Trying to resend again; third time lucky maybe... :)
Don O'Malley wrote:
Hi Martin/Richard,
I sent this mail earlier this morning, but it didn't seem to deliver???
Anyway, in a nutshell Martin is correct. Further details:
Hi Richard,
We have identified a bug in the new Entitlement Service (i.e. in
getupdates2.sun.com) that is called prior to proceeding with a patch
download from Akamai.
The bug usually leads to transient 403 or 500 errors from the
Entitlement Service, similar to what you are seeing below, though I
have not seen the errors persist like this on subsequent retries before.
I have tested this fix in Beta over the past week now and have
confirmed that it will eliminate these errors (famous last words, I
know!).
The good news is that the fix is due to be pushed to production in
Thursday morning (Pacific Time).
Once this is live you should no longer see these errors (unless of
course you really aren't entitled to a patch, in which case you will
get a 403).
Sorry for the inconvenience.
Best,
-Don
To confirm the process flow is as Martin describes:
- Patch download query goes first to sunsolve as before.
- Query then gets redirected to the new download service (i.e.
getupdates2).
- New download service performs an entitlement check.
- If the entitlement check is successful redirect to Akamai for patch
download, else a 403 ereor is returned.
HTH,
-Don
Martin Paul wrote:
Georg Schwarz wrote:
That's pretty much the same problem that I have. Pca is only able to
download patches from the akamai server. Downloads from the
getupdates2 server are not possible at all and fail.
To be precise - the actual download will always be from the akamai
server. As far as I understand it:
- pca/wget asks sunsolve which redirects the query to getupdates2
- getupdates2 verifies the SOA data and the entitlement and redirects to
akamai if the user is allowed to get the patch.
- the patch zip file itself is downloaded from akamai.
The problem as seen in Richard's logfile is that getupdates2 denies
the request at first, but when it's asked often enough, it gives its
acknowledgement and makes the redirect to akamai. That's something
that must be fixed on Sun's side; actually, I was afraid that
splitting the sunsolve service onto three servers would end up in
exactly this kind of problems which are hard to track down.
Martin.
