Creating a Patching Job

This topic describes how to create a Patching Job. A Patching Job identifies missing patches on your servers.

It includes the following sections:

Contents of the Patching Job
Before you begin
To create a Patching Job
Where to go from here

Contents of the Patching Job

A Patching Job includes the following:

Analysis — The Patching Job checks the configuration of target servers and determines which patches are needed.
(Optional) Creation of remediation artifacts — The Patching Job performs the following actions:
1. (Microsoft Windows, Solaris only) Downloads the required payload.
2. Packages the payload as a BLPackage.
3. Creates a Deploy Job.
  Important
  The Patching Job creates the Deploy Job. The Deploy Job executes according to the schedule you define for Deploy Jobs.
  By default, the patching job creates the Deploy Job but does not run it. However, if users schedule a Deploy Job as part of a Patching Remediation Job to execute immediately (using the Execute Now option), the Deploy Jobs are chained to the parent Patching Job, and the parent Patching Job is marked as complete only after the Deploy Job finishes execution.
  If you have permission for the analysis part of a Patching Job, then you also have permission for the remediation part of the job.

Before you begin

You need to enable the required permissions for anyone responsible for creating and executing the patching job, see Role-based-permissions-for-creating-and-running-a-patching-job for the list of permissions. In addition, ensure that anyone who can view results of the Patching Job, has the DepotObject.Read permission enabled for the patch catalog that is used for the analysis.
Make sure that the libnsl.so.1 package is installed on the RHEL and CentOS targets.
Make sure that Perl is installed on the RHEL 8.x zSeries (s390x) targets.
(Solaris Only) For an agent, running on a target server in single-user mode, to mount a source location using the NFS transmission protocol, the following must be done prior to deployment:
- Enable NFS client services on the target server.
- Change the server property setting, DEPLOY_ALLOW_NFS_DURING_SUM, to true.
For more information, see Using NFS to mount a location while running single-user mode.

To create a Patching Job

In the Jobs folder, navigate to the folder where you want to create a Patching Job.
Do one of the following actions:
- Right-click and select New > Patching Job >platformNamePatching Job. For example, Microsoft Windows Patching Job, Solaris Patching Job.
- Right-click a specific server and select Patch Analysis.
- Right-click a catalog and select Analyze Using This Catalog.

Provide information for the Patching Job as described in the following topics.

Panel

Description

Patching Job - General

On the General tab, you can enter following basic information about a Patching Job:

Name	Enter the name of the Patching Job. NEW IN 21.02(For Windows Patching jobs) When you create an Analysis job with the auto remediate option enabled, name of the created remediation job is appended with the date and timestamp values. If the characters in the name exceed 260, the Remediation job fails. To avoid this issue, the remediation job name after 30 characters is truncated.
Description	Enter some information about the Patching Job.
Save in	Select a folder where you would want the job to be stored.
Specify a Catalog	Browse to and select a patch catalog.
Unlimited	Select this to have the job to run in parallel on as many target servers as possible.
Limited	Select this to have the job to run in parallel on a specific number of target servers.
Set Execution Override	Select when the Patching Job always execute as the user, BLAdmin, and the role, BLAdmins.
Clear Execution Override	Select when the Patching Job always execute using the user and role that scheduled the job.

Patching Job - Analysis Options

Complete one of the following panels, based on patch platform.

Patching Job - Analysis Options for Microsoft Windows

A Patching Job checks the configuration of patches on specific servers according to the filters defined as part of the job definition.

You can select List and create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box. You can specify the patches that you want to include or exclude, or you can specify a .txt file that contains a list of QNumbers for these patches.

We recommend adding only those patches that you want to test against the target to the include list because adding additional patches might increase the time taken to analyze the target.

If you want to use the Include and Exclude patch lists in combination for superseded patches, use the Filter Exclude List Before Analysis check box:

If you select this check box, the patches in the Exclude list are removed from the patches in the Include list. This revised patch list is used for patch analysis.
If you do not select this check box, the patches from the Include list are used for analysis and the patches specified in the Exclude list are filtered from the analysis results.

Example scenario

You have two patches as P1 and P2 where P2 supersedes P1, and you performed these steps:

Create the smart groups; SG1 for P1, SG2 for P1 and P2, and SG3 for P2
Create a new Patch Analysis Job.
On the Analysis Options tab, do the following:
1. Add SG2 in the Include list and SG3 in the Exclude list.
2. Select the Filter Exclude List Before Analysis check box.
Run the Patch Analysis Job.

