Important

   

This space contains documentation for TrueSight Server Automation 8.9.03 and the later service packs for 8.9. For earlier releases, see BMC Server Automation 8.9.

Creating a patch catalog for AIX

Related BMC Communities article

BMC Customers using Automation for Patching use cases depend on OS vendors for Patches and metadata.  To view a document that tracks the service status of the different OS Vendors as known to BMC Support, see the following BMC Communities document:

OS Patching Vendor Health Dashboard

The patch catalog is used to maintain and work with the patch repository through the TrueSight Server Automation Console. For both types of repositories, online and offline, you create a patch catalog through the TrueSight Server Automation console. Patches are added to the catalog as depot objects according to filters defined for the catalog.

This topic describes how to set up a patch catalog for IBM AIX, and includes the following sections:

Step 1: Review prerequisites for the catalog

Review the following prerequisites for creating patch catalogs for AIX.

  • Ensure that security policies on the repository server do not block the download of the catalog.
  • The SUMA command used in the SUMA download option, does not allow TrueSight Server Automation to configure a proxy server automatically. The proxy server must be manually configured by using the System Management Interface Tool (SMIT), which is recommended by IBM.

     Click here to view steps for configuring the repository server using SMIT.

    To configure a proxy server on repository server while using the SUMA download option, perform the following steps:

    1. On the repository server, start the System Management Interface Tool (SMIT) by running the smit command.
    2. Select the Communications Applications and Services option.
    3. Select the Create/Change Service Configuration option.
    4. Select the Create/Change Service Configuration option, once again.
    5. Select the Create/Change Primary Service Configuration option.
    6. In the entry field for Connection type enter HTTP_PROXY.
    7. Enter the IP address, port number, and authentication user ID of the proxy server that you want to use.

    You can now use the proxy server for creating an online or offline catalog with the SUMA download option.

  • Ensure that the system you will use for the patch repository is supported by TrueSight Server Automation.

     Click here to see the platforms supported for storing your repository

    Oops, it seems that you need to place a table or a macro generating a table within the Table Filter macro.

    The table is being loaded. Please wait for a bit ...

    Patch catalogSupported platforms for storing patch repositories
    Windows

    Windows or Unix

    AIX

    Any AIX server

    Note: If you are downloading patches using the SUMA option, ensure that you have the SUMA utility installed on your repository server.

    Red Hat Enterprise Linux (RHEL) using the CDN interface

    Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7

    SuSE Linux 12

    SuSE Linux with SMT installed.

    Note:To patch SuSE 12 targets, ensure that the SuSE patch repository server is configured with the Subscription Management Tool (SMT).

    The following table lists the versions that are installed with SMT out-of-the-box, as well as the versions on which SMT must be manually installed.

    Repository server versionSMT installation

    SuSE 11 SP3
    SuSE 11 SP4

    SuSE 12

    Note: SuSE recommends upgrading SuSE 12 to SuSE 12 SP1 to avoid dependency issues.

    Not configured with SMT out of the box. You must manually install and configure SMT (version 11 SP3) on the repository server before you create a SuSE patch catalog.
    SuSE 12 SP1 or later (recommended)SMT is shipped out-of-the-box with the operating system.

    Warning: BMC strongly recommends using Zypper when creating a patching job for a patch catalog that was created using the Subscription Management Tool (SMT). For more information, see Zypper patching tool.

    SuSE Linux 11SuSE Linux with createrepo and python-urlgrabber installed.
    Oracle Enterprise LinuxAny supported RPM-based Linux with createrepo and python-urlgrabber installed
    Solaris

    Windows or Unix

    Note: If you are using Solaris 11 patches, you can only use a Solaris 11 server for storing the patch repository.

    UbuntuUnix
    DebianWindows or Unix
    Cent OSAny supported RPM-based Linux with createrepo and python-urlgrabber installed
    Fujitsu SolarisWindows or Linux
    HP-UX

    An HP-UX patch repository must reside either directly on the HP-UX (SWA) Server or in a directory that the SWA Server considers to be a local share.

