Linux baseline patching

Having issues with creating a Linux baseline for patching RHEL 8 systems. Working from the following chart

Fixlet IDTask

200 Delete RHEL 8 Package List File for Multiple-Package Baseline Installation 0/200
300 TROUBLESHOOTING: RHEL 8 Patching Deployment Logs - Cleanup 2/200
301 Import RPM-GPG-KEY-redhat-release - RHEL 8 200/200
201 Enable the Multiple-Package Baseline Installation feature - RHEL 8 200/200

In my environment, Fixlet 200 is not accessible to any of my systems. Unable to create baselines to patch servers. How would I create the baselines for patching these systems.

You haven’t said what your issue is?
One thing I’d point out is that the “import GPG key” should be run first, separately from the baseline. The ‘prefetch’ commands from the patches, that run before the Action executes, will depend on the GPG keys already being set up.

You also don’t say whether you’re using the RHSM plugin, are you using that and if so have you configured the system entitlement certificate?

For my test system, I’ve imported GPG key. I’ve setup the dashboards in my environment. The RHSM plugin hs been set version 1.0.7.0

what is system entitlement cert

For my test system, I’ve imported GPG key. I’ve setup the dashboards in my environment. The RHSM plugin hs been set version 1.0.7.0

Red Hat requires a subscription to download their content. The entitlement cert is what attaches the RHSMPlugin to your Red Hat Subscription. See https://help.hcltechsw.com/bigfix/10.0/patch/Patch/Patch_RH/c_setting_up_rhsm_certificates.html

I’m receiving content. BigFix is populated with RHEL 8 patches. I have ran the gpg-key for rhel 8 on test system. the task to Delete RHEL 8 Package is not applicable to any of my systems which is preventing me from crea
ting baselines. individually, patches can be applied

https://help.hcltechsw.com/bigfix/10.0/patch/Patch/Patch_RH/t_installing_multiple_packages_in_a_baseline.html

Yeah, reading that page, I see how this is not clear.
For a Red Hat 8 Multi-Package Baseline deployment, your Baseline should start with these tasks. These set the client up to begin a multi-package install. It doesn’t matter whether Task 200 is relevant, that’s just meant to clean up after any prior run of a multi-package baseline.

Fixlet ID Task
200 Delete RHEL 8 Package List File for Multiple-Package Baseline Installation
300 TROUBLESHOOTING: RHEL 8 Patching Deployment Logs - Cleanup
301 Import RPM-GPG-KEY-redhat-release - RHEL 8
201 Enable the Multiple-Package Baseline Installation feature - RHEL 8

After these components, you need to include all of the Fixlets that you want to apply as part of the Baseline.

At the end of the Baseline after all of your RPM fixlets, you need to append

Fixlet ID Task
101 Multiple-Package Baseline Installation - RHEL 8 - x86_64

During the baseline execution, you may observe a ‘failed’ status for each of the RPM packages, that changes to Fixed after that last component Task 101 completes. This is because instead of executing each RPM during the baseline component run, all it’s doing is resolving and downloading all of the RPM package dependencies and queuing all of the RPMs for later installation. Then, that last component Task 101 actually executes the RPM / DNF commands to install all of the queued RPMs at once.

That all sounds complicated, but it’s a lot faster & more efficient than running each patch fixlet separately. Without a Multi-Package Installation Baseline, each Fixlet has to download the RPM repo metadata separately to do dependency resolution; with a Multi-Package Baseline, that repo metadata is only downloaded once and then reused for each component action.

2 Likes

Thank you for your help. I was able to complete a baseline with your. The baseline was adjusted to include Fixlet ID’s 200, 300 and 201. 101 was placed at the end of the baseline. I applied 301 to the client outside the baseline, since its only needed once. I had to modify the 200 because its initial relevance 2 to true since it was not picking up RHEL 8 servers in my environment.

This was removed “exist file ((if(exist property “storage folder”) then pathname of storage folder of client else pathname of client folder of current site & “/…/…”) & “/EDRDeployData/MultiPkgInstall.txt”)” andchnged to true.

Baseline were completed successfully after this change was made.

Glad it helped.

You shouldn’t need to force Task 200 to be True though; if it’s false, that just means a previous multi-package baseline has not been run, so no cleanup is needed, and this task would just get skipped when you deploy the baseline

The reason why I changed the relevance was to add the task to the baseline. Otherwise, I was unable to select the task

Oh, you may need to select the “View non-relevant content” near the top of the Console.

I did and the results were that the task did not hve any relevance on any system. when it was edited and I removed the questionable relevance and ran it, the baselines executed without any problems

Ok, well, if 200 is not relevant it doesn’t need to run on the system, that task would just get skipped when it’s part of a baseline but it’s not relevant. No harm in forcing it to run though that I can see.