Result: P1 is shown as missing in the Object view. If you perform these steps without selecting the Filter Exclude List Before Analysis check box, no patches are shown as missing.

If you do not select List, you can choose from one of the following analysis options:

Click here to see a description of the options.

The referenced document [xwiki:Automation-DevSecOps.Server-Automation.TrueSight-Server-Automation.tssa252.Using.Creating-and-modifying-TrueSight-Server-Automation-jobs.Panel-reference-for-Patch-Management-Jobs.Patch-analysis-job-panels.Patching-Job-Analysis-Options-for-Microsoft-Windows.WebHome] was not found.

Patching Job - Analysis Options for Solaris

You can select List and create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box, or choose from one of the following options:

Click here to see a description of the options.

Patching Job - Analysis options for AIX

A Patch Analysis Job on AIX does not show any fileset or BFF file dependency issues in the analysis log files and the Deploy Job might fail. You must ensure that all the required filesets and BFF files are installed on the target computer. You can create an Include/Exclude List for specific patch containers (PTFs or APARs) through the Include-or-Exclude-Selection dialog box, or choose from one of the following options:

Click here to see a description of the options.

Analysis Option	Choose one of the following options for the Patch Analysis: Stop Analysis if any applied fileset found Stop analysis on any target server that has filesets in the applied state (installed but not committed). Use Patch global configuration settings Use the settings in the Global configuration parameters. Continue Analysis if any applied fileset found Continue analysis on any target server that has filesets in the applied state (installed but not committed).
Analysis Mode	Choose either Install Mode or Update Mode. For AIX, the Patch Analysis Job fails in the Install Mode because of missing rpms in the repository. A single repository will contain updates for all available packages. The Install Mode is intended to install new packages on the target. Hence, BMC recommends the use of Install Mode on selective packages, rather than using the Install Mode on the complete repository.
Upgrade Installp during analysis	Depending on how you want to upgrade the ‘bos.rte.install’ package, choose one of the following options: Skip: The ‘bos.rte.install’ package on the target is not upgraded. Apply: The ‘bos.rte.install’ package on the target is upgraded to the later version available in the catalog during the analysis. ‘bos.rte.install’ is deployed on the target in the applied state. Apply and Commit: The ‘bos.rte.install’ package on the target is upgraded to the later version available in the catalog during the analysis. ‘bos.rte.install’ is deployed on the target in the committed state. Note: Using Apply and Apply and Commit options, the Patch analysis is done in one pass only.
Additional Installp option (Optional)	Enter any additional options that you want to use with the Installp command. By default, TrueSight Server Automation passes the following options: -V -e -p -a -Y -g -d -f to the Installp command. Warning: The options that you enter here are passed in addition to the default options passed by TrueSight Server Automation. You cannot modify these default options. The options entered in this field are directly passed to the Installp command.
New in 8.9.03.001Analyse with efix/ifix	Select this option if you want to run the patch analysis job when an eFix/iFix is installed on the target machine. The efix must be part of a service pack. By default, the checkbox is not selected. Note: If the eFix on the target server machine is not part of a service pack, BMC recommends you to remove the efix and execute the analysis job.
Group	Select to use the entire patch catalog for patch analysis.
List	Create an Include List or an Exclude List, depending on your requirements. For an APAR or PTF-based catalog, you can create an Include List for specific APAR or PTF IDs. You can also create an Exclude List for a specific fileset. Use this option if inclusion of the fileset would lead to deployment failure, such as if the fileset had dependency issues, whereas exclusion of the fileset would result in successful analysis and deployment. Analysis of a specific APAR or PTF includes the entire service pack. Therefore, the version of the target server is upgraded to the same version as the service pack that was analyzed. Note: Exclusion is the only action you can perform at the fileset level.

Patching Job — Analysis Options for Red Hat Enterprise Linux, Oracle Linux Public Repo or SUSE Linux Enterprise

(Applicable for Red Hat Enterprise Linux only) Starting from version 23.2, a target server node in the Server View of the Patch Analysis Job results displays the count of installed RPMs and Erratas in addition to the missing RPMs and Erratas.

Important

If you are upgrading from 23.1, you do not need to re-run the Patching Job again. If you have done any customizations to the Patching Job table, right-click the table and select Reset Column Configuration. For more information, see Resetting-column-configuration-for-the-Job-Results-view.

Click here to see a description of the options.

