Patch Management using Dell Management Console v1.0 Dell Technical White Paper By Abhijit Pathak Dell Product Group - Enterprise
Revision History Version Date Description Author(s) 1.0 13 April 2009 First Version Abhijit Pathak THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND TECHNICAL INACCURACIES. THE CONTENT IS PROVIDED AS IS, WITHOUT EXPRESS OR IMPLIED WARRANTIES OF ANY KIND. Dell, the DELL logo, PowerEdge, PowerVault, and Dell EqualLogic are trademarks of Dell, Inc.; Microsoft is a registered trademark of Microsoft Corporation in the United States and/or other countries. EMC, CLARiiON, and UltraFlex are trademarks or registered trademarks of EMC Corporation. Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products. Dell disclaims proprietary interest in the marks and names of others. 2009 Dell Inc. All rights reserved. Reproduction in any manner whatsoever without the express written permission of Dell, Inc. is strictly forbidden. For more information, contact Dell.
CONTENTS REVISION HISTORY... 2 INTRODUCTION... 4 GETTING STARTED... 4 RECOMMENDED WORKFLOW... 6 ACCESSING DELL PATCH MANAGEMENT REPORTS... 17 TROUBLESHOOTING PATCH MANAGEMENT SOLUTION... 18
Introduction The Dell Management Console centralizes multiple aspects of systems management into a single easyto-use tool. Administrators can upgrade existing systems to the Symantec Management Platform architecture and migrate discovery settings from Dell OpenManage IT Assistant to help smooth the transition to this next-generation console. The next-generation Dell Management Console is designed to significantly simplify systems management, enabling administrators to manage the myriad aspects of their IT environment including deployment, help-desk support, security, backup, and server and storage management from a single centralized console. Based on the flexible, extensible Symantec Management Platform architecture, this tool can integrate easily with an entire catalog of high-value plug-ins without requiring complicated integration services.1 implementing a single console that can support a wide variety of management tasks not only helps reduce operational costs, but can also help simplify training for IT staff and enable administrators to focus on enhancing the business value of their IT infrastructure rather than on managing their management tools. Along with various other features, Dell management console provides a solution called Patch Management for Dell Server. The Patch Management solution enables you to scan your operating environment to determine if supported Dell PowerEdge systems meet the minimum requirements for accepting the Dell Update Packages (DUPs) for BIOS, drivers, and firmware. The solution also automates the downloading and distribution of DUPs. Getting Started Patch Solution Home Page contains information from commonly used reports, tasks, and policies. The home page can be found under: Home Patch Management for Dell Servers Home. The home page is an interactive portal page that is comprised of Web parts. Each Web part contains information from commonly used reports, tasks, and policies. The page provides a summary of important patch management information at a glance. You can activate tasks and reports by clicking on the links in the Web parts. For example, clicking the install the Altiris Agent link in the Identify Supported Servers Web part installs the agent on managed computers.
Figure 1: Patch Management for Dell Servers Home The following table describes various web parts on the Patch management home page. Table 1: Web parts on the Patch Management for Dell Servers home page Web Part Description Getting started This Web part has links to common configuration and patch management process items. The included items are as follows: Configure proxy Download DUP Catalog Download Inventory Catalog Solution Global Settings Install Altiris Agent Run compliance check Check applicable updates by computers Manage Updates Identify Supported Servers This Web part displays the report that discovers servers with supported operating systems, server models, and the Altiris Agent. If you have not installed the agent on managed computers, you can complete the task by clicking on install the Altiris
Inventory Supported Servers Review update compliance of servers that are ready to receive updates Review status of update jobs Agent in the dialog that appears. This Web part displays the report that returns the inventory of driver and firmware information for supported servers. The servers that are returned in this scan are either ready to receive updates, do not meet prerequisites, or fail to return inventory. This Web part determines the compliance of supported servers and distributes updates. The pie chart lists servers that are up to date, missing one or more recommended updates, or missing one or more urgent updates. You can click on the sections of the pie chart to distribute applicable updates. For example, if the blue section shows the servers missing urgent updates, you must click on the blue section to distribute those updates. This Web part displays the status of all DUP Rollout Jobs. Recommended Workflow Getting Started web part displays the recommended work flow for using the Patch Management solution. Getting Started web part is logically divided into two sections. The Configuration section described in the first four links is part of one time setup. The second section called Patch Process contains the links which are used for the actual updating activity.
