Remediating servers
Remediation is the process of downloading the payload for patches determined to be missing on one or more target servers and then applying that payload to the identified target servers to bring each one up to the required level.
This topic contains the following sections:
To control the number of Deploy Jobs created during remediation
By default, a single Deploy Job is created during remediation to deploy multiple BLPackages to multiple target servers. However, you can choose to have multiple Deploy Jobs created, one for each target server, as was the standard behavior in earlier versions of TrueSight Server Automation.
- From the Configuration menu, select Patch Global Configuration.
- In the Patch Global Configuration dialog box, select a value for the Use Single Deploy Job setting:
- Yes — only one Deploy Job for all target servers that require remediation. This is the default setting.
- No — multiple Deploy Jobs, a separate Deploy Job for each target that requires remediation.
- Click OK.
To automatically remediate servers
If you select the Create remediation artifacts check box during patching job definition, the process of packaging and deploying the payload is handled automatically according to the schedule you defined for the job.
However, when analysis results indicate that patches are missing, you can also choose to remediate the target server manually, as described in the next section.
To manually remediate a server
- At the end of analysis, right-click the patching job and select Show Results.
- Expand the analysis results from the root node and under Server View, right-click Successful targets and select Remediate All Server(s).
Provide information for the remediation job as described in the following table:
Panel
Description
The Default Notifications panel provides options for defining default notifications that are generated when a job completes. If you have set up notifications for a particular scheduled job, those notifications are generated instead of default notifications.
The Schedules panel lets you schedule a job to execute immediately, schedule a job at a specific time in the future, schedule a job on a recurring basis, and define notifications that are issued when a job runs.
The Properties panel provides a list of properties automatically assigned to the job being created. In this list, you can modify the value of any properties that are defined as editable.
For any property that has a check in the Editable column, select the property and click in the Value column.
- To set a property value back to its default value, click Reset to Default Value
.
The value of the property is reset to the value it inherits from a built-in property class. The Value Source column shows the property class from which the value is inherited. - Depending on the type of property you are editing, you can take different actions to set a new value, such as entering an alphanumeric string, choosing from an enumerated list, or selecting a date.
To insert a parameter into the value, enter the value, bracketed with double question mark delimiters (for example, ??MYPARAMETER??) or click Select Property
.
Using the Permissions panel, you can add individual permissions to an object. You can also set permissions by adding ACL templates or ACL policies. The Permissions list is an access control list (ACL) granting roles access to any objects created in the system, such as depot objects. ACLs control access to all objects, including the sharing of objects between roles. For more information, see the following table:
Task
Description
Adding an authorization
An authorization grants permission to a role to perform a certain type of action on this object.
To add authorization to this object, click Add Entry
in the Access Control List area. Then use the Add New Entry dialog box to specify the role and authorization you want to add.Adding an ACL template
An ACL template is a group of predefined authorizations granted to roles. Using an ACL template, you can add a group of authorizations to the object.
To add an ACL template to the object, click Use ACL Template
in the Access Control List area. Then use the Select ACL Template dialog box to specify an ACL template that you want to add to this object.To set the contents of the selected ACL templates so that they replace all entries in the access control list, select Replace ACL with selected templates. If you do not select this option, the contents of the selected ACL templates are appended to existing entries in the access control list.
Adding an ACL policy
An ACL policy is a group of authorizations that can be applied to this object but can be managed from one location.
To add an ACL policy to this object, click Use ACL Policy
in the ACL Policies area. Then use the Select ACL Policy dialog box to specify an ACL policy that you want to add to the object.To set the contents of the selected ACL policies so they replace all entries in the access control list, select Replace ACL with selected policies. If you do not select this option, the contents of the selected ACL policies are appended to existing entries in the access control list.
- To set a property value back to its default value, click Reset to Default Value
For information about viewing the results of the remediation, see Viewing-Patching-Job-results.
To set deploy options
Remediation generates one or more deployment jobs, which are used to apply a specific set of missing patches to a list of target servers. For each of those jobs, TrueSight Server Automation lets you control deployment behavior by defining deploy options.
You can set deploy options:
Individually — Select the deploy options that should be used when generating a specific Deploy Job during remediation. For more information about the options you can select, refer to the following table describing Deploy Job behavior:
Panel
Description
For all types of Deploy Jobs, you can use the Phase Options panel to make choices that control how the Simulate, Stage, and Commit phases of a job behave. You can also modify job behavior when undoing a deployment.
The Phase Options panel also lets you assign pre- and post-commands for the Deploy Job and the undoing of the Deploy Job.
To complete the Phase Options panel, you may have to perform the following procedures:
Choosing-simulate-and-stage-options
The Phases and Schedules panel lets you choose the deployment phases that should occur during deployment of a software package or BLPackage. It also lets you schedule the execution of a job.The Phases and Schedules panel prompts you for the following categories of information:
- By Group — Specify an existing Deploy Job in the remediation options tab (in Deploy Options dialog) in the Remediation Editor. Its options are used as a template that is applied to all Deploy Jobs created during remediation.
Deploy Jobs are chained to the parent Patching Job, and the parent Patching Job is marked as complete only after the Deploy Job finishes execution. The TrueSight Server Automation Console displays the execution status of the Deploy Jobs and a consolidated status summary of all the Deploy Jobs.
To stage the patches before applying them
When you are preparing to patch servers, you can save time in the deployment process by staging the patches on the target(s) prior to performing the actual patching.
To do so, complete the following steps:
- When you run the Patch Remediation Job (the one that creates the Deploy Job or Jobs), in the Deploy Job Options of Patch Remediation Job, set the schedule for the Simulate phase to start relatively soon, or whenever you want the staging to occur (for example, during the weekdays).
- Ensure that the job executes the Stage start right after the Simulate phase. Do not schedule the job to Commit, as that is the phase that actually performs the patching.
All the Deploy Jobs will run at the scheduled time that you specified (Simulate and Stage). During the Stage phase, the patches will be copied to the targets. - At a later point in time (for example during a change window on the weekend), you can kick off the Batch Job (which was also created during Patch Remediation run).
The Batch Job will simply resume every Deploy Job in the Commit phase. The Commit phase is the only one that performs the actual patch installation.
To enable sequential execution of auto-remediation batch jobs
Where to go from here