25 Patching Linux Hosts

Prerequisites for Setting Up the RPM Repository

Before setting up the RPM repository, meet the following prerequisites:

1. Identify a Redhat or OEL host, install a Management Agent, and point to the OMS. This host must have the sudo package installed.

2. Obtain a valid Customer Support Identifier (CSI) number from your Oracle sales representative.

3. Download the up2date packages corresponding to the host version and release from https://linux.oracle.com/switch.html.

4. Upload the up2date packages to the Software Library.

   Note:

   :For a multi-OMS setup, the following steps only need to be performed on one OMS.

   • First compress up2date and up2date-gnome into a zip file and name it as up2date_comp.zip.

   • Copy the zip file to the <ORACLE_HOME>/sysman/metadata/swlib/patch/stageServerComponents directory present in the Oracle home of the OMS.

   • Edit the Patch Software Library entities metadata file swlib.xml under the <ORACLE_HOME>/sysman/metadata/swlib/patch directory present in the Oracle home of the OMS to upgrade the ExternalID of the Software Library entity Up2date Package Component.

   • Upload the zip file to Software Library by running the following command:

     $ emctl register oms metadata -service swlib -file $ORACLE_HOME/sysman/metadata/swlib/patch/swlib.xml -core

5. Ensure that ULN staging host is able to communicate with the ULN network. If proxy is required, up2date from the host needs to be configured as well. The connectivity with ULN will be detrimental for up2date –register –nox command.

6. Patch user (OS credentials used to setup the staging server) must have write permission under the agent home. Patch user must also have SUDO privilege.

Setting Up the RPM Repository

To set up an RPM Repository that downloads latest RPM packages and advisories from ULN, follow these steps.

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Setup RPM Repository.

3. On the Setup RPM Repository page, in the RPM Repository Server section, select the RPM Repository server by clicking the search icon. Select the host assigned for subscribing to ULN.

4. In the Credentials section, enter the user name and password to use. Click Apply.

5. In the Deployment Procedure submission confirmation, click Linux RPM Repository Server Setup. The deployment procedure starts a job to download latest RPM packages and Advisories from the subscribed ULN channels.

6. (Optional) If you want to change the refresh mode to 30 seconds, then from the View Data list, select Real Time: 30 Second Refresh.

7. In the Steps tab of the Status Detail section, check the status of this step. Wait till the step Installing Up2date is completed or skipped.

8. Click the status of the step Register with ULN. In the Phase Status page, do the following:

   1. Log in to the RPM Repository server machine.

   2. Configure up2date to use a proxy server, if any, by following the instructions at:

      https://linux.oracle.com/uln_faq.html - 9
      

   3. Register the host to ULN by following the steps at:

      https://linux.oracle.com/uln_faq.html - 2
      

      Note:

      While registering, you can choose the user name and password. This credential will be used to log in to http://linux.oracle.com

   4. After registering the host, select the target and click Confirm, and then click Done to go to the main flow.

9. Click the status of the step Subscribe to ULN channels. In the Phase Status page, do the following:

   1. When you register a server, it will be subscribed to a channel that has the latest Enterprise Linux packages for the appropriate architecture. To subscribe to additional channels, log in to http://linux.oracle.com after you register your system. Click on the Systems tab to manage subscriptions for each subscribed server.

   2. Subscribe either to el*_addon channel (this channel contains createrepo) or manually install the createrepo package.

   3. Type the command up2date –nox –show-channels to verify the list of subscribed channels.

10. Once the deployment procedure ends successfully, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

11. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository to verify if the ULN channels are displayed in the Cloud Control console.

12. On the Manage RPM Repository page, check if all the subscribed channels are listed and if all the packages are downloaded.

Prerequisites for Setting Up Linux Patching Group

Before setting up the Linux Patching Group, meet the following prerequisites:

• RPM Repository server must be set up or a custom RPM Repository must be set as a channel in Cloud Control.

• Yum or up2date should be installed in the target hosts.

• Sudo must be installed on the target hosts.

• You must have Operator privileges on the hosts that you want to add to the Linux host patching group.

• Patch user must have write access under the agent home. Patch user must have sudo privilege.

Setting Up a Linux Patching Group

To set up a Linux patching group, do the following:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Setup Groups.

3. On the Setup Groups page, click Create.

4. On the Create Group: Properties page, enter a unique name for the group. Select the maturity level, Linux distribution, and Linux hosts to be added to the group.

5. Click Next.

6. On the Create Group: Package Repositories page, select the RPM Repositories to be associated with the group (click the search icon to select repository).

   Select Automatically Update Hosts if you want to auto-update the host, that is, to schedule an update job (schedule specified as one of the subsequent step) to update all non-compliant packages from the selected package repository.

   Under the Package Compliance section, choose whether to include Rogue packages in compliance reporting or not.

