Patch Management

[Mike Duffy]

Morning,

I have been tasked with the following;

1. Detail listings of all patches on each server.
2. Details of missing patches.
3. Required patches.

Anyone got any ideas?

[Stuart Browne]

What do you mean 'patches'?

Do you mean udpated software packages?

Which distribution are you using?

In the RedHat world, this sort of thing is handled by RHN and 'up2date'. Of course, up2date requries Internet access.

If you're in an Advanced Server network, you have the ability to use your local servers as a distribution point for the RHN.

As for getting lists of installed software, 'rpm -qa' is where you look, but this is a very messy way of trying to get up-to-date lists of installed packages.

[Steven E. Protter]

You sound like an HP-UX admin who's wants the Linux equivalent of swlist.

Sorry, Linux doesn't work like that though the update tools are pretty slick.

Even with rpm queries you are not going to get a current list, because this does not cover stuff you've installed and compiled off tarball or other compressed format.

BTW, HP-UX swlist doesn't show those installs better.

Red hat dosn't really use patches the HP does.

If sendmail 8.1.2 has a problem, Red Hat will put up the next version in rpm format for either downland and install(rpm -i filename).

The installation whichever way you do it will replace sendmail 8.1.2 with the newever version.

SEP

[John de Villiers]

You can also try installing red-carpet. It has support for more products that what RHN does. It will give you a list of what you currently have installed ( it its a product that red-carpet lists ) and provide you with updates if needed.

[dan dobbs]

If you want a list of 'patches' that haven't been installed (and you're running Red Hat), try up2date. Up2date is the free upgrade tool from Red Hat, and it will not only tell you what new packages are out, but it will download and install them, too. Up2date -l shows a 'list' of possible updates. Here's my monitoring box (it's already patched up, except for the kernel):


[root@obiwan root]# up2date -l

Fetching package list for channel: redhat-linux-i386-7.2...
########################################

Fetching Obsoletes list for channel: redhat-linux-i386-7.2...
########################################

Fetching rpm headers...

Name Version Rel
----------------------------------------------------------

The following Packages were marked to be skipped by your configuration:

Name Version Rel Reason
-------------------------------------------------------------------------------
kernel 2.4.18 24.7.xPkg name/pattern
kernel-source 2.4.18 24.7.xPkg name/pattern

None of the packages you requested were found, or they are already updated.
[root@obiwan root]#


Good luck!

-dd

[Christopher C. Weis]

If you're using an RPM-based distro, and you're not worried about "non-RPM" stuff, then the "rpm" command-line tool is your friend.

Download ALL of the latest and greatest updated packages from your distro., 'cd' into the directory(ies) where the updates are at, and do a "rpm -Fv --test *.rpm". This will take a little while, but it will give you a list of every RPM that is out of date. MAKE SURE you pass it the "--test" option, of you'll actually start patching things. If you put all the patches on an NFS server somewhere, you can script this process on every machine (and actually patch things much easier)

"rpm" also has the "--queryformat" option, that allows you to specify exactly what you want to know about a package. For you, something like the following might be useful...

rpm -qa --qf "%{NAME}\t%{VERSION}\t%{RELEASE}\n"

This will give you a nice parseable output that you can feed into something else to do the version comparison.

It's too bad "rpm" doesn't get more publicity. It's a very powerful tool.

I hope this helps.

~Chris