1. Configure Proxy Figure 2: Configure Proxy If your environment needs proxy settings to access ftp.dell.com web site for downloading the DUPs catalog and updates, you can do so by clicking Configure Proxy link in the getting started web part. Provide the required credentials and click the Test Settings button to check if the configuration is successful. Remember to configure the settings for FTP as well. Configuring Proxy is not required if you are using the catalog and updates from Dell Server Updates Utility DVD. 2. Download DUP Catalog
Figure 3: Download DUP Catalog The Dell Update Catalog contains all the Dell software management resources. The software resources populate the Manage Dell Hardware Updates page. The resources also update the Dell Update Packages (DUPs) that are sent to the managed Dell servers by DUP Rollout Jobs. You must download the catalog before you can create any DUP Rollout Jobs. The DUP Catalog Import task lets you automate the downloading of the catalog, to ensure you have the latest DUPs released by Dell. To download the Dell Update Catalog: 1. In the right pane, leave Dell site checked unless you are using Local Storage option. In which case, you can import the catalog from Dell Server Updates Utility DVD. When importing from the DVD, you will need to import both catalog.cab and prereq.cab files from the DVD. 2. Only download if modified is checked by default to ensure that only updated files are downloaded, thus avoiding unnecessary downloads. 3. Leave the other fields with their default settings unless otherwise required. 4. Click Schedule to specify a schedule for the task. You must specify a schedule for the task to run. You can run the task immediately by selecting Now in the Schedule Task dialog box as shown in Figure 4. 5. Click Save changes if you have made any changes to the default settings.
3. Dell Inventory Collector Import Figure 4: Schedule DUP Catalog Import
Figure 5: Import Dell Inventory Collector The Dell Hardware Inventory Collector tool is used to gather information on current operating system and hardware firmware. The tool determines if your Dell servers can receive updates. Dell provides separate tools for Dell Windows and Dell Linux servers. The tools are updated on a quarterly basis. The tools are available at a public Symantec download portal in.cab files. The Dell Inventory Collector task lets you download each tool automatically. To download the Dell Inventory Collector: 1. In the right pane, leave the default settings unless you want to import from local storage. In which case, click Local storage and specify the locations for Windows and Linux cab files in their respective fields. 2. Click Schedule to specify a schedule for the task. You can run the task immediately by selecting Now in the Schedule Task dialog. 3. Click Save changes if you have made any changes to the default settings. 4. DUP Configuration Settings
Figure 6: DUP Configuration Settings This page lets you set up how you want Dell Update Packages (DUPs) distributed. You can continue with the default options. Some of these settings are used as default values in the Rollout Job Wizard. All new DUPs that are downloaded have these settings by default. If you change the settings, the existing Software Update tasks and packages are not updated with these defaults. You can force them to update by re-creating packages from the Manage Software Updates page. Following tables describe various options present on the configuration page Table 2: Options on the General Tab Option Description DUPs Download Verification Checked by default, Verify authenticity of downloaded Dell Packages ensures that all DUPs are Dell certified. DUPs Download Location Dell site is selected by default so DUPs are downloaded directly from Dell. Click Local storage if you want to use DUPs from Dell Server Updates Utility DVD. In that case specify the folder containing the updates on the
DVD. DUPs Distribution Options This table specifies targets to receive distributed DUPs for Windows Dell Servers and Linux Dell Servers. Table 3: Options on the Advanced Tab Option Description Package Defaults Lets you determine how often to delete software update packages. Package Distribution Allow Package Server distribution This field is checked by default to ensure that a package server processes all software update packages. Use alternate download location on Package Server Lets you specify a different Location to download packages onto a package server, and then specify the locations for Windows and Linux Dell servers. Program Defaults Use alternate download location on client Lets you specify a different Location to download packages on managed computers, and then specify the locations for Windows Dell servers and Linux Dell servers. Run with rights Specifies whether the program is run with the System Account, Logged in User, or Specified User account. If you select the Specified User, you must specify the user domain in the field. This option is only applicable to Windows Dell servers. Program can run Specifies the conditions in which the program can run. The options are Only when a user is logged on, Whether or not a user is logged on and Only when no user is logged on. This option is only applicable to Windows Dell servers. Minimum connection speed Agent settings is selected by default, but you can specify a different speed. Agent Events Terminate after Specifies a time after which to terminate software update tasks. Lets you choose to send the relevant events from managed computers to the Notification Server.
5. Install Altiris Agent Dell Patch solution utilizes Altiris Agent for distributing the updates and executing the update tasks. If you haven t already deployed Altiris Agent on the target servers, it can be done by clicking the Install Altiris Agent link in the Getting Started web part. You can either choose the targets individually or enable the Scheduled Push to Computers policy which will push the Altiris Agents on all the computers as and when those are discovered. Figure 7: Install Altiris Agent 6. Determine Patchable Dell Servers (Windows/Linux) The Jobs to determine Patchable Dell servers can be accessed by the Run Compliance check links in the Getting Started web part for Windows/Linux Dell Servers. Based on Windows or Linux link, this server job runs the Dell Servers Discovery Task and the Compliance Assessment Task in order. The job finds Dell servers in your environment and establishes which of them meet Dell prerequisites and are thus ready to receive updates.
The Dell Servers Discovery Task finds all the Dell servers in your network environment. The task compares managed computer vendor and model numbers with a list of supported Dell servers. The recommended target for Windows discovery task is All Windows Dell Server Discovery Candidates. Similarly the recommended target for Linux discovery task is All Linux Dell Server Discovery Candidates. The Compliance Assessment task determines which of your Dell servers can receive Dell updates. The task reports on applicable DUPs and installed firmware. The recommended target for Windows Compliance assessment task is All Windows Supported Dell Servers and for Linux task, it is All Linux Supported Dell Servers. 7. Manage Dell Hardware Updates The Manage Dell Hardware Updates page enables you to view and stage all System Update Sets. You can download DUPs from either ftp.dell.com or the Dell Server Updates Utility DVD. When you stage a System Update Set, associated DUPs are downloaded to the Dell Management Console system. After all DUPs for the System Update Set are downloaded, the DUPs are ready to be distributed in Bundle Rollout Jobs.
You can filter DUPs by Dell System types, operating systems, severity, and group. Options available on this page are described in the table below. Manage Bundles Manage Updates Filter By OS Type Group Updates Severity Stage and Distribute All Bundles Stage and Distribute Table 4: Options on the Manage Dell Hardware Updates Page Option Description The icon enables you to choose to either distribute bundles of DUPs (Manage Bundles), or individual DUPs (Manage Updates). Enables you to filter by system model or name Enables you to filter by Windows, Linux, or all operating system types. Enables you to search in an organizational group Enables you to select whether to show all, or check Show applicable only. Enables you to choose a severity level to filter updates by. Enables you to stage and distribute all listed bundles Enables you to stage and distribute only selected
Selected Bundles Manage Selected Bundle Bundle/Update Name Release Date Severity Calendar bundles. Opens a bundle and then creates a rollout job for a single DUP. The name of the System Update Set or bundle. The date the bundle was released The severity level of the bundle. For example, Urgent Enables you to specify beginning (From) and end (To) dates to display the bundles that were released between the said dates. # of Computers The number of affected Dell systems. # Updates The number of DUPs in a bundle. # Downloaded The number of DUPs that have been downloaded for the relevant bundle. 8. Staging and Distributing Updates You can stage bundles/updates from the Manage Dell Hardware Updates page, where all available bundles/updates are listed. The Stage and Distribute wizard creates rollout jobs. Rollout jobs distribute Dell Update Packages (DUPs) to managed systems. This wizard automatically filters targets to only install DUPs on applicable systems.
