How long do you keep patch software?

[James Brand]

How long do people keep the patches in /var/adm/sw/save (or /var/adm/sw/patch for HP-UX 10.20)? This is for backoff purposes which we hardly ever do, especially after a week or two. Yet we never delete these except the superseded ones with a % in front. Some of our servers have 500 MB in this directory. Does it seem reasonable to delete the patches over six months old?

Thanks in advance,
Jim

[John Poff · Accepted solution]

We keep ours for a year and then delete them. We patch quarterly, so that keeps the last four rounds of patches for us. Six months is probably plenty of time to save them.


JP

[A. Clay Stephenson]

HI James,

First, NEVER delete without using one of the
software tools. The best utility is 'cleanup' and it will remove the software in a safe manner and allow you to keep as many past revisions as you like. For my purposes, I've fould that 1 previous revision is sufficient.

I typically install the General Release first on a sandbox. Test it there and then after about 2 weeks move to test environment and finally when scheduling permits, move the patchset into production. Using that scheme, 1 revision back has never failed me and it is very rare that I have ever had to roll a patch back out.

My 2 cents, Clay

[James R. Ferguson]

Hi James:

As Clay said, use *ONLY* the 'cleanup' utility to manage /var/adm/sw. Failure to do otherwise can lead to a system that cannot be patched!

On 10.20, use run 'cleanup' without any options to leave one level of superseded patches available for reinstatement.

With 11.x, you can choose the depth to which you keep superseded patches. This is controlled by the '-c' option of 'cleanup'.

One method of managing patches is to do the cleanup *before* you start your next patch application.

...JRF...

[Sachin Patel]

That is great guys. I didn't know about this cleanup things. I generally remove from /var/*.
Thank God I am not in trouble yet.

Sachin

[John Poff]

Hello,

Just to clarify my previous post, 'delete' probably wasn't the best word to use. When I 'delete' patches I'm actually doing an 'swmodify -x patch_commit=true' on the patch. Of course, Clay and James are correct [ as usual :-) ]. It looks like you could just go into /var/adm/sw/save and start rm'ing things, but you can't. You've gotta use 'cleanup' or 'swmodify'.

JP

[Deshpande Prashant]

HI
I use the cleanup utility to comit the patches that are atleast twice superseeded. Some time I commit the patch that's once superseeded and is taking more space (aprox.>20MB)using swmodify command. The only reason to keep old patches is in case you need to remove the it. (eg. Patch being recalled by HP).
Thanks.
Prashant Deshpande.

[James Brand]

Thanks for all of the responses but I'm a little confused. The man page on cleanup only refers to depots. I'm concerned with the rollback files in /var/adm/sw/save. Am I missing something here?

[Deshpande Prashant]

Hi
You can use the cleanup utility on system as well as depot.
#cleanup -p -c 2 -d @ will list all patches superseeded twice, on given depot. If you omit "-p" option then same will be commited.

#cleanup -p -c 2 will list patches superseeded twice on system.

Thanks.
Prashant Deshpande.

[James R. Ferguson]

Hi (again) James:

Make sure you have the latest 'cleanup' patches:

For 10.20: PHSS_20824
For 11.0 : PHSS_24347

'cleanup' will recover space in /var/adm/sw/save appropriately.

...JRF...

[John Poff]

James,

The patch files you see in /var/adm/sw/save are the files the system would need to roll back the patches. When you put a patch on an HP system, 'swinstall' will save the patch files by default. If you are convinced you won't have to rollback a patch, you use 'swmodify' to committ the patch, which puts it into a 'Committed' state and removes the files from /var/adm/sw/save.

Here is a sample command line I would use to commit patch PHKL_20163:

swmodify -x patch_commit=true PHKL_20163.\*

If you have a bunch of patches to do, you can put it into a loop. I usually do a long listing in /var/adm/sw/save by date, see how many patches I need to commit, and do something like this:

for f in $(ls -rt | head -47); do print $f; swmodify -x patch_commit=true $f.\*; done

That's how this poor sys admin does it. I'll bet there are slicker ways to do it. Maybe somebody will post some.

JP

[James R. Ferguson]

Hi (once more):

...sorry, the latest 'cleanup' patches are *PHCO* as:

For 10.20: PHCO_20824
For 11.0 : PHCO_24347

Again, for the most functionality, make sure to download and apply these!

...JRF...

[James Brand]

Thanks again to everyone.