Change of SAPSYS Group

[SAPSupport]

Dear Support team,

We have migrated SAP system from RHEL 7 to RHEL 8 whereby there is a need of changing the Group ID to different number. 
For this case, we are planning to change  the sapsys group to sapsys_legacy group with different GUID. 

We are not sure about the impact of changing the sapsys user group to different name on the Os level. Of course we will adjust the group name from OS level too.

Can you please recommend an option of changing the GID for sapsys without impact to the systems ? 

Thanks and Regards

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

You are thinking about the right direction to avert possible production issues in the live SAP environment. You can change the GID without immediately affecting running processes. A couple of things to note:

1. Any running processes which refer to the old GID will not be affected until they are restarted.

2. File system objects such as directories and files that have the old GID will retain that GID until they are individually changed. You can use the chgrp or find -exec chgrp commands to make these changes.

Below are the steps you would have to follow:

1. Rename the group to the legacy name, sapsys_legacy, so that the naming is consistent:

   groupmod -n sapsys_legacy sapsys

2. Create a new group with the name sapsys and your desired GID. Replace new_group_id with your desired GID.

   groupadd -g new_group_id sapsys

3. Find and change the group owner for all items that were previously owned by the sapsys_legacy group.

   find / -group sapsys_legacy -exec chgrp sapsys {} \;

4. Adjust the group membership for any accounts that were members of the sapsys_legacy group. Please note down the list of users under sapsys_legacy before migration so you can add them back to sapsys. Replace user with the relevant account usernames.

   usermod -a -G sapsys user

In the best scenario, you should have a test environment where you can validate these changes before applying them to a production system.

Remember, Always test this type of changes first in the non-production system.