Patch management overview and workflow
This topic provides an overview of patch management in BMC Server Automation, and introduces the set of tasks required to prepare for, set up, and execute patch management jobs.
Patch management overview
Patch management refers to the acquisition, testing, and installation of patches.
The patch administrator analyzes individual servers to determine which patches must be acquired and installed to comply with organizational standards. BMC Server Automation automates the process of building and maintaining a patch repository, analyzing target servers, and, if necessary, packaging and deploying patches. At the end of the process, reports are available to show compliance.
- BMC recommends that you set up a small test group of servers and run the patch process on the group. Then, expand the process to all servers in the organization.
(Windows patching only) VMware Update Agent (VUM) uses the same stPatchAssessment.dll file that is used by Shavlik Protect Patch Engine. If you install the VMWare Update Agent on a machine with an RSCD agent, it unregisters the stPatchAssessment.dll file and you cannot perform patching on the target.
Supported platforms for patch management
The patch management feature in BMC Server Automation supports the following operating systems:
- Microsoft Windows
- Oracle Solaris 10 and 11
- Fujitsu Solaris
Multibos and Alternate disk patching is supported on AIX platforms, see How to perform AIX patching on an alternate disk or on a multiple boot operating system (multibos).
- Red Hat Enterprise Linux
- SUSE Linux Enterprise
- Oracle Linux
For detailed information about supported operating systems and versions, see the BMC Solution and Product Availability and Compatibility Utility.
Patch management is supported for HP-UX and CentOS using an external tool called Vendor Patch Content (VPC). VPC is included as part of BMC Server Automation. For more information, see How to perform HP-UX or CentOS patch analysis using Vendor Patch Content.
An additional, separate package is provided for patch management on Solaris 11. For more information, see How to perform script-based patch analysis for Solaris 11.
Supported platforms for storing the patch repositories of patch catalogs
|Patch catalog||Supported platforms for storing patch repositories|
Windows or Unix
Any AIX server
Note: If you are downloading patches using the SUMA option, ensure that you have the SUMA utility installed on your repository server.
Red Hat Enterprise Linux (RHEL) using the CDN interface
Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7
|SuSE Linux 12|
SuSE Linux with SMT installed.
Note:To patch SuSE 12 targets, ensure that the SuSE patch repository server is configured with the Subscription Management Tool (SMT).
The following table lists the versions that are installed with SMT out-of-the-box, as well as the versions on which SMT must be manually installed.
Warning: BMC strongly recommends using Zypper when creating a patching job for a patch catalog that was created using the Subscription Management Tool (SMT). For more information, see Zypper patching tool.
|SuSE Linux 11||SuSE Linux with createrepo and python-urlgrabber installed.|
|Oracle Enterprise Linux||Any supported RPM-based Linux with createrepo and python-urlgrabber installed|
Windows or Unix
Note: If you are using Solaris 11 patches, you can only use a Solaris 11 server for storing the patch repository.
|Ubuntu||Windows or Unix|
|Debian||Windows or Unix|
|Cent OS||Any supported RPM-based Linux with createrepo and python-urlgrabber installed|
|Fujitsu Solaris||Windows or Linux|
An HP-UX patch repository must reside either directly on the HP-UX (SWA) Server or in a directory that the SWA Server considers to be a local share.
Note that if you are using an offline downloader, you can run the offline downloader on any Windows or Linux machine, but the HP-UX patch repository must still reside on the HP-UX (SWA) Server.
Repository servers for any operating system that are remote from the Application Server (for example, across a wan or slow network) are not supported.
Offline and online modes
BMC Server Automation includes two patch management modes:
- Online mode — Patches are downloaded directly from the appropriate product site.
- Offline mode — Patches are pre-downloaded to a local repository and patches are applied from the repository.
Use Offline mode if you work in an air-gapped environment, where the BMC Server Automation Application Server does not have external Internet access. In Offline mode, you use the BMC offline Patch Downloader utility to download metadata and payload information to a server with Internet access. After downloading, you can transfer the metadata and payload information (using removable storage) to the patch repository within the air-gapped environment.
The Patch Downloader utilities run scripts that use XML configuration files (samples are provided) containing required information such as the repository location, as well as filters used during downloading from the vendor website.
Patch management workflow
Patch management consists of the following tasks:
- Preparatory tasks
- Defining role-based permissions
- Configuring Global Configuration parameters
- (Windows only) Defining the location of Microsoft Windows installation media for Microsoft Office patch deployment
- (Offline mode only) Building an offline patch repository
- Downloading patch downloader utilities from BMC
- Preparing XML configuration files for downloading patch content
- Downloading patches to the offline patch repository
- Patching tasks
- Creating and updating a patch catalog
- Creating and running a Patching Job and a Remediation Job
These tasks are described in more detail in the following table:
Defining role-based permissions
To create or update a catalog, you must be assigned a role that includes the necessary permissions. To facilitate division of responsibilities, you can assign permissions to one role or divide them between several roles.
Configuring Global Configuration parameters
Global Configuration parameters provide basic information used during patch catalog creation and updating, as well as for Patch and Remediation Jobs. The following parameter groups are available:
Defining the location of Microsoft Windows installation media for Microsoft Office patch deployment
(Windows only) To deploy Microsoft Office patches, BMC Server Automation must have access to a network location containing installation media for Microsoft Office. Because target servers can run different versions of Microsoft Office, you might need to specify a different location for each target server or smart group.
Building an offline patch repository
(Offline mode only)
Obtaining the Patch Downloader utilities from BMC
From the BMC EPD site, download the appropriate utilities for building your offline repository. The utilities are platform-specific. You must know which platform you plan to use to download your patches.
Preparing XML configuration files for downloading patch content
Use the utilities that you downloaded from the BMC EPD site to prepare the XML configuration files for downloading the patch content.
Downloading patches to the offline patch repository
To download the patch content, use the utilities that you downloaded from the BMC EPD site and the XML configuration files that you prepared.
Creating and updating a patch catalog
For both types of repositories, online and offline, you create a patch catalog using the BMC Server Automation Console. Patches are added to the catalog as depot objects according to filters that you define for the catalog.
Creating and running a Patching and Remediation Job
A Patching Job has two parts:
Additional Information on installed patches, configuration data, and more
The following methods can be used to obtain additional information:
Live browse — Use live browse to look at installed patches on the server, one server at a time. For more information about live browse, see Server browse options.
Live browse on a server does not list non-security patches.
- Snapshot Jobs — Snapshots can record the configuration of patches on a target server at a specific point in time. To take a snapshot, you must run a Snapshot Job. For more information, see Creating and modifying Snapshot Jobs.
- Reports — For information about patch management reports, see the online technical documentation for BMC Decision Support for Server Automation.
Where to go from here
The following video demonstrates how to perform Red Hat patching (starting with the creation of a patch catalog, and then execution of a Patching Job and a Remediation Job):
The following video demonstrates how to perform Windows patching and includes a discussion of the business advantages of automating the patching process with BMC Server Automation.