Appling Patches to ESX 3.5

[r8escjohn]

This may be somewhat of a noobie question, so bear with me.:->

Using the lsiting of ESX 3.5 patches I see 18 total patch 'bundles'. Using the 'ESX Server 3 Patch Management Guide' I have a

general idea on the usage of the 'esxupdate' command. Questions:

- Is it recommended that I load all 17 patch bundles or just some that affect my config? What order do I need to apply? Do I just 'follow' dependiancies?

- I have just a 'base' install of ESX 3.5, from the listing it appears that I first need to load 'ESX350-200802403-BG', is that correct?

- I have only one ESX box with a few VM's on it. Is it recommended that I setup a separate HTTP/FTP Depot or just use a local folder on root of ESX system such as '/VMWare_Patches'?

- Any other suggestions for usingthe 'esxupdate' command?

John H

[azn2kew]

I would install all the patches for ESX 3.5 in case you have to use it in the future otherwise you tend to forget. If you download to script patching tools from Michael Knight or Dominic than its pretty straight forward, run the script and it will install in sequential order and if you have patch.txt files with all patches included it will follow that as well. You can use other patch GUI like VMTS.net, Update Manager built-in ESX 3.5, AutoPatch tool with Xtravirt.com hope that helps you get started.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

iGeek Systems LLC.

VMware, Citrix, Microsoft Consultant

[Lee_Sargeant]

Are you using Virtual Centre 2.5? If so I would recommend using the new Update Manager. It is really simple to use and it will even automatically put the servers in maintenance mode, reboot them and take back out of maintenance mode.

[r8escjohn]

Lee,

Well there is a bit of a story to that ......I thought I had Virutal Center and had planed to use that for both updates and VM image managment. Went to install and found out that Virutal Center is a seperate product that I need to purchace seperate from ESX Server 3.x that my wonderful reseller failed to tell me about.:-< We are a small k-12 not-for-profit and it was hard enought to get the money together for VM Ware ESX Server 3.5-

So all that wining and ranting to say, no I have only console (and VM Infrastructre Client).

Thanks for your answer!

[r8escjohn]

Many thanks for the info!...Will start looking for those scripts.

Ok, stupid noobie question, but what Update Manager bulit into ESX 3.5? Do you mean Virutal Center 2.5?

John H

[azn2kew · Accepted solution]

Did you look at Foundation kit license, its pretty good for small shops like yours check them out more details which include all features required to manage esx effectively.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

iGeek Systems LLC.

VMware, Citrix, Microsoft Consultant

[philvirt]

Yes. You have to apply the patches in order. Some of the patches have dependencies. The good part is at least it will tell you what it needs.

Regards,

Fil

[patrickds]

I keep all the patches on my laptop, and make them available through ftp with a filezilla server (free, small ftp server)

When i need to update an ESX host (i do a lot of ESX installations for clients), i just start up the ftp service, issue the esxupdate command and point it to my ftp and it's done in a couple of minutes.

If you only have 1 host to maintain, you could of course copy everyhting over to a local directory on the ESX, but doing it over ftp is just as easy, and you will keep the patches available in case of a reinstall.

You'll have to download the patches from the website on another machine anyway.

You could even keep them on a CD, only read access is needed from the ESX host.

The repository content description xml file has the patches listed in the correct order, which is also the order in which they will get installed, so nothing to worry about there.

Just some steps to follow.

- download the patches and the contents file (zip containing xml) and extract them all in one directory (you'll end up with a directory containing the xml and sig, and a bunch of subdirectories for the patches)

- make the directory available with anonymous ftp

- shutdown all running VMs, and put host in maintenance mode (not really required with only one)

- open firewall on the ESX host to enable ftp connection: esxcfg-firewall --allowOutgoing

- check if your repository is available and working: esxupdate -d ftp://yourftprepository scan

- start patching: esxupdate -d ftp://yourftprepository -n update

- close firewall again: esxcfg-firewall --blockOutgoing

- reboot

Unless you have a really slow network connection between the machine holding the ftp with patches and the host, this will just take a couple ofminutes.

In my opinion this is really the easiest way, i find that copying all the patches over to the host with Winscp (or anything similar ), then extracting and updating from there takes more time and work.

Bear in mind that VMTS patchmanager (i used to use this until 3.0.2 as well) and Xtravirt Patchdownloader do not work on ESX 3.5 hosts.

Neither will most of the previously available scripts.

Personally i don't really think they're needed anymore, since the new version of esxupdate does it all automatically, if your repository is set up correctly.

[r8escjohn]

patrickds,

Many thanks! This is exactly the info I was looking for! Due to a RAID5 Drive Failue, my box is currently rebuliding the array, but soon as that gets done I will start ..............

John H

[petedr]

patrickds,

Thats a good approach for 3.5 patching. I had normally moved the files to my esx host and then did the patches but this looks like a good approach as well.

Also I agree and highly recommend applying all of the 3/10 patches for 3.5

[IRQ2006]

There is a number of free patch managers for ESX now evailable, some you can run from your client PC.

[patrickds]

Those will no longer work on a 3.5 host; and i haven't found any yet that will, mostly because i found the new method didn't require anything else.

As far as I know, they all rely on the old version of the esxupdate command and don't support the new one which uses a repository as update source instead of individual patches.

[azn2kew]

I believe the script from Dominic has been updated to work with ESX 3.5 and you can download and check it out for more details.

If you found this information useful, please consider awarding points for "Correct" or "Helpful". Thanks!!!

Regards,

Stefan Nguyen

iGeek Systems LLC.

VMware, Citrix, Microsoft Consultant

[JRink]

I just wanted to say thanks to patrickds for documenting the ftp process he uses. That simplified things for me a LOT and made this whole patching process much easier. I think the entire patching pdf manual could have be written in the 10 sentences or so patrickds listed... At least in my case where I just managed a couple individual 3.5 servers (no VC) at various clients. Having all the patches on my laptop is very easy to setup. Kudos.

JR