Following table describes the options available on the Stage and Distribute Wizard Table 5: Options on the Stage and Distribute Wizard Options Description Reboot Options Reboot immediately Enables you to choose to restart immediately after installing DUPs. Do not Reboot Enables you to choose not to restart after installing DUPs. Installation Options Silent Enables you to choose a silent install. Silent, allow downgrade Enables you to choose to install a DUP that has been superseded. Schedule Now Enables you to choose to immediately install DUPs. Schedule Enables you to choose a schedule to install the DUPs. Windows Targets Enables you to choose a target to apply the rollout job to. Only applicable computers in a target receive DUPs from the rollout job. Distribute Bundles List A list of DUP bundles that the rollout job distributes Create Finishes the wizard and creates a rollout job. 9. Rollout Jobs Rollout jobs are user-created tasks. They distribute Dell Update Packages to managed systems. After you stage DUPs, you must create rollout jobs to deploy DUPs to the appropriate Dell systems. You can use the following rollout jobs: DUP Rollout Jobs DUP Rollout Jobs contain a single DUP and are stored in the Jobs and Tasks System Jobs and Tasks Software Patch Management for Dell Servers Rollout Jobs DUPs folder Bundle Rollout Jobs Bundle Rollout Jobs contain all the DUPs in a System Update Set and are stored in the Jobs and Tasks System Jobs and Tasks Software Patch Management for Dell Servers Rollout Jobs Bundles folder. The job is read only and used for viewing the progress of the rollout job. Dell strongly recommends that you use the Bundle Rollout Jobs. Rollout Jobs only update server components to newer versions. A rollout job with an older update than the one that is currently installed on the target server fails. You have the option to force a downgrade. Accessing Dell Patch Management Reports You can view and manage your Patch Management data through reports. To access Dell Patch Management reports
1. On the Reports menu, click All Reports. 2. In the left pane, click Reports Patch Management for Dell Servers. 3. Select the folder with the reports you require. For example, Dell Server patching inventory reports, Hardware update compliance reports, and Update installation results reports. 4. Select the report you require. Troubleshooting Patch Management Solution To assist in troubleshooting, error codes are generated in reports and execution instance details. Dell Update Package exit codes After running Update Packages, exit codes are generated. They appear in the Dell Update Execution Details report. The exit codes help you determine and analyze the execution results after you run Update Packages. Table 6: DUP Exit Codes Value Message Description 0 SUCCESSFUL The update was successful 1 UNSUCCESSFUL An error has occurred during the update process; the update was unsuccessful. 2 REBOOT REQUIRED Restart the system to apply updates 3 DEP_SOFT_ERROR Possible explanations are as follows: You attempted to update to the same version of the software You tried to downgrade to a previous version of the software 4 DEP_HARD_ERROR The required prerequisite software was not found on the system. 5 QUAL_HARD_ERROR The Update Package is not applicable. Possible explanations are as follows: The Update Package does not support the operating system. The Update Package is not compatible with the devices
found in your system 6 REBOOTING_SYSTEM Restarting System Windows Dell Servers Discovery Task Failed Error Codes These error codes appear when the Windows Dell Servers Discovery Task fails. The codes can be found in the task's execution instance details. Table 7: Windows Dell Server Discovery Task Failed Error Codes Value Message Description 10 Err_OK_IsDellServer Successfully executed system is a Dell server. 11 Err_OK_IsNotDellServer Successfully executed system is not a Dell server. 12 Err_OK_IsNotSupportedDellServer Successfully executed system is a Dell computer but is not a supported Dell server or does not have a supported operating system. -20 Err_EndofScript Err_EndofScript Not used at the moment -21 Err_FileNotFound Server list file (DellServers.ini) was not found. -22 Err_FailedStringSearch Not used at the moment. -24 Err_InvalidCmdArgument Command-line arguments wrong. Must be blank, "/model" or "/omsa". -25 Err_CantAccessWMI Could not execute WMIquery. Either not installed or not running. Windows Dell Servers Discovery Task Failed Error Codes These error codes appear when the Linux Dell Servers Discovery Task fails. The codes can be found in the task's execution instance details. Table 8: Linux Dell Server Discovery Task Failed Error Codes Value Message Description 7 RPM_VERIFY_FAILED RPM verification has failed. 10 Err_OK_IsDellServer Successfully executed system is a Dell server. 11 Err_OK_IsNotDellServer Successfully executed system is not a Dell server. 12 Err_OK_IsNotSupportedDellServer Successfully executed system is a Dell computer but is not a supported Dell server or does not have a supported operating system. 21 Err_FileNotFound Failure. Server list file (DellServers.ini) was not found.
File name is not as specified in SupportedDellServers.txt. 24 Err_InvalidCmdArgument Failure. Command-line arguments are wrong. 25 Err_CantAccessDMI Could not execute DMIquery.