HP server supports 6.7u2, not 6.7u3. Best way to exclude parts of u3 in vmware update manager?

[drheim]

Hey guys,

I have a 6.7u2 vSphere environment(vCSA and hosts) and I have a HPE Synergy frame/SPP combination that only supports 6.7u2.  It does not support 6.7u3 until we upgrade(VCSA 1st, HPE Synergy Frame Composer 2nd, HPE Synergy Frame Hardware 3rd, and Synergy Server SPPs 4th) later this year.  I want to apply vSphere security patches through VUM, but noticed the default critical baseline automatically include 6.7 complete update 3, which both my vCenter server and hardware are not ready for yet.  Is there a simple way to exclude the 6.7 complete update 3, and also any of its included componenets that might cause issues from a VUM baseline?

I have always had concerns about remaining in a supported configuration and following the correct upgrade path.  Because of that, typically it has been easier to wait until we run all HPE updates first,  confirm what version of VMWare they support, and then apply all VMWare updates after.  I know I can try to piece together a baseline without 6.7 complete update 3, but figuring out what should and should not go in there can be tough.  If anyone has a good process for updating a VMWare environment, or how to comfortably apply needed updates without u3 and the modules that go in it, etc. it would really be appreciated

[berndweyand]

here you can compare the parts of standard image profile vs. security image profile and select the parts you want: https://esxi-patches.v-front.de/vm-6.7.0.html

[jburen]

Maybe create a manual baseline and apply that to your hosts. That way you can specify which update you want in your baseline.

[drheim]

I created my own baseline, specifically did not select 6.7 complete update 3, but it still went to 6.7u3 from the other updates(before my vcenter was on 6.7u3).  Not even sure how I could have stopped it.