Patch clusters

I see separate clusters on the recommended ant security website for solaris 8 (regular and J2SE) If I'm runnung Java2E should I still apply both clusters or just the cluster for J2SE. If I need to install both, which order should they be installed in?
Thanks,
Sean Jaehne

I don't think the order matters, although personally, I would do the Recommended cluster first.
A lot of the patches in the J2SE cluster are also included in the Recommended, so you'll see some "error 2" messages when running the second cluster.
You can check the README files for both. They list the pacthes each cluster has.
http://patches.sun.com/clusters/8_Recommended.README
http://patches.sun.com/clusters/J2SE_Solaris_8_Recommended.README

Similar Messages

How can I do "pkgupdate" and/or create private patch clusters?

I hope this is the right forum for this post :)
I maintain a number of Solaris 8-10 systems which are automated by my scripts
(i.e. for dumping data to a backup server, watchdog the services, start up portal
services, etc.)
Long ago I made my life easier by creating such scripts; then I made it easier by
packaging these scripts into thematic Solaris packages (as in pkgadd/pkgrm).
Since this concerns maintaining older systems, references to the new OpenSolaris
Indiana Packaging System are not interesting.
Now I want to simplify maintenance and update of such packages by building a
patch cluster of them. In short, there should be one archive to copy to all these
servers and one command to run (i.e. patchadd), and it should reinstall only(!)
those of my script packages which are already installed.
An interim solution would be to come up with a sort of "pkgupdate" utility which
REinstalls only the existing package instances which are older than the one I
currently provide (perhaps someone can share a pkgadd admin file with options
to force such behavior?)
I guess I can script up another solution for this automation as well, but I wonder
if this wheel is already invented? It actually is, with the Sun-provided patch clusters
proving that, but I've not seen any tools to create such clusters myself :)
This is particularly important while maintaining a Solaris 10 system with lots of
Solaris zones. Having different tasks, these zones are configured with different
sets of my packages. Simply running pkgrm/pkgadd in the global zone would
result in all zones having all of these packages, and I don't want that since I
believe in specialization and minimization. And checking each zone is rather
tedious, there's lots of them.
Looking forward to constructive suggestions,
//Jim
Edited by: JimKlimov on Dec 2, 2008 7:47 PM

Can you expand on that? How do you use automator in your game? Can you give me a rough idea of how and what you do with it? I have watched a tutorial on Automator and it seems more useful for documents.

Recommended Patch Clusters and Zones

Good Afternoon,
Ran into a problem earlier this week and wanted to get other views on this. Our current configuration is as followed:
Global zone installed on Local Disk (ZFS)
5 - Non-global whole root zones installed on SAN disk (ZFS)
No Live Upgrade (Will eventually get to this)
Never have had any problems until I attempted to install the latest Patch Cluster because of Comms Suite 7. I shutdown all of the non-global zones and shutdown the Global zone to init S. I then started my Patch Cluster install. The Patch Cluster appears to start all of the zones up in an Administrative Mode for patching. The problem was that when it go to the kernel patch, 141414-10, it appeared to install in the Global but none of the non-global zones were updated. The Patch then stopped on 141414-10 (Patch 109 of 155). I did finally get the patch cluster to install after some work and a support call.
My question is this the proper way to install the Patch Clusters? I've been told that you have to "mount" the zones manually but wouldn't that defeat the purpose of being single-user?
Any help is appreciated.
Doug

I tend to use LU to create a new BE and then patch that. Then activate the new BE and reboot.
Saves a lot of pain and gives a safe fall back option.

Understanding Patch Clusters

I'm wondering if anyone has looked at the various patch clusters available on Sunsolve in detail:
e.g. For Solaris 10 SPARC there's the following:
     Solaris 10 SPARC 05/08 Patch Bundle Chunk 1/2/3
     Solaris 10 Sun Alert Patch Cluster
     Solaris 10
The first one supposedly brings you up to date as per the 05/08 media. It's the other two I'm puzzled about. The latter one is the "recommended" patch cluster and the definition of this is almost exactly the same as the definition for the Sun Alert Patch Cluster - and I believe there is a possiibility that these may be combined in future?
Anyway, digging deeper - the 2 clusters each have 119 patches included, and the only difference I can see is that despite both clusters being dated Sep 2008, the Recommended cluster has latest revisions of each patch whereas the Sun Alert one has many which are many revisions obsoleted (cf 118712-22 vs 118712-08).
This is backed up by the fact that the Sun Alert cluster is considerably smaller that the recommended one.
Anyone understand why there are these discrepanices?
Regards,
GXW

Thanks. That's a lot clearer now - so they do contain the same patches - the alert bundle contains the minimum level of each patch which fixes a know alert - and the recommended bundle contains the highest available versions of those patches.
Can I ask a follow-up question? If I do a "smpatch update" with my patchpro.patchset set to "current", which of the 3 patch bundles listed in my original post does this equate to?

