SAP Netweaver Application Server Java
Skip to end of metadata
Go to start of metadata

Subaccount registration error due to low disk space

The ConfgurationServlet tries to create a new subaccount, however, the subaccount configuration files cannot be created on the file system.

The ljs_trace file in <sap>/scc20/log folder contains this error:

#ERROR#com.sap.scc.rt#http-bio-8443-exec-9#          #error while writing audit log
java.io.IOException: There is not enough space on the disk (path C:\\SAP\\scc20\\log\\audit\\<region>.hana.ondemand.com\\<subaccount ID>\\audit-log_<subaccount ID>_YYY-MM-DD.csv, working dir C:\\SAP\\scc20)
	at java.io.FileOutputStream.writeBytesWithPath(Native Method)
	at java.io.FileOutputStream.write(FileOutputStream.java:341)
	at sun.nio.cs.StreamEncoder.writeBytes(StreamEncoder.java:221)
	at sun.nio.cs.StreamEncoder.implFlushBuffer(StreamEncoder.java:291)
	at sun.nio.cs.StreamEncoder.implFlush(StreamEncoder.java:295)
	at sun.nio.cs.StreamEncoder.flush(StreamEncoder.java:141)
	at java.io.OutputStreamWriter.flush(OutputStreamWriter.java:229)
	at java.io.BufferedWriter.flush(BufferedWriter.java:254)
	at com.sap.scc.audit.file.FileSystemAuditLogger.raiseEvent(FileSystemAuditLogger.java:177)
	at com.sap.scc.audit.file.FileSystemAuditLogger.<init>(FileSystemAuditLogger.java:86)
	at com.sap.scc.audit.file.FileSystemAuditLogger.<init>(FileSystemAuditLogger.java:75)
	at com.sap.scc.audit.AuditLoggerFactory.createAuditLogger(AuditLoggerFactory.java:24)
	at com.sap.scc.config.SccConfig.createNewAccount(SccConfig.java:946)
	at com.sap.scc.config.SccConfig.getAndCreateAccount(SccConfig.java:929)
	at com.sap.scc.config.SccConfig.createAccount(SccConfig.java:900)
	at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:83)
	at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355)
...
#INFO#com.sap.scc.ui#http-bio-8443-exec-9#          #Subaccount already added or employed for disaster recovery
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: Subaccount already added or employed for disaster recovery
	at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:87)
	at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355)
...
Caused by: com.sap.scc.config.SccConfigurationException: Unable to create a account configuration dir for <subaccount ID>@<region>.hana.ondemand.com[C:\\SAP\\scc20\\scc_config\\<region>.hana.ondemand.com\\<subaccount ID>]
	at com.sap.scc.config.AccountConfiguration.ensureAccountConfigDir(AccountConfiguration.java:115)
	at com.sap.scc.config.AccountConfiguration.<init>(AccountConfiguration.java:72)
	at com.sap.scc.config.SccConfig.createNewAccount(SccConfig.java:947)
	at com.sap.scc.config.SccConfig.getAndCreateAccount(SccConfig.java:929)
	at com.sap.scc.config.SccConfig.createAccount(SccConfig.java:900)
	at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:83)

Problem

The ConfigurationServlet cannot create the necessary configuration files on the file system due to low disk space.

Solution

Free some disk space.

Subaccount registration fails with 403 HTTP code

The ljs_trace file in <sap>/scc20/log folder contains this error:

#INFO#com.sap.scc.security#http-bio-8443-exec-1#          #Executing Http Get request to https://connectivitycertsigning.cf.eu10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccount ID>|
#INFO#com.sap.scc.security#http-bio-8443-exec-1#          #Returned Http Response with code 403|
#WARN#com.sap.scc.rt#http-bio-8443-exec-1#          #Tunnel account:///<subaccount ID> is inoperative. SccEndpoint com.sap.scc.config.TunnelSccEndpoint@5f67286e ok, and context == null|
#ERROR#com.sap.scc.ui#http-bio-8443-exec-1#          #SCC handshake failed: 403 — Forbidden
com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 403 — Forbidden
	at com.sap.scc.cert.HttpCertificateManagementService.processRequest(HttpCertificateManagementService.java:137)
	at com.sap.scc.cert.HttpCertificateManagementService.executeGetRequest(HttpCertificateManagementService.java:91)
	at com.sap.scc.cert.HttpCertificateManagementService.getConnectivityAgentCA(HttpCertificateManagementService.java:62)
	at com.sap.scc.cert.CertificateSigningClient.getCACertificate(CertificateSigningClient.java:41)
	at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:139)
	at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:96)
	at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355)
...

Problem

The subaccount does not exist in the selected region and a wrong region is selected from the dropdown list.

For example region, Europe (Frankfurt) - AWS (cf.eu10.hana.ondemand.com) is selected however the subaccount belongs to Europe (Frankfurt) (eu2.hana.ondemand.com).

Solution

In SAP Cloud Connector subaccount registration popup, enter the region hostname manually, for example, eu2.hana.ondemand.com:

The latest cloud connector version includes the new regions.

The region list is available in the online help:

Regions and Hosts Available for the Neo Environment

Regions and API Endpoints Available for the Cloud FoundryEnvironment

 

How to check subaccount registration from a browser

When a subaccount is added to the cloud connector, the cloud connector fetches a certificate from the certificate signing service.

The cloud connector trace contains a similar entry, in this case, a NEO platform hanatrial region is configured:

#Executing Http Get request to https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>
#Returned Http Response with code 200

or to a Cloud Foundry subaccount, the log entry looks like this one:

#Executing Http Get request to https://connectivitycertsigning.cf.eu10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/aaaaaaaa-bbbb-4444-5555-666666666666
#Returned Http Response with code 200

The received certificate can be checked in a browser as well:

https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>

 

How to check subaccount registration from command line

Use curl tool to check if the subaccount certificate can be reached with the known user credentials.


curl -u "userID:password" https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>

Note, when cloud connector is connected to SAP cloud platform through a proxy, define the same in curl command:

curl --proxy "proxy:8888" --proxy-user "proxyUser:proxyPassword" -u "userID:password" https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>

see Curl manpage.


  • No labels