Re: pca install features vs. smpatch

Neal A. Lucier wrote:
One nice feature of smpatch on Solaris 10 is that on the next reboot all the patches disallowed by the patch policy (reboot immediate, single user, etc.) are automatically applied as the system is coming down.

I'm not a big fan of that feature, mainly for two reasons:

I want to have close control over patch installation. If I decide to install (a subset of) patches in single user mode, I will do that manually. A system starting to install patches automatically during a reboot just doesn't make me feel comfortable.

There have been (and still are) a lot of patches with wrong patch properties (reboot, reconfig, etc.). Knowing that I can't trust this data, I wouldn't trust automatic patch installation either. An example from today is patch 121580. It only installs two header files (*.h). Still, in rev 01 it was tagged to require a reboot, and in rev 02 it's tagged to be installed in single-user mode.

I'm ass-u-me'ing that pca only has different logic from smpatch to determine which patches in which order need to be applied, but that it uses the standard Sun tools to actually apply the patches, thus people using pca still get the afore mentioned nice feature.

Only partly correct. pca does use standard Sun tools to install patches, namely patchadd. The deferred patch installation is a feature of smpatch, though, which is *not* used by pca. So - no, you don't get this feature with pca. I've thought about implementing it in the past, but as pca would have to install a script in /etc/init.d/ (or an SMF service) I never did. I can think of too many things that could go wrong, and it's against pca's principle of not modifying the system whenever possible.

The recommendation for pca is one of these:

Download all patches with "pca -d", reboot to single user mode, and install all patches with "pca -i". Then do another reboot. This is the safest method.

Install all patches in multi-user mode, and reboot afterwards. I've done that for years, and never had a problem. Still, I wouldn't do that on my most important production servers, probably.

Download all patches but only install those that don't require a reboot with "pca --noreboot -i". Then reboot into single user mode, and install the rest with "pca -i". This is similar to smpatch's feature of deferred patch installation.

hth,

mp.
--
Systems Administrator | Institute of Scientific Computing | Univ. of Vienna
| http://www.par.univie.ac.at/solaris/pca/
Patch Check Advanced | Analyze, download and install patches for Sun Solaris
.

Relevant Pages

  • Re: MS03-026 - are you patched? Windows Update isnt sure!
    ... registry checks to determine if a patch is installed on a given machine. ... Many patches install a registry key to indicate that they have been ...
    (NT-Bugtraq)
  • Re: This is Why Consoles are More Popular than PCs for Gaming
    ... Just remembering you needed that faithful floppy disk to install SATA ... > patch downloaded, well the patch took *forever* to install. ... You download patches every time? ... still have patches for games I have uninstalled on CD. ...
    (comp.sys.ibm.pc.games.action)
  • Re: Patching Solaris 9 systems to "current"
    ... Would it be best/safest to get a support case with Sun and ask for the last recommended patch cluster, and just install that? ... The main thing I'm looking for is "safety", by which I mean minimizing the possibility of trashing any of these systems, since all of the people who were involved with the original deployment are apparently long gone:(. ... I'd *strongly* suggest that you make a backup of the system disk on each machine before applying ANY patches! ...
    (comp.unix.solaris)
  • Re: Sun Solaris login bug patches out
    ... Sometimes the patches are not needed, ... don't require a reboot after installation. ... if you have to wait for the regular scheduled time to install ... an important patch, that may make matters worse also -- being a slave to ...
    (Focus-SUN)
  • Re: Patching Solaris 9 systems to "current"
    ... Would it be best/safest to get a support case with Sun and ask for the last recommended patch cluster, and just install that? ... I'd *strongly* suggest that you make a backup of the system disk on each machine before applying ANY patches! ... Load all the patches onto your patch server and have the other machines grab them over the network. ...
    (comp.unix.solaris)