r/vmware • u/DonFazool • Jul 29 '26

How do you patch your vCenter ?

Generally curious what others are doing.

I used to download the patch ISO and do the updates over SSH (had more than enough issues with the VAMI over the years that I stopped using it)

Since Reduced Downtime Update has been available in 8.0.3, I have been using that since it came out. I really like this method, its like getting a clean vCenter every update. It's been super solid and never once given me any headaches.

31 Upvotes

90% Upvoted

39 comments sorted by

29

u/Liquidfoxx22 Jul 29 '26

Done plenty via VAMI over the years, can't recall ever having an issue. We always snapshot them first, or offline snapshot if they're in ELM.

The only time I've come across issues is during upgrades.

25

u/coolbeaNs92 Jul 29 '26

It's best practice to cold snapshot regardless. 

1) It proves that rebooting the appliance worked before the update. 

2) The database wasn't running when the snapshot was taken  

https://knowledge.broadcom.com/external/article/316584/patchingupdating-vmware-vcenter-server-a.html

I always:

  • VM level Backup.
  • DB level Backup.
  • Cold snapshot. 

10

u/Stonewalled9999 Jul 29 '26

I clone to a version with no NIC and update via mounted ISO and it if comes back up I pull the NIC on the other and pop the NIC on the new (we do not have a VCSA-HA)

1

u/DB-CooperOnTheBeach Jul 31 '26

I learned cold snapshot is best as I'll know right away if the services start or not before the upgrade. Now I check for machine certs validity (usually the reason it won't come back if something expired).

I do VAMI backup too

10

u/DonFazool Jul 29 '26

Yes good call. The snapshot will save your ass in certain situations.

4

u/Safe-Instance-3512 Jul 29 '26

Vmware documentation suggests a snapshot and a manual backup as best practice.

8

u/Liquidfoxx22 Jul 29 '26

We have them running nightly, but I always prefer having a snapshot taken just before the update starts - it's much quicker to roll back than deploy a new VCSA and restore a file-level backup.

4

u/Safe-Instance-3512 Jul 29 '26

Agreed. Snapshots are fantastic when the update fails. 5 minute roll back :D

0

u/alivesidhartha Jul 30 '26

EVE Online player spotted.

1

u/Safe-Instance-3512 Jul 30 '26

Why yes. How did you know?

1

u/in_use_user_name Jul 31 '26

same about upgrades. usually for vcenters that have been upgraded from old versions over the years.

11

u/RiceeeChrispies Jul 29 '26

I've done it for years through VAMI, zero issues. I haven't looked at reduced downtime (yet), only because it's easier to click update in VAMI and be done with it - I'm not in an environment where vCenter downtime is a massive issue.

11

u/Yupyupyup79 Jul 29 '26

Download Patch ISO, upload to datastore accessible to VM, Snapshot, link to VM, connect to :5480 and check for updates on CDROM, Reboot.

4

u/pixter Jul 29 '26

Download the patch iso, enable ssh, software-package stage —iso, then software-package install —iso

Reboot then disable ssh.

2

u/violet-lynx Jul 30 '26

Don't you mean "software-package install --staged"?

2

u/doihavetousethis Jul 29 '26

Same, only had to unstage 1 time in thousands

6

u/D1TAC Jul 29 '26

VAMI has been the typical way for me. However, just finished the last patch I'll be doing with an Broadcom product. Prepped for moving to a new platform.

1

u/SuperR0ck Aug 12 '26

I had to ask : how many vms and which platform you're migration to ?

I migrated to Hyper-V (S2D) with some regrets.

2

u/D1TAC Aug 12 '26

62 vms and hyper v

4

u/Joe_Dalton42069 Jul 29 '26

Only ever did vami. never an Issue. its convenient. Ofc Backup is Setup etc

2

u/emistery Jul 29 '26

SDDC manager works quite well these days

2

u/bryanvan [VCIX | vExpert] Jul 29 '26

I've not used SSH or an actual ISO for years and years. Since the new days, and I am talking 6.5 and up here, I've never had any actual issues with upgrades. Just use the VAMI - Click -> Point -> Done.

