Managing Patch Jobs for Linux Assets

Patch Management allows you to deploy patch jobs on Linux assets. You can use a single job to deploy a single patch on multiple assets, multiple patches on a single asset, and multiple patches on multiple assets. You cannot target Windows and Linux assets in a single job. For security purposes, the Linux patches are downloaded manually and stored in a shared folder that must be accessible through a mounted directory on each server. This shared directory helps reduce the traffic, ensure that the file integrity and is only exposed to selective servers. The patches are transferred to the repository only after successful assessment on the staging server. We recommend fetching the patch installation files directly from the vendor to assure authenticity and integrity.

Supported Versions

- RHEL 6, 7, and 8

- CentOS 6 and 7

Consider this!

  - On the Assets tab for Linux, you cannot view the agent scan status based on the vulnerability scan. Agent scan date would be the date of latest vulnerability scan on an asset.

 - You cannot create widgets that show Linux patches or assets data for Unified Dashboards.

 - Superseded patches are not applicable for Linux.

 - You cannot enable the opportunistic patch download to allow the Cloud Agent for Linux to download the required patches before a scheduled job run begins. The patches must be stored in a repository at a predefined location which is accessible to each asset.

 - You can only create deployment jobs for Linux assets. Uninstall jobs are not applicable for Linux assets.

 - While creating a Linux deployment job, if you select an asset tag that includes Windows and Linux assets, only Linux assets will be added for the job.

 - Job title for each job must be unique. You cannot have the same job title as a Windows job. For example, if a Windows job titled Security Patches is created, you cannot have a Linux job titled as Security Patches.

 - If a deployment job contains multiple OS patches, then only the job assets with specific OS will have applicable patches installed. For example,

- A job that has a mixed set of patches i.e. both RHEL 6 and RHEL 7, but only RHEL6 assets, in this case, the status for RHEL 7 patches will be displayed as Skipped.

- A job that has RHEL 6 patches and also has RHEL 7 assets, in this case, no manifest will be sent and status for asset will be shown as Not Applicable.

Prerequisite

- You must install the Cloud Agent for Linux on each of your Linux assets before you can deploy patch jobs.

- Ensure that the patches that you want to install are available in the agent-side repository for respective OS on the asset during the job execution. This configuration must be setup at the OS specific setting and not specific for Patch Management.

Creating Patch Job for Linux Assets

1. Navigate to Jobs  > Linux and then click  Create Jobs.

2. On the Basic Information page, enter a job title and description and then click Next.

Basic Information

3. (Optional) Select Add Exclusion Assets check box to exclude specific assets from the deployment job.
Note: You can include and exclude maximum 50 assets from a job.

Exclude Assets

Note: Based on the selected options, the final list of assets is calculated taking into consideration included and excluded assets tags and included and excluded assets.

4. Select assets or asset tags on which you want to apply patches and click Next.
Note: You can include and exclude maximum 50 asset tags from a job.

Select Assets

5. (Optional) If you want to exclude the assets with All and Any tags from the deployment job, select the Add Exclusion Asset Tags check box and then select one of the following options and click Next.

- Any – to include assets that have any of the selected tags
- All – to include only those assets that have all the selected tags 
The patches are deployed on the selected tags only for assets that are contained in the user's scope.

Note: To understand how final assets are determined for a job, see Which Assets are Included for a Job.

6. On the Select Patches page, click Take me to patch selector.

7. Select one or more patches, click Add to Job and then click Close.
Note: You can only add 2000 patches to a single job.

8. On the Select Patches page, click Next.
Note: Ensure that the selected patches are available in the agent-side repository during the job schedule.

Select Patches

9. On the Schedule Deployment page, select one of the following options and click Next:

 - On Demand – to install the patches immediately once the job is created and enabled.
- Schedule – to install the patches at a specified time, set the start date and start time. You can schedule a job to recur daily, weekly, or monthly. For more information, see Scheduling Jobs.

Schedule Deployment

10. Set your Reboot Communication options and click Next.

The Continue patching even after a package fails to install for a patch option ensures that if one of the packages for the patch fails to install, an attempt to install other packages is made.

Reboot Options

11. On the Job Access page add the co-author who can edit the job and click Next.

Job Access

12. On the Confirmation page, review the settings and click Save to create the job or click Save and Enable to deploy the job immediately.

Confirmation Screen

Scheduling Jobs

Enabling or Disabling Jobs