Configuring the Internet Communication Manager (ICM)

Objectives

After completing this lesson, you will be able to:
  • Describe the implementation of the ICM
  • Illustrate monitoring options for the ICM process
  • Describe the configuration of the ICM process for the use of SSL

Architecture of the ICM Process

The figure above shows an example of a system landscape in which Web browsers from the internet and intranet are connected with an AS ABAP (in this case, distributed across a number of servers). Important features are:

  • Support for standard Web protocols such as HTTP, HTTPS, WebDAV, SOAP, and SMTP

  • Display of standard Web formats such as HTML, XML, OData and XSLT

  • Complete integration into the SAP environment (development environment, user administration, authorization concept, system monitoring, and communication protocols)

The AS ABAP can act both as a Web server (server role) and as a Web client (client role). The server role, in which the AS ABAP can accept and process HTTP(S) requests from any Web client (such as a Web browser) and send back an HTTP(S) response, is what we will discuss in this lesson.

Within a work process, the Internet Communication Framework (ICF) provides the environment for handling HTTP(S) requests. The ICF is the bridge between the C kernel of the SAP system and the application program created in ABAP.

Internet Communication Manager is a component of the SAP architecture that allows the ABAP based SAP system to communicate directly with the internet. Technically, the Internet Communication Management is a standalone multi-threaded process that is started and monitored by the ABAP dispatcher.

Work processes can directly generate Web-compatible content in a way that can be forwarded to a Web browser using the ICM. One way of creating content of this type is to use Web Dynpro applications that are developed in the SAP system using the ABAP Workbench (for example transaction SE80).

From a technical point of view, the ICM is a separate process (icman at operating system level) that is started and monitored by the ABAP dispatcher. Its task is to ensure that the SAP system can communicate with the outside world (using HTTP, HTTPS, and SMTP). In the server role, it can process requests from the internet that arrive with URLs with the server/port combination for which the ICM is listening. The ICM then calls the appropriate local handler, depending on the URL. The ICM process uses threads to process the created workload in parallel.

The components of the ICM are:

  • Thread Control: This thread accepts the incoming TCP/IP requests and creates (or raises) a worker thread from the thread pool to process the request.

  • Worker Thread: This thread handles requests and responses for a connection. A worker thread contains an I/O handler for the network input and output, and various plug-ins for the different supported protocols.

  • Watchdog: A worker thread usually waits for a response (whether it is client or server); if a timeout occurs, the watchdog takes over the task of waiting for the response. The worker thread can then be used for other requests.

  • Signal Handler: This thread processes signals that are sent from the operating system or another process (such as the ABAP dispatcher).

  • Connection Information: Table with information for each existing network connection.

  • Memory Pipes: These memory-based communication objects allow data transfer between the ICM and the ABAP work processes.

The requests from the ICM must also wait in the dialog queue of the ABAP dispatcher. When a free dialog work process is found, ICM threads and dialog work processes communicate directly with each other.

The ICM uses plug-ins to implement the different communication protocols. Once the AS ABAP has been installed, the following protocols can be used:

  • HTTP

  • HTTPS

  • SMTP

  • LDAP

Cache for response pages of the ICM. This stores pages before they are sent to the client. The next time that the relevant URL is called, as long as the expiry time has not elapsed, the page is sent back to the client directly from the ICM; in this case, it does not need to be branched to the task handler and the ICF.

A part of the ICM that is important for performance is the Internet Server Cache (ISC), which stores HTTP(S) objects before they are sent to the Web browser. The next request can then be made directly from the ISC, provided that the expiry time has not elapsed. This avoids branching to the ABAP work process, which can accelerate the access considerably.

Some features of the ISC are:

  • Two-level hierarchy: When objects are stored, the advantages of both the high speed of main memory (memory cache) and the storage capacity of hard disks (disk cache) are used.

  • Dynamic Caching: Traditional products are based on HTTP proxies and usually offer caching only of static content, such as images. The ISC can also cache dynamic content such as JSPs or BSPs.

  • Active Caching: The application has full control over ensuring that the objects in the cache are up to date.

  • UFO Caching: Invalid requests ("UnFound Objects") that lead to error situations in the application server or the database are directly rejected, so that the system is protected against invalid or malignant requests.

  • Browser-dependent Caching: The developer of a BSP can define whether his or her application is dependent on the browser type. If this indicator is set, the ISC uses the data in the cache only for requests from the same browser type.

The ISC is configured using the profile parameter icm/HTTP/server_cache* and can be monitored and invalidated from the SAP system.

Start Procedure and ICM Monitoring

The profile parameter rdisp/start_icman controls whether an ICM process is also started when an application server is started. If no value is specified, the default setting true applies. You configure the ICM using profile parameters (most of which begin with icm/). The settings for icm/server_port_<xx> are of particular importance. These settings determine the port used for each protocol, as well as other attributes of the protocol (such as timeout).

SAP Note 2560792ABAP instances in SAP S/4HANA always start with an icman process states that as of Kernel 7.72, the AS ABAP instance always starts with an ICM process. As of this Kernel version, the parameter rdisp/start_icman no longer exists and is ignored.

In the SAP system, you can quickly obtain an overview of which application servers are running with an ICM using the AS Instances of SAP System <SID> overview (transaction SM51).

For more detailed information (such as the thread ID), see the ICM Monitor (transaction SMICM). From this transaction, you can choose the menu path AdministrationICM to terminate the ICM with a soft termination (corresponds to Unix signal 2) or (depending on the release) a hard termination (corresponds to Unix signal 9). The dispatcher then starts a new ICM process. By choosing AdministrationICMRestartYes/No (if available), you can control whether the ABAP dispatcher will restart the ICM when it is terminated by an error or at the request of an administrator.

The most important tool for an administrator in the ICM environment is the ICM Monitor (transaction SMICM). Note that the data displayed is instance-dependent (in the same way as the work process overview, transaction SM50). Some administrative activities (all available from transaction SMICM) are:

  • Monitoring and restarting the ICM.

  • Configuring the trace level (GotoTrace Level...), values range from 0 (no trace) to 3 (full trace with buffers).

  • Evaluating the trace files (GotoTrace File...); the system reads the ICM trace file dev_icm or the ICM security log dev_icm_sec from the work directory of the current instance.

    Note

    Depending on the release, the ICM security log can also be named dev_icm_sec-<date> and be located in the log directory of the current instance.

  • Overview of the profile parameters (GotoParametersDisplay/Change). The ICM is configured using profile parameters. The displayed values apply for the instance to which you are currently logged on. For documentation on the parameters, see

    • the ICM Monitor (transaction SMICM, menu path GotoParameters, select the parameter in question and choose Documentation),
    • transaction RZ11, and
    • SAP online documentation.
  • Display the statistics (GotoStatisticsDisplay). You can use these statistics to find out how many requests the ICM has processed since it was started (or since the statistics were reset). The system also displays information about the processing time.

  • Monitoring (GotoHTTP Plug-InServer CacheDisplay) and resetting (GotoHTTP Plug-InServer CacheInvalidate Locally / Globally) the ICM server cache. The ICM server cache stores HTTP objects before they are sent to the client. The next time that this object is requested, the content can be sent directly from the cache to the client.

  • In maintenance mode (AdministrationICMMaintenance ModeActivate / Deactivate), the ICM logs off from the ABAP message server and is not available for Web requests. The ICM processes only the remaining requests. If an internet user accesses an ICM in this status from the Web browser, the system will issue a message stating that the service is not available.

You can determine some of the listed data at operating system level using the icmon program. The call icmon -h displays the possible parameters for this small program, which can also, among other things, generate requests to simulate normal system workload.

Note

A Web Administration interface is available for administration and monitoring purposes as well.

Using this interface, you can monitor and administrate the ICM from a Web browser and from SAP MC / SAP MMC. The Web admin interface provides the same functions as the ICM Monitor.

Administrate the ICM

Business Example

Your company uses many browser-based functions offered by SAP S/4HANA.

As an administrator, you are responsible for monitoring the ICM processes that establish the connection between the Web browser and the SAP system.

The following figure shows how the training landscape looks for this exercise.

Task 1: Check ICM Settings

Check the number, port, and release of the ICM processes in your SAP S/4HANA system.

Steps

  1. How many ICM processes are running in your SAP S/4HANA system?

    1. Log on to your SAP system using the credentials provided by your instructor (for example with user train-## where ## denotes your group number).

    2. Start transaction SM51.

    3. Count the application server instances for which the ICM process is listed as Instance Service. An ICM process should be configured for each of the listed AS ABAP-based instances.

  2. Determine the port through which requests in the HTTPS protocol are processed for the application server to which you are currently logged on.

    1. Check the value of the profile parameter icm/server_port_0, for example:

      • Start transaction SMICM and choose the menu path GotoParameters (here, it is displayed as icm/server_port[0]).
      • Start transaction SA38 and execute program RSPFPAR. Enter icm/server_port* as Profile Parameters and choose Execute.
      • Start transaction RZ11. On the following screen, enter icm/server_port_0 as Parameter Name and choose Display.

      Hint

      The determined port is instance-specific. In the training systems, the parameter icm/server_port_0 has the value PROT=HTTPS, PORT=443$$ (and further timeout settings). The variable $$ is replaced by the instance number when the ICM is started (such as 21 for the primary application server of the S4Q system).

  3. Which release of the ICM is used in your SAP S/4HANA system?

    1. You can determine the ICM release in the ICM Monitor (transaction SMICM) by choosing Release Notes in the application toolbar or the menu path GotoRelease Notes.

      The information that you are looking for is at the start of the list. At the end of the list, you can find all issues that are solved with the current patch level (with associated SAP Notes).

Result

You know the port and release for the ICM process on your assigned SAP S/4HANA system.

Task 2: Simple HTTPS Requests

Start a request in the Web browser and monitor it with the ICM monitor.

Steps

  1. Launch the following URL: https://<server with domain>:<ICM HTTPS port>/sap/public/ping.

    1. In your training environment (on the WTS) start a Web browser of your choice.

    2. Enter the following URL:

      • Q team: https://s4qhost.wdf.sap.corp:44321/sap/public/ping
      • P team: https://s4phost.wdf.sap.corp:44331/sap/public/ping

      Hint

      All services under /sap/public use a predefined user (SAPSYS). Therefore, no explicit logon is required for this request.

      Services must be explicitly activated. This should already have been done in the training system for the services specified in this exercise.

    Result

    The message Server reached. appears. Keep this Web browser session open.
  2. Open the ICM Monitor and note how many requests have been processed by the worker threads (for this you may have to Refresh the URL stated above in your Web browser session) .

    Hint

    The data in the ICM monitor is instance-specific.
    1. If you have not yet already done so, log on to your SAP system using the credentials provided by your instructor (for example with user train-## where ## denotes your group number).

    2. Open the ICM Monitor (transaction SMICM) on the application server that is related to the port which you have specified in your URL of the previous step. Note the entries in column Numbers.

    3. In your Web browser session from the previous step, choose Refresh several times.

    4. Back in the ICM Monitor (transaction SMICM), now choose the Refresh button. You can see that the entries in column Number have changed.

  3. Launch the following URL: https://<server with domain>:<ICM HTTPS port>/sap/public/icman/ping.

    1. In a Web browser at WTS level, enter the following URL:

      • Q team: https://s4qhost.wdf.sap.corp:44321/sap/public/icman/ping
      • P team: https://s4phost.wdf.sap.corp:44331/sap/public/icman/ping
    2. The message server on host <sid>host system <sid>host_<SID>_<Instance> (000) successfully reached appears.

  4. Launch the following URL: https://<server with domain>:<ICM HTTPS Port>/sap/public/icman/mime/theme.jpg.

    1. In a Web browser at WTS level, enter the following URL:

      • Q team: https://s4qhost.wdf.sap.corp:44321/sap/public/icman/mime/theme.jpg
      • P team: https://s4phost.wdf.sap.corp:44331/sap/public/icman/mime/theme.jpg
    2. A small image should appear.

Result

You can monitor the activity of the ICM.

Task 3: Monitor the Load with the icmon Tool

Use the icmon tool to monitor the ICM and to start workload simulations.

Steps

  1. Using an SSH connection in MobaXterm, log on to the operating system of your SAP S/4HANA system. Use the virtual hostname s4<q|p>host.wdf.sap.corp and the operating system user s4<q|p>adm.

    1. On the WTS, launch the application MobaXterm.

    2. Within the MobaXterm main window, choose Session.

    3. In the Connection settings dialog, choose SSH.

    4. Enter the following:

      Remote host

      Q team: s4qhost.wdf.sap.corp

      P team: s4phost.wdf.sap.corp

      Specify usernameselect this option
      field right to Specify username

      Q team: s4qadm

      P team: s4padm

    5. Keep all other settings unchanged and choose OK.

      In case of a Connexion to... dialog, select Do not show this message again and choose Accept.

    6. Enter the password of the user s4<q|p>adm. Your instructor will provide details.

      Hint

      There is no visual feedback while you are typing the password. After you entered the correct password, MobaXterm may ask if you want to store the password permanently. If you want to, you have to provide an arbitrary master password for MobaXterm (two times).
  2. At operating system level of your SAP S/4HANA system, execute the command icmon pf=<instance profile name>.

    Launch the menu (by pressing m) and generate load with the following values:

    FieldValues
    Host

    Q team: s4qhost.wdf.sap.corp

    P team: s4phost.wdf.sap.corp

    Port

    Q team: 44321

    P team: 44331

    '1.x'=HTTP/1.x or '9.x' HTTPS9.1 (default setting)
    Get request data from fileNo (default setting)
    Path/sap/public/icman/mime/theme.jpg
    Optional AttributesNo (default setting)
    Expected OK-Code0 (default setting)
    Think time in millisecs0 (default setting)
    Number of requests20000
    Number of threads25
    Wait time in millisecs between thread creation during rampup0 (default setting)
    1. Within the SSH shell, enter cdpro to change to the profile directory.

    2. Enter dir to see the available profiles.

    3. Execute the command icmon pf=<instance profile name>. Example:

      • icmon pf=S4Q_D21_s4qhost for the PAS instance of the Q team
      • icmon pf=S4P_D31_s4phost for the PAS instance of the P team
    4. Type m to switch to the Monitor-Menue.

    5. Type g to generate client load.

    6. Enter the parameters specified in the task description.

  3. Observe in the ICM Monitor how the requests generated by icmon are processed by the worker threads.

    1. If you have not yet already done, log on to your SAP system using the credentials provided by your instructor (for example with user train-## where ## denotes your group number).

    2. In transaction SMICM of the application server instance that you have specified by the port in the previous step, choose the Refresh function in the application toolbar to observe the activity of the worker threads. You may notice that the ICM starts further worker threads.

      Remember that the display in transaction SMICM is not system-wide, but only applies to your application server instance.

      Note

      The selected load data generates 500,000 requests (that is, the number of requests multiplied by the number of threads).

  4. On operating system level, end the icmon tool.

    1. Following the previous task, switch back to your MobaXterm session on operating system level.

    2. In the SSH window for the icmon tool, enter q to quit the icmon menu. Then close this session by executing exit.

Result

You can use the icmon tool to monitor the ICM and to start workload simulations.

Task 4: Maintenance Mode

Set the maintenance mode in the ICM Monitor for one of the application server instances of your SAP S/4HANA system.

Steps

  1. Use the ICM Monitor to activate the maintenance mode for your AAS instance.

    1. If you have not yet already done so, log on to your SAP system using the credentials provided by your instructor (for example with user train-## where ## denotes your group number).

    2. Start transaction SM51.

    3. Select the line with the AAS instance (22|32).

    4. Choose the menu path GotoMonitorsICM Monitor.

    5. Within transaction SMICM, choose the menu path AdministrationICMMaintenance ModeActivate.

    6. Choose Yes to confirm the popup.

    Result

    The ICM Status now has switched from Running to Maintenance.

  2. In a Web browser (on the WTS for your training class), enter the following URL: https://<server with domain>:<ICM HTTPS port>/sap/public/ping.

    Hint

    Ensure to use the ICM HTTP port of the AAS instance (on which you activated the maintenance mode).
    1. In a Web browser at WTS level, enter the following URL:

      • Q team: https://s4qhost.wdf.sap.corp:44322/sap/public/ping
      • P team: https://s4phost.wdf.sap.corp:44332/sap/public/ping

      Result

      The 503 Maintenance Mode message appears.
    2. Keep this Web browser session open.

  3. Use the ICM monitor to deactivate the maintenance mode.

    1. Following the previous step, switch back to transaction SMICM on the AAS instance.

    2. Choose the menu path AdministrationICMMaintenance ModeDeactivate.

    3. Choose Yes to confirm the popup.

      Result

      The ICM Status has switched back to Running.

    4. Feel free to refresh / reload the URL in your Web browser session from the previous step. You should now get the result Server reached..

Configure SSL for the ICM

You can use the Secure Sockets Layer (SSL) protocol to secure HTTP connections to and from AS ABAP. When using SSL, the data being transferred between the two parties (client and server) is encrypted.

The SSL protocol uses public-key technology to provide its protection. Therefore, as a prerequisite to use SSL, the server must possess a public and private key pair and a corresponding public-key certificate. It must possess

  • one key pair and certificate to identify itself as the server component

  • and another key pair and certificate in case that the server is to identify itself as a client component.

These key pairs and certificates are stored in the Personal Security Environments (PSEs) of the server, the SSL server PSE and the SSL client PSE, respectively.

The following roadmap contains the main steps to configure SSL for the AS ABAP:

For more information, see the SAP S/4HANA online documentation (Product Assistance), area Enterprise TechnologyABAP PlatformSecuring the ABAP PlatformSecurity Concepts and ToolsNetwork and Transport Layer SecurityTransport Layer Security on ABAP PlatformConfiguring the ABAP Platform to Support TLS and SAP Note 510007Additional considerations for setting up SSL on Application Server ABAP.

Related Information

Concerning the Internet Communication Manager (ICM), the following paths in SAP Online documentation and the following SAP Notes might be helpful for further information:

  • SAP S/4HANA online documentation (Product Assistance), area Enterprise TechnologyABAP PlatformApplication Server ABAP - InfrastructureComponents of Application Server ABAPInternet Communication Manager (ICM)Administration of the ICM

  • SAP Note 2007212: Tuning SAP Web Dispatcher and ICM for high load

  • SAP Note 2149132ICM performance checks
  • SAP Note 2160678SSO stops working when the ICM trust parameters are configured
  • SAP Note 2052899ICM - Multiple Trusted Reverse Proxies
  • SAP Note 2456368How to find SAP WIKI for BC-CST-IC

Log in to track your progress & complete quizzes