On the Basic Options tab, you can perform the following actions:

(Additional step for SuSE Patching only) Select whether you want to perform patching using the Zypper or yum tool.

Click here for more information about the Zypper patching tool.

An improved packaging framework called Zypper has been introduced in SUSE Linux 10.3 and later versions. TrueSight Server Automation now supports patching using the Zypper packaging framework. Because Zypper is an improved packaging framework, BMC strongly recommends using the Zypper tool for patching instead of the existing YUM patching tool. When using YUM, you might encounter dependency issues.
Important
- Ensure that you have Zypper 1.3.7 or later is installed on your SuSE repository server, before you use Zypper for patching.
- BMC strongly recommends using Zypper when creating a patching job for a patch catalog that was created using the Subscription Management Tool (SMT).
Choose one of the following options:
- Install Mode - Analyze for missing RPMs and updates available for installed RPMs on a target server
  Notes
  Do not choose Install Mode if you are including all errata or all RPMs from the catalog. Various conflicts and dependency issues between RPMs may occur because Install Mode attempts to install RPMs for which the base versions or earlier versions are not present.
  You are not required, nor is it recommended, to include the default RPMs Patch smart group that is part of the catalog. If no includes are specified, the analysis will check for the missing patches for the target server OS version and platform. If the include list is specified, there will be an explicit check for each rpm in the patch smart group.
- Update Mode - Analyze only for updates available for installed RPMs on a target server
- (Additional option for Red Hat Enterprise Linux) Security Mode - Analyze for security updates available for installed RPMs on target server. Select from one of the following options:
  - Update: Analyze all available security updates. This option analyzes the last version available of any package with at least one security errata, thus can analyze non-security erratas if they provide a more updated version of the package.
  - Update-minimal: Analyzes the packages that have a security errata use.
  Important
  After you upgrade to version 23.1 or later from a version earlier than 21.3, ensure that you update the patch catalog for the Security Mode option to take effect.
- (Additional option for Red Hat Enterprise Linux) KPatch Mode - Analyze only for kernel patches (kpatch) available for target server
  Important
  After you upgrade to version 23.1, we recommend updating the existing patch catalogs to get the latest kernel patches.
- (Additional option for SuSE if you are patching with Zypper) Dist-Upgrade Mode - Analyze only for distribution upgrade or service pack upgrade.
  Important
  If you have created a SuSE patch catalog in the online mode, you can only update your target from the existing OS level to the next OS level. For example, to update a target from SuSE Linux Enterprise 11 SP2 to SuSE Linux Enterprise 11 SP4, you must first update your target to SUSE Linux Enterprise 11 SP3, and only then upgrade to SUSE Linux Enterprise 11 SP4.
  Note
  Zypper supports updates for distributions and service packs, which is not supported by the YUM patching tool. The Zypper method of analysis automatically skips distribution and service pack upgrade-related rpms during normal package updates (Install mode and Update mode). In yum method of analysis, however, the distribution and service pack upgrade-related rpms must be manually excluded during the normal package updates. As a result, you may find a difference in the analysis results of Zypper and yum.
  Your selection between Zypper and Yum is captured in the job property OTHER_LINUX_ANALYSIS_PATCHING_TOOL, with a value of 0 for Zypper or 1 for Yum (the default).
  Click here to see steps to for upgrading SuSE 11 SP1 to SuSE 11 SP2 using zypper
  For an online catalog:
  Create a SuSE online catalog for SuSE 11 SP2 by selecting following repositories during filter selection:
  SLES11-SP2-Update
  SLES11-SP2-Pool
  SLES11-SP1-Update
  SLES11-SP2-Pool
  Run the patch analysis job using the patch catalog created above.
  For an offline catalog:
  Provide URLs for the following repositories in SuSE downloader config xml and run the offline downloader
  SLES11-SP2-Update
  SLES11-SP2-Pool
  SLES11-SP1-Update
  SLES11-SP2-Pool
  Create the offline catalog by providing repository created by offline downloader.
  Run the patch analysis job using the patch catalog created above.

Create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box to override the default, which includes the entire Patch catalog in the analysis.

