Is it possible to remove a patch from the Non-Critical Host Patches baseline in Update Manager (vCenter 6.7)?

[pasalott]

We need to update the qlogic drivers for our HP ESXi hosts (ESXi 6.7).  I've uploaded the patch to a new baseline to deploy, but for some reason this patch is also showing for the Non-Critical Host Patches baseline.  When I scan our Cisco UCS hosts for updates, the Non-Critical baseline now shows as non-compliant with one patch to install, which is the qlogic patch for the updated drivers.  The UCS blades do not have any qlogic devices.  I haven't tried remediating one of the UCS hosts yet.  I would like to be able to remove the qlogic patch from the Non-Critical baseline to avoid any possible issues.  When I check in Update Manager, I only have the option to remove it from the custom baseline I created.

[lucasbernadsky]

Hi pasalott. How are you?

You can create a custom baseline, uploading the .vib you need and then applying them to hosts. Create a Host Upgrade Baseline and Working with Baselines and Baseline Groups.

To be honest, I don't think you can remove only one parch from the non-critical host patches, since all the patches belong to the same baseline.

Please keep me updated!

Regards

[pasalott]

That is what I did.  I created a custom baseline and uploaded the vib to that baseline, and attached that baseline to our HP ESXi hosts to update the qlogic drivers.  But for some reason the patch also shows under the Non-Critical Host patches baseline, which is attached to all our hosts (HP and UCS).  I am unable to remove this patch from the Non-Critical Host Patches baseline.  This qlogic driver patch does not need to be installed on our UCS blades, but yet when scanning, the Non-Critical baseline shows as non-compliant due to the qlogic vib showing as missing for that server, even though there are no qlogic devices on our UCS blades. 

My question is one, is it normal for all patches you upload to a custom baseline to also show under the Non-Critical (predefined) baseline?  And two, how can I attempt to prevent the qlogic patch from being deployed from the Non-Compliant Host Patches (predefined) baseline to our UCS hosts without having to create a custom baseline for non-critical patches?  We use the predefined baselines for critical and non-critical to automatically download new patches from VMware.

[lucasbernadsky]

In that case, I think you will need to use one custom baseline for each vendor ESXi. The non-critical patches download the default patches from the same webpage.

You can set up Update Manager to download patches from different sources (Configuring the Update Manager Download Sources​) but I don't think that it will solve the issue you have.

Your UCS and HPE servers use the same qlogic adapters? If not, I think it will be ok to stage the patches. I would like to have more information about this scenario

[wlodeek]

I have the same situation with qlogic FC driver.

Any suggestion how to remove that patch from non-critical (predefined) baseline?

[JDMils_Interact]

If I'm not mistaken, you can not only customise the Non-Critial & Critical baselines but also choose which patches you wanted to deploy and which you did not when using the FLEX client. This allowed me to exclude 5.5, 6.0 & 6.5 patches for my newly upgraded 6.7 vSphere environment. The HTML5 client does not allow you to do this- it's all or nothing.

For example, when I was upgrading our hosts from 6.0 to 6.5 to 6.7, I found that once the host was upgraded, out of the 60-odd patches vSphere wanted me to install, I really only needed to install the latest TWO patches which from memory were roll-ups (two patches which superceded the other 58 patches in the list), and I was not able to do this with the HTML5 client, however I could with the FLEX client, until Adobe killed Flash off, now that's impossible.