Patch

Hi,I heard that there is a motto in system administration that not to update the patches unless it brokes. Is it true? I'm quite new to unix, could you give some links to follow the system monitoring.Thank you.

[246 byte] By [Thiru_Sab] at [2007-11-25 23:40:38]

«« How can I stop sendmail from listening on Sol 10?
»» how to manage /var/adm/wtmpx file?

# 1

> I heard that there is a motto in system

> administration that not to update the patches unless

> it brokes. Is it true?

Wow. Not at all! If that were true, we'd all be running outdated, insecure systems.

> I'm quite new to unix, could you give some links to

> follow the system monitoring.

Well... you could start at http://www.unix.com/ and I'm sure you'll get many more replies.

Red_Oregon at 2007-7-5 18:48:24 >

top of Java-index,General,Sys Admin Best Practices...

# 2

In fact it IS a sun recommended best practice to patch only what you need.

If you have a host that hasn't changed much over a period of time, it's a good idea to not patch it unless there are security patches or other "high-alert" type patches that have been released by Sun.

There are some SAs who would disagree and like to patch a system to an inch of it's life. Then there are some who don't patch unless it is absolutely necessary.

In either case, it's not a simple task (and one should not choose to do either based on laziness). Patches need to be assessed -- their effect on a system tested (when possible). given that there might be many different systems (at different patch-levels and running different apps). It however is a good idea to try and standardize the builds/patchrevs etc across the board such that patches can be analyzed and recommended (for the majority, in any case).

The question becomes a semi-philosophical one then. "If your server doesn't need a particular patch, why install it?"

or "If it ain't broke -- why fix it? and fix what?"

it is a general rule of thumb that in absence of an absolutely compelling reason to mess with something (anything), it is advisable not to mess with it.

;)

HTH

implicate_order at 2007-7-5 18:48:24 >

# 3

here's sun's whitepaper on Patch management: http://docs.sun.com/app/docs/doc/817-0574-12

implicate_order at 2007-7-5 18:48:24 >

# 4

Indeed, you don't patch just because a patch exists.

However, in the case of a security patch for instance, you would want to patch, even though "everything still works".

In other words, in most cases, you wouldn't want to *not* patch just because you don't have any obvious problems, that's my point.

Red_Oregon at 2007-7-5 18:48:24 >

# 5

[[[n other words, in most cases, you wouldn't want to *not* patch just because you don't have any obvious problems, that's my point.]]]

Actually it makes more sense to "Not patch" something you don't have a problem with. But just because one doesn't have a problem doesn't mean the problem doesn't exist... :) (if we do go down to picking knits)....

If there are *bullet-train* patches that the vendor has released - by all means -- you have to patch your system.

But would I want to install a telnet vulnerability patch on a system that has telnet disabled? Maybe you should...depends on many things.

Experience shows that most cases, you can simply run through and do a cluster install and it's going to be just fine. But then again, you have some of those "special moments" when something breaks and you can't log back into the box or can't back a patch out...

implicate_order at 2007-7-5 18:48:24 >

# 6

Agreed. :)

Red_Oregon at 2007-7-5 18:48:24 >

# 7

Yes, thanks to all for your useful informations, and definitely agree that experience will teach a lot. As "implicate_order" said, it doesn't mean that probem didn't exist, if one doesn't have problem. From my windows experience, all the patches released for operating system need to be patched, otherwise there is a lot of performance related problem. For example, if 50 users using a 8GB memory unix box, not all users using at one time and not even half of them. So how can we identify there is a problem exist, if there is no downtime, everyone thinks the system is ok, thats why its up and running. no one can notice a problem until it affect something.

Thiru_Sab at 2007-7-5 18:48:24 >

Java programming resources: FAQs, tutorials, compiler and browser download sites, documentation, books lists, IDEs, etc.

Patch

General New Topic

General Hot Topic

General

All Classified