[pca] Setting up PCA patch server

Wed Oct 19 16:47:30 CEST 2011

Glenn,

This is a good explanation of running pca in proxy mode.  I did see this topic in the pca documentation, but it wasn't entirely clear to me.  Thanks for additional details and examples.

Lisa

-----Original Message-----
From: pca-bounces at lists.univie.ac.at [mailto:pca-bounces at lists.univie.ac.at] On Behalf Of Glenn Satchell
Sent: Tuesday, October 18, 2011 6:29 PM
To: PCA (Patch Check Advanced) Discussion
Subject: Re: [pca] Setting up PCA patch server

You're making this far more complicated than it has to be. On your patch 
server you run pca in proxy mode. Then configure each machine to 
download patches from the patch server via http. If the patch server has 
the correct version of the patch then it is returned, otherwise the 
patch server downloads it from oracle and then serves it up to the 
client. The proxy becomes completely transparent, and only downloads 
each patch once.

On the proxy you install pca as pca-proxy.cgi in a suitable area where 
the web serve can execute cgi scripts. That means take the same pca 
script and make a copy that is called pca-proxy.cgi - the executable 
name causes pca to now behave as a proxy. Then create a pca-proxy.conf 
file to tell it how to do the downloads.

On the client you use your existing pca.conf, but point the downloads to 
your server.

Here are some examples:

pca-proxy.conf

# oracle user
user=xxxxxxx
passwd=xxxxxxx
dltries=3
#debug=1
patchdir=/usr/local/www/patches

debug=1 turns on debug output for the pca-proxy and writes output to 
/var/tmp/pca-proxy-debug.txt

and pca.conf

# use a central proxy
patchurl=http://www.example.com.au/patches/pca-proxy.cgi
xrefurl=http://www.example.com.au/patches/pca-proxy.cgi

regards,
-glenn

On 10/19/11 08:00, Roland Soderstrom wrote:
> I slight variation of Charles method is to use explorer outputs to get
> the individual clients patchset.
> Collect explorers to your patchserver.
> Run pca with
> cd $your-patchdir
> pca -d -f ${EXPLORER_PATH}/${HOST} missingrs
>
> pca gather info about a client using
> /usr/bin/pkginfo -x
> /usr/bin/showrev -p
> /usr/bin/uname -a
> And it will find them all in an explorer output.
>
> Another way of doing the same would be to collect pkginfo showrev and
> uname and use them with pca for collecting patches for a client.
> Instead of pca running those commands on the local client.
> A simple cronjob on each client that copies output of these 3 commands
> to the "pca-server".
> Run pca with
> pca -d -f ${Pkginfo-Uname-Showrev-dir}/${HOST} missingrs
>
> - Roland
>
>
>
> On 19/10/11 04:17 AM, Charles.Witt.CTR at dcpds.cpms.osd.mil wrote:
>>
>> Lisa,
>>
>> This is one method that fits my case.
>>
>> One method is to run "pca --noheader | cut -d ' ' -f 1 >
>> $generatedlist" on each patch client which will generate a list of
>> required patches.
>>
>> Merge the contents of the required patch list into one file with
>> something like "sort -ui Missing.pca.txt/ConsolidatedMissing.pca.txt |
>> uniq > SortedUniqueConsolidatedMissing.pca.txt".
>>
>> You would execute something like: "pca -d RequiredPatchList" on your
>> patch server to download required patches from Oracle. The "d" will
>> keep the patches.
>>
>> Then you have to figure out how to get the patches to each patch
>> client. I have BASH scripts that use public/private SSH keys, Expect,
>> SSH, and SCP. Man pca has one or more other methods.
>>
>> Then execute "pca -i" on each patch client. That is the summary of one
>> method. I left details out.
>>
>> Man pca will give some ideas. You need to experiment with a couple of
>> servers to determine what works best in your case.
>>
>> Thanks,
>>
>> Charles W. Witt
>>
>> Contractor
>>
>> STG Inc.
>>
>> DCPDS Arcsight Logger/Quality Center/Solaris/Web Support
>>
>> 1777 N.E. Loop 410, Suite 300
>>
>> San Antonio, TX 78217-5216
>>
>> Phone: (210)581-6227
>>
>> Cell: (210)787-2734
>>
>> Charles.Witt.ctr at dcpds.cpms.osd.mil
>>
>> Quality Center: QCSupport at dcpds.cpms.osd.mil
>>
>> Solaris: SolarisSupport at dcpds.cpms.osd.mil
>>
>> Web: web.support at dcpds.cpms.osd.mil
>>
>> *From:*pca-bounces at lists.univie.ac.at
>> [mailto:pca-bounces at lists.univie.ac.at] *On Behalf Of *Becktold, Lisa
>> M. (LARC-B7)[Chugach Federal Solutions, Inc.]
>> *Sent:* Tuesday, October 18, 2011 11:30 AM
>> *To:* pca at lists.univie.ac.at
>> *Subject:* [pca] Setting up PCA patch server
>>
>> Hi,
>>
>> We have started using pca to patch our servers. It's been working very
>> well, and we'd like to refine our setup.
>>
>> Instead of each server accessing support.oracle.com, we'd like to set
>> up an internal pca patch server. The patch clients should access this
>> internal patch server, and NOT go outside our internal network to
>> download patches.
>>
>> I'm a bit confused about what should reside on that internal patch
>> server. Should I download the latest recommended patch cluster and
>> associated patchdiag.xref file, and place it on the internal patch server?
>>
>> If the full recommended patch cluster is located on the patch server,
>> then there the patch client doesn't need to go outside our internal
>> network and access support.oracle.com, right?
>>
>> The patch server must either share the patch directory via NFS, or
>> offer it via http or ftp, correct?
>>
>> Lisa
>>
>> Lisa Becktold
>>
>> System Administrator
>>
>> Chugach Federal Solutions, Inc.
>>
>> NASA Center for AeroSpace Information Contract
>>
>> Phone: 443 995 5805
>>