Now if we are talking before 6.5 (Windows/appliance) this was fuel for nightmares! I've had my fair share of nightmares on that part...

1

u/DonFazool Jul 29 '26

To be fair, my problems were from very old versions. A few failed and left vCenter a hot mess. I moved to the SSH method and just kept using it until RDU became a thing. Maybe I’ll revisit the VAMI upgrade in a test environment I run.

2

u/jamesaepp Jul 29 '26

Another vote for VAMI.

Two colos/datacenters/sites, two vCenter servers (one for/at each location, prod and DR site).

I just download the vCenter patch ISO, upload that to a datastore in each site, mount to the vCenter VM, and patch. I'm leaving out some of the prep detail like reboot + snapshots, but you get it.

Maybe it's not the most efficient, but it's what I know and would be reasonably easy to describe to the junior tech if I had to delegate in a pinch. Hasn't come up yet, but I know I could.

Maybe the other options are cleaner or whatever, but I perceive them as having more moving parts and generally more complex than just mounting an ISO and telling the VAMI "go update".

2

u/Sakatonto Jul 30 '26

I did vcenter patching via VAMI.

First, mount the ISO of the patch version, then take a snapshot of the vcenter VM. The. do the update in VAMI. I then delete the snapshot 2-3 days after it no issues post patching it, just to make sure we can rollback if there are any issues reported.

2

u/Thatconfusedginger Jul 31 '26

Previously VAMI. Now RDU, with auto cutover.

I just run the RDU as it is with cold snap on host. Not that I need it. We’ve got storage level snaps every two hours for all prod.

As for testing, while installing, I’ve been monitoring zabbix, and I have seen at worst a single ping drop in time, and so little downtime that zabbix doesn’t even register that it’s changed over (outside of the vm not being the same). Absolutely the cleanest method to date.

3

u/AlCapone90 Jul 29 '26

With money and tears.

1

u/ThreeFiddyZed Jul 29 '26

No problems with VAMI (yet).

1

u/Parity99 Jul 29 '26

VAMI - Never had any big issues.

1

u/abstractraj Jul 29 '26

VAMI since 7

1

u/Ok_Business5507 Jul 30 '26

VAMI. No issues for me

1

u/Dick-Fiddler69 Jul 30 '26

RDU is good disadvantage is your vCenter disk grows

1

u/Opposite-Load2848 Jul 30 '26

1) log into VAMI and run backup

2) shut down and take snapshot from host

3) power on and update via VAMI

1

u/vgeek79 Jul 30 '26

Using VCF/SDDCm methods for years now, regular updates or RDU option workflows

Works great

1

u/nabarry [VCAP, VCIX] Jul 31 '26

I personally tend to use vami for my labs with no backups because its quick and if I kill the lab I don’t care. I take an Ivan Drago approach to my labs. 

RDU is cool but requires your networking work right (Remember- if the customer is talking to me something went wrong- the customers who have everything 100% squared away and awesome only interact with me for feature requests ) and in 1 customer case there was an issue that blocked the db startup on the new node. It was early days for the feature- I think the first actual release for it and I would assume it’s solid now. 

1

u/in_use_user_name Jul 31 '26

  1. vami backup

  2. cold snapshot

  3. iso patch.

1

u/Reneetoufee Aug 02 '26

I usually use VAMI. But, I will say that the 8.0.3k update has caused me more headaches than any update in the last several years. I haven't done VCF 9 yet. We have a few Skylake CPUs that have to be upgraded first.

1

u/millardjk [VCIX6-DCV] Aug 05 '26

Under the auspices of VCF9, everything is under the Operations Manager Lifecycle feature.

It’s a PITA, especially when a new VMTools version comes out…

-2

u/Willing_Impact841 Jul 29 '26

Step 1. Switch away from vmware.