantee.

Adding Permissions on a Table or Column to a User or Role [page 272] Add permissions on a table or column to a user, user-extended role, or standalone role.

Removing Permissions on a Table or Column from a User or Role [page 272] Remove permissions on a table or column from a user, user-extended role, or standalone role.

Adding Administrative Rights on a Granted Table or Column Permission to a User or Role [page 273] Add user or role administrative rights only to a granted table or column permission.

Removing Administrative Rights Only on a Table or Column Permission from a User or Role [page 273] Remove administrative rights only from a permission granted to a user, user-extended role, or standalone role, on a table or column.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 269 5.16.1.6.1.1 About the User or Role Table Permissions List

The Tables permissions list displays permission details the tables and column directly granted to a user, user- extended role, or standalone role.

There are several table object permissions, which can be granted with or with out administrative rights. Some permissions can be granted at the table level only, while others can be granted at either the table or column level.

● SELECT – table or column level ● INSERT – table level only ● DELETE – table level only ● UPDATE – table or column level ● ALTER – table level only ● REFERENCE – table or column level ● LOAD – table level only ● TRUNCATE – table level only

You can grant object permissions in several ways:

Users or roles with object ownership or the MANAGE ANY OBJECT PRIVILEGE system privilege are automatically granted all possible object permissions with administrative rights.

The permissions list only lists those tables or columns object permissions granted directly to the selected user or role. The list indicates the table and column the permission is granted on, by who (grantor), and the permissions and their corresponding administrative rights. The permissions list does not list object permissions obtained through ownership, the MANAGE ANY OBJECT PRIVILEGE system privilege, or role membership.

For each table, permissions granted to all columns on the table are listed first (all), followed by each column, sorted alphabetically by column name.

All members of the role inherit permissions granted to a role, including administrative rights. The role, not the users indirectly granted the permissions through inheritance, appears on the permissions list.

SAP IQ Cockpit Non-GUI Administration and Monitoring 270 PUBLIC Administer SAP IQ If multiple permissions are granted, you can revoke some or all of the permissions. However, if you revoke a permission granted administrative rights, and the grantee has granted the permission to other users, who in turn have granted it to other users, and so on, every grantee in the chain who has received the permission indirectly, with or without administrative rights, also has their permission revoked. For example, UserA is granted the SELECT permission with the With grant option. UserA grants SELECT to UserB with the With grant option. UserB grants SELECT to UserC and UserD without administrative rights and to UserE with administrative rights. When you revoke the SELECT permission from UserA, it is also revoked for UserB, UserC, UserD and UserE.

Permissions can be granted on the same table or column, by multiple grantors, resulting in the same table or column appearing multiple times on the list. If the same permission is granted to the same table or column, with and without administrative rights, the grant with the administrative right takes precedence.

For example, the user is granted the SELECT permission by both DBA and Alex, with different administrative rights. When the same permission is granted with different administrative rights, the higher administrative right takes precedence.

5.16.1.6.1.2 Following the User or Role Table Permissions Grant Trail

Before revoking a grantee's permission, you must identify grantees directly or indirectly granted the permission from the original grantee.

The grant chain traces how a grantee has in turn granted a permission to other grantees.

When you view the object permissions granted to a specific user, user-extended role, or standalone role, you see only the permissions granted. You do not see who the user or role has in turn granted the permissions to.

To determine who the selected user or role has in turn granted an object permission to, note the table, column name (if applicable), and the permission to be traced, then display the permissions list for the table object being traced. See Following the Table Permissions Grant Trail.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 271 5.16.1.6.1.3 Adding Permissions on a Table or Column to a User or Role

Add permissions on a table or column to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT Object-Level Privilege Statement.

5.16.1.6.1.4 Removing Permissions on a Table or Column from a User or Role

Remove permissions on a table or column from a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE Object-Level Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 272 PUBLIC Administer SAP IQ 5.16.1.6.1.5 Adding Administrative Rights on a Granted Table or Column Permission to a User or Role

Add user or role administrative rights only to a granted table or column permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.6.1.6 Removing Administrative Rights Only on a Table or Column Permission from a User or Role

Remove administrative rights only from a permission granted to a user, user-extended role, or standalone role, on a table or column.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.6.2 Role-Based View or Materialized View Permissions

Grant permissions on a view or materialized view to a user, user-extended role, or standalone role.

In this section:

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 273 About the User or Role View Permissions List [page 274] The Views permissions list displays permission details the tables and column directly granted to a user, user-extended role, or standalone role.

Following the User or Role View Permission List [page 275] Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

Adding Permissions on a View or Materialized View to a User or Role [page 276] Add permissions on a view or materialized view to a user, user-extended role, or standalone role.

Removing Permissions on a View or Materialized View from a User or Role [page 276] Remove permissions from a view or materialized view to a user, user-extended role, or standalone role.

Adding Administrative Rights to a Granted View Permission to a User or Role [page 277] Add administrative rights only to a granted view or materialized view permission.

Removing Administrative Rights Only on a View or Materialized Permission from a User or Role [page 277] Remove administrative rights only from a permission granted to a user, user-extended role, or standalone role on a view or materialized view.

5.16.1.6.2.1 About the User or Role View Permissions List

The Views permissions list displays permission details the tables and column directly granted to a user, user- extended role, or standalone role.

There are four object permissions for views or materialized views, which you can grant with or with out administrative rights:

● SELECT ● INSERT ● DELETE ● UPDATE

You can grant object permissions in several ways:

Users or roles with object ownership or the MANAGE ANY OBJECT PRIVILEGE system privilege are automatically granted all possible object permissions with administrative rights.

The permissions list only lists those view and materialized view object permissions granted directly to the selected user or role. The list indicates the view or materialized view the permission is granted on, by who (grantor), and the permissions and their corresponding administrative rights. The permissions list does not list

SAP IQ Cockpit Non-GUI Administration and Monitoring 274 PUBLIC Administer SAP IQ object permissions obtained through ownership, the MANAGE ANY SYSTEM OBJECT system privilege, or role membership.

The permissions list is sorted alphabetically by Grantor.

Permissions can be granted on the same view or materialized view, by multiple grantors, resulting in the same view or materialized view appearing multiple times on the list. If the same permission is granted to the same view or materialized view, with and without administrative rights, the grant with the administrative right takes precedence.

5.16.1.6.2.2 Following the User or Role View Permission List

Before revoking a grantee's permission, you need to identify grantees directly or indirectly granted the permission from the original grantee.

The grant chain traces how a grantee has in turn granted a permission to other grantees.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 275 5.16.1.6.2.3 Adding Permissions on a View or Materialized View to a User or Role

Add permissions on a view or materialized view to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT Object-Level Privilege Statement.

5.16.1.6.2.4 Removing Permissions on a View or Materialized View from a User or Role

Remove permissions from a view or materialized view to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 276 PUBLIC Administer SAP IQ 5.16.1.6.2.5 Adding Administrative Rights to a Granted View Permission to a User or Role

Add administrative rights only to a granted view or materialized view permission.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.6.2.6 Removing Administrative Rights Only on a View or Materialized Permission from a User or Role

Remove administrative rights only from a permission granted to a user, user-extended role, or standalone role on a view or materialized view.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.6.3 Role-Based Procedure or Function Permission

Grant and revoke execute permission on a function, procedure, dbspace, or sequence generator for a user, user-extended role, or standalone role.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 277 In this section:

Adding EXECUTE Permission to a User or Role [page 278] Add execute permission on a function or procedure to a user, user-extended role, or standalone role.

Removing EXECUTE Permission from a User or Role [page 278] Remove execute permission on a function or procedure to a user, user-extended role, or standalone role.

5.16.1.6.3.1 Adding EXECUTE Permission to a User or Role

Add execute permission on a function or procedure to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT EXECUTE Privilege Statement.

5.16.1.6.3.2 Removing EXECUTE Permission from a User or Role

Remove execute permission on a function or procedure to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE EXECUTE Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 278 PUBLIC Administer SAP IQ 5.16.1.6.4 Role-Based Dbspace Permission

Grant and revoke create permission on a dbspace for a user, user-extended role, or standalone role.

In this section:

Adding CREATE Permission to a User or Role [page 279] Add create permission on a dbspace to a user, user-extended role, or standalone role.

Removing CREATE Permission to User or Role [page 279] Remove create permission on a dbspace to a user, user-extended role, or standalone role.

5.16.1.6.4.1 Adding CREATE Permission to a User or Role

Add create permission on a dbspace to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT CREATE Privilege Statement.

5.16.1.6.4.2 Removing CREATE Permission to User or Role

Remove create permission on a dbspace to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 279 Context

To perform this task using SQL, see REVOKE CREATE Privilege Statement.

5.16.1.6.5 Role-Based Sequence Generator Permission

Grant and revoke usage permission on a sequence generator for a user, user-extended role, or standalone role.

In this section:

Adding USAGE Permission to a User or Role [page 280] Add usage permission on a sequence generator to a user, user-extended role, or standalone role.

Removing USAGE Permission from a User or Role [page 281] Remove usage permission on a sequence generator from a user, user-extended role, or standalone role.

5.16.1.6.5.1 Adding USAGE Permission to a User or Role

Add usage permission on a sequence generator to a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT USAGE ON SEQUENCE Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 280 PUBLIC Administer SAP IQ 5.16.1.6.5.2 Removing USAGE Permission from a User or Role

Remove usage permission on a sequence generator from a user, user-extended role, or standalone role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE USAGE ON SEQUENCE Privilege Statement.

5.16.1.6.6 Role-Based Database Object Permissions Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based user, user- extended role, or standalone role tasks relating to database objects.

Grant or Revoke Permissions on a Table or Column

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights (with grant option) to the permission ● You own the database object

Modify Administrative Permissions on a Table or Column

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 281 Database Version Role-Based Database Object Privileges Required

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights to the permission being modified ● You own the database object

Grant or Revoke Permissions on a View or Materialized View

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights (with grant option) to the permission ● You own the database object

Modify Administrative Permissions on a View or Materialized View

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You have administrative rights to the permission being modified ● You own the database object

Grant or Revoke Permissions on a Function or Procedure

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the database object

SAP IQ Cockpit Non-GUI Administration and Monitoring 282 PUBLIC Administer SAP IQ Grant or Revoke Permissions on a Sequence Generator

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the sequence generator

Grant or Revoke Permissions on a Dbspace

Database Version Role-Based Database Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

5.16.1.7 System Roles

System roles are automatically created in each newly created or database and have been granted specific system privileges.

You can grant and revoke system roles to users and roles, but you cannot delete them. System roles cannot own objects.

System Role Name Authorized Tasks Supported

diagnostics Allows users to run diagnostic operations. The diagnostics system role owns the diagnostic tables and views.

rs_systabgroup Allows users to perform replication server functionality.

SA_DEBUG Allows users to use the SQL Anywhere Debugger.

SYS_REPLICATION_ADMIN_ROLE Allows users to perform replication related administration tasks.

SYS_RUN_REPLICATION_ROLE Allows users to perform replication tasks using the dbremote utility and synchronization tasks using the dbmlsync utility.

SYS_SPATIAL_ADMIN_ROLE Allows users to create, alter, drop, or comment on spatial ref erence systems and spatial units of measure. The SYS_SPA TIAL_ADMIN_ROLE is the owner of all spatial objects.

SYS The SYS role owns the system tables and views for the data base, which contain the full description of database schema, including all database objects and all user IDs. The SYS sys tem role can be granted to other roles with no administrative rights only.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 283 System Role Name Authorized Tasks Supported

dbo The dbo system role owns many system stored procedures and views.

PUBLIC The PUBLIC system role has SELECT permission on the sys tem tables.

In this section:

View Grantees of a System Role [page 285] Display a list of the users and roles granted membership to a system role.

View Underlying Roles of a System Role [page 285] Display a list of the underlying roles granted to a system role.

View System Privileges Granted to a System Role [page 286] Display a list of the system privileges granted to a system role.

Adding a Grantee to a System Role [page 286] Add a user or role as a member (grantee) of a system role. Grantee inherits all underlying system privileges and roles of the system role.

Removing a Grantee from a System Role [page 287] Remove a user or role as a member of a system role.

Adding a Role to a System Role [page 287] Add a role as an underlying role of a standalone role. Members of the system role inherit the system privileges of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the standalone role.

Changing Administrative Rights on an Underlying Role of a System Role [page 289] Changes a member's (grantee's) ability to manage an underlying role of a system role.

Removing a Role from a System Role [page 289] Remove a role as an underlying role of a system role. Members of the system role lose the ability to use any system privileges of the underlying role.

Adding a System Privilege to a System Role [page 290] Add a system privilege to a system role.

Changing Administrative Rights on a System Role Granted Privilege [page 290] Change the administrative rights on a system privilege granted to a system role.

Removing a System Privilege from a System Role [page 291] Remove a system privilege from a system role.

Role-Based System Role Privilege Summary [page 291] A list of the system privileges and object permissions required to complete the various role-based system role tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring 284 PUBLIC Administer SAP IQ 5.16.1.7.1 View Grantees of a System Role

Display a list of the users and roles granted membership to a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Display Roles Granted.

5.16.1.7.2 View Underlying Roles of a System Role

Display a list of the underlying roles granted to a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Display Roles Granted.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 285 5.16.1.7.3 View System Privileges Granted to a System Role

Display a list of the system privileges granted to a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Determining the Roles and Privileges Granted to a User.

5.16.1.7.4 Adding a Grantee to a System Role

Add a user or role as a member (grantee) of a system role. Grantee inherits all underlying system privileges and roles of the system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 286 PUBLIC Administer SAP IQ 5.16.1.7.5 Removing a Grantee from a System Role

Remove a user or role as a member of a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.7.6 Adding a Role to a System Role

Add a role as an underlying role of a standalone role. Members of the system role inherit the system privileges of the underlying role, but do not become members of the underlying role. Members of the underlying role do not become members of the standalone role.

Prerequisites

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 To enable the Manage Roles option – MANAGE ROLES system privilege

To then add an underlying role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

● The SAP IQ system is running, registered, and authenticated. ● The selected SAP IQ system supports role-based security.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 287 Procedure

1. In SAP IQ Cockpit, click the EXPLORE workset.

2. In the left pane, expand IQ Servers Security Role-Based , and then click System Roles. 3. In the right pane, select an item, and do one of:

○ Click the arrow to the right of the name. ○ Click the Actions button. 4. Select Manage Roles. A list of underlying roles currently granted to the system role appears. 5. Click Grant. 6. Select one or more underlying roles to grant.

 Tip

Use Shift + click or Ctrl + click to select multiple items.

