Chapter 8. Performing post-upgrade tasks

1. Remove any remaining Leapp packages from the exclude list in the /etc/dnf/dnf.conf configuration file, including the snactor package. During the in-place upgrade, Leapp packages that were installed with the Leapp utility are automatically added to the exclude list to prevent critical files from being removed or updated. After the in-place upgrade, you must remove these Leapp packages from the exclude list before they can be removed from the system.

   • To manually remove packages from the exclude list, edit the /etc/dnf/dnf.conf configuration file and remove the desired Leapp packages from the exclude list.

   • To remove all packages from the exclude list:

     # yum config-manager --save --setopt exclude=''

     Copy to Clipboard Toggle word wrap

2. Remove remaining RHEL 7 packages, including remaining Leapp packages.

   1. Determine old kernel versions:

      # cd /lib/modules && ls -d *.el7*

      Copy to Clipboard Toggle word wrap

   2. Remove weak modules from the old kernel. If you have multiple old kernels, repeat the following step for each kernel:

      # [ -x /usr/sbin/weak-modules ] && /usr/sbin/weak-modules --remove-kernel <version>

      Copy to Clipboard Toggle word wrap

      Replace <version> with the kernel version determined in the previous step, for example:

      #  [ -x /usr/sbin/weak-modules ] && /usr/sbin/weak-modules --remove-kernel 3.10.0-1160.25.1.el7.x86_64

      Copy to Clipboard Toggle word wrap
      Note

      Ignore the following error message, which is generated if the kernel package has been previously removed:

      /usr/sbin/weak-modules: line 1081: cd: /lib/modules/<version>/weak-updates: No such file or directory

      Copy to Clipboard Toggle word wrap

   3. Remove the old kernel from the boot loader entry. If you have multiple old kernels, repeat this step for each kernel:

      # /bin/kernel-install remove <version> /lib/modules/<version>/vmlinuz

      Copy to Clipboard Toggle word wrap

      Replace version with the kernel version determined in the previous step, for example:

      # /bin/kernel-install remove 3.10.0-1160.25.1.el7.x86_64 /lib/modules/3.10.0-1160.25.1.el7.x86_64/vmlinuz

      Copy to Clipboard Toggle word wrap

   4. Locate remaining RHEL 7 packages:

      # rpm -qa | grep -e '\.el[67]' | grep -vE '^(gpg-pubkey|libmodulemd|katello-ca-consumer)' | sort

      Copy to Clipboard Toggle word wrap

   5. Remove remaining RHEL 7 packages, including old kernel packages, and the kernel-workaround package from your RHEL 8 system. To ensure that RPM dependencies are maintained, use YUM or DNF when performing these actions. Review the transaction before accepting to ensure no packages are unintentionally removed.

      For example:

      # yum remove kernel-workaround $(rpm -qa | grep \.el7 | grep -vE 'gpg-pubkey|libmodulemd|katello-ca-consumer')

      Copy to Clipboard Toggle word wrap

   6. Remove remaining Leapp dependency packages:

      # yum remove leapp-deps-el8 leapp-repository-deps-el8

      Copy to Clipboard Toggle word wrap

   7. