What's in an Update

[jscooper22]

Hi,

Running vSphere Client version 7.0.3.01100 with 2 HP hosts:

DL360Gen9
DL380Gen10

The Gen9 seems to be more up to date, probably because I set it up later (I re-provisioned an old hyper-v server to take some of the load of my newer main server).

In vCenter, choose the Gen10 host, Update tab, I (somehow) got it so I see two baselines. I assume I only have to apply one since the other is already complient, but do these include the latest firmware from HP, or should I install HPE's SPP separately? And should I do the firmware before or after I apply the baselines to make my Host compliant?

Sorry, one more question: the ESXi version in the screenshot doesn't list which build this baseline is, Can I assume it's the latest, or does it say somewhere else if it's build 20842708 or whatever the latest is (20842708 is what my other server is and it says it's compliant.

Thanks,

Jeff

[a_p_]

If you want to stay with the classic "Update Manager", I'd suggest you create a new, individual patch baseline with only the latest ESXi rollup bulletin in it, unassign the 2 predefined baselines (the ones in the screenshot), ans assign the newly create one. Since ESXi patches are cumulative, the latest one contains all previous ones.

That said, you may also consider to switch the cluster from Update Manager to the new Live Cycle Manager. This will allow you to define the desired state for the hosts in the cluster, which includes VMware patches, as well as the HPE patches (Add-Ons). Even individual components - if needed - and firmware can be patched using vLCM. For the firmware patches however, you also need additional HPE tools like the iLO-Amplifier, ...

Setting up and maintaining additional vendor tools may however be overkill for a small environment. That's why I usually run the firmware updated using the latest SPP.
Hint: Prior to running the SPP update, update the iLO firmware, and the hosts's BIOS from the iLO interface. Not only that the latest available iLO firmware, and the BIOS is newer that that on the SPP, but with the latest iLO firmware already installed, there will be no interruption of the iLO interface while updating the remaining firmware.

Unless you are running a really old firmware on the hosts, it shouldn't matter whet is updated first, SPP or ESXi. I usually go with firmware updates first.

André

[jscooper22]

Thank you Andre. Your answer provided me with a lot of pieces to this puzzle I could not find elsewhere

I am running lifecycle manager (I didn't think I had a choice since it's what came with v7). 

My iLO is updated already since I could do that without rebooting the entire server. 

This was all initially installed less than a year ago, so I'm probably not going to get a situation where esxi won't boot because the firmware is too new..

 But are you saying that, if I remove the baselines in the screenshot, there's a way to get the latest update from the lifecycle manager screen to this one? I'm honestly not sure how they ended up there in the guest place, I thought it was automatic when VMware released an update but maybe I did something in the middle of trying to figure it out the last time.

 And how do I know which HPE addon to install? There are dozens of them, including several for my particular server. But it seems very slight differences in certain drivers (and firmware?). Do I need to research each listed driver to ensure with my particular machine, things will or won't work, depending which addon I choose?

 Thank you!

Jeff

[a_p_]

With the two baseline that show up, you most likelydo not have switched to vLCM yet.

The vendor Add-Ons are automatically downloaded (if your vCenter Server has access to the VMware downloads), and can be selected in vLCM so that they match the VMware image/patch that you are going to deploy.

Please take a few minutes to watch https://www.youtube.com/watch?v=ZPD_O0a3J1I which explains that in detail.

André

[jscooper22]

Getting closer!

I'm wondering if part of my confusion because something in the vLCM is wrong. The critical host  patches baseline says it was last modified (which I assume means downloaded in this case since I didn't build it) 10 months ago. But when I select it and view the contents it includes the ESXI update that was released a couple weeks ago.

[a_p_]

That's because it's a "dynamic" baseline. The modification date is the date when the baseline's configuration has been created, or last modified.

But again, your cluster is still configured for "Update Manager" patches.

André

[jscooper22]

Thanks for indulging and sticking with me André. Much appreciated!

Jeff

[jscooper22]

I'll be applying the update (at least to my more-outdated host) this weekend. I have the critical-update and security-update chosen in the LifeCycle Manager. (Hopefully just) One more question: Why do you think I'm "configured for update manager patches?" I'm definitely in LifeCycle Manager and don't even have Update Manager available.

Thanks,

Jeff

[Sam0054]

@jscooper22 

VMware Update Manager is available on version 6.7 and older version and Lifecycle Manager is available on VMware vSphere version 7.0 and above. You cannot find Update Manager in version 7.0 and above

• To create the baseline, go to the Lifecycle Manager, create a new baseline and import the appropriate HPE custom image
• Follow screen prompt to configure baseline and wait for baseline setup to finish
• Now go to the specific host and click the update tab, add new baseline and attach the baseline created from the above step
• Click attach and remediate
• Wait for the remediation to run
• The host will be reboot and new ESXi version 7 should be available

You may check this article for further tips

https://www.cbtnuggets.com/blog/technology/system-admin/vmware-lifecycle-manager-a-step-by-step-guid...

Do give a thumbs up if this helps

Thank you

[jscooper22]

Yes it does. In fact, all the advice and articles here have helped me better wrap my head around what I thought would be a very basic operation ("update the server"). I run a small IT Dept so I like to think of myself as bright enough to at least do that and it's disconcerting when you find yourself questioning if your basic abilities are lacking and you need to ask for help upon help, or if the documentation is really that convoluted.

Part of my hesitation is likely that this is a small office (under 100 staff), not a large cloud-services provider with a big team or a rack of redundant servers or anything of that scale (just a couple guys and a server room), and the fear of installing an update only to have the host not boot afterwards and be bricked, is maybe more overwhelming than it would be if I had a bigger operation.

Now of course the Hardware Compatibility check is being ambiguous about what BIOS will work with this update, but I think that's a matter of HPE and VMWare labeling versions slightly differently, so I'll post it to different thread here or to HP's forums (though they're probably sick of me too).

I'm incredibly grateful for the help from all you with way more experience with and knowledge of these systems than I.

Thanks,

Jeff

[jscooper22]

Well, I got the HP side of things to work. I updated updated the firmware via HPE SPP Offline Mode and it worked!

I'll run the VMWare updates in the next few weeks (I have people in the office today who want to work).

Seems keeping them separate (let HP do the firmware side of things and VMware take care of the OS) is the way to go.

Now I'm getting errors in Lifecycle Manager, but I'll post those separately.

Thanks,

Jeff

[jscooper22]

Been a while I know but it's done!

I used VMWare's updates to do it; nothing from HPE (I'll probably use HPE's images when I do a full-on upGRADE at the of the year.

Updated vCenter to the latest version of 7.0.3. Took what they said it would (a couple hours).

Remediated one host (of two). This took 10 minutes.

We don't have vMotion (Essentials plus in budget for next FY) so I used StarWinds V2V to move my vCenter from Host 2 to the now-updated Host 1. This took all day; can't wait for vMotion.

Remediated Host 2.

Thanks everyone for advice and help.

[aj800]

"The modification date is the date when the baseline's configuration has been created, or last modified." 

Can you clarify a bit more on what this means?  I created a baseline of patches back in 2020 for patches that had been available between 2019 and January of 2020 for the hosts, and that baseline's still listed in my baseline list in Lifecycle Manager (7.0U3o).  I forgot about it and haven't even looked at it until today when we were doing some exploring.  Yet the "Last Modified" date shows "1 month ago".  I'm fairly certain no one else has used it or changed it, also.  What would have changed that "last modified" date?  I have another 'Predefined' one (Critical Host Patches) that says "4 years ago".  I think the last critical patches came out a few months ago.  Can you explain "dynamic" baselines?  It doesn't make a whole lot of sense to me.  What is being "modified", by who, and at what point?  Thanks.