    Note that if you are using an offline downloader, you can run the offline downloader on any Windows or Linux machine, but the HP-UX patch repository must still reside on the HP-UX (SWA) Server.

Step 2: Create the patch catalog


  1. Right-click a folder in the Depot and select New > Patch catalog > AIX Patch Catalog.
    The New Patch Catalog dialog panel opens.
  2. Provide information for the patch catalog as described in the following table:

    Panel sectionDescription
    GeneralEnter a Name for the patch catalog and a Description of its contents. Then, browse to the folder in which you want to store the catalog.
    Catalog options

    Define a number of options including locations (such as the location of the source files and the repository), as well as filters and whether local copies of the files are created on the target server or downloaded directly during deployment.

    Catalog Mode

    Select one of two options:

    • Source from IBM Network (Online Mode): Use this mode if the TrueSight Server Automation Application Server is installed on a server with Internet access. Credentials are not required.
    • Source from Disk Repository (Offline Mode): Use this mode in a secured environment where download occurs on a server, with Internet access, outside of the environment.

    Download option

    Select one of the two download options:

    • Fixget: Use this mode if you want to download the AIX patches from Fixget servers.
    • SUMA: Use this mode if you want to download the AIX patches from Fix Central servers using IBM Service Update Management Assistance (SUMA).

      Notes

      • BMC recommends using, the latest, SUMA download option instead of the Fixget download option for AIX patching.
      • Before you use the SUMA download option, ensure that the repository server is running AIX 6 TL 6 or a later version and that it is configured with ECC.

      • The SUMA command used in the SUMA download option, does not allow TrueSight Server Automation to configure a proxy server automatically. The proxy server must be manually configured by using the System Management Interface Tool (SMIT), which is recommended by IBM.

         Click here to view steps for configuring the repository server using SMIT.

        To configure a proxy server on repository server while using the SUMA download option, perform the following steps:

        1. On the repository server, start the System Management Interface Tool (SMIT) by running the smit command.
        2. Select the Communications Applications and Services option.
        3. Select the Create/Change Service Configuration option.
        4. Select the Create/Change Service Configuration option, once again.
        5. Select the Create/Change Primary Service Configuration option.
        6. In the entry field for Connection type enter HTTP_PROXY.
        7. Enter the IP address, port number, and authentication user ID of the proxy server that you want to use.

        You can now use the proxy server for creating an online or offline catalog with the SUMA download option.

    Repository Options

    Enter the following information:

    Field

    Description

    Payload Source Location (NSH path)

    Location where existing metadata and payload files are stored
    Metadata files stored in this location are copied to the catalog automatically. Payload files are not copied to the catalog.

    Repository Location (NSH path)

    NSH path to the location where the patch repository is located
    BMC recommends that this location have ample free space. Repositories typically contain many files, usually totaling gigabytes of data.
    (Offline Only)
    Either this location must be hosted on an AIX platform, or the downloader must be run on an AIX platform. If both are not on AIX platforms, you cannot create an AIX patch catalog.
    (Online Only)
    This location must be hosted on an AIX platform.
    Note: As you do not need to specify the URL of the patch files, the Payload Source Location (NSH path) option is dimmed.

    Note: When specifying a host within an NSH path, you can use either the host name of the IP address (IPv4 or IPv6).

    Base Repository Location

    Enter the following information:

    Field

    Description

    Base Repository Location

    NSH path to the location where base-level payload files are stored. Base-level payload files are not copied to the repository location.

    Base Repository Network URL

    URL of the location where base-level metadata and payload files are stored. Specifying a value for this field is optional if you have selected the Copy to agent at staging option for the Network URL Type For Payload Deployment field.

    Notes:

    • If the patches that you require do not contain dependencies, you need not specify values for the Base Repository Location and Base Repository Network URL fields.
    • For more information about how to upgrade or install AIX patches using the Base Repository Location and the Base Repository Network URL options, see Creating a patch catalog for AIX in online mode.