7. Click OK to grant the role. Newly granted underlying roles appear with Role only rights (no administrative rights). 8. (Optional) (For compatibility and user-defined roles only) To modify the administrative rights of an underlying role, highlight a role. Click in the Grant Options column, click the arrow, and select the administrative rights to be granted.

Grant Option Description

Role only (Default) Grantee can use the underlying system privileges of the role only.

Administrative only Grantee can grant and revoke the selected role to other users and roles, but cannot use its underlying system privileges.

Administrative and role Grantee can grant and revoke the selected role to other users and roles and use its underlying system privileges.

 Note

The following steps represent a behavior change as of SAP IQ 16.0, for the following roles only. ○ SYS_AUTH_DBA_ROLE ○ SYS_AUTH_BACKUP_ROLE ○ SYS_RUN_REPLICATION_ROLE ○ SYS_AUTH_RESOURCE_ROLE ○ SYS_AUTH_VALIDATE_ROLE Prior to 16.0, when granting membership to one of these roles, the default inheritance behavior was to not allow members of the role to automatically inherit the underlying system privileges and roles of the compatibility role. Only the log in user (of the role) would inherit. As of 16.0, the default behavior is to allow automatic inheritance by all members of the role.

9. (Optional for SYS_AUTH_DBA_ROLE only) To prevent automatic inheritance of the SYS_AUTH_DBA_ROLE when granted with the Administrative and Role option, click in the Inheritance column, and select No Inheritance.

SAP IQ Cockpit Non-GUI Administration and Monitoring 288 PUBLIC Administer SAP IQ 10. (Optional for SYS_AUTH_DBA_ROLE, SYS_AUTH_BACKUP_ROLE, SYS_RUN_REPLICATION_ROLE, SYS_AUTH_RESOURCE_ROLE, or SYS_AUTH_VALIDATE_ROLE only) To prevent automatic inheritance when granted with Role only option, click in the Inheritance column, and select No Inheritance. 11. Click OK to update any changes to the database and close the page.

5.16.1.7.7 Changing Administrative Rights on an Underlying Role of a System Role

Changes a member's (grantee's) ability to manage an underlying role of a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.7.8 Removing a Role from a System Role

Remove a role as an underlying role of a system role. Members of the system role lose the ability to use any system privileges of the underlying role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 289 5.16.1.7.9 Adding a System Privilege to a System Role

Add a system privilege to a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.7.10 Changing Administrative Rights on a System Role Granted Privilege

Change the administrative rights on a system privilege granted to a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 290 PUBLIC Administer SAP IQ 5.16.1.7.11 Removing a System Privilege from a System Role

Remove a system privilege from a system role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

5.16.1.7.12 Role-Based System Role Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based system role tasks.

View Grantees, Underlying Roles, and System Privileges Granted to a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

Adding and Removing Grantees to and from a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ROLES system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 291 Adding and Removing Underlying Roles to and from a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 To enable the Manage Roles option – MANAGE ROLES system privilege

To then add an underlying role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

Changing Administrative Rights of an Underlying Role on a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 To enable the Manage Roles option – MANAGE ROLES system privilege

To then add an underlying role – one of:

● Administrative rights over the underlying role (role administrator) ● MANAGE ROLES system privilege if the underlying role has a global role adminis trator

Adding and Removing System Privileges from a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ROLES system privilege along with administrative rights over the system priv ilege

Changing Administrative Rights of an Underlying Role on a System Role

Database Version Role-Based System Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ROLES system privilege along with administrative rights over the system priv ilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 292 PUBLIC Administer SAP IQ 5.16.1.8 Compatibility Roles

Compatibility roles are automatically created in each newly created or database and has been granted specific system privileges.

You can grant and revoke compatibility roles to users and roles. They can be migrated to standalone roles and dropped under specific conditions. Compatibility role names begin with SYS_AUTH_ and end with _ROLE. Also called predefined roles, they are created for backward compatibility with earlier versions of SAP IQ.

Compatibility Role Name Authorized Tasks Supported

SYS_AUTH_SA_ROLE Allow users to perform authorized tasks pertaining to data and system administration responsibilities.

SYS_AUTH_SSO_ROLE Allow users to perform authorized tasks pertaining to secur ity and access control responsibilities.

SYS_AUTH_DBA_ROLE Allow users to perform all authorized tasks.

SYS_AUTH_BACKUP_ROLE Allow users to perform all backups.

SYS_AUTH_MULTIPLEX_ADMIN_ROLE Allow users to perform authorized tasks to manage Multi plex.

SYS_AUTH_OPERATOR_ROLE Allow users to checkpoint databases, drop connections (in cluding those for users with SYS_AUTH_DBA_ROLE), back up databases, and monitor the system.

SYS_AUTH_PERMS_ADMIN_ROLE Allow users to manage data privileges, groups, authorities, and passwords.

SYS_AUTH_PROFILE_ROLE Allow users to enable/disable server tracing for application profiling.

SYS_AUTH_READFILE_ROLE Allow users to read to a file resident on the server machine.

SYS_AUTH_READCLIENTFILE_ROLE Allow users to read to a file resident on the client machine.

SYS_AUTH_RESOURCE_ROLE Allow users to create new database objects, such as tables, views, indexes, or procedures.

SYS_AUTH_SPACE_ADMIN_ROLE Allow users to manage dbspaces.

SYS_AUTH_USER_ADMIN_ROLE Allow users to manage external logins, login policies, and other users.

SYS_AUTH_VALIDATE_ROLE Allow users to validate or check tables, materialized views, indexes or databases in the system store that are owned by any user.

SYS_AUTH_WRITEFILE_ROLE Allow users to write to a file resident on the server machine.

SYS_AUTH_WRITECLIENTFILE_ROLE Allow users to write to a file resident on the client machine.

There is a behavior change in SAP IQ 16.0 with respect to inheritance, for these compatibility roles only:

● SYS_AUTH_DBA_ROLE ● SYS_AUTH_BACKUP_ROLE ● SYS_AUTH_RESOURCE_ROLE ● SYS_AUTH_VALIDATE_ROLE only

Prior to 16.0, the default inheritance behavior for these roles was to not allow grantees to automatically inherit the underlying system privileges. As of 16.0, the default behavior is to allow automatic inheritance.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 293 In this section:

View Grantees of a Compatibility Role [page 294] Display a list of the users and roles granted membership to a compatibility role.

View Underlying Roles Granted to a Compatibility Role [page 295] Display a list of the underlying roles granted to a compatibility role.

View System Privileges Granted to a Compatibility Role [page 295] Display a list of the system privileges granted to a compatibility role.

Adding a Grantee to a Compatibility Role [page 296] Add a user or role as a member (grantee) of a compatibility role. Grantee inherits all underlying system privileges and roles of the compatibility role.

Changing a Grantee's Administrative Rights on a Compatibility Role [page 296] Changes a member's (grantee's) ability to manage a compatibility role.

Removing a Grantee from a Compatibility Role [page 297] Remove a user or role as a member (grantee) of a compatibility role. Grantees lose the ability to use any underlying system privileges or roles of the compatibility role.

Deleting a Compatibility Role [page 297] Delete a compatibility role from the database.

Role-Based Compatibility Role Privilege Summary [page 298] A list of the system privileges and object permissions required to complete the various role-based compatibility role tasks.

5.16.1.8.1 View Grantees of a Compatibility Role

Display a list of the users and roles granted membership to a compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Display Roles Granted.

SAP IQ Cockpit Non-GUI Administration and Monitoring 294 PUBLIC Administer SAP IQ 5.16.1.8.2 View Underlying Roles Granted to a Compatibility Role

Display a list of the underlying roles granted to a compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Display Roles Granted.

5.16.1.8.3 View System Privileges Granted to a Compatibility Role

Display a list of the system privileges granted to a compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Determining the Roles and Privileges Granted to a User.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 295 5.16.1.8.4 Adding a Grantee to a Compatibility Role

Add a user or role as a member (grantee) of a compatibility role. Grantee inherits all underlying system privileges and roles of the compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

5.16.1.8.5 Changing a Grantee's Administrative Rights on a Compatibility Role

Changes a member's (grantee's) ability to manage a compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 296 PUBLIC Administer SAP IQ 5.16.1.8.6 Removing a Grantee from a Compatibility Role

Remove a user or role as a member (grantee) of a compatibility role. Grantees lose the ability to use any underlying system privileges or roles of the compatibility role.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE ROLE Statement.

5.16.1.8.7 Deleting a Compatibility Role

Delete a compatibility role from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP ROLE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 297 5.16.1.8.8 Role-Based Compatibility Role Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based compatibility role tasks.

View Grantees, Underlying Roles, and System Privileges Granted to a Compatibility Role

Database Version Role-Based Compatibility Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

Granting and Revoking a Grantee to and from a Compatibility Role

Database Version Role-Based Compatibility Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the compatibility role

Deleting Compatibility Roles

Database Version Role-Based Compatibility Role Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over the compatibility role being deleted

5.16.1.9 System Privileges

System privileges control the rights of users to perform authorized database tasks.

You can grant and revoke system privileges to users and roles, with or without administrative rights, but you cannot delete them.

In this section:

View Users of a System Privilege [page 299] Display a list of the users and roles granted to a system privilege.

Adding a User to a System Privilege [page 299]

SAP IQ Cockpit Non-GUI Administration and Monitoring 298 PUBLIC Administer SAP IQ Add users or roles to a system privilege grant list.

Changing a User's Administrative Rights on a System Privilege [page 315] Change a user or role's ability to manage a system privilege.

Removing a User from a System Privilege [page 315] Remove a user or role as a member (grantee) of a system privilege grant list.

Role-Based System Privilege Summary [page 316] A list of the system privileges and object permissions required to complete the various role-based system privilege tasks.

5.16.1.9.1 View Users of a System Privilege

Display a list of the users and roles granted to a system privilege.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Determining the Roles and Privileges Granted to a User.

5.16.1.9.2 Adding a User to a System Privilege

Add users or roles to a system privilege grant list.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 299 In this section:

Alphabetical List of System Privileges [page 300] A list of all system privileges.

System Privileges Listed by Functional Area [page 307] A list of system privileges organized by functional area.

5.16.1.9.2.1 Alphabetical List of System Privileges

A list of all system privileges.

System privileges control the rights of users to perform authorized database tasks.

The following is a list of available system privileges:

System Privilege Description Functional Area

ACCESS SERVER LS Allows logical server connection using the SERVER logical server Multiplex context.

ACCESS USER PASSWORD Allows a user to access views that contain password hashes, and User and Login Man perform operations that involve accessing passwords, such as un agement loading, extracting, or comparing database

ALTER ANY INDEX Allows a user to alter and comment on indexes and text indexes Indexes on tables and views owned by any user.

ALTER ANY MATERIALIZED Allows a user to alter and comment on materialized views owned Materialized Views VIEW by any user.

ALTER ANY OBJECT Allows a user to alter and comment on the following types of ob Objects jects owned by any user:

● Data types ● Events ● Functions ● Indexes ● Materialized views ● Messages ● Procedures ● Sequence generators ● Spatial reference systems ● Spatial units of measure ● Statistics ● Tables ● Text configuration objects ● Text indexes ● Triggers ● Views

ALTER ANY OBJECT OWNER Allows a user to alter the owner of any type of table object. This Objects privilege does not allow changing of the owner of other objects, such as procedures, materialized views, and so on.

SAP IQ Cockpit Non-GUI Administration and Monitoring 300 PUBLIC Administer SAP IQ System Privilege Description Functional Area

ALTER ANY PROCEDURE Allows a user to alter and comment on procedures and functions Procedures owned by any user.

ALTER ANY SEQUENCE Allows a user to alter sequence generators owned by any user. Sequence

ALTER ANY TABLE Allows a user to: Tables

● Alter and comment on tables (including proxy tables) owned by any user. ● Truncate tables, table partitions, or views owned by any user ● Comment on tables (including proxy tables) and columns in tables owned by any user.

ALTER ANY TEXT CONFIGURA Allows a user to alter and comment on text configuration objects Text Configuration TION owned by any user.

ALTER ANY TRIGGER Allows a user to: Triggers

● Alter triggers on tables and views. ● Issue comments on tables (also requires the ALTER object- level privilege on the table).

ALTER ANY VIEW Allows a user to alter and comment on views owned by any user. Views

ALTER DATABASE Allows a user to: Database

● Upgrade a database. ● Perform cost model calibration. ● Load database statistics. ● Alter transaction logs (also requires the SERVER OPERATOR system privilege). ● Change ownership of the database (also requires the MAN AGE ANY MIRROR SERVER system privilege).

ALTER DATATYPE Allows a user to alter data types. Data Type

BACKUP DATABASE Allows a user to back up a database. Database

CHANGE PASSWORD Allows a user to manage user passwords for any user. User and Login Man agement This system privilege can apply to all users, or it can be limited to a set of specified users, or users who are granted one or more specified roles.

This system privilege is not required to change a user's own pass word.

CHECKPOINT Allows a user to force the database server to execute a check Database point.

COMMENT ANY OBJECT Allows a user to comment on any type of object owned by any Objects user that can be created using the CREATE ANY OBJECT system privilege.

CREATE ANY INDEX Allows a user to create and comment on indexes and text indexes Indexes on tables and views owned by any user.

CREATE ANY MATERIALIZED Allows a user to create and comment on materialized views Materialized Views VIEW owned by any user.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 301 System Privilege Description Functional Area

CREATE ANY MUTEX SEMA Allows a user to create a mutex or semaphore owned by any user. Mutex and Sema PHORE phores

CREATE ANY OBJECT Allows a user to create and comment on the following types of ob Objects jects owned by any user:

CREATE ANY PROCEDURE Allows a user to create and comment on procedures and func Procedure tions owned by any user.

CREATE ANY SEQUENCE Allows a user to create sequence generators, regardless of owner. Sequence

CREATE ANY TABLE Allows a user to: Table

● Create and comment on tables (including proxy tables) owned by any user. ● Comment on columns in tables (including proxy tables) owned by any user.

CREATE ANY TEXT CONFIGU Allows a user to alter and comment on text configuration objects Text Configuration RATION owned by any user.

CREATE ANY TRIGGER Allows a user to create and comment (also requires the ALTER Triggers object level privilege on the table) on tables and views.

CREATE ANY VIEW Allows a user to create and comment on views owned by any user. Views

CREATE DATABASE VARIABLE Allows a user to create, select from, update, and drop self-owned Database Variables database-scope variables.

CREATE DATATYPE Allows a user to create data types. Database

CREATE EXTERNAL REFER Allows a user to create external references in the database. External Environment ENCE You must have the system privileges required to create specific database objects before you can create external references.

For example, creating a self-owned text configuration object that uses an external term breaker requires both the CREATE TEXT CONFIGURATION and CREATE EXTERNAL REFERENCE system privileges.

SAP IQ Cockpit Non-GUI Administration and Monitoring 302 PUBLIC Administer SAP IQ System Privilege Description Functional Area

CREATE MATERIALIZED VIEW Allows a user to create and comment on self-owned materialized Materialized Views views.

CREATE MESSAGE Allows a user to create messages. Miscellaneous

CREATE PROCEDURE Allows a user to create and comment on self-owned procedures Procedure and functions. create a self-owned stored procedure or function.

CREATE PROXY TABLE Allows a user to create self-owned proxy tables. Table

CREATE TABLE Allows a user to: Table

● Create self-owned tables. ● Comment on self-owned columns and tables.

CREATE TEXT CONFIGURA Allows a user to create and comment on self-owned text configu- Text Configuration TION ration objects.

CREATE VIEW Allows a user to create and comment on self-owned views. Re Views quired to create self-owned views.

DEBUG ANY PROCEDURE Allows a user to debug any database object. Miscellaneous

DELETE ANY TABLE Allows a user to delete rows in tables and views owned by any Table user.

DROP ANY INDEX Allows a user to drop indexes and text indexes on tables and views Indexes owned by any user.

DROP ANY MATERIALIZED Allows a user to drop materialized views owned by any user. Materialized View VIEW

DROP ANY MUTEX SEMA Allows a user to drop a mutex or semaphore owned by any user. Mutex and Sema PHORE phores

DROP ANY OBJECT Allows a user to drop the following types of objects owned by any Objects user:

DROP ANY PROCEDURE Allows a user to drop procedures and functions owned by any Procedure user.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 303 System Privilege Description Functional Area

DROP ANY SEQUENCE Allows a user to drop sequence generators owned by any user. Sequence

DROP ANY TABLE Allows a user to drop tables (including proxy tables) owned by any Table user.

DROP ANY TEXT CONFIGURA Allows a user to drop text configuration objects owned by any Text Configuration TION user.

DROP ANY VIEW Allows a user to drop views owned by any user. Views

DROP CONNECTION Allows a user to drop any connections to the database. Database

DROP DATATYPE Allows a user to drop data types. Database

DROP MESSAGE Allows a user to drop messages. Miscellaneous

EXECUTE ANY PROCEDURE Allows a user to execute procedures and functions owned by any Procedure user.

INSERT ANY TABLE Allows a user to insert rows into tables and views owned by any Table user.

LOAD ANY TABLE Allows a user to load data into tables owned by any user. Table

MANAGE ANY DATABASE VARI Allows a user to create and drop database-scope variables owned Database Variables ABLE by self or by PUBLIC.

MANAGE ANY DBSPACE Allows a user to: Dbspaces

● Create, alter, drop, and comment on dbspaces. ● Grant and revoke CREATE object-level privileges on dbspa ces. ● Move data to any dbspace. ● Issue a read-only selective restore statement on any dbspace. ● Run the database delete file function.

MANAGE ANY EVENT Allows a user to create, alter, drop, trigger, and comment on Miscellaneous events.

MANAGE ANY EXTERNAL EN Allows a user to alter, comment on, start, and stop external envi External Environment VIRONMENT ronments.

MANAGE ANY EXTERNAL OB Allows a user to install, comment on, and remove external envi External Environment JECT ronment objects.

MANAGE ANY LDAP SERVER Allows a user to create, alter, drop, validate, and comment on Miscellaneous LDAP servers.

MANAGE ANY LOGIN POLICY Allows a user to create, alter, drop, and comment on login poli User and Login Man cies. agement

MANAGE ANY MIRROR Allows a user to: Miscellaneous SERVER ● Create, alter, drop, and comment on mirror servers. ● Change mirror server parameters. ● Set mirror server options. ● Change ownership of a database.

SAP IQ Cockpit Non-GUI Administration and Monitoring 304 PUBLIC Administer SAP IQ System Privilege Description Functional Area

MANAGE ANY OBJECT PRIVI Allows a user to: Objects LEGES ● Grant and revoke SELECT, INSERT, DELETE, UPDATE, AL TER, REFERENCES, LOAD, and TRUNCATE object-level privi leges on tables owned by any user. ● Grant and revoke SELECT, INSERT, DELETE, and UPDATE ob ject-level privileges on views owned by any user. ● Grant and revoke EXECUTE privileges on procedures and functions owned by any user. ● Grant and revoke USAGE object-level privileges on sequence generators owned by any user. ● Grant and revoke CREATE object-level privileges on dbspa ces.

MANAGE ANY PROPERTY HIS Allows a user to turn on and configure the tracking of database Server Operator TORY server property values.

MANAGE ANY SPATIAL OB Allows a user to create, alter, drop, and comment on spatial refer Miscellaneous JECT ence systems and spatial unit of measures.

MANAGE ANY STATISTICS Allows a user to create, alter, drop, and update database statistics Miscellaneous for any table.

MANAGE ANY USER Allows a user to: User and Login Man agement ● Create, alter, drop, and comment on database users (includ ing assigning an initial password). ● Force a password change on next login for any user. ● Assign and reset the login policy for any user. ● Create, drop, and comment on integrated logins and Ker beros logins. ● Create and drop external logins.

MANAGE ANY WEB SERVICE Allows a user to create, alter, drop, and comment on web serv Miscellaneous ices.

MANAGE AUDITING Allows a user to run the sa_audit_string stored procedure. Procedure

MANAGE LISTENERS Allows a user to start and stop network listeners. Server Operator

MANAGE MULTIPLEX Allows users to: Multiplex

● Create, alter, drop, or comment on logical servers and logical server policies. ● Assign a dbspace to logical servers. ● Release a populated dbspace from the exclusive use of a logi cal server. ● Manages failover configurations, and perform a manual fail over.

MANAGE PROFILING Allows a user to manage database server tracing. The DIAGNOS Database TICS system role is also required to fully utilize diagnostics func tionality for user information.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 305 System Privilege Description Functional Area

MANAGE ROLES Allows a user to create new roles and act as a global administrator Roles for new and existing roles. By default, MANAGE ROLES is granted administrative rights on each newly created role. A user requires administrative rights on the role to delete it.

Administration of a role can also be granted directly to users ei ther during or after the creation of the role. When granted directly to a user, the user does not require the MANAGE ROLES system privilege to administer the role.

If no role administrator is specified during role creation, the MAN AGE ROLES system privilege is automatically granted to the role with the ADMIN ONLY OPTION clause, allowing the global role ad ministrator to administer the role. If at least one role administra tor is specified during creation, the MANAGE ROLES system privi lege is not granted to the role, and global role administrators can not manage the role.

MONITOR Allows a user to monitor a database, including accessing privi Database leged statistics, connected users, and locks.

READ CLIENT FILE Allows a user to read files on the client computer. Files

READ FILE Allows a user to read files on the database server computer. Files

REORGANIZE ANY OBJECT Allows a user to reorganize tables and materialized views owned Objects by any user.

SELECT ANY TABLE Allows a user to query tables and views owned by any user. Table

SELECT PUBLIC DATABASE Allows a user to select the value of a database-scope variable Database Variables VARIABLE owned by PUBLIC.

SERVER OPERATOR Allows a user to: Server Operator

● Create, drop, change ownership of a database, and restore the catalog (only). ● Create, alter, and drop a server. ● Manage a server cache. ● Start and stop database or database engine. ● Encrypt databases. ● Change a database transaction log.

SET ANY PUBLIC OPTION Allows a user to set PUBLIC database options that do not require Database Options the SET ANY SECURITY OPTION or the SET ANY SYSTEM OP TION system privileges.

SET ANY SECURITY OPTION Allows a user to set any PUBLIC security database options. Database Options

SET ANY SYSTEM OPTION Allows a user to set PUBLIC system database options. Database Options

SET ANY USER DEFINED OP Allows a user to set user-defined database options. Database Options TION

SAP IQ Cockpit Non-GUI Administration and Monitoring 306 PUBLIC Administer SAP IQ System Privilege Description Functional Area

SET USER (granted with admin Allows a user to temporarily assume the roles and privileges of User and Login Man istrative rights only) another user. agement

This system privilege can apply to all users, or can be limited to a set of specified users, or users who are granted one or more specified roles.

TRUNCATE ANY TABLE Allows a user to truncate data for tables and materialized views Table owned by any user.

UPDATE ANY MUTEX SEMA Allows a user to update a mutex or semaphore owned by any Mutex and Sema PHORE user. phores

UPDATE ANY TABLE Allows a user to update rows in tables and views owned by any Table user.

UPDATE PUBLIC DATABASE Allows a user to update database-scope variables owned by PUB Database Variables VARIABLE LIC.

UPGRADE ROLE Allows a user to be a default administrator of any system privilege Roles that is introduced when upgrading an SAP IQ database from ver sion 16.0. By default, the UPGRADE ROLE system privilege is granted to the SYS_AUTH_SA_ROLE role, if it exists.

USE ANY SEQUENCE Allows a user to use sequence generators owned by any user. Sequence

VALIDATE ANY OBJECT Allows a user to validate tables, materialized views, indexes, and Objects text indexes owned by any user.

WRITE CLIENT FILE Allows a user to write files to the client computer. Files

WRITE FILE Allows a user to write files on the database server computer. Files

5.16.1.9.2.2 System Privileges Listed by Functional Area

A list of system privileges organized by functional area.

Functional Area System Privilege Description

Database Options SET ANY PUBLIC OPTION Allows a user to set PUBLIC database options that do not require the SET ANY SECURITY OPTION or the SET ANY SYSTEM OP TION system privileges.

SET ANY SECURITY OPTION Allows a user to set any PUBLIC security database options.

SET ANY SYSTEM OPTION Allows a user to set PUBLIC system database options.

SET ANY USER DEFINED OP Allows a user to set user-defined database options. TION

Database Variables CREATE DATABASE VARIABLE Allows a user to create, select from, update, and drop self-owned database-scope variables.

MANAGE ANY DATABASE VARI Allows a user to create and drop database-scope variables owned ABLE by self or by PUBLIC.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 307 Functional Area System Privilege Description

SELECT PUBLIC DATABASE Allows a user to select the value of a database-scope variable VARIABLE owned by PUBLIC.

UPDATE PUBLIC DATABASE Allows a user to update database-scope variables owned by PUB VARIABLE LIC.

Database CHECKPOINT Allows a user to force the database server to execute a check point.

DROP DATATYPE Allows a user to drop data types.

MANAGE PROFILING Allows a user to manage database server tracing. The DIAGNOS TICS system role is also required to fully utilize diagnostics func tionality for user information.

MONITOR Allows a user to monitor a database, including accessing privi leged statistics, connected users, and locks.

ALTER DATABASE Allows a user to:

BACKUP DATABASE Allows a user to back up a database.

CREATE DATATYPE Allows a user to create data types.

DROP CONNECTION Allows a user to drop any connections to the database.

MANAGE ANY DBSPACE Allows a user to:

External Environment CREATE EXTERNAL REFER Allows a user to create external references in the database. ENCE You must have the system privileges required to create specific database objects before you can create external references.

For example, creating a self-owned text configuration object that uses an external term breaker requires both the CREATE TEXT CONFIGURATION and CREATE EXTERNAL REFERENCE system privileges.

MANAGE ANY EXTERNAL EN Allows a user to alter, comment on, start, and stop external envi VIRONMENT ronments.

MANAGE ANY EXTERNAL OB Allows a user to install, comment on, and remove external envi JECT ronment objects.

SAP IQ Cockpit Non-GUI Administration and Monitoring 308 PUBLIC Administer SAP IQ Functional Area System Privilege Description

Files READ CLIENT FILE Allows a user to read files on the client computer.

READ FILE Allows a user to read files on the database server computer.

WRITE CLIENT FILE Allows a user to write files to the client computer.

WRITE FILE Allows a user to write files on the database server computer.

Indexes ALTER ANY INDEX Allows a user to alter and comment on indexes and text indexes on tables and views owned by any user.

CREATE ANY INDEX Allows a user to create and comment on indexes and text indexes on tables and views owned by any user.

DROP ANY INDEX Allows a user to drop indexes and text indexes on tables and views owned by any user.

Materialized View DROP ANY MATERIALIZED Allows a user to drop materialized views owned by any user. VIEW

ALTER ANY MATERIALIZED Allows a user to alter and comment on materialized views owned VIEW by any user.

CREATE ANY MATERIALIZED Allows a user to create and comment on materialized views VIEW owned by any user.

CREATE MATERIALIZED VIEW Allows a user to create and comment on self-owned materialized views.

Miscellaneous ALTER DATATYPE Allows a user to alter data types.

CREATE MESSAGE Allows a user to create messages.

DEBUG ANY PROCEDURE Allows a user to debug any database object.

DROP MESSAGE Allows a user to drop messages.

MANAGE ANY EVENT Allows a user to create, alter, drop, trigger, and comment on events.

MANAGE ANY LDAP SERVER Allows a user to create, alter, drop, validate, and comment on LDAP servers.

MANAGE ANY MIRROR Allows a user to: SERVER ● Create, alter, drop, and comment on mirror servers. ● Change mirror server parameters. ● Set mirror server options. ● Change ownership of a database.

MANAGE ANY SPATIAL OB Allows a user to create, alter, drop, and comment on spatial refer JECT ence systems and spatial unit of measures.

MANAGE ANY STATISTICS Allows a user to create, alter, drop, and update database statistics for any table.

MANAGE ANY WEB SERVICE Allows a user to create, alter, drop, and comment on web serv ices.

Multiplex ACCESS SERVER LS Allows logical server connection using the SERVER logical server context.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 309 Functional Area System Privilege Description

MANAGE MULTIPLEX Allows users to:

Mutex and Sema CREATE ANY MUTEX SEMA Allows a user to create a mutex or semaphore owned by any user. phores PHORE

DROP ANY MUTEX SEMA Allows a user to drop a mutex or semaphore owned by any user. PHORE

UPDATE ANY MUTEX SEMA Allows a user to update a mutex or semaphore owned by any PHORE user.

Objects ALTER ANY OBJECT OWNER Allows a user to alter the owner of any type of table object. This privilege does not allow changing of the owner of other objects, such as procedures, materialized views, and so on.

ALTER ANY OBJECT Allows a user to alter and comment on the following types of ob jects owned by any user:

COMMENT ANY OBJECT Allows a user to comment on any type of object owned by any user that can be created using the CREATE ANY OBJECT system privilege.