7. Click Next.

8. On the Create Group: Credentials page, enter the host credentials or choose to use preferred credentials.

9. Click Next.

10. On the Create Group: Patching Script page, enter any pre/post patching operations to be done. This is not a mandatory step.

    Note:

    Steps (10), (11), (12), (13) will be skipped if Automatically Update Hosts was not selected.

11. Click Next.

12. On the Schedule page, set the schedule for the update job.

13. Click Next.

14. On the Review page, validate all the parameters.

15. Click Finish.

    Note:

    If you had not selected the Automatically Update Hosts option, then three jobs are submitted. If the option was selected, then four jobs are submitted. Table 25-2 explains the jobs submitted. Follow the jobs submitted by clicking the job's link.

16. From the Enterprise menu, select Provisioning and Patching, then select Linux Patching. Verify the compliance report generated. The group created will have at least one out-of-date package.

Prerequisites for Viewing Compliance History

• Ensure that you have defined at least one Linux patching group.

• Ensure that you have View privileges on the Linux host comprising the patching group.

Viewing Compliance History

To view the compliance history of a Linux patching group, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Compliance Home page, from the Related Links section, click Compliance History.

3. On the Compliance History page, the Groups table lists all the accessible Linux patching groups and the number of hosts corresponding to each group.

4. If there are multiple Linux patching groups, the Compliance History page displays the historical data (for a specific time period) for the first group that is listed in that table.

5. To view the compliance history of a Linux patching group, click the View icon corresponding to that group.

Prerequisites for Patching Non-Compliant Packages

Before patching non-compliant packages, ensure that a Linux Patching group is created and the Compliance Collection job has succeeded.

Patching Non-Compliant Packages

To patch non-compliant packages, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, in the Compliance Report section, select the Group and click Schedule Patching.

3. In the Patch Linux Hosts Wizard, provide the required details in the interview screens, and click Finish on the Review page.

4. A deployment procedure is submitted to update the host. Check if all the steps finished successfully.

Prerequisites for Deinstalling Packages

Before rolling back or deinstalling the packages, meet the following prerequisites:

• Ensure that a Linux Patching group is created.

• Ensure that the lower version of the package is present in the RPM repository.

Rolling Back or Deinstalling Packages

To roll back or uninstall the packages, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, in the Compliance Report section, select a group, and click Undo Patching.

3. On the Undo Patching: Action page, select an appropriate option:

   • Uninstall Packages, deinstalls a package.

   • Rollback Packages, rolls back to an earlier version/release of a package. To perform this operation, more than one version/release of that package should be present in the packages repositories.

   • Rollback Last Update Session, reverts the effects of the previous patch update session.

4. Click Next.

5. Provide the required details in the wizard, and on the Review page, click Finish.

6. A job is submitted to rollback the updates done in the previous session.

7. Examine the job submitted to see if all the steps are successful.

Prerequisites for Registering a Custom Channel

Before registering a custom channel, meet the following prerequisites:

• Ensure that the RPM Repository is under /var/www/html and is accessible through HTTP protocol.

• Ensure that metadata files are created by running yum-arch and createrepo commands.

• Ensure that a Management Agent is installed on the RPM repository host, and ensure that Management Agent is communicating with the OMS.

Registering a Custom Channel

To register a custom RPM Repository, follow these steps:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository.

3. On the Manage Repository Home page, click Register Custom Channel.

4. On the Register Custom Channel page, enter a unique channel name.

5. Click Browse and select the host where the custom RPM repository was setup.

6. Enter the path where RPM repository resides. The directory location must start with /var/www/html/.

7. Click OK.

   A Package Information job is submitted. Follow the job until it completes successfully.

Prerequisites for Cloning a Channel

Before cloning a channel, meet the following prerequisites:

1. Ensure that there is at least one channel already present.

2. Ensure that the patching user has read/write access on both the source and target channel hosts.

3. Ensure that there is enough space on the target channel host.

4. Ensure that the patch user has write access on the agent home. Also ensure that the patch user has SUDO privileges.

Cloning a Channel

To clone a channel, follow these steps:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository.

3. On the Manage RPM Repository page, select the source channel you want to clone, and click Create Like.

4. Enter the credentials to use for the source channel. The credentials must have both read and write access.

5. Enter a unique target channel name.

6. Click Browse to select the target host name.

7. Enter the directory location of the target channel. This directory should be under /var/www/html.

8. Enter the credentials to use for the target channel. This credential should have both read and write access.

9. Click OK.

   A Create-Like job is submitted. Follow the job until it completes successfully.

Prerequisites for Copying Packages from One Channel to Another

Before copying the packages from one channel to another, meet the following prerequisites:

1. Ensure that there are at least 2 channels.

2. Ensure that the patching user has read/write access on both the source and target channel hosts.

3. Ensure that the target channel machine has adequate space.

4. Ensure that the patch user has write access on the agent home. Also ensure that patch user has SUDO privilege.

Copying Packages from One Channel to Another

To copy the packages from one channel to another, follow these steps:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository.

