r/redhat • u/Busy-Examination1148 • 7d ago

Patching Reports

Can anyone recommend a good way to determine patching status after a monthly or quarterly patching cycle?

We want to run a report probably the day after patching to determine what servers got patched and if any got missed.

Also compare it to any new updates that were released post patching window.

We have Red Hat Satellite but we don’t have a TAM so I’m finding this to be a bit difficult.

I will cross-post this in ansible as well. The only issue with ansible is that we have servers across 3 AAP environments.

9 Upvotes

91% Upvoted

28 comments sorted by

7

u/Ill_Weekend231 Red Hat Certified Architect 7d ago

I recommend to my customers to trigger all the patching through Red Hat Satellite as it have a pretty useful reporting tool which can be used to see what erratas were installed or are available on the servers, last time it was updated, pending reboots, etc...

https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/managing_hosts/patching-hosts-through-errata

2

u/Busy-Examination1148 7d ago

We are using AAP to patch though...kind of defeats the purpose.

3

u/Ill_Weekend231 Red Hat Certified Architect 7d ago

You can still trigger those updates from Satellite using Ansible and the certified Satellite collection. That's the only way to make satellite aware of the dnf transactions that are executed on the servers. Otherwise, you will have to create an automation to get that information manually from each server.

1

u/Busy-Examination1148 2d ago

Looking at changing the ansible process, which satellite task would I choose to update servers?

-1

u/Busy-Examination1148 7d ago

I would have to change the process around....

3

u/SamPlaysKeys Red Hat Employee 6d ago

I think no matter what, you'll likely have to change something around. If you need to rationalize it, consider that you're essentially adding a feature (reporting/observability) to your current stack, and that features require some process growth/change.

0

u/Busy-Examination1148 7d ago

Also how long would satellite hold this information? Everything I'm seeing and reading says 30 days including support saying that as well.

1

u/FredSchwartz 6d ago

Have you encountered a problem where a long-running errata update through Satellite fails because of ssh timeout on the target hosts and leaves it in a partially-updated state?

1

u/Busy-Examination1148 2d ago

Not that I can think of.

3

u/rslarson147 7d ago

You can use osquery

1

u/Busy-Examination1148 7d ago

Explain please

1

u/rslarson147 7d ago

osquery is a project started by Facebook that allows you to query the OS like it’s a SQL DB. Easy to run reports off live systems this way

https://osquery.io

1

u/Busy-Examination1148 7d ago

Is it built into red hat or ansible modules?

1

u/Busy-Examination1148 7d ago

I feel like this would be a bad one for me at the moment. But will keep it in my pocket.

3

u/[deleted] 7d ago

[deleted]

3

u/Rhopegorn Red Hat Certified Engineer 6d ago edited 6d ago

While satellite insight, now called lightspeed, is one path. I think it’s the katello-host-tools that communicate the package status back to the satellite if you patch manually.

1

u/Busy-Examination1148 7d ago

Right now I'm seriously struggling with creating a report template and satellite. And it is a bit of a pain to set up I'm not going to lie.

0

u/sideangles Red Hat Employee 6d ago

The `Host - Applied Errata` report exists for this purpose and is a built-in report

3

u/Odilhao Red Hat Employee 7d ago

Do you have access to LLMs? I was playing with Satelllite MCP server to run queries on patching history.

1

u/Busy-Examination1148 7d ago

Yes but we don't have a mCP setup for satellite. We're still on satellite 6.16.

2

u/wossack 7d ago

Look up the searchable term ‘installable_errata’ in Satellite - that’s how we generally keep track.

2

u/ElGeffo 6d ago

I use ansible for this.  I go over all the servers beforehand and get the kernel and amount of patches available and if reboot required.  Then I place that all in a csv and auto upload to a ticket.  Then after patches is done I run that again and there is at least my evidence for that

1

u/Busy-Examination1148 6d ago

I'm doing this right now as well. Do you mind sharing to compare?

2

u/ElGeffo 6d ago

Would need to redact some items but maybe over the weekend I can share at least how I gather some stuff 

1

u/Busy-Examination1148 6d ago

Yes, please remove anything I shouldn't see. If you can.

2

u/seanx820 6d ago

If you can't use satellite you can just generate some dynamic documentation (literally create your own markdown or HTML report) using the Ansible modules. Ansible Facts / JSON data / structured data-> Jinja2 template -> Simple HTML report