Automate patch download & deployment

UNIX AIX
1

Hi all,

I am exploring how I can automate the download and patching of my AIX servers via a central management mechanism.

I will need to patch all my servers annually to a certain pre-determined Service Pack (SP) level.

So far I performed some online search and found 2 products that might be able to do this. IBM Endpoint Manager and BMC Server Automation.

Does anyone have experience with either of the products? What are the pros & cons? Also, are there any other products out there that can do the same?

2

Thanks for the question.

I regret I have a few in response first.

  • What sort of environment do you have in play? Is it just 2-3 servers or many?
  • Do you have a NIM server (or more)
3

Check out the AIX command suma....

suma

1 Like
4

Hi,

We have 30 - 50 LPARs.
All Service Packs are copied & patched manually.

At the moment no NIM & SUMA server yet.
Question is, is IBM endpoint manager utilizing the underlying SUMA and NIM functions to download and install patches?

5

IBM endpoint manager uses NIM so you'll need a NIM server as well.
The IBM endpoint manager documentation includes building the NIM server.
You'll want a NIM server anyway for an estate like that, you might even want two depending on how many physical systems you have.
They can be built on a small LPAR or often people use an old, small, dedicated system.

6

Hi Dukessd,

Thank you for the reply.

For this case can I assume the NIM+Endpoint acts like a satellite server?

Seems like product from lumension (Patch and Remediation) can do similar stuff.

Are there any other products out there? I am tasked to do an evaluation on the various products.

7

If you define "acts like" losely enough: yes.

With 30-50 LPARs, like you said above, you should definitely have a NIM-Server anyways. NIM-Servers are not only helpful in software deployment but also for configuration management, installation of new systems, systems backup, system recovery and the like.

The big exception being a heavily firewalled environment: this is where NIM servers really suck, because they need an awful lot of ports and most firewall people are reluctant to tear so many big holes into their firewall. I remember working once in a shop where you couldn't even "ping" the default gateway. One needed to get special permission to even use ping to test the failover node on a cluster. NIM was not used there.

If you do not have such a paranoid environment (and, frankly, i do not wish anybody to undergo such a torture) i strongly suggest to set up a NIM server and make all your LPARs NIM clients. It is quite easy to do, a matter of maybe 3-4 hours, all in all, to set up the basic structures and the resources needed most.

I hope this helps.

bakunin