For more information about Include/Exclude list optimizations in Red Hat patch analysis using the By Complete Package Name and By Package Name only options, click the following link:

Click here to expand information about optimizations in the Include/Exclude list for Red Hat

TrueSight Server Automation can automatically select the appropriate rpm version or versions while including or excluding an rpm package in an RHEL patch analysis job. To enable this version optimization, select the By Package Name Only option while including or excluding patches. Whenever any rpm package is selected with the By Package Name Only option, TrueSight Server Automation automatically performs the following:

In case of an include patch operation—includes the latest rpm version of the package from the catalog, even if that version is not manually selected
In case of an exclude patch operation—excludes all rpm versions of the package from the catalog, even if all versions are not manually selected

You can still individually specify rpm versions for include or exclude by selecting the By Complete Package Name option. When this option is selected, TrueSight Server Automation does not automatically include or exclude any rpm version that is not manually selected by the user from the catalog. Whenever any rpm package is selected with the By Complete Package Name option, TrueSight Server Automation automatically performs the following:

In case of an include patch operation—includes the latest rpm version of the package, from the selected rpm packages
In case of an exclude patch operation—excludes all rpm versions of the package, from the selected rpm packages

Important

The exclude operation takes precedence over the include operation. Therefore, If a package is excluded with the By Package Name Only option, all versions of the package will be excluded from analysis, even if specific versions are manually included.

Examples:

	Manually select each version from the catalog	Specific versions displayed in the Include/Exclude list
When a selection is made with the By Complete Package Name option you can manually select each version to include or exclude from the catalog.
When a selection is made with the By Package Name Only option, you can select any one version of the rpm packages and TrueSight Server Automation automatically selects the appropriate versions for the packages.
	Select any one version of the rpm packages	Only package names are displayed in the Include/Exclude list

On the yum.conf tab, perform either of the following actions:

Select the Use Patch Global Configuration File check box if you want to use a yum.conf file with default settings provided with TrueSight Server Automation.

Deselect the Use Patch Global Configuration File check box if you want to use a custom yum.conf file. You can customize the yum.conf file to configure the different patch analysis and deployment parameters. Your desired entries should be added in the text box provided.

Click here to see a sample of a yum.conf file.

[main]
debuglevel=4
logfile=/var/log/yum.log
pkgpolicy=newest
distroverpkg=RedHat-release
tolerant=1
obsoletes=1
plugins=0
gpgcheck=0
bootloader=1

Notes

The system default /etc/yum.conf file is not used in either of the above cases.

In addition to the options listed in the sample yum.conf above, if you want to avoid the removal of old RPMs during patch analysis when a native yum is used, you can include the installonly_limit option in the yum.conf file. For more information, see the description of this issue in Troubleshooting Patch Management issues.

For more information about all the options that you can include in the yum.conf file, see the yum.conf man page.

The yum.conf tab applies only to Red Hat Enterprise Linux, Oracle Enterprise Linux, and SUSE Linux Enterprise servers. You can also customize the yum.conf file from the Patch Global Configuration option. For more information, see Global-Configuration-parameter-list.

Patching Job - Analysis Options for Ubuntu

Click here to see a description of the options.

Patching Job - Analysis Options for Debian

Click here to see a description of the options.

Patch Job - Analysis options for CentOS

Click here to see a description of the options.

A Patch Analysis Job checks the configuration of patches on specific servers according to filters defined as part of the job definition.

Select one of the following options:
- Analyze for missing patches and updates available for the installed patches on a target server (Install Mode).
- Analyze only for updates available for the installed patches on a target server (Update Mode).
Create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box to override the default of including the entire patch catalog in the analysis.

Note

Depending on the mode you have selected, you cannot perform the following operations:

If Install Mode is selected, you cannot exclude a patch or smart group.
If Update Mode is selected, you cannot include a patch or smart group.

Patch Job - Analysis options for Amazon Linux

Click here to see a description of the options.

A Patch Analysis Job checks the configuration of patches on specific servers according to filters defined as part of the job definition.

Select one of the following options:
- Analyze for missing patches and updates available for the installed patches on a target server (Install Mode).
- Analyze only for updates available for the installed patches on a target server (Update Mode).
Create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box to override the default of including the entire patch catalog in the analysis.

Note

Depending on the mode you have selected, you cannot perform the following operations:

If Install Mode is selected, you cannot exclude a patch or smart group.
If Update Mode is selected, you cannot include a patch or smart group.

Patch Job - Analysis options for OL ULN

Click here to see a description of the options.

A Patch Analysis Job checks the configuration of patches on specific servers according to filters defined as part of the job definition.

Select one of the following options:
- Analyze for missing patches and updates available for the installed patches on a target server (Install Mode).
- Analyze only for updates available for the installed patches on a target server (Update Mode).
Create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box to override the default of including the entire patch catalog in the analysis.

