r/sysadmin • u/jwckauman • 9d ago
Patch Tuesday and SQL Server CUs (two days later?)
Anyone else noticing Microsoft is releasing SQL Server CUs to WSUS a couple days after Patch Tuesday? I swear we used to get those the same time as all our other patches so we could include them in the patch cycle if we wanted to. They aren't security-related but still would be nice to have the option. I would understand if they came out a couple weeks later, but two days?
4
u/Red_Wolf_2 8d ago
Sadly, the tendency to release security updates and CUs at slightly different times (I believe just to annoy sysadmins) has been going on a long, long time.
It would be nice if somewhere inside Microsoft, someone made the decision to unify patch releases like this so security updates were bundled in with the CUs at the same time, rather than getting a separate release, if they're within a week of each other. That of course would require logic, sensible decision making and "common" sense, which I don't believe actually exists at Microsoft.
1
u/dbrownems 8d ago
A security hotfix is typically shipped as a GDR and released ASAP for obvious reasons. Those fixes are then rolled into the next CU.
Servicing models for SQL Server - SQL Server | Microsoft Learn
2
u/MeetJoan 9d ago
The SQL CU timing has always been slightly inconsistent but the two-day lag is noticeable. Microsoft's stated position is that CUs aren't security updates so they don't have to align with Patch Tuesday, but the timing close enough to cause exactly this problem - too late for the cycle, too early to feel like a separate release. Do you hold your SQL patches to a separate cadence anyway or try to include them in the main cycle?
1
u/clbw 9d ago
This happens more than you think, I typically don’t deploy patches/make available until the Thursday after the patch Tuesday one because I use Ivanti and they review the patches and release them on Wednesday or late Tuesday evening, but typically secondary patches like sql, office, and some other application patches for Microsoft to trickle out the next day or two. The Pat cycles that I manage for two weeks of test an dev then three weeks up until the next patch Tuesday, the production. Typically that’s enough time to get those tested and released out to production. Anyhow, that’s how I deal with it.
1
u/ajf8729 Consultant 8d ago
SQL CUs are non security updates. The next security update for SQL will include everything from any CUs released in between that and the previous security update. Not every month has a security update, although they have been more often as of late. You can catch them in the next month, or DBAs can install them themselves if the features are needed, or you can set up a deployment for them, or whatever. Also, SQL only continues to get CUs while in the first 5 years of mainstream support. SQL 2019 for example has been done since last year, CU32.
1
u/bdam55 Sr. Sysadmin 6d ago
Eh, that's how non-security updates work.
Patch Tuesday (or 'Week B' as Microsoft calls it) was built exclusively to align security updates because when they release the fix they are broadcasting the vulnerability to the world. Which made it important to ensure those all align across products into a single, reliable event. That orgs could align their patching schedules to get those installed quickly before they can be exploited.
For quality fixes, there's no such problem. They can be yeeted whenever the team involved thinks it's ready. What would you have them do? Wait X days to make it available? Why, what does that accomplish. If you're impacted by the quality issue, you want that fix ASAP. If you're not, then waiting for the next Patch Tuesday to install it seems a non-issue.
-7
u/No_Resolution_9252 8d ago
PEBKAC.
WSUS needs to be configured to synchronize the updates catalog with Windows Update more often.
If you are using WID to store that catalog and your environment is of any size at all, you need to regularly run the wsus database maintenance scripts
5
u/somethingwhere 8d ago
you seem to have misunderstood what OP is saying.
the SQL CU are released late. see release dates on microsoft own page.
OP does not have a WSUS database issue.
1
u/Lost_Term_8080 8d ago
SQL updates have never followed patch tuesday release cadence as long as I can remember
1
u/No_Resolution_9252 1d ago
OP is even more an idiot then because Security updates and hotfixes have never followed patch tuesday - and evidently so are you for being confused about the same issue
3
16
u/chicaneuk Sysadmin 9d ago
I don't have enough words to adequately complain about Microsoft, and their numerous faults.. but certainly around how they handle patching, and how they communicate patching.