Patch management overview and workflow

Preparatory tasks

Defining role-based permissions

To create or update a catalog, you must be assigned a role that includes the necessary permissions. To facilitate division of responsibilities, you can assign permissions to one role or divide them between several roles.

For a list of the required permissions, see Minimum permissions for patching.

For details about assigning roles and permissions, see Managing Authorizations.

For a list of the required permissions for creating Patching Jobs and for deploying patches, see Minimum permissions for patching.

Configuring Global Configuration parameters

Global Configuration parameters provide basic information used during patch catalog creation and updating, as well as for Patch and Remediation Jobs. The following parameter groups are available:

• All Operating Systems — Configuration parameter options for a proxy server.
• Platform-specific groups for each platform (such as Windows and Solaris) — Parameters that apply only to that specific platform type
• Shavlik URL Configuration — Configuration for connecting to Shavlik Technologies to download patch-related metadata for patching Windows software.
  
  For details about the global configuration parameters, see Global Configuration parameter list.

Defining the location of Microsoft Windows installation media for Microsoft Office patch deployment

(Windows only) To deploy Microsoft Office patches, BMC Server Automation must have access to a network location containing installation media for Microsoft Office. Because target servers can run different versions of Microsoft Office, you might need to specify a different location for each target server or smart group.

For details about defining locations of Microsoft Office patch media, see Defining location of Microsoft Windows installation media for Microsoft Office patch deployment.

Building an offline patch repository

(Offline mode only)

Obtaining the Patch Downloader utilities from BMC

From the BMC EPD site, download the appropriate utilities for building your offline repository. The utilities are platform-specific. You must know which platform you plan to use to download your patches.

For details, see Downloading patch downloader utilities.

Preparing XML configuration files for downloading patch content

Use the utilities that you downloaded from the BMC EPD site to prepare the XML configuration files for downloading the patch content.

For details, in Setting up the Offline Patch Downloader utility.

Downloading patches to the offline patch repository

To download the patch content, use the utilities that you downloaded from the BMC EPD site and the XML configuration files that you prepared.

For details, see the appropriate section for the platform type that you want to patch in Setting up the Offline Patch Downloader utility.

Patching

Creating and updating a patch catalog

For both types of repositories, online and offline, you create a patch catalog using the BMC Server Automation Console. Patches are added to the catalog as depot objects according to filters that you define for the catalog.

To ensure that you are working with valid patch content, you must run a Catalog Update Job before you run a Patch Job.

For details, see Creating a patch catalog.

Creating and running a Patching and Remediation Job

A Patching Job has two parts:

• Analysis — Analyzes the configuration of target servers and determines the required patches.
• Remediation —
  1. Downloads the payload from the vendor sites to the Patch Repository
  2. Packages the payload as a BLPackage
• Creates a Deploy Job to apply the patches 
  
  You can choose to run only the Analysis part of a Patching Job, and then run Remediation later, or you can run Remediation immediately after the Analysis. 
  
  For details about Patching Jobs, see Creating a Patching Job. For details about running Remediation Jobs separately, see Remediating servers.