SAP IQ Cockpit Non-GUI Administration and Monitoring 310 PUBLIC Administer SAP IQ Functional Area System Privilege Description

CREATE ANY OBJECT Allows a user to create and comment on the following types of ob jects owned by any user:

DROP ANY OBJECT Allows a user to drop the following types of objects owned by any user:

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 311 Functional Area System Privilege Description

MANAGE ANY OBJECT PRIVI Allows a user to: LEGES ● Grant and revoke SELECT, INSERT, DELETE, UPDATE, AL TER, REFERENCES, LOAD, and TRUNCATE object-level privi leges on tables owned by any user. ● Grant and revoke SELECT, INSERT, DELETE, and UPDATE ob ject-level privileges on views owned by any user. ● Grant and revoke EXECUTE privileges on procedures and functions owned by any user. ● Grant and revoke USAGE object-level privileges on sequence generators owned by any user. ● Grant and revoke CREATE object-level privileges on dbspa ces.

REORGANIZE ANY OBJECT Allows a user to reorganize tables and materialized views owned by any user.

VALIDATE ANY OBJECT Allows a user to validate tables, materialized views, indexes, and text indexes owned by any user.

Procedures ALTER ANY PROCEDURE Allows a user to alter and comment on procedures and functions owned by any user.

CREATE ANY PROCEDURE Allows a user to create and comment on procedures and func tions owned by any user.

CREATE PROCEDURE Allows a user to create and comment on self-owned procedures and functions. create a self-owned stored procedure or function.

DROP ANY PROCEDURE Allows a user to drop procedures and functions owned by any user.

EXECUTE ANY PROCEDURE Allows a user to execute procedures and functions owned by any user.

MANAGE AUDITING Allows a user to run the sa_audit_string stored procedure.

Roles MANAGE ROLES Allows a user to create new roles and act as a global administrator for new and existing roles. By default, MANAGE ROLES is granted administrative rights on each newly created role. A user requires administrative rights on the role to delete it.

SAP IQ Cockpit Non-GUI Administration and Monitoring 312 PUBLIC Administer SAP IQ Functional Area System Privilege Description

UPGRADE ROLE Allows a user to be a default administrator of any system privilege that is introduced when upgrading an SAP IQ database from ver sion 16.0. By default, the UPGRADE ROLE system privilege is granted to the SYS_AUTH_SA_ROLE role, if it exists.

Sequence ALTER ANY SEQUENCE Allows a user to alter sequence generators owned by any user.

CREATE ANY SEQUENCE Allows a user to create sequence generators, regardless of owner.

DROP ANY SEQUENCE Allows a user to drop sequence generators owned by any user.

USE ANY SEQUENCE Allows a user to use sequence generators owned by any user.

Server Operator MANAGE ANY PROPERTY HIS Allows a user to turn on and configure the tracking of database TORY server property values.

MANAGE LISTENERS Allows a user to start and stop network listeners.

SERVER OPERATOR Allows a user to:

Table CREATE PROXY TABLE Allows a user to create self-owned proxy tables.

CREATE TABLE Allows a user to:

● Create self-owned tables. ● Comment on self-owned columns and tables.

DELETE ANY TABLE Allows a user to delete rows in tables and views owned by any user.

DROP ANY TABLE Allows a user to drop tables (including proxy tables) owned by any user.

INSERT ANY TABLE Allows a user to insert rows into tables and views owned by any user.

LOAD ANY TABLE Allows a user to load data into tables owned by any user.

SELECT ANY TABLE Allows a user to query tables and views owned by any user.

TRUNCATE ANY TABLE Allows a user to truncate data for tables and materialized views owned by any user.

UPDATE ANY TABLE Allows a user to update rows in tables and views owned by any user.

CREATE ANY TABLE Allows a user to:

● Create and comment on tables (including proxy tables) owned by any user. ● Comment on columns in tables (including proxy tables) owned by any user.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 313 Functional Area System Privilege Description

ALTER ANY TABLE Allows a user to:

Text Configuration ALTER ANY TEXT CONFIGURA Allows a user to alter and comment on text configuration objects TION owned by any user.

CREATE TEXT CONFIGURA Allows a user to create and comment on self-owned text configu- TION ration objects.

DROP ANY TEXT CONFIGURA Allows a user to drop text configuration objects owned by any TION user.

CREATE ANY TEXT CONFIGU Allows a user to alter and comment on text configuration objects RATION owned by any user.

Triggers ALTER ANY TRIGGER Allows a user to:

● Alter triggers on tables and views. ● Issue comments on tables (also requires the ALTER object- level privilege on the table).

CREATE ANY TRIGGER Allows a user to create and comment (also requires the ALTER object level privilege on the table) on tables and views.

ACCESS USER PASSWORD Allows a user to access views that contain password hashes, and perform operations that involve accessing passwords, such as un loading, extracting, or comparing database

CHANGE PASSWORD Allows a user to manage user passwords for any user.

This system privilege can apply to all users, or it can be limited to a set of specified users, or users who are granted one or more specified roles.

This system privilege is not required to change a user's own pass word.

MANAGE ANY LOGIN POLICY Allows a user to create, alter, drop, and comment on login poli cies.

MANAGE ANY USER Allows a user to:

● Create, alter, drop, and comment on database users (includ ing assigning an initial password). ● Force a password change on next login for any user. ● Assign and reset the login policy for any user. ● Create, drop, and comment on integrated logins and Ker beros logins. ● Create and drop external logins.

SAP IQ Cockpit Non-GUI Administration and Monitoring 314 PUBLIC Administer SAP IQ Functional Area System Privilege Description

SET USER (granted with admin Allows a user to temporarily assume the roles and privileges of istrative rights only) another user.

This system privilege can apply to all users, or can be limited to a set of specified users, or users who are granted one or more specified roles.

Views ALTER ANY VIEW Allows a user to alter and comment on views owned by any user.

CREATE ANY VIEW Allows a user to create and comment on views owned by any user.

CREATE VIEW Allows a user to create and comment on self-owned views. Re quired to create self-owned views.

DROP ANY VIEW Allows a user to drop views owned by any user.

5.16.1.9.3 Changing a User's Administrative Rights on a System Privilege

Change a user or role's ability to manage a system privilege.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.16.1.9.4 Removing a User from a System Privilege

Remove a user or role as a member (grantee) of a system privilege grant list.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 315 Context

To perform this task using SQL, seeREVOKE System Privilege Statement .

5.16.1.9.5 Role-Based System Privilege Summary

A list of the system privileges and object permissions required to complete the various role-based system privilege tasks.

View Users and Roles Granted to a System Privilege

Database Version Role-Based System Privilege Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

Adding and Removing Grantees to and From a System Privilege

Database Version Role-Based System Privilege Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over any system privilege

Changing Administrative Rights of a Grantee of a System Privilege

Database Version Role-Based System Privilege Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 Administrative rights over any system privilege

5.16.2 Login Mappings

Map a Windows user profile or a Kerberos principal to an existing user in the database to maintain a single user ID for database connections, operating system logins, and network logins.

In this section:

SAP IQ Cockpit Non-GUI Administration and Monitoring 316 PUBLIC Administer SAP IQ Creating a Login Mapping [page 317] Create a login mapping to allow easier connection to a network server on Windows or a database that uses the Kerberos network authentication protocol.

Deleting a Login Mapping [page 317] Delete a login mapping for a Windows user profile or a Kerberos principal.

Generating Login Mapping DDL Commands [page 318] There's no SQL-side equivalent for this task.

Viewing Login Mapping Properties [page 318] There's no SQL-side equivalent for this task.

Login Mapping Privilege Summary [page 318] A list of the system privileges and object permissions required to complete the various login mapping tasks.

5.16.2.1 Creating a Login Mapping

Create a login mapping to allow easier connection to a network server on Windows or a database that uses the Kerberos network authentication protocol.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT KERBEROS LOGIN Statement.

5.16.2.2 Deleting a Login Mapping

Delete a login mapping for a Windows user profile or a Kerberos principal.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 317 Context

To perform this task using SQL, see REVOKE KERBEROS LOGIN Statement.

5.16.2.3 Generating Login Mapping DDL Commands

There's no SQL-side equivalent for this task.

Context

5.16.2.4 Viewing Login Mapping Properties

There's no SQL-side equivalent for this task.

Context

5.16.2.5 Login Mapping Privilege Summary

A list of the system privileges and object permissions required to complete the various login mapping tasks.

Creating a Login Mapping

Database Version Login Mapping Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority along with SELECT permission on the SYSLOGINMAP view

SAP IQ 16.1 MANAGE ANY USER system privilege along with one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the SYSLOGINMAP view

SAP IQ Cockpit Non-GUI Administration and Monitoring 318 PUBLIC Administer SAP IQ Deleting a Login Mapping

Database Version Login Mapping Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority along with SELECT permission on the SYSLOGINMAP view

SAP IQ 16.1 MANAGE ANY USER system privilege along with one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the SYSLOGINMAP view

Generating Login Mapping DDL Commands

Database Version Login Mapping Privileges Required

SAP IQ 15.3 and 15.4 SELECT permission on the SYSLOGINMAP view

SAP IQ 16.1 One of:

● SELECT ANY TABLE system privilege ● SELECT permission on the SYSLOGINMAP view

Viewing Login Mapping Properties

Database Version Login Mapping Privileges Required

SAP IQ 15.3 and 15.4 View Login Mapping properties – SELECT permission on the SYSLOGINMAP view

Modify Login Mapping comment – one of:

● DBA authority ● USER ADMIN authority along with SELECT permission on the SYSLOGINMAP view

SAP IQ 16.1 View any login mapping property page – one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the SYSLOGINMAP view

Modify a login mapping comment – MANAGE ANY USER system privilege along with one of:

● SELECT ANY TABLE system privilege ● SELECT permission on the SYSLOGINMAP view

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 319 5.16.3 Login Policies

A login policy is a named object in a database that consists of a set of rules that are applied when you create a database connection for a user. All new databases include a root login policy. You can modify the root login policy values, but you cannot delete the policy. Login policies are not inherited through group memberships.

In this section:

Creating a Login Policy for an SAP IQ Server [page 320] Create a login policy to define password and login parameters for users connecting to an SAP IQ database.

Creating a Login Policy for a Multiplex [page 321] Create a login policy to define password and login parameters for users connecting to a multiplex database. Multiplex servers can only be accessed by logical servers, which can be assigned the login policy.

Deleting a Login Policy [page 321] Delete a login policy for an SAP IQ server or multiplex that is not currently assigned to a user. The root login policy cannot never be deleted.

Generating Login Policy DLL Command [page 322] There's no SQL-side equivalent for this task.

Modifying Login Policy Properties [page 322] Change properties of a login policy for an SAP IQ server or multiplex.

Login Policy Privilege Summary [page 322] A list of the system privileges and object permissions required to complete the various login policy tasks.

5.16.3.1 Creating a Login Policy for an SAP IQ Server

Create a login policy to define password and login parameters for users connecting to an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE LOGIN POLICY Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 320 PUBLIC Administer SAP IQ 5.16.3.2 Creating a Login Policy for a Multiplex

Create a login policy to define password and login parameters for users connecting to a multiplex database. Multiplex servers can only be accessed by logical servers, which can be assigned the login policy.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE LOGIN POLICY Statement.

5.16.3.3 Deleting a Login Policy

Delete a login policy for an SAP IQ server or multiplex that is not currently assigned to a user. The root login policy cannot never be deleted.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP LOGIN POLICY Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 321 5.16.3.4 Generating Login Policy DLL Command

There's no SQL-side equivalent for this task.

Context

5.16.3.5 Modifying Login Policy Properties

Change properties of a login policy for an SAP IQ server or multiplex.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER LOGIN POLICY Statement.

5.16.3.6 Login Policy Privilege Summary

A list of the system privileges and object permissions required to complete the various login policy tasks.

Creating a Login Policy for an SAP IQ Server or Multiplex

Database Version Login Policy Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority

SAP IQ 16.1 MANAGE ANY LOGIN POLICY system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 322 PUBLIC Administer SAP IQ Deleting a Login Policy

Database Version Login Policy Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● USER ADMIN authority

SAP IQ 16.1 MANAGE ANY LOGIN POLICY system privilege

Generating Login Policy DDL Commands

Database Version Login Policy Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing Login Policy Properties

Database Version Login Policy Privileges Required

SAP IQ 15.3 and 15.4 View any login policy property page – none

Modify any login policy property – one of:

● DBA authority ● USER ADMIN authority

SAP IQ 16.1 View any login policy property page – none

Modify any login policy property – MANAGE ANY LOGIN POLICY system privilege

5.16.4 LDAP Servers

The SAP IQ LDAP server configuration object allows LDAP user authentication with SAP IQ.

 Note

SAP IQ LDAP user authentication is only supported with SAP IQ 16.1

In this section:

LDAP Server Overview [page 324]

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 323 SAP IQ uses a configuration object called LDAP server to provide connections between the SAP IQ server and external LDAP servers.

Creating an LDAP Server Configuration Object [page 325] Create an LDAP server configuration object to enable LDAP user authentication.

Deleting an LDAP Server Configuration Object [page 325] Delete an LDAP server configuration object.

Activating an LDAP Server Configuration Object [page 326] Set an LDAP server configuration object to a READY state. The state of the LDAP server configuration object changes to ACTIVE once a user authentication request successfully processes. Multiple LDAP server configuration objects can be activated at the same time.

Suspending an LDAP Server Configuration Object [page 326] Put an LDAP server configuration object into maintenance mode. While in maintenance mode, all connections to the LDAP server configuration object are closed and LDAP user authentication is unavailable.

Refreshing an LDAP Server Configuration Object [page 327] Re-initializes LDAP user authentication on the LDAP server configuration object.

Validating a User on an External LDAP Server [page 327] Validate the existence of a specific user on an external LDAP server.

Generating LDAP Server Configuration Object DDL Commands [page 328] There's no SQL-side equivalent for this task.

Modifying LDAP Server Configuration Object Properties [page 328] Change properties of an LDAP server configuration object. Any changes to an LDAP server configuration object are applied on subsequent connections. Any connection already started when the change is applied do not reflect the change.

LDAP Server Configuration Object Privilege Summary [page 329] A list of the system privileges and object permissions required to complete the various LDAP server configuration object tasks for SAP IQ.

5.16.4.1 LDAP Server Overview

SAP IQ uses a configuration object called LDAP server to provide connections between the SAP IQ server and external LDAP servers.

Despite its name, the SAP IQ LDAP server is an object that resides on the SAP IQ server and is NOT an actual server. The LDAP server configuration object's sole function is to provide a connection to a physical LDAP server to allow LDAP user authentication. Any settings of the LDAP server database configuration object apply solely to the SAP IQ side of the LDAP user authentication equation. No LDAP server configuration object settings are written to the physical LDAP server.