    Note: When specifying a host within an NSH path, you can use either the host name of the IP address (IPv4 or IPv6).


    OS Base Version

    Version of the operating system (OS) for which you want to source Technology Levels, Service Packs, and so on. The SUMA download option is only supported on AIX 7.2, AIX 7.1, and AIX 6.1.

    Filters

    Filters limit the amount of information brought into the catalog. For an offline catalog, re-create the filters defined in the configuration file used by the download utility. Available filter types are as follows:

    • By Update Level
    • By Fix Type
    • By Fix ID

    Only patches that match the combinations you define are added to the catalog. You can define filters either when the catalog is created or later, when you edit the catalog. To begin, click Add Filter and select from the following:

    Field

    Description

    By Update Level

    By Fix Type

    Select one of the following three fix types for a particular update level — All Latest Fixes, All Security Fixes, or All Critical Fixes. Only one Fix Type filter can be included in the patch catalog.

    Note: The SUMA download option is only supported for the All Latest Fixes update level.

    OS Level

    Fixes of a particular type are downloaded for the Operating System Level defined here.

    By Fix ID

    Create an individual filter for a specific APAR or PTF. Multiple filters of this type are permitted in the patch catalog.

    • Type: Select either APAR or PTF. Multiple filters of this type are permitted in the patch catalog.
    • APAR Id/PTF Id: Enter the identifier for the APAR/PTF.
      If the patch catalog contains this type of filter, you can create an Include/Exclude list as part of the analysis options for a Patching Job based on this patch catalog.

    Note: The SUMA download option is only supported for PTF type of filters.

  3. In the bottom right corner, select Job options. (You can also edit the catalog at a later time to set these options).
  4. Provide information for the patch catalog options as described in the following table:

    TabDescription
    Schedules
    The Schedules panel lets you schedule a job to execute immediately, schedule a job at a specific time in the future, schedule a job on a recurring basis, and define notifications that are issued when a job runs.

    When scheduling a job, you can perform any of the following tasks:

    • Scheduling a job that executes immediately — To schedule a job that executes immediately, select Execute job now.
    • Scheduling a job — The Schedule tab lets you schedule a job so it can run one time, recur hourly, daily, weekly, or monthly, or recur at some arbitrary interval. For more information, see Patch catalog - Scheduling.
    • Defining job notifications — The Job Notifications tab lets you set up notifications that are generated when a scheduled job runs. For more information, see Patch catalog - Scheduled Job Notifications.
    Job Run Notifications

    The Default Notifications panel provides options for defining default notifications that are generated when a job completes. If you have set up notifications for a particular scheduled job, those notifications are generated instead of default notifications.

    Default notifications can take the form of emails or SNMP traps. When a job completes, an SNMP trap is sent to a specified server, where it can be read using software that receives and interprets SNMP traps. Default notifications are sent when you run a job immediately (that is, you do not schedule the job) or a scheduled job completes but you have not set up email or SNMP notifications for that scheduled occurrence.

    Job Run Notifications

    FieldDescription

    Send email to

    Lists email addresses of the accounts to notify when a job completes with the status that you specify. Separate multiple email addresses with semicolons, such as sysadmin@bmc.com;sysmgr@bmc.com. After entering email address information, check the statuses that cause an email to be generated. The statuses can be Success, Failed, or Aborted.

    Send SNMP trap to

    Provides name or IP address of the server to notify when the job completes. After entering server information, select the statuses that should cause an SNMP trap to be generated. The statuses can be Success, Failed, or Aborted.

    TrueSight Server Automation provides a management information base (MIB) that describes its SNMP trap structure. You can use this MIB to create scripts that integrate traps into your trap collection system. The MIB is located on the Application Server host computer at installDirectory/Share/BladeLogic.mib.

    List failed servers in email notification

    Indicates that email notifications should list all servers on which a job has failed.

     Create incident on job failure

    Creates an incident in BMC Remedy ITSM if the job fails.

