Sign in

what finally made your patching boring and predictable??

maintenanceoperationspatching12 replies · 411 views · started
Reply
  1. Diego
    @diego.brandt

    ok so we look after a dozen on-prem servers and patch monthly. management wants faster, the app owners want never on a weekday. im trying to desgin smth sane: staging rings, maintenance windows, auto-reboots or not. what actually works for you in practice?

    we have basic monitoring and backups, but no proper test enivronment that mirrors production. whatever process we pick has to work with that reality. id love to hear what cadence and safeguards people consider reasonable for a setup like ours. any ideas??

    14
  2. Haruto Banerjee
    @harutob59

    do you have a staging or canary group that mirrors production roles? ??

    thinking

    5 0 helpful
  3. Diego
    @diego.brandt
    in reply to @harutob59

    ok so no real staging lmao A couple of test VMs that dont look much like a dozen on-prem servers.

    5 1 helpful
  4. Hugo Rahman
    @hugo_uplink

    ok but is maintenance even worth bothering with or should i just leave it 😂 +1 same here

    0 1 helpful
  5. Hugo Rahman
    @hugo_uplink
    in reply to @hugo_uplink

    ahh classic rings work: a small canary group patched first (including at least one server per role), then a wider group a few days later, then the rest, problems surface on servers that matter less. worked for me anyway 🤷

    thinking

    1 0 helpful
  6. Hugo Rahman
    @hugo_uplink

    ahh classic separate security updates from everything else. unattended security-only updates are fairly low risk on Debian/Ubuntu (unattended-upgrades with only teh security origin enabled), while feature updates go through teh window.

    1 4 helpful
  7. Haruto Banerjee
    @harutob59

    have u checked your on-prem settings?? mine were reset after an update xD this. sooo much this fingers crossed 🤞

    thumbsup

    15 1 helpful
  8. Cyrus
    @mutex_shed

    oh ive been there lol exact same thing hapepned to my mac last month worked for me anyway 🤷

    11 0 helpful
  9. Felix Brandt
    @fbrandt_5

    reboots are teh hard part 😤 tools like needrestart (Debian/Ubuntu) or needs-restarting -r (RHEL family) tell you whether a reboot is actually required, sooo u only reboot when needed.

    0 12 helpful
  10. Bram P.
    @bpereira

    uhh wait does this also apply to monthly?... make a bacukp before u touch teh default config, learned that the hard way ??

    1 0 helpful
  11. Hugo Rahman
    @hugo_uplink

    track compliance, not intentions :) A simple report of last patch date and pending reboots per server shows which machines silently fell behind. worked for me anyway 🤷

    4 3 helpful
  12. Viktor O.
    @kernel_pilot

    ok so pro tip: write down what u change. i didnt and had to redo dozen from scratch

    0 2 helpful
  13. Haruto Banerjee
    @harutob59

    hmm idk counterpoint to rings: with a small 2,000 Windows devices, a single well-tested window may be simpelr than three groups to manage.

    facepalm

    2 14 helpful

Reply to this topic

Sign in or create an account to reply.