 Note

Any references to LDAP server in the SAP IQ Cockpit user interface refer to the SAP IQ LDAP server configuration object, not the external physical LDAP server.

SAP IQ Cockpit Non-GUI Administration and Monitoring 324 PUBLIC Administer SAP IQ 5.16.4.2 Creating an LDAP Server Configuration Object

Create an LDAP server configuration object to enable LDAP user authentication.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE LDAP SERVER Statement.

5.16.4.3 Deleting an LDAP Server Configuration Object

Delete an LDAP server configuration object.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP LDAP SERVER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 325 5.16.4.4 Activating an LDAP Server Configuration Object

Set an LDAP server configuration object to a READY state. The state of the LDAP server configuration object changes to ACTIVE once a user authentication request successfully processes. Multiple LDAP server configuration objects can be activated at the same time.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER LDAP SERVER Statement.

5.16.4.5 Suspending an LDAP Server Configuration Object

Put an LDAP server configuration object into maintenance mode. While in maintenance mode, all connections to the LDAP server configuration object are closed and LDAP user authentication is unavailable.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER LDAP SERVER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 326 PUBLIC Administer SAP IQ 5.16.4.6 Refreshing an LDAP Server Configuration Object

Re-initializes LDAP user authentication on the LDAP server configuration object.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER LDAP SERVER Statement.

5.16.4.7 Validating a User on an External LDAP Server

Validate the existence of a specific user on an external LDAP server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see VALIDATE LDAP SERVER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 327 5.16.4.8 Generating LDAP Server Configuration Object DDL Commands

There's no SQL-side equivalent for this task.

Context

5.16.4.9 Modifying LDAP Server Configuration Object Properties

Change properties of an LDAP server configuration object. Any changes to an LDAP server configuration object are applied on subsequent connections. Any connection already started when the change is applied do not reflect the change.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER LDAP SERVER Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 328 PUBLIC Administer SAP IQ 5.16.4.10 LDAP Server Configuration Object Privilege Summary

A list of the system privileges and object permissions required to complete the various LDAP server configuration object tasks for SAP IQ.

Creating an LDAP Server Configuration Object

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY LDAP SERVER system privilege

Deleting an LDAP Server Configuration Object

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY LDAP SERVER system privilege

Activating, Suspending, and Refreshing an LDAP Server Configuration Object

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY LDAP SERVER system privilege

Validating User

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY LDAP SERVER system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 329 Generating LDAP Server Configuration Object DDL Commands

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 None

Viewing or Modifying LDAP Server Configuration Object Properties

Database Version LDAP Server Configuration Object Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 View any LDAP server property page – none

Modify any LDAP server property – MANAGE ANY LDAP SERVER system privilege

5.17 Dbspaces

Add, modify, view properties, or delete a dbspace.

In this section:

Creating a Dbspace [page 331] Add a new dbspace to the database.

Deleting a Dbspace [page 331] Delete (drop) a dbspace from the database.

Preallocating Space for a Dbspace [page 332] Preallocate space for an IQ (catalog) system store dbspace.

Generating Dbspace DDL Commands [page 332] There's no SQL-side equivalent for this task.

Changing a Dbspace to Read-Only [page 332] Change a dbspace to read-only mode.

Configuring Point-in-Time Recovery Logging Options [page 333] Define the directory path and prefix for point-in-time recovery (PITR) log files.

Modifying Dbspace Properties [page 333] Change the name, mode, status, and striping properties of a dbspace.

Granting Dbspace CREATE Permission [page 334] Grant dbspace create permission to users and roles. Not applicable to cache dbspaces.

Revoking Dbspace CREATE Permission [page 334] Remove dbspace create permission from users and roles. Not applicable to cache dbspaces.

SAP IQ Cockpit Non-GUI Administration and Monitoring 330 PUBLIC Administer SAP IQ Dbspace Privilege Summary [page 335] A list of the system privileges and object permissions required to complete the various dbspace tasks.

5.17.1 Creating a Dbspace

Add a new dbspace to the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE DBSPACE Statement.

5.17.2 Deleting a Dbspace

Delete (drop) a dbspace from the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 331 5.17.3 Preallocating Space for a Dbspace

Preallocate space for an IQ (catalog) system store dbspace.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE DBSPACE Statement.

5.17.4 Generating Dbspace DDL Commands

There's no SQL-side equivalent for this task.

Context

5.17.5 Changing a Dbspace to Read-Only

Change a dbspace to read-only mode.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER DBSPACE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 332 PUBLIC Administer SAP IQ 5.17.6 Configuring Point-in-Time Recovery Logging Options

Define the directory path and prefix for point-in-time recovery (PITR) log files.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER DBSPACE Statement.

5.17.7 Modifying Dbspace Properties

Change the name, mode, status, and striping properties of a dbspace.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER DBSPACE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 333 5.17.8 Granting Dbspace CREATE Permission

Grant dbspace create permission to users and roles. Not applicable to cache dbspaces.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT System Privilege Statement.

5.17.9 Revoking Dbspace CREATE Permission

Remove dbspace create permission from users and roles. Not applicable to cache dbspaces.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE System Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 334 PUBLIC Administer SAP IQ 5.17.10 Dbspace Privilege Summary

A list of the system privileges and object permissions required to complete the various dbspace tasks.

Creating a Dbspace

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Deleting a Dbspace

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Preallocating Space for a Dbspace

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Generating Dbspace DDL Commands

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 335 Changing a Dbspace to Read-Only

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Configuring Point-in-Time Recovery Logging Options

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 Not supported

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Viewing or Modifying Dbspace Properties

Database Version Dbspace Privileges Required

SAP IQ 15.3 and 15.4 View any dbspace property page – none

Modify dbspace permissions – one of:

● DBA authority ● PERMS ADMIN authority

Modify any other dbspace property – one of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 View any dbspace property page – none

Modify dbspace permissions – MANAGE ANY DBSPACE system privilege

Modify any other dbspace property – MANAGE ANY DBSPACE system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 336 PUBLIC Administer SAP IQ Granting and Revoking Dbspace CREATE Permission

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

5.18 Dbfiles

Add, modify, view properties, or delete a database file.

In this section:

Creating a Dbfile [page 338] Add a dbfile to a dbspace. Follow these steps to add files to shared dbspaces (IQ_SYSTEM_MAIN, IQ_SHARED_TEMP, Cache, RLV), and user-defined dbspaces.

Deleting a Dbfile [page 338] Delete a dbfile from a dbspace. With the exception of the IQ_SHARED_TEMP dbspace, you cannot delete the last dbfile in a dbspace.

Emptying a Dbfile [page 339] Empty a dbfile and move the objects in the file to another available read-write dbfile. Not applicable to cache dbspace dbfiles.

Generating Dbfile DDL Commands [page 339] There's no SQL-side equivalent for this task.

Viewing or Modifying Dbfile Properties [page 339] Display and change the name, mode, and path properties of a dbfile.

Dbfile Privilege Summary [page 340] A list of the system privileges and object permissions required to complete the various dbfile tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 337 5.18.1 Creating a Dbfile

Add a dbfile to a dbspace. Follow these steps to add files to shared dbspaces (IQ_SYSTEM_MAIN, IQ_SHARED_TEMP, Cache, RLV), and user-defined dbspaces.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE DBSPACE Statement.

5.18.2 Deleting a Dbfile

Delete a dbfile from a dbspace. With the exception of the IQ_SHARED_TEMP dbspace, you cannot delete the last dbfile in a dbspace.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see sp_iqemptyfile Procedure.

SAP IQ Cockpit Non-GUI Administration and Monitoring 338 PUBLIC Administer SAP IQ 5.18.3 Emptying a Dbfile

Empty a dbfile and move the objects in the file to another available read-write dbfile. Not applicable to cache dbspace dbfiles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see sp_iqemptyfile Procedure.

5.18.4 Generating Dbfile DDL Commands

There's no SQL-side equivalent for this task.

Context

5.18.5 Viewing or Modifying Dbfile Properties

Display and change the name, mode, and path properties of a dbfile.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 339 Context

To perform this task using SQL, see sp_iqfile Procedure.

5.18.6 Dbfile Privilege Summary

A list of the system privileges and object permissions required to complete the various dbfile tasks.

Creating a Dbfile

Database Version Dbfile Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Deleting a Dbfile

Database Version Dbfile Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

Emptying a Dbfile

Database Version Dbfile Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 340 PUBLIC Administer SAP IQ Generating Dbfile DDL Commands

Database Version Dbfile Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Dbfile Properties

Database Version Dbfile Privileges Required

SAP IQ 15.3 and 15.4 View any dbfile property page – none

Modify any dbfile property – One of:

● DBA authority ● SPACE ADMIN authority

SAP IQ 16.1 View any dbfile property page – none

Modify any dbfile property – MANAGE ANY DBSPACE system privilege

Granting or Revoking Dbspace CREATE Permission

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority

SAP IQ 16.1 MANAGE ANY DBSPACE system privilege

5.19 Events

You can automate routine tasks by adding an event to a database, and providing a schedule or conditional trigger for the event. In a multiplex, an event is a global object that is shared across all nodes participating in the multiplex.

There are three types of events:

● Scheduled events have an associated schedule and execute at specified times. ● Conditional events are associated with a system event, and an optional list of conditions that is tracked by the database server.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 341 ● Manual events can only be fired explicitly.

After each execution of an event handler, a COMMIT occurs if no errors occurred. A ROLLBACK occurs if there was an error.

In this section:

Creating an Event [page 342] Create a new event, set to be triggered manually, by a schedule or by a system event and specific conditions.

Deleting an Event [page 343] Permanently delete an event and all associated event schedules and triggers.

Disabling an Event [page 343] Disable a currently enabled event.

Enabling an Event [page 344] Enable a currently disabled event.

Triggering an Event [page 344] Execute an event. You can trigger an event manually regardless of its type (manual, scheduled, or conditional). The TRIGGER EVENT statement can be called at any time for any event.

Generating Event DDL Commands [page 345] There's no SQL-side equivalent for this task.

Modifying Event Properties [page 345] Change the properties of the selected event.

Event Schedules [page 345] You can schedule an event to run at a specific date, time or duration, once or at a recurring interval. An event can have more than one schedule.

Event Privilege Summary [page 347] A list of the system privileges and object permissions required to complete the various event tasks.

5.19.1 Creating an Event

Create a new event, set to be triggered manually, by a schedule or by a system event and specific conditions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE EVENT Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 342 PUBLIC Administer SAP IQ 5.19.2 Deleting an Event

Permanently delete an event and all associated event schedules and triggers.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, seeDROP Statement .

5.19.3 Disabling an Event

Disable a currently enabled event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER EVENT Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 343 5.19.4 Enabling an Event

Enable a currently disabled event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER EVENT Statement.

5.19.5 Triggering an Event

Execute an event. You can trigger an event manually regardless of its type (manual, scheduled, or conditional). The TRIGGER EVENT statement can be called at any time for any event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see TRIGGER EVENT Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 344 PUBLIC Administer SAP IQ 5.19.6 Generating Event DDL Commands

There's no SQL-side equivalent for this task.

Context

5.19.7 Modifying Event Properties

Change the properties of the selected event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER EVENT Statement.

5.19.8 Event Schedules

You can schedule an event to run at a specific date, time or duration, once or at a recurring interval. An event can have more than one schedule.

In this section:

Creating an Event Schedule [page 346] Make a new schedule for an existing event.

Deleting an Event Schedule [page 346] Delete one or more schedule(s) for a selected event.

Generating Event Schedule DDL Commands [page 347] There's no SQL-side equivalent for this task.

Modifying Event Schedule Properties [page 347] Change the properties of a schedule event.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 345 5.19.8.1 Creating an Event Schedule

Make a new schedule for an existing event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER EVENT Statement.

5.19.8.2 Deleting an Event Schedule

Delete one or more schedule(s) for a selected event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, seeDROP Statement .

SAP IQ Cockpit Non-GUI Administration and Monitoring 346 PUBLIC Administer SAP IQ 5.19.8.3 Generating Event Schedule DDL Commands

There's no SQL-side equivalent for this task.

Context

5.19.8.4 Modifying Event Schedule Properties

Change the properties of a schedule event.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER EVENT Statement.

5.19.9 Event Privilege Summary

A list of the system privileges and object permissions required to complete the various event tasks.

Creating an Event

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● MANAGE ANY EVENT system privilege ● CREATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 347 Deleting an Event

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● MANAGE ANY EVENT system privilege ● DROP ANY OBJECT system privilege

Disabling or Enabling an Event

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● MANAGE ANY EVENT system privilege ● ALTER ANY OBJECT system privilege

Triggering an Event

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EVENT system privilege

Generating Event DDL Commands

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

SAP IQ Cockpit Non-GUI Administration and Monitoring 348 PUBLIC Administer SAP IQ Viewing or Modifying Event Properties

Database Version Event Privileges Required

SAP IQ 15.3 and 15.4 View event properties – none

Modify event comment or properties – DBA authority

SAP IQ 16.1 View event properties only – none

Modify event properties – one of:

● MANAGE ANY EVENT system privilege ● ALTER ANY OBJECT system privilege

Modify event comment only – one of:

● MANAGE ANY EVENT system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege

Creating an Event Schedule

Database Version Event Schedule Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● MANAGE ANY EVENT system privilege ● ALTER ANY OBJECT system privilege

Deleting an Event Schedule

Database Version Event Schedule Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 One of:

● MANAGE ANY EVENT system privilege ● ALTER ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 349 Generating Event Schedule DDL Commands

Database Version Event Schedule Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Event Schedule

Properties

Database Version Event Schedule Privileges Required

SAP IQ 15.3 and 15.4 View any event schedule property page – none

Modify any event schedule property – DBA authority

SAP IQ 16.1 View any event schedule property page – none

Modify any event schedule property – one of:

● MANAGE ANY EVENT system privilege ● ALTER ANY OBJECT system privilege

5.20 External Environments

Install, delete, update, and modify the components of external development environments.

In this section:

Working in a Java External Environment [page 351] Install and manage Java classes and JAR files. Test a Java external environment and modify its properties.

Working in a Perl External Environment [page 357] Install Perl objects, test a Perl external environment, and change its properties.

Working in a PHP External Environment [page 363] Install PHP objects, test a PHP external environment, and change its properties.

Working in a C ESQL External Environment [page 369] View and update the properties of C ESQL32 and C ESQL64 external environments.

Working in a C ODBC External Environment [page 370] View and update the properties of C ODBC32 and C ODBC64 external environments.

