Patches - just for discussion

[Lai Nee Shyang_1]

Hi there,

I'm getting phobia when my HP ASE bug me about applying patches on the systems. There seems to be endless patches to be apply. True that there are always improvements and bug fixes, but the sheer volumes of patches is sometime too much to handle (29 pages of A4) and I always wonder if it is really life and death matters if patches aren't apply. Sometimes I feel like I'm being threaten that if patches are not updated regular, its my responsiblity if systems fail. : (

Another matter abt patches is that the swinstall always leave my /var directory bloated. I've tried all means of moving some of the sw directories away to other filesystems,But I still face /var directory size problem with systems having limited storage.

I wonder anyone out there share my view or have some ways to get out of this messy stuff.

Cheers


Lai

[Hartmut Lang]

My policiy is:
- update to the latest Quality/Patch-Bundles once or twice a year.
- if there are problems to solve, install the related patches.
- without problems, do not install patches.

But i know this will be a long discussion. Because every system/environment has its on requirements, regarding stability, uptime, performance, new features, ...

So there will never be an overall valid answer to your question.

[Alexander M. Ermes]

Hi there.
Yes, i share your view in most points.
Problem is, you have to install critical patches. These patches rely on a lot of other patches and so on and so on.
Just a hint for your directory /var :
create a directorx 'save' in a different filesystem and move the contents of /var/adm/sw/save to this directory.
if /var/adm/sw/save is empty, remove it and create a softlink to the new save directory.
Rgds
Alexander M. Ermes

[Lai Nee Shyang_1]

Hi guys,

I've done the moving and softlink part, but on some of the smaller systems. I even run of place to store the sw/save other than /var. Is it all right to arhcive them on tape to free up the /var directory. I think it is crazy to let swinstall keep bloating the systems with the patches files without any form of archiving strategy.

Cheers

Lai

[Hartmut Lang · Accepted solution]

If disk space is a problem:
you can use the "cleanup" command to get rid of superseded patches.

Or - if your situation allows it - create an empty file named /var/adm/sw/patch/PATCH_NOSAVE. Your superseded/original software will not be saved. You save some disk-space, but you can not uninstall the patches again.

[T. M. Louah]

Generally, you will need to patch if you are installing a new component (lan Card, FC card ..) or a new version of a software (File system related .. ), or your application Vendor recommend a specific patch(es) or patch bundle prior to installing his database. I could go on ..! but certainly you have some investigation to do on patches, their rating ! what HP says about it, what others (3rd party) recommend. A good place to try is http://us-support.external.hp.com/common/bin/doc.pl/sid=77b639fa0abfa7f2e6/screen=commonHome.
Good luck

[Animesh Chakraborty]

Hi,
Even after updating your server with all latest patches you are not done!!!

In my case when our V-clas crashed HP told that we need 'site specific patch', meaning, specifically write a patch for us to address this problem.
I have seen in many company one sys admin is dedicated for patch management only.Think of that poor guy!

[James R. Ferguson]

Hi Lai:

A very sound, safe practice is to use the SupportPlus Quality Pack (QPK) [formerly the General Release (GR)] patch bundles on a regular basis.

The QPK bundle is a rigourously tested and certified set of patches issued about every quarter. Designed for 11.x, it includex all stable defect-fix patches for core HP-UX, graphics and networking drivers. HP thoroughly tests each Quality Pack and requires that it pass the same tests as would a new HP-UX operating system release.

For 10.20, use the GR bundle, offering the same quality control.

These bundles will generally contain the best patches within about 2-months of the bundle release date.

For more information on SupportPlus, in general, see this link:

http://www.software.hp.com/SUPPORT_PLUS/

Go to Maintenance and Support -> Downloads & Licensing (Standard Patch Bundles) -> View SupportPlus Releases before you load a bundle to see if there are any patch recalls and/or superseded patches for the bundle you wish to use.

Regards!

...JRF...

[James R. Ferguson]

Hi Lai (again):

With regard to disk space management, *always* abnd *only* use 'cleanup' to mangage the '/var/adm/sw' directory. Doing otherwise can lead to a system that can no longer be patched.

The 'cleanup' utility trims the 'sw' log files and is a front-end to 'swmodify' for committing patches.

For 10.20, you can do:

# cleanup

For 11.x, you can do:

# cleanup -c 1

The QPK or GR bundles I described in my previous post will offer 'cleanup' as a patch if you don't already have it on your system.

Regards!

...JRF...

[John Payne_2]

We never used to patch our boxes unless it became absolutely necessary. (Like Y2K. haha.) I eventually got tired of having problems with the older systems crashing, etc, and when the sys. interrupt team looked at the crash, they would ask for like 20 patches to be applied to a box. (And then you have to apply 40 to get dependencies.) It seemed at times like they were asking for patching 'for patching's sake' It was a pain in the rear looking for 20-40 separate patches. So I decided to make a change and create a patching policy. That way, we get the best patches, (like JRF mentioned) and it is nice to at least have the box patched when something goes wrong.

What I do now is apply the latest patch set on a development or staging machine as soon as I get the disk in my hands. (I'm talking about the Support plus CD's.) Sometimes I can get the application's guys in a good mood and get the bundle on 4 or 5 boxes right away. Then I let the patch bundle "burn in" for 3 months. At that point I am already confident in the 3-month-old patch set, and apply it into production. Then a few days later, I get the new patch bundle and start all over again.

I use the 'cleanup -c 1' on the production machines, and the 'cleanup -c 2' command on the development machines. This ensures that if I have a bad patch that made it into production, we can get it off everywhere.

BTW, cleanup -c 1 will remove the saved files from all patches superseeded at least once. cleanup -c 2 will remove the saved files from patches that have been superseeded twice. (two levels of superseeding)

I agree with JRF, don't play with the location of the saved files or patch directories. You are asking for more troube than it is worth. If you have made it a habit of patching, but do not use the cleanup command, it can make a whole world of difference to start using the cleanup command.

John