Lagacy Patch Clusters or Patches

I am looking for patches for Solaris 2.5 and 2.6, are patch clusters available for these versions?
Regards,
Brian Borders

I don't think the order matters, although personally, I would do the Recommended cluster first.
A lot of the patches in the J2SE cluster are also included in the Recommended, so you'll see some "error 2" messages when running the second cluster.
You can check the README files for both. They list the pacthes each cluster has.
http://patches.sun.com/clusters/8_Recommended.README
http://patches.sun.com/clusters/J2SE_Solaris_8_Recommended.README

Does patch clusters contain all old patches?

Suppose I have a system installed long ago, that has never been patched. If I install only the latest recommended and security patch cluster, will I then get all recommended and security patches?
Or will there be recommended and security patches missing because I have failed to install earlier patch clusters?
/Lars

Hello Lars,
This forum is for the support of the Sun Update Connection product only. As such we are not the correct forum for questions of this type.
However if you install the latest patch cluster this will contain all the most recent security patches, which will either include or obselete the previous patches.
Regards,

Where are older Recommended Patch Clusters located?

My project is spec'd to use the June 2009 Recommended Patch Cluster release, but I can't find the previous patch cluster releases. Is there anywhere on the Sun site that I can find the older patch clusters?

I ended up calling out Sun support, and after about a week he got back with us and said that although usually such a patch is available on a DVD he recieves every month, the June 2009 DVD was pulled due to "quality issues". Thank you both for your support.

Patch clusters and what they break.....

Hi,
Just wondering if anyone knows if Sun keeps a list of what their clusters break anywhere. I have not had 1 patch cluster yet that didn't re-write a conf or break some sort of dependancy / app.
It would be really handy to know before hand what to backup instead of everything. (local support for the latest cluster advised "3 things break but we don't know what they are" !)
Cheers,
Harv

My only problem with Patch 3a are crashes
but comparing with Patch 1, they were
substantially reduced. After 5 weeks I have
not seen any GUI or PL/SQL problem. I think
Oracle should stop adding functionalities
and concentrate on stability. To be honest
it is the best tool for database applications
far more productive than any other tool I
have seen, including Java, not to mention
runtime performance and functionalities. But
this stability problem exists for many years
and I wonder why Oracle doesn't solve it
once for all...
null

How to patch clustered SOA domain keeping the domain running?

Hi All,
We want to patch SOA 11.1.1.3.0 to SOA 11.1.1.6.0. The SOA 11.1.1.3.0 environment is a clustered environment( 2-node cluster). Also database schemas are present in RAC database.
I know the patching process but my concern is I have to patch production environment and we have to minimize the downtime. Can we patch a WebLogic + SOA domain keeping the environment running ?
Please suggest.
Regards,
Roshni Shankar

Hi Roshni,
Check this:
http://docs.oracle.com/cd/E16764_01/core.1111/e10106/busreq.htm
It says, During the rolling patching of a cluster, each server in the cluster is individually patched and restarted while the other servers in the cluster continue to host your application
Always keep a backup before applying a patchset to your environment.
Thanks,
Sharmela

Jumpstart/JET - How to maintain multiple versions of patch clusters

Is there a way to maintain multiple versions of the recommended patch cluster with JET? Since Sun uses the same filename (10_recommended.zip) but releases several versions over time, its hard to keep new systems at the same baselines as ones built previously. So when I download a patch bundle I always rename it to the date downloaded (ie 10_Recommened_10SEPT2010.zip) Is there a way to integrate this into JET?
Thx,

when you are talking about versioing , starting form XI 3.1 SAP business objects released the BusinessObjects LifeCycle Manager for XI 3.1
find more details here
http://help.sap.com/businessobject/product_guides/boexir31/en/xi31_LCM_User_en.pdf
good luck
Amr

Solaris 10 patch clusters

I'm sorry if this is in the wrong forum, but I didn't see a better/more relevant spot for it.
Is there a way to download the Solaris 10 without having a SunSolve account? When I tried to download it I get redirected to a login/register page which requires a SunSolve support contract.
Thanks in advance for any help you can offer.
-Will

Hello Will,
To download a Solaris 10 patch cluster a service contract is required. There are no alternate sources !
Individual patches that fix security issues or patches required by these (security) patches are available for <b>free</b>.
Michael

Best Practices for patching Sun Clusters with HA-Zones using LiveUpgrade?