Working in a CLR (.NET) External Environment [page 371] View and update the properties of a CLR external environment.

SAP IQ Cockpit Non-GUI Administration and Monitoring 350 PUBLIC Administer SAP IQ 5.20.1 Working in a Java External Environment

Install and manage Java classes and JAR files. Test a Java external environment and modify its properties.

In this section:

Installing a Java Classes File into an SAP IQ Database [page 352] Install a Java classes file to an SAP IQ database using SAP IQ Cockpit. This enables the database to execute functions and procedures written in Java.

Updating a Java Classes File [page 352] Update a Java classes file in an SAP IQ database.

Deleting a Classes File [page 353] There's no SQL-side equivalent for this task.

Viewing or Modifying Java Classes File Properties [page 353] Display the properties of a Java classes file associated with an SAP IQ database. Only the comment can be modified.

Installing a Java JAR File into an SAP IQ Database [page 353] Install a Java JAR file to an SAP IQ database. This enables the database to execute functions and procedures written in Java.

Updating a Java JAR File [page 354] Update a Java JAR file in an SAP IQ database.

Deleting a JAR File [page 354] There's no SQL-side equivalent for this task.

Modifying the Java JAR File Properties [page 354] Only the comment can be modified.

Testing the Configuration of a Java External Environment [page 355] Test the configuration of a Java external environment to make sure the JRE is accessible and responding.

Viewing or Modifying Java External Environment Properties [page 355] Display and change the properties of a Java external environment, including the location of the executable and the associated user.

Java External Environment Privilege Summary [page 356] A list of the system privileges and object permissions required to complete the various external environment Java tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 351 5.20.1.1 Installing a Java Classes File into an SAP IQ Database

Install a Java classes file to an SAP IQ database using SAP IQ Cockpit. This enables the database to execute functions and procedures written in Java.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see How to install Java classes into a database.

5.20.1.2 Updating a Java Classes File

Update a Java classes file in an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Updating classes and JAR files.

SAP IQ Cockpit Non-GUI Administration and Monitoring 352 PUBLIC Administer SAP IQ 5.20.1.3 Deleting a Classes File

There's no SQL-side equivalent for this task.

Context

5.20.1.4 Viewing or Modifying Java Classes File Properties

Display the properties of a Java classes file associated with an SAP IQ database. Only the comment can be modified.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Updating classes and JAR files.

5.20.1.5 Installing a Java JAR File into an SAP IQ Database

Install a Java JAR file to an SAP IQ database. This enables the database to execute functions and procedures written in Java.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 353 Context

To perform this task using SQL, see Installing a JAR file.

5.20.1.6 Updating a Java JAR File

Update a Java JAR file in an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Updating classes and JAR files.

5.20.1.7 Deleting a JAR File

There's no SQL-side equivalent for this task.

Context

5.20.1.8 Modifying the Java JAR File Properties

Only the comment can be modified.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 354 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see Updating classes and JAR files.

5.20.1.9 Testing the Configuration of a Java External Environment

Test the configuration of a Java external environment to make sure the JRE is accessible and responding.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see What are Prerequisites for Java in the Database?.

5.20.1.10 Viewing or Modifying Java External Environment Properties

Display and change the properties of a Java external environment, including the location of the executable and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Updating classes and JAR files.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 355 5.20.1.11 Java External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various external environment Java tasks.

Installing a Java Classes or JAR File

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Updating a Java Classes or JAR File

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Deleting a Java Classes or JAR File

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Viewing or Modifying a Java Classes or JAR File

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 View external environment properties – none

Modify external environment properties – DBA authority

SAP IQ 16.1 View external environment properties – none

Modify external environment properties – MANAGE ANY EXTERNAL OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 356 PUBLIC Administer SAP IQ Testing the Configuration of a Java External Environment

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL ENVIRONMENT system privilege

Viewing or Modifying Java External Environment Properties

Database Version External Environment – Java Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL ENVIRONMENT system privilege

5.20.2 Working in a Perl External Environment

Install Perl objects, test a Perl external environment, and change its properties.

A Perl stored procedure or function behaves like a SQL stored procedure or function except that the code for the procedure or function is written in Perl and the execution of the procedure or function takes place outside the database server (that is, within a Perl executable instance).

You must create a separate instance of the Perl executable for each connection that uses Perl stored procedures and functions. This behavior is different from Java stored procedures and functions. For Java, there is one instance of the Java VM for each database rather than one instance per connection. The other major difference between Perl and Java is that Perl stored procedures do not return result sets, whereas Java stored procedures can return result sets.

In this section:

Creating a Perl Object [page 358] Install Perl and create a Perl object before installing the new Perl object into the SAP IQ database.

Perl Objects in SQL Procedures and Functions [page 359] When defining SQL procedures and functions referencing Perl objects, the LANGUAGE is always and the EXTERNAL NAME string contains the information needed to call the Perl subroutines and to return OUT parameters and return values.

Installing a Perl Object into an SAP IQ Database [page 359] Install a Perl object into an SAP IQ database. After installing it, you can reference the object in SQL procedures and functions.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 357 Updating a Perl Object [page 359] Update a Perl object in an SAP IQ database.

Deleting a Perl Object [page 360] Remove a JAR file from an SAP IQ database.

Viewing or Modifying Perl Object Properties. [page 360] Display the properties of a Perl object associated with an SAP SAP IQ database. Only the comment can be modified.

Testing the Configuration of a Perl External Environment [page 361] Test the configuration of a Perl external environment to make sure the Perl object is accessible and responding.

Modifying Perl External Environment Properties [page 361] Change the properties of a Perl external environment, including the location of the Perl object and the associated user.

Perl External Environment Privilege Summary [page 362] A list of the system privileges and object permissions required to complete the various Perl external environment tasks.

5.20.2.1 Creating a Perl Object

Install Perl and create a Perl object before installing the new Perl object into the SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

SAP IQ Cockpit Non-GUI Administration and Monitoring 358 PUBLIC Administer SAP IQ 5.20.2.2 Perl Objects in SQL Procedures and Functions

When defining SQL procedures and functions referencing Perl objects, the LANGUAGE is always and the EXTERNAL NAME string contains the information needed to call the Perl subroutines and to return OUT parameters and return values.

In this example, the Perl object PerlConsoleExample creates the string 'Hello world'. This SQL procedure writes the output of PerlConsoleExample to the database server messages window:

CREATE PROCEDURE PerlWriteToConsole( IN str LONG VARCHAR) EXTERNAL NAME ' WriteToServerConsole( $sa_perl_arg0 )' LANGUAGE PERL; // 'Hello world' should appear in the database server messages window

CALL PerlWriteToConsole( 'Hello world' );

5.20.2.3 Installing a Perl Object into an SAP IQ Database

Install a Perl object into an SAP IQ database. After installing it, you can reference the object in SQL procedures and functions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

5.20.2.4 Updating a Perl Object

Update a Perl object in an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 359 Context

To perform this task using SQL, see Perl DBI support.

5.20.2.5 Deleting a Perl Object

Remove a JAR file from an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

5.20.2.6 Viewing or Modifying Perl Object Properties.

Display the properties of a Perl object associated with an SAP SAP IQ database. Only the comment can be modified.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

SAP IQ Cockpit Non-GUI Administration and Monitoring 360 PUBLIC Administer SAP IQ 5.20.2.7 Testing the Configuration of a Perl External Environment

Test the configuration of a Perl external environment to make sure the Perl object is accessible and responding.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

5.20.2.8 Modifying Perl External Environment Properties

Change the properties of a Perl external environment, including the location of the Perl object and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Perl DBI support.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 361 5.20.2.9 Perl External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various Perl external environment tasks.

Installing a Perl Object

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Updating a Perl Object

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Deleting a Perl Object

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Viewing or Modifying a Perl Object Properties

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 View external environment properties – none

Modify View external environment properties – DBA authority

SAP IQ 16.1 View external environment properties – none

Modify external environment properties – MANAGE ANY EXTERNAL OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 362 PUBLIC Administer SAP IQ Testing the Configuration of a Perl External Environment

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Viewing or Modifying Perl External Environment Properties

Database Version External Environment – Perl Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL OBJECT system privilege

5.20.3 Working in a PHP External Environment

Install PHP objects, test a PHP external environment, and change its properties.

A PHP stored procedure or function behaves the same as a SQL stored procedure or function except that the code for the procedure or function is written in PHP and the execution of the procedure or function takes place outside the database server (that is, within a PHP executable instance).

You must create a separate instance of the PHP executable for each connection that uses PHP stored procedures and functions. This behavior is quite different from Java stored procedures and functions. For Java, there is one instance of the Java VM for each database rather than one instance per connection. The other major difference between PHP and Java is that PHP stored procedures do not return result sets, whereas Java stored procedures can return result sets. PHP only returns an object of type LONG VARCHAR, which is the output of the PHP script.

In this section:

Creating a PHP Object [page 364] Install PHP and create a PHP script before installing the new PHP object into the SAP IQ database.

Installing a PHP Object [page 364] Install a PHP object into an SAP IQ database. After installing it, you can reference the object in SQL procedures and functions.

Updating a PHP Object [page 365] Update a PHP object in an SAP IQ database.

Deleting a PHP Object [page 365]

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 363 Remove a PHP object from an SAP IQ database.

Viewing or Modifying PHP Object Properties [page 366] Display the properties of a PHP object associated with an SAP IQ database. Only the comment can be modified.

Testing the Configuration of a PHP External Environment [page 366] Test the configuration of a PHP external environment to make sure the PHP object is accessible and responding.

Viewing or Modifying PHP External Environment Properties [page 367] Display and change the properties of a PHP external environment, including the location of the PHP object and the associated user.

PHP External Environment Privilege Summary [page 367] A list of the system privileges and object permissions required to complete the various PHP external environment tasks.

5.20.3.1 Creating a PHP Object

Install PHP and create a PHP script before installing the new PHP object into the SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

5.20.3.2 Installing a PHP Object

Install a PHP object into an SAP IQ database. After installing it, you can reference the object in SQL procedures and functions.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring 364 PUBLIC Administer SAP IQ Context

To perform this task using SQL, see PHP support.

5.20.3.3 Updating a PHP Object

Update a PHP object in an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

5.20.3.4 Deleting a PHP Object

Remove a PHP object from an SAP IQ database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 365 5.20.3.5 Viewing or Modifying PHP Object Properties

Display the properties of a PHP object associated with an SAP IQ database. Only the comment can be modified.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

5.20.3.6 Testing the Configuration of a PHP External Environment

Test the configuration of a PHP external environment to make sure the PHP object is accessible and responding.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

SAP IQ Cockpit Non-GUI Administration and Monitoring 366 PUBLIC Administer SAP IQ 5.20.3.7 Viewing or Modifying PHP External Environment Properties

Display and change the properties of a PHP external environment, including the location of the PHP object and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see PHP support.

5.20.3.8 PHP External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various PHP external environment tasks.

Installing a PHP Object

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 View external environment properties – none

Modify external environment properties – DBA authority

SAP IQ 16.1 View external environment properties – none

Modify external environment properties – MANAGE ANY EXTERNAL OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 367 Updating a PHP Object

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Deleting a PHP Object

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Viewing or Modifying a PHP Object Properties

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 View properties – none

Modify comment – MANAGE ANY EXTERNAL OBJECT system privilege

Testing the Configuration of a PHP External Environment

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY EXTERNAL OBJECT system privilege

Viewing or Modifying PHP External Environment Properties

Database Version External Environment – PHP Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ Cockpit Non-GUI Administration and Monitoring 368 PUBLIC Administer SAP IQ Database Version External Environment – PHP Privileges Required

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL OBJECT system privilege

5.20.4 Working in a C ESQL External Environment

View and update the properties of C ESQL32 and C ESQL64 external environments.

Install the C or C++ code outside of SAP IQ Cockpit. You cannot use SAP IQ Cockpit to install the executable.

In this section:

Viewing or Modifying C ESQL Executable Properties [page 369] Display and change the properties of a C ESQL32 or C ESQL64 external environment, including the location of the executable and the associated user.

Other External Environment Privilege Summary [page 370] A list of the system privileges and object permissions required to complete the various external environment tasks.

5.20.4.1 Viewing or Modifying C ESQL Executable Properties

Display and change the properties of a C ESQL32 or C ESQL64 external environment, including the location of the executable and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Embedded SQL.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 369 5.20.4.2 Other External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various external environment tasks.

Viewing or Modifying C ESQL, C ODBC, or CLR (.NET) Executable Properties

Database Version Other External Environment Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL OBJECT system privilege

5.20.5 Working in a C ODBC External Environment

View and update the properties of C ODBC32 and C ODBC64 external environments.

Install the C or C++ code outside of SAP IQ Cockpit. You cannot use SAP IQ Cockpit to install the executable.

In this section:

Modifying C ODBC Executable Properties [page 371] Change the properties of a C ODBC32 or C ODBC64 external environment, including the location of the executable and the associated user.

Other External Environment Privilege Summary [page 371] A list of the system privileges and object permissions required to complete the various external environment tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring 370 PUBLIC Administer SAP IQ 5.20.5.1 Modifying C ODBC Executable Properties

Change the properties of a C ODBC32 or C ODBC64 external environment, including the location of the executable and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ODBC CLI.

5.20.5.2 Other External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various external environment tasks.

Viewing or Modifying C ESQL, C ODBC, or CLR (.NET) Executable Properties

Database Version Other External Environment Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL OBJECT system privilege

5.20.6 Working in a CLR (.NET) External Environment

View and update the properties of a CLR external environment.

The CLR external environment is supported on Windows servers only.

Install the .NET code outside of SAP IQ Cockpit. You cannot use SAP IQ Cockpit to install the executable.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 371 In this section:

Modifying CLR (.NET) Executable Properties [page 372] Change the properties of a CLR external environment, including the location of the executable and the associated user.

Other External Environment Privilege Summary [page 372] A list of the system privileges and object permissions required to complete the various external environment tasks.

5.20.6.1 Modifying CLR (.NET) Executable Properties

Change the properties of a CLR external environment, including the location of the executable and the associated user.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see .NET application programming.

5.20.6.2 Other External Environment Privilege Summary

A list of the system privileges and object permissions required to complete the various external environment tasks.

Viewing or Modifying C ESQL, C ODBC, or CLR (.NET) Executable Properties

Database Version Other External Environment Privileges Required

SAP IQ 15.3 and 15.4 View any external environment property page – none

Modify any external environment property – DBA authority

SAP IQ Cockpit Non-GUI Administration and Monitoring 372 PUBLIC Administer SAP IQ Database Version Other External Environment Privileges Required

SAP IQ 16.1 View any external environment property page – none

Modify any external environment property – MANAGE ANY EXTERNAL OBJECT system privilege

5.21 Functions

Create, delete, display, and manage the properties of functions in SAP IQ.