Note

Depending on the mode you have selected, you cannot perform the following operations:

If Install Mode is selected, you cannot exclude a patch or smart group.
If Update Mode is selected, you cannot include a patch or smart group.

Patch Job - Analysis options for Rocky Linux

Click here to see a description of the options.

A Patch Analysis Job checks the configuration of patches on specific servers according to filters defined as part of the job definition.

Select one of the following options:
- Analyze for missing patches and updates available for the installed patches on a target server (Install Mode).
- Analyze only for updates available for the installed patches on a target server (Update Mode).
Create an Include/Exclude list for specific patches through the Include-or-Exclude-Selection dialog box to override the default of including the entire patch catalog in the analysis.

Note

Depending on the mode you have selected, you cannot perform the following operations:

If Install Mode is selected, you cannot exclude a patch or smart group.
If Update Mode is selected, you cannot include a patch or smart group.

Patching Job - Remediation Options

Patching Job - Targets

Patching Job - Output

The Output panel lets you capture the job completion status for the current job and use it to populate a predefined property that you created in the Property Dictionary, within the built-in property class for the job targets — the Server, Component, or Device property class.

The list of properties for selection includes all complex properties of the JobRunStatusEnumeration type. It does not include intrinsic and deprecated properties.

Using the property that you specify here, you can create smart groups based on the completion status of the current job at the various targets. For example, you can create a smart group that includes all servers at which this job has not yet run or a smart group for all servers at which this job has been completed successfully.

The JobInfraManager enableJobOutput configuration parameter enables access to the Job Output property on the application server. The set command sets the parameter to the specified value in the configuration. For more information on using the set command, see Using-the-Set-command.

To enable a parameter by using command line

Open the command prompt and enter the following:
- blasadmin
- set <parameter> true
  Important
  Set command will enable the tab after restarting the application server.

To view the status

Open the command prompt and enter the following:
- blasadmin
- show <parameter>
  Important
  Show command will display the current value of the parameter.

Example

bladmin:default>set JobInfraManager enableJobOutput true
bladmin:default>Show JobInfraManager enableJobOutput
enableJobOutput:true
bladmin:default>

Patching Job - Default Notifications

Patching Job - Schedules

Patching Job - Properties

The Properties panel provides a list of properties automatically assigned to the job being created. In this list, you can modify the value of any properties that are defined as editable.

For any property that has a check in the Editable column, select the property and click in the Value column.

To set a property value back to its default value, click Reset to Default Value .
The value of the property is reset to the value it inherits from a built-in property class. The Value Source column shows the property class from which the value is inherited.
Depending on the type of property you are editing, you can take different actions to set a new value, such as entering an alphanumeric string, choosing from an enumerated list, or selecting a date.
To insert a parameter into the value, enter the value, bracketed with double question mark delimiters (for example, ??MYPARAMETER??) or click Select Property .

The following table provides a list of editable properties:

Property name	Property type	Description
AUTO_GENERATED	Boolean	Specifies whether the object was auto generated.
DEBUG_MODE_ENABLED	Boolean	Specifies whether the Debug Mode has been enabled for the patching job. If this property is set to TRUE, the logs that are created while performing a patch analysis job on the targets are saved on the Application Server. Click here for the location. <ApplicationServerName>/ opt/bmc/bladelogic /NSH/tmp/debug /application_server/ <JobName>/ <TimeAndDateStamp> / <TargetServerIPAddress>
JOB_PART_TIMEOUT	Integer	Specifies the number of minutes the job part or work item should run before it is automatically canceled.
JOB_TIMEOUT	Integer	Specifies the number of minutes the job should run before it is automatically canceled.
MAX_PARALLEL_PER_VM_HOST	Integer	Specifies the maximum number of parallel work items processed per Vitrual Machine host.
PRIORITY	JobPriorityEnumeration	Specifies the priority of the Patching Job
RESULTS_RETENTION_TIME	Integer	Specifies the number of days to retain old job runs and job results for the job.

Patching Job - Permissions

Patching Job - Parallel Execution of CUJ and PAJ

After completing the last step of the wizard, click Finish.
A Patching Job is stored in the appropriate Jobs folder. You can open the job and edit it.

Where to go from here

Performing-patch-remediation

Creating a Patching Job

Contents of the Patching Job

Before you begin

To create a Patching Job

To view the status

Where to go from here

On this page