We've been running Sun Cluster for about 7 years now, and I for
one love it. About a year ago, we starting consolidating our
standalone web servers into a 3 node cluster using multiple
HA-Zones. For the most part, everything about this configuration
works great! One problem we've having is with patching. So far,
the only documentation I've been able to find that talks about
patch Clusters with HA-Zones is the following:
http://docs.sun.com/app/docs/doc/819-2971/6n57mi2g0
Sun Cluster System Administration Guide for Solaris OS
How to Apply Patches in Single-User Mode with Failover Zones
This documentation works, but has two major drawbacks:
1) The nodes/zones have to be patched in Single-User Mode, which
translates to major downtime to do patching.
2) If there are any problems during the patching process, or
after the cluster is up, there is no simple back out process.
We've been using a small test cluster to test out using
LiveUpgrade with HA-Zones. We've worked out most of bugs, but we
are still in a position of patching our HA-Zoned clusters based
on home grow steps, and not anything blessed by Oracle/Sun.
How are others patching Sun Cluster nodes with HA-Zones? Has any
one found/been given Oracle/Sun documentation that lists the
steps to patch Sun Clusters with HA-Zones using LiveUpgrade??
Thanks!

Hi Thomas,
there is a blueprint that deals with this problem in much more detail. Actually it is based on configurations that are solely based on ZFS, i.e. for root and the zone roots. But it should be applicable also to other environments. "!Maintaining Solaris with Live Upgrade and Update On Attach" (http://wikis.sun.com/display/BluePrints/Maintaining+Solaris+with+Live+Upgrade+and+Update+On+Attach)
Unfortunately, due to some redirection work in the joint Sun and Oracle network, access to the blueprint is currently not available. If you send me an email with your contact data I can send you a copy via email. (You'll find my address on the web)
Regards
Hartmut

Critical security patches on Solaris 9

Hi.
My director asked me to install critical security patches on our solaris 9 servers. Previously I downloaded that 9_recommended patch from sunsolve.com and install the whole patch clusters. My question is how can I ONLY get all those patches which are critical to the security issue? The recommended patch cluster includes a lot patches which are not relevant to security.
BTW, does anybody know some autopatching tools?
Thank you very much!

PatchPro is probably what you want. It should be available at
http://sunsolve.sun.com
-- richard

Management console problem after installing recommended patch cluster

Hello everyone.
I just got a new SUN 440 server, it didn't come with the solaris os installed and so I installed solaris 9 12/03 to it. The installation went fine and I could start the management console with no problems at all. Then I went to sunsolve.sun.com to download the latest recommended patch clusters for solaris 9 (this was yesterday Sept.-06-2006), I downloaded the file, checked it with md5sum, unzipped it, went to single user mode and ran the install_patch script. After the patch cluster finished installing I rebooted the server for the patches to take effect, I logged in, tried to run console management 2.1 and it starts OK but I cannot use any services it offers because it says (in the console events):
"Server Not Running: no solaris management console server was available on the specified server. Please ensure there is a Solaris Management Console server available on the specified host and that it is running"
When I click on "See Exception" I get (for a particular service that is... in this case com.sun.admin.fsmgr.client.VFsMgr - for managing file systems):
java.rmi.RemoteException: Server RMI is null:
at sun.com.management.viperimpl.client.ViperClient.lookupServer(ViperClient.java:376)and so on...
I already checked that the service is running on port 898 and it seems that there is no other app. using that same port. I also restarted the service using /etc/init.d.init stop/status/start but I get the same results.
I don't know solaris very much and don't know what else to do, please help.
Thanks in advance.

Well, I guess what you see isn't what you get.
Guess I'm used to the fact USENET just left things formatted the way they were :-O

Patching 8, 9 & 10 without internet connection

Hi
I'm looking to automate and manage Solaris patching for a large number of Solaris systems. The OS on these systems range from 8, 9 and 10.
The systems sit within a secure domain and have absolutely no connection to the internet ... there is a physical air gap between the network and the internet.
What I would like to do, is build a central patch manager server that I can populate manually ( via DVD for example) patches. Clients would then interrogate this system for patches, install those appropriate, and reboot (if required) at a predefinied time.
Is this possible with the latest supported tools?
If it is, can I just populate my my patch server with patch clusters off Sunsolve, or do they have to be delivered in some other form.
This could be the difference between my high level management staying with SUN or moving to HP entirely.
Many thanks
Andy

Hi Andy,
A draft solution is as follows:
Have one server working as NFS server. This is will be your patch server.
All other servers will be NFS client.
On NFS server:
- share via NFS a directory, let's say /export/patch.
- periodically (you decide the frequency), load Solaris 8, 9 & 10 recommended patch clusters on /export/patch.
- write a script, let's say script1, that contains all the intelligence to patch a server. Store script1 in /export/patch.
On NFS client:
- create a script that does the following:
. mount /export/patch from NFS server in /mnt
. run /mnt/script1
. umount /mnt
. reboot the server (if you are applying recommended patch cluster it is guaranteed that you will need to reboot the servers).
- make the script a cronjob to run every saturday (or any other frequency you like)
Another solution, the one I have in my company is
- All servers are behind corporate firewall.
- one server has sunUC proxy server installed. This is the only server allowed to connect to Internet.
- all other servers have sunUC client installed.
The patching on all servers is done the way I described above, except the servers get their patches via the sunUC proxy server. No need to load manually Solaris patch clusters.
Hope this helps.

Patch clusters

Similar Messages

Maybe you are looking for