3. On the Manage RPM Repository page, select the source channel, and click Copy Packages.

4. Select the target channel.

5. From the source channel section, select and copy the packages to the target channel section.

6. Enter credentials for the source and target channels. These credentials should have read/write access to the machines.

7. Click OK.

   A Copy Packages job is submitted. Follow the job until it completes successfully.

Prerequisites for Adding Custom Packages to a Channel

Before you add custom packages to a channel, meet the following prerequisites:

1. Ensure that there is at least one channel.

2. Ensure that the patching user has write access on the channel host.

3. Ensure that the patch user has write access on the agent home. Also ensure that the patch user has SUDO privilege.

Adding Custom Packages to a Channel

To add custom RPMs to a channel, follow these steps:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository.

3. On the Manage RPM Repository page, select the channel name where you want to add the RPM, and click Add.

4. Select the source target name and the credentials to be used for the host. The credentials you use must have read/write access.

5. On the Upload Files section, click the search icon to browse for the RPM files.

6. Enter the credentials to be used on the channel's host.

7. Click OK.

   An Add Package job is submitted. Follow the job until it completes successfully.

Prerequisites for Deleting a Channel

Before deleting a channel, meet the following prerequisites:

1. Ensure that there is at least one channel.

2. Ensure that the patching user has write access to delete the RPM files from the channel host.

3. Ensure that the patch user has write access on the agent home. Also, ensure that the patch user has SUDO privileges.

Deleting a Channel

To delete a channel, follow these steps:

1. In Cloud Control, from the Setup menu, select Provisioning and Patching, then select Linux Patching.

2. On the Patching Setup page, in the Linux Patching Setup tab, click Manage RPM Repository.

3. On the Manage RPM Repository page, select the channel name you want to delete, and click Delete.

4. If you want to delete the packages from the RPM Repository machine, select the check box and enter the credentials for the RPM Repository machine. Click Yes.

5. If you have not selected to delete the packages from RPM Repository machine, you will get a confirmation message stating Package Channel <channel name> successfully deleted. If you have selected the Delete Packages option, a job will be submitted to delete the packages from the RPM Repository machine. Follow the job until it completes successfully.

Prerequisites for Uploading Configuration Files

Before uploading configuration files, ensure that there is at least one configuration file.

Uploading Configuration Files

To upload configuration files, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, click the Configuration Files tab.

3. In the Configuration Files tab, select the configure file you want to upload, and click Upload Configuration Files.

4. Select an appropriate upload mode. You can either upload files from local host (where the browser is running) or from a remote host (agent should be installed on that host and that agent should be communicating with this OMS).

5. In the File Upload section, enter the file name, path where the file will be deployed in the target host, and browse for the file on the upload host.

6. For uploading from remote machine, click Upload from Agent Machine. Click Select Target and select the remote machine.

   Before browsing for the files on this machine, set preferred credential for this machine.

7. After selecting the files, click OK.

   You will see a confirmation message that states that files have been uploaded.

Prerequisites for Importing Configuration Files

Before importing configuration files, ensure that there are at least two channels.

Importing Configuration Files

To import configuration files, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, click the Configuration Files tab.

3. In the Configuration Files tab, select the source channel, and click Import Files.

4. Select the target channel.

5. From Source channel section, select the files and copy it to the target channel section. Click OK.

   You will see a confirmation message stating that the selected files have been imported successfully.

Prerequisites for Deploying Configuration Files

Before deploying configuration files, meet the following prerequisites:

• Ensure that the patch user has write access on the agent home. Also ensure that the patch user has SUDO privilege.

• Ensure that there is at least one channel with some files uploaded.

Deploying Configuration Files

To deploy files, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, click the Configuration Files tab.

3. In the Configuration Files tab, select the source channel, and click Deploy Files.

4. In the wizard that appears, select the files you want to deploy, and click Next.

5. Click Add to select the targets where you want to deploy the files.

6. Enter the credentials for the selected targets.

7. Enter the Pre/Post scripts you want to run before or after deploying the files.

8. Review the deploy parameters and click Finish.

   A deploy job is submitted. Follow the job's link until it completes successfully.

Prerequisites for Deleting Configuration File Channels

Before deleting a configuration file channel, ensure that there is at least one configuration file.

Deleting Configuration File Channels

To delete a configuration file channel, follow these steps:

1. In Cloud Control, from the Enterprise menu, select Provisioning and Patching, then select Linux Patching.

2. On the Linux Patching page, click the Configuration Files tab.

3. In the Configuration Files tab, select the channel, and click Delete. Click Yes.

   You will see a configuration message stating that the channel was successfully deleted.