    This option is available if this job type was selected to support the creation of ITSM incidents and a connection to BMC Remedy ITSM was set up. For more information, see Enabling Change Automation for TrueSight Server Automation jobs.

    Depot Object Options

    Network URL Type for Payload Deployment

    • (default) Copy to agent at staging: The TrueSight Server Automation Application Server copies patch payloads to a staging directory on the target server during the Deploy Job staging phase.
    • Agent mounts source for direct use at deployment (no local copy): A Deploy Job instructs the agent on a target server to: mount the device specified in the URl and deploy patch payloads directly to the agent. The Deploy Job does not copy patch payloads to a staging area on the agent, so the job does not create any local copies of the patches on target servers.

    Network URL for Payload Deployment

    The value entered here depends on your selection in the Network URL Type for Payload Deployment box:

    • If you chose Copy to agent at staging, do not enter a value here. The value is autopopulated based on the repository location.
    • If you chose Agent mounts source for direct use at deployment (no local copy), enter the NFS-accessible path to the location of the payload.
      If you specify the host in this path as an IPv6 address, enclose the IPv6 address in square brackets.

    RBAC Policy

    Browse to and select a predefined ACL Policy. Permissions defined by the ACL Policy are assigned to all Depot objects created in the catalog.

    Max Deport Object Work Items to Process in Parallel

    Maximum number of work items that can be performed in parallel.

    Job Properties

    The Properties panel provides a list of properties automatically assigned to a Snapshot Job. In this list, you can modify the value of any properties that are defined as editable.

    For any property that has a check in the Editable column, select the property and click in the Value column.

    • To set a property value back to its default value, click Reset to Default Value .
      The value of the property is reset to the value it inherits from a built-in property class. The Value Source column shows the property class from which the value is inherited.
    • Depending on the type of property you are editing, you can take different actions to set a new value, such as entering an alphanumeric string, choosing from an enumerated list, or selecting a date.
      To insert a parameter into the value, enter the value, bracketed with double question mark delimiters (for example, ??MYPARAMETER??) or click Select Property .

    Permissions

    Using the Permissions panel, you can add individual permissions to an object. You can also set permissions by adding ACL templates or ACL policies. The Permissions list is an access control list (ACL) granting roles access to any objects created in the system, such as depot objects. ACLs control access to all objects, including the sharing of objects between roles. For more information, see the following table:
    TaskDescription

    Adding an authorization

    An authorization grants permission to a role to perform a certain type of action on this object.

    To add authorization to this object, click Add Entry  in the Access Control List area. Then use the Add New Entry dialog box to specify the role and authorization you want to add.

    Adding an ACL template

    An ACL template is a group of predefined authorizations granted to roles. Using an ACL template, you can add a group of authorizations to the object.

    To add an ACL template to the object, click Use ACL Template  in the Access Control List area. Then use the Select ACL Template dialog box to specify an ACL template that you want to add to this object.

    To set the contents of the selected ACL templates so that they replace all entries in the access control list, select Replace ACL with selected templates. If you do not select this option, the contents of the selected ACL templates are appended to existing entries in the access control list.

    Adding an ACL policy

    An ACL policy is a group of authorizations that can be applied to this object but can be managed from one location.

    To add an ACL policy to this object, click Use ACL Policy  in the ACL Policies area. Then use the Select ACL Policy dialog box to specify an ACL policy that you want to add to the object.

    To set the contents of the selected ACL policies so they replace all entries in the access control list, select Replace ACL with selected policies. If you do not select this option, the contents of the selected ACL policies are appended to existing entries in the access control list.

  5. Click Finish
    A Patch Catalog is stored in the appropriate Depot folder.


Editing the options

  1. In the Depot, right-click the AIX Patch Catalog you just created.
  2. Select Open.
  3. Set or update any information for the patch catalog options.

  4. When finished, save the catalog.

Where to go from here

Downloading patch payloads to the catalog

Was this page helpful? Yes No Submitting... Thank you

Comments