Sample functions and procedures are provided with SAP IQ. Sample functions are visible in SAP IQ Cockpit in the EXPLORE workset ( IQ Servers Compiled Objects Functions . The samples include explanatory comments and can be found in IQ/IQ-X_X/samples/udf, where X_X is the SAP IQ release number (16.1, for example).

In this section:

Creating a Watcom SQL or Transact-SQL Function [page 374] Set up a new Watcom SQL or Transact-SQL function on an SAP IQ server.

Creating an External Java Function [page 374] Set up a new external Java function on an SAP IQ server.

Creating an External C/C++ Scalar or Aggregate Function [page 375] Set up a new external C or C++ aggregate function on an SAP IQ server.

Deleting a Function [page 375] Remove a function from an SAP IQ server.

Generating Function DDL Commands [page 376] There's no SQL-side equivalent for this task.

Modifying a Function [page 376] View and change the SQL statement and properties of a function on an SAP IQ server.

Granting Function EXECUTE Permission [page 376] Grant function execute permission to users and roles.

Revoking Function EXECUTE Permission [page 377] Remove function execute permission from users and roles.

Function Privilege Summary [page 377] A list of the system privileges and object permissions required to complete the various function tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 373 5.21.1 Creating a Watcom SQL or Transact-SQL Function

Set up a new Watcom SQL or Transact-SQL function on an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE FUNCTION Statement.

5.21.2 Creating an External Java Function

Set up a new external Java function on an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE FUNCTION Statement [Java UDF].

SAP IQ Cockpit Non-GUI Administration and Monitoring 374 PUBLIC Administer SAP IQ 5.21.3 Creating an External C/C++ Scalar or Aggregate Function

Set up a new external C or C++ aggregate function on an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Creating a Scalar or Aggregate UDF.

5.21.4 Deleting a Function

Remove a function from an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 375 5.21.5 Generating Function DDL Commands

There's no SQL-side equivalent for this task.

Context

5.21.6 Modifying a Function

View and change the SQL statement and properties of a function on an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER FUNCTION Statement.

5.21.7 Granting Function EXECUTE Permission

Grant function execute permission to users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT EXECUTE Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 376 PUBLIC Administer SAP IQ 5.21.8 Revoking Function EXECUTE Permission

Remove function execute permission from users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE EXECUTE Privilege Statement.

5.21.9 Function Privilege Summary

A list of the system privileges and object permissions required to complete the various function tasks.

Creating a Watcom SQL or Transact-SQL Function

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 Watcom SQL or Transact-SQL function to be owned by self – one of:

● DBA authority ● RESOURCE ADMIN authority

Watcom SQL or Transact-SQL function to be owned by any user – DBA authority

SAP IQ 16.1 Watcom SQL or Transact-SQL to be owned by self – CREATE PROCEDURE system privilege

Watcom SQ or Transact-SQL function to be owned by any user – one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 377 Creating an External C/C++ Scalar or Aggregate Function

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 External C/C++ Scalar or Aggregate function to be owned by self or any user – DBA au thority

SAP IQ 16.1 External C/C++ Scalar or Aggregate function to be owned by self – all of:

● CREATE PROCEDURE system privilege ● CREATE EXTERNAL REFERENCE system privilege

External C/C++ Scalar or Aggregate function to be owned by any user – CREATE EX TERNAL REFERENCE system privilege along with one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

Creating an External Java Function

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 External Java function to be owned by self or any user – DBA authority

SAP IQ 16.1 External Java function to be owned by self – all of:

● CREATE PROCEDURE system privilege ● CREATE EXTERNAL REFERENCE system privilege

External Java function to be owned by any user – CREATE EXTERNAL REFERENCE sys tem privilege along with one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

Deleting a Function

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the function

SAP IQ 16.1 One of:

● DROP ANY PROCEDURE system privilege ● DROP ANY OBJECT system privilege ● You own the function

SAP IQ Cockpit Non-GUI Administration and Monitoring 378 PUBLIC Administer SAP IQ Generating Function DDL Commands

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Function Properties

Database Version Function Privileges Required

SAP IQ 15.3 and 15.4 View any function property page regardless of type – none

Modify permissions for any function type – one of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

Modify any other function property regardless of type – one of:

● DBA authority ● You own the function

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 379 Database Version Function Privileges Required

SAP IQ 16.1 View any function property page regardless of type – none

Modify SQL code for Watcom SQL or Transact-SQL function – one of:

● ALTER ANY PROCEDURE system privilege ● ALTER ANY OBJECT system privilege ● You own the function

Modify SQL code for External C/C++ Scalar or Aggregate, or External Java function – CREATE EXTERNAL REFERENCE system privilege along with one of:

● ALTER ANY PROCEDURE system privilege ● ALTER ANY OBJECT system privilege ● You own the function

Modify a comment for any function type – one of:

● CREATE ANY PROCEDURE system privilege. ● ALTER ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the function

Modify permissions for any function type – one of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the database object

Granting or Revoking Function EXECUTE Permission

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the database object

SAP IQ Cockpit Non-GUI Administration and Monitoring 380 PUBLIC Administer SAP IQ 5.22 Procedures

Create, delete, display, and manage the properties of procedures in SAP IQ, including remote procedures and table-valued user-defined functions / table parameterized functions.

SAP provides sample procedures and functions with SAP IQ. Sample procedures are visible in SAP IQ Cockpit in the EXPLORE workset ( IQ Servers Compiled Objects Procedures ). The samples include explanatory comments and can be found in IQ/IQ-X_X/samples/udf, where X_X is the SAP IQ release number (16.1, for example).

In this section:

Creating a Procedure [page 382] Set up a new procedure on an SAP IQ server.

Creating a Remote Procedure [page 382] Define a local alias for a procedure: a means of accessing a procedure on a remote server, through a local resource. Before you can map procedures from another server to the local alias, you must define the remote server where the procedure is located.

Creating a Table UDF or TPF [page 382] Set up an external table-valued user-defined function (Table UDF) or external table parameterized function (TPF) in C/C++, or an external table-valued user-defined function in Java (Java Table UDF) on an SAP IQ server.

Executing a Procedure, Table UDF, or TPF using View Data in SQL [page 383] Populate the Mini iSQL window with the result set of a selected procedure, remote procedure, Table UDF, or TPF.

Deleting a Procedure, Table UDF, or TPF [page 383] Remove a procedure, remote procedure, Table UDF, or TPF from an SAP IQ server.

Generating Procedure, Table UDF, or TPF DDL Commands [page 384] There's no SQL-side equivalent for this task.

Modifying a Procedure, Table UDF, or TPF [page 384] Examine the SQL statement and properties of a procedure, remote procedure, Table UDF, or TPF on an SAP IQ server. You can edit the SQL statement and change some property values.

Granting Procedure EXECUTE Permission [page 385] Grant procedure execute permission to users and roles.

Revoking Procedure EXECUTE Permission [page 385] Remove procedure execute permission from users and roles.

Procedure Privilege Summary [page 386] A list of the system privileges and object permissions required to complete the various procedure tasks.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 381 5.22.1 Creating a Procedure

Set up a new procedure on an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE PROCEDURE Statement.

5.22.2 Creating a Remote Procedure

Define a local alias for a procedure: a means of accessing a procedure on a remote server, through a local resource. Before you can map procedures from another server to the local alias, you must define the remote server where the procedure is located.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE PROCEDURE Statement.

5.22.3 Creating a Table UDF or TPF

Set up an external table-valued user-defined function (Table UDF) or external table parameterized function (TPF) in C/C++, or an external table-valued user-defined function in Java (Java Table UDF) on an SAP IQ server.

SAP IQ Cockpit Non-GUI Administration and Monitoring 382 PUBLIC Administer SAP IQ Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see Table UDFs, TPFs, and PTFs.

5.22.4 Executing a Procedure, Table UDF, or TPF using View Data in SQL

Populate the Mini iSQL window with the result set of a selected procedure, remote procedure, Table UDF, or TPF.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CALL Statement.

5.22.5 Deleting a Procedure, Table UDF, or TPF

Remove a procedure, remote procedure, Table UDF, or TPF from an SAP IQ server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 383 Context

To perform this task using SQL, see DROP Statement.

5.22.6 Generating Procedure, Table UDF, or TPF DDL Commands

There's no SQL-side equivalent for this task.

Context

5.22.7 Modifying a Procedure, Table UDF, or TPF

Examine the SQL statement and properties of a procedure, remote procedure, Table UDF, or TPF on an SAP IQ server. You can edit the SQL statement and change some property values.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER PROCEDURE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 384 PUBLIC Administer SAP IQ 5.22.8 Granting Procedure EXECUTE Permission

Grant procedure execute permission to users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see GRANT EXECUTE Privilege Statement.

5.22.9 Revoking Procedure EXECUTE Permission

Remove procedure execute permission from users and roles.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see REVOKE EXECUTE Privilege Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 385 5.22.10 Procedure Privilege Summary

A list of the system privileges and object permissions required to complete the various procedure tasks.

Creating a Procedure

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 Watcom SQL or Transact-SQL procedure to be owned by self – one of:

● DBA authority ● RESOURCE ADMIN authority

Watcom SQL or Transact-SQL, to be owned by any user – DBA authority

External C/C++ or External Environment procedure to be owned by self or any user – DBA authority

SAP IQ 16.1 Watcom SQL or Transact-SQL procedure to be owned by self – CREATE PROCEDURE system privilege

Watcom SQL or Transact-SQL procedure to be owned by any user – one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

External C/C++ or External Environment procedure to be owned by self – all of:

● CREATE EXTERNAL REFERENCE system privilege ● CREATE PROCEDURE system privilege

External C/C++ or External Environment procedure to be owned by any user – CRE ATE EXTERNAL REFERENCE system privilege along with one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

Creating a Remote Procedure

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 Remote procedure to be owned by self or any user – DBA authority

SAP IQ 16.1 Remote procedure to be owned by self – CREATE PROCEDURE system privilege

Remote procedure to be owned by any user – one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 386 PUBLIC Administer SAP IQ Creating a Table UDF or TPF

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 Table UDF or TPF to be owned by self – all of:

● CREATE EXTERNAL REFERENCE system privilege ● CREATE PROCEDURE system privilege

Table UDF or TPF to be owned by any user – CREATE EXTERNAL REFERENCE system privilege along with one of:

● CREATE ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege

Executing a Procedure Using View Data in SQL

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You have EXECUTE permission on the procedure ● You own the procedure

SAP IQ 16.1 One of:

● EXECUTE ANY PROCEDURE system privilege ● You have EXECUTE permission on the procedure ● You own the procedure

Deleting a Procedure

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● You own the procedure

SAP IQ 16.1 One of:

● DROP ANY PROCEDURE system privilege ● DROP ANY OBJECT system privilege ● You own the procedure

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 387 Generating Procedure DDL Commands

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Procedure Properties

Database Version Procedure Privileges Required

SAP IQ 15.3 and 15.4 View any procedure property page regardless of type – none

Modify permissions for any procedure type – one of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

Modify any other procedure property regardless of type – one of:

● DBA authority ● You own the procedure

SAP IQ Cockpit Non-GUI Administration and Monitoring 388 PUBLIC Administer SAP IQ Database Version Procedure Privileges Required

SAP IQ 16.1 View any procedure property page regardless of type – none

Modify SQL code for Watcom-SQL or Transcat-SQL procedures – one of:

● ALTER ANY PROCEDURE system privilege ● ALTER ANY OBJECT system privilege ● You own the procedure

Modify SQL code for Table UDFs, TPFs, or External Environment procedures – CREATE EXTERNAL REFERENCE system privilege along with one of:

● ALTER ANY PROCEDURE system privilege. ● ALTER ANY OBJECT system privilege ● You own the procedure

Modify a comment for any procedure type – one of:

● CREATE ANY PROCEDURE system privilege ● ALTER ANY PROCEDURE system privilege ● CREATE ANY OBJECT system privilege ● ALTER ANY OBJECT system privilege ● COMMENT ANY OBJECT system privilege ● You own the procedure

Modify permissions for any procedure type – one of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the database object

Granting or Revoking Procedure EXECUTE Permission

Database Version Database Object Privileges Required

SAP IQ 15.3 and 15.4 One of:

● DBA authority ● PERMS ADMIN authority ● You own the database object

SAP IQ 16.1 One of:

● MANAGE ANY OBJECT PRIVILEGE system privilege ● You own the database object

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 389 5.23 Web Services

The IQ (catalog) system store contains a built-in HTTP server that allows you to provide Web services, as well as to access Web services in other databases and over the Internet. You can manage Web services only for IQ (catalog) system store tables.

Web services define valid URLs and their functionality. Web services commonly facilitate data transfer and interoperability. You create and store Web services in databases; a single database can define multiple Web services. You can define Web services in different databases so that they appear to be part of a single Web site.

Simple Object Access Protocol (SOAP) is the standard used for access, but the built-in HTTP server also lets you handle standard HTTP and HTTPS requests from client applications.

SOAP provides a method for internet communication, between applications such as those written in Java, or a Microsoft .NET language like Visual C#. SOAP messages define the services that a server provides. Actual data transfer generally takes place using HTTP. Any application, such as a client or server, that participates in SOAP communication is called a SOAP node or SOAP endpoint. Such applications can transmit, receive, or process SOAP messages.

SAP IQ Web services can listen for and handle standard SOAP requests. Web services provide client applications an alternative to such traditional interfaces as JDBC and ODBC. Web services can be accessed from client applications written in a variety of languages and running on a variety of platforms. Even common scripting languages such as Perl and Python provide access to Web services. You create Web services in a database using the CREATE SERVICE statement.

SAP IQ can also function as a SOAP or HTTP client, permitting applications running within the database to access standard Web services available over the Internet, or provided by other SAP IQ databases. This client functionality is accessed through stored functions and procedures.

In addition, the term Web services also refers to applications that use the built-in Web server to handle HTTP requests from clients. These applications generally function like traditional database-backed Web applications, but can be more compact and are easier to write as the data and the entire application can reside within a database. In this type of application, the Web service typically returns documents in HTML format. The GET, HEAD, and POST methods are supported.

The collection of Web services within your database together define the available URLs. Each service provides a set of Web pages. Typically, the content of these pages is generated by procedures that you write and store in your database, although they can be a single statement or, optionally, allow users to execute statements of their own. These Web services become available when you start the database server with options that enable it to listen for HTTP requests.

Since the HTTP server that handles Web service requests is embedded in the database, performance is good. Applications that use Web services are easily deployed, since no additional components are needed, beyond the database and database server.

In this section:

Creating a Web Service [page 391] Create a Web service to facilitate data transfer with SOAP or HTTP.

Enabling a Web Service [page 391] Enable a disabled Web service so the service can listen for requests over HTTP or HTTPS.

Disabling a Web Service [page 392]

SAP IQ Cockpit Non-GUI Administration and Monitoring 390 PUBLIC Administer SAP IQ Disable a Web service to prevent the service from listening for requests over HTTP or HTTPS. The Web service definition remains in the database.

Deleting a Web Service [page 392] Delete an enabled or disabled Web service to permanently remove the object and its definition from the server.

Generating Web Service DDL Commands [page 393] There's no SQL-side equivalent for this task.

Modifying Web Services Properties [page 393] Change the properties of the selected web service.

Web Service Privilege Summary [page 393] A list of the system privileges and object permissions required to complete the various Web service tasks.

5.23.1 Creating a Web Service

Create a Web service to facilitate data transfer with SOAP or HTTP.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see CREATE SERVICE Statement.

5.23.2 Enabling a Web Service

Enable a disabled Web service so the service can listen for requests over HTTP or HTTPS.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 391 Context

To perform this task using SQL, see ALTER SERVICE Statement.

5.23.3 Disabling a Web Service

Disable a Web service to prevent the service from listening for requests over HTTP or HTTPS. The Web service definition remains in the database.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SERVICE Statement.

5.23.4 Deleting a Web Service

Delete an enabled or disabled Web service to permanently remove the object and its definition from the server.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see DROP SERVICE Statement.

SAP IQ Cockpit Non-GUI Administration and Monitoring 392 PUBLIC Administer SAP IQ 5.23.5 Generating Web Service DDL Commands

There's no SQL-side equivalent for this task.

Context

5.23.6 Modifying Web Services Properties

Change the properties of the selected web service.

Prerequisites

● You have a SQL client running and connected to the SAP IQ database (not the embedded SAP SQL Anywhere repository database).

Context

To perform this task using SQL, see ALTER SERVICE Statement.

5.23.7 Web Service Privilege Summary

A list of the system privileges and object permissions required to complete the various Web service tasks.

Creating a Web Service

Database Version Web Service Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY WEB SERVICE system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring Administer SAP IQ PUBLIC 393 Enabling or Disabling a Web Service

Database Version Web Service Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY WEB SERVICE system privilege

Deleting a Web Service

Database Version Web Service Privileges Required

SAP IQ 15.3 and 15.4 DBA authority

SAP IQ 16.1 MANAGE ANY WEB SERVICE system privilege

Generating Web Service DDL Commands

Database Version Web Service Privileges Required

SAP IQ 15.3 and 15.4 None

SAP IQ 16.1 None

Viewing or Modifying Web Service Properties

Database Version Web Service Privileges Required

SAP IQ 15.3 and 15.4 View any Web service property page – none

Modify any Web service property – DBA authority

SAP IQ 16.1 View any Web service property page – none

Modify any Web service property – MANAGE ANY WEB SERVICE system privilege

SAP IQ Cockpit Non-GUI Administration and Monitoring 394 PUBLIC Administer SAP IQ 6 Alerts in SAP IQ

Monitor and manage alerts in an SAP IQ server or multiplex environment.

Alerts in SAP IQ Cockpit are categorized into three key performance areas (KPA): Availability, Performance, and Capacity.

Each KPA is composed of several key performance indicators (KPI). Data is collected at defined intervals and alerts triggered when the KPI exceeds the predefined thresholds or state.

By default, all alerts are enabled. You can customize the threshold of each alert and disable alerts not required. You cannot add additional alerts to a KPA.

Data for KPIs is collected using these default collection jobs:

● IQ Availability Statistics ● IQ Performance Statistics ● IQ Capacity Statistics

In this section:

Monitor and Resolve Alerts [page 395] There’s no SQL-side equivalent for this SAP IQ Cockpit task.

Configuring and Managing KPIs [page 396] Enable, disable, and manage alerts and alert thresholds.

Related Information

Configure SQL-Based Alerting [page 21]

6.1 Monitor and Resolve Alerts

There’s no SQL-side equivalent for this SAP IQ Cockpit task.

SAP IQ Cockpit Non-GUI Administration and Monitoring Alerts in SAP IQ PUBLIC 395 6.2 Configuring and Managing KPIs

Enable, disable, and manage alerts and alert thresholds.

Prerequisites

● You completed all tasks in Configure SQL-Based Alerting [page 21].

●  Note

This procedure assumes you've configured and used the Flash-based graphical user interface for email alerting in an SAP IQ 16.0 or 16.1 version earlier than 16.1 SP04 PL08. This procedure assumes you performed the task Configuring the E-mail Server at some time in the past.

SQL-based alerting is available for customers who are upgrading from an earlier SAP IQ, but not for new customers who are installing SAP IQ (version 16.1 SP04 PL08 and later) for the first time.

Context

The examples in this task use the Store Disk Usage KPI. This task assumes you previously disabled the Store Disk Usage KPI using the Flash-based user interface, and now you want to enable the Store Disk Usage KPI using SQL.

Three tables are impacted when enabling or disabling a KPI:

● uas_alrt_type

● alt_alert_prof

● alt_threshold_prof

SAP IQ Cockpit Non-GUI Administration and Monitoring 396 PUBLIC Alerts in SAP IQ Procedure

1. Obtain the resource GUID (RES_GUID) and the resource ID (RES_ID). You need these values later in this task.

select *

from res_resource_d R, res_resource_type_m RT where R.res_rt_id = RT.rt_id and RT.rt_name in ('Cockpit','IQ Multiplex', 'IQ Logical Server','IQ Server')

and RT.rt_name = 'IQ Server'

The system responds with:

 Output Code

RES_ID,RES_RT_ID,RES_NAME,RES_GUID,RES_OWNER,RES_SRC_ID,RES_SRC_INFO,RES_DE SC,RT_ID,RT_NAME,RT_FAM,RT_CLASS,RT_DESC,RT_REGISTER,RT_VISIBLE

5,10,'iqdemo161', 0xf7778562000643aab623e319d3efb9d9,'com.sybase.ua.plugins.iqmap', 3,'ApplicationManager','IQ Server Resource Type',10,'IQ Server','ManagedObject','com.sybase.ua.plugins.iqmap.mo.IQMO','IQ Server Resource Type',true,true

select upper(RES_GUID)

from res_resource_d R, res_resource_type_m RT where R.res_rt_id = RT.rt_id and RT.rt_name in ('Cockpit','IQ Multiplex', 'IQ Logical Server','IQ Server')

and r.res_name = 'iqdemo161'

The system responds with:

 Output Code

upper(R.RES_GUID)

'F7778562-0006-43AA-B623-E319D3EFB9D9'

2. Get the next available alert_type_id. To find the max value, get:

execute uas_get_next_id

select current_val from uas_cntr where id_type =

Use current_val as alert_type_id for inserting a row. 3. Get ALP_ID after insert into ALT_ALERT_PROF. ALP_ID is used in the insert into the threshold table.

select * from alt_alert_prof

4. Get the Alert Definition ID (ADF_ID) from the query that shows all the KPIs that can be enabled.

In this case, the ADF_ID is 14.

SAP IQ Cockpit Non-GUI Administration and Monitoring Alerts in SAP IQ PUBLIC 397 5. Get the Threshold values for the 'Store Disk Usage' KPI.

select * from alt_threshold_def D,

(select * from alt_alert_def D, (select * from mon_kpi_def_d I, mon_kpa_def_d A, (select * from res_resource_type_ver_m tv, res_resource_type_m t where t.rt_name in ('Cockpit','IQ Multiplex', 'IQ Logical Server','IQ Server') and t.rt_name='IQ Server' and tv.rtv_short_ver_str='15.1.0.0' and tv.rtv_rt_id=t.rt_id ) RTV where I.kpi_kpa_id = a.kpa_id and rtv.rtv_id = a.kpa_rtv_id ) I where d.adf_kpi_id = I.kpi_id ) AD where ad.adf_id = d.thd_adf_id

and ad.kpi_display_name = 'Store Disk Usage'

Insert Alert Types into the Alert Tables

Procedure

1. Set connection_authentication before performing the inserts. Make sure auto_commit is disabled – you must execute all inserts in a single complete transaction.

set temporary option auto_commit = 'OFF';

set temporary option connection_authentication='Company=SAP;Application=Cockpit;Signature=000fa5515 7edb8e14d818eb4fe3db41447146f1571g6eb2a6d2966db36d82642c745d1d1bde020b45b6'

2. Insert into the uas_alrt_type table. Use the alert_type_id shown in step 2 above. The response_auth is either the DBA, or the technical user ID (if you defined one.)

insert into dba.uas_alrt_type

( alert_type_id, alert_type_name, alert_desc, response_auth, suppress_period, purge_ind ) values

SAP IQ Cockpit Non-GUI Administration and Monitoring 398 PUBLIC Alerts in SAP IQ

(117,, NULL, '', 60, NULL)

insert into dba.uas_alrt_type ( alert_type_id, alert_type_name, alert_desc, response_auth, suppress_period, purge_ind ) values (117, 'F7778562-0006-43AA-B623-E319D3EFB9D9_Store Disk Usage', NULL, 'DBA', 60, NULL)

3. Insert into the alt_alert_prof table.

insert into alt_alert_prof (alp_adf_id, alp_res_id, alp_alert_type_id) values (, , )

○ is the ADF_ID. ○ is RES_ID from step 1 at the top of this procedure in section Configuring and Managing KPIs [page 396]. ○ is ALERT_TYPE_ID from the previous step.

Example:

insert into alt_alert_prof (alp_adf_id, alp_res_id, alp_alert_type_id) values (14, 5, 117)

4. Insert into the alt_alert_threshold table.

insert into alt_threshold_prof (thp_alp_id, thp_end, thp_start, thp_sev_levl, thp_thd_id)

values (, 70, 0, 'NORMAL', 64)

insert into alt_threshold_prof (thp_alp_id, thp_end, thp_start, thp_sev_levl, thp_thd_id)

values (, 80, 71, 'LOW', 62)

insert into alt_threshold_prof (thp_alp_id, thp_end, thp_start, thp_sev_levl, thp_thd_id)

values (, 90, 81, 'MEDIUM', 61)

insert into alt_threshold_prof (thp_alp_id, thp_end, thp_start, thp_sev_levl, thp_thd_id)

values (, 100, 91, 'HIGH', 63)

SAP IQ Cockpit Non-GUI Administration and Monitoring Alerts in SAP IQ PUBLIC 399 5. Execute a commit.

Disabling Alerts

In these examples, you disable the 'Store Disk Usage' KPI. Disabling an alert requires deletions from three tables.

Procedure

1. Set connection_authentication before performing the deletions. Make sure auto_commit is disabled – you must execute all inserts in a single complete transaction.

set temporary option auto_commit = 'OFF';

set temporary option connection_authentication='Company=SAP;Application=Cockpit;Signature=000fa5515 7edb8e14d818eb4fe3db41447146f1571g6eb2a6d2966db36d82642c745d1d1bde020b45b6'

2. Query to find the rows to delete from the alt_threshold_prof table. Replace with the actual value:

select * from alt_threshold_prof

where thp_alp_id = (select alp_id from alt_alert_prof aap, uas_alrt_type uat

where uat.alert_type_id = aap.alp_alert_type_id and uat.alert_type_name = '')

3. Execute this delete statement:

delete from alt_threshold_prof where thp_alp_id = 18

SAP IQ Cockpit Non-GUI Administration and Monitoring 400 PUBLIC Alerts in SAP IQ 4. Query to find all associated rows in the alt_alert_type table. Replace with the actual value:

select alp_id from alt_alert_prof aap, uas_alrt_type uat where uat.alert_type_id = aap.alp_alert_type_id and uat.alert_type_name = ''

5. Execute this delete statement:

delete from alt_alert_prof where alp_id = 18

6. Query to find the associated row in the alert_type_name table. Replace with the actual value:

select alert_type_id, alert_type_name from uas_alrt_type where alert_type_name = ''

7. Execute this delete statement:

delete from uas_alrt_type where alert_type_id = 117

8. Execute a commit.

Modify Thresholds

In this example, you modify the Available Connections Thresholds. You change the HIGH threshold to end at 1, and the MEDIUM threshold to start at 2.

Procedure

1. Get the current threshold settings. Replace with the actual value:

select * from alt_threshold_prof

where thp_alp_id = (select alp_id from alt_alert_prof aap, uas_alrt_type uat

where uat.alert_type_id = aap.alp_alert_type_id and uat.alert_type_name = '')

2. Set connection_authentication before performing the modifications. Make sure auto_commit is disabled – you must execute all inserts in a single complete transaction.

set temporary option auto_commit = 'OFF';

SAP IQ Cockpit Non-GUI Administration and Monitoring Alerts in SAP IQ PUBLIC 401 set temporary option connection_authentication='Company=SAP;Application=Cockpit;Signature=000fa5515 7edb8e14d818eb4fe3db41447146f1571g6eb2a6d2966db36d82642c745d1d1bde020b45b6'

3. Modify the thresholds.

update alt_threshold_prof set thp_end = 1 where thp_alp_id = 8 and thp_sev_levl = 'HIGH'

update alt_threshold_prof set thp_start = 2 where thp_alp_id = 8 and thp_sev_levl = 'MEDIUM'

4. Execute a commit.

SAP IQ Cockpit Non-GUI Administration and Monitoring 402 PUBLIC Alerts in SAP IQ Important Disclaimers and Legal Information

Hyperlinks

Some links are classified by an icon and/or a mouseover text. These links provide additional information. About the icons:

● Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements with SAP) to this:

● The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information. ● SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

● Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering a SAP-hosted Web site. By using such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information.

Videos Hosted on External Platforms

Some videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within the control or responsibility of SAP.

Beta and Other Experimental Features

Experimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use the experimental features in a live operating environment or with data that has not been sufficiently backed up. The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example Code

Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example code unless damages have been caused by SAP's gross negligence or willful misconduct.

Gender-Related Language

We try not to use gender-specific word forms and formulations. As appropriate for context and readability, SAP may use masculine word forms to refer to all genders.

SAP IQ Cockpit Non-GUI Administration and Monitoring Important Disclaimers and Legal Information PUBLIC 403 www.sap.com/contactsap

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.

Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.

Please see https://www.sap.com/about/legal/trademark.html for additional trademark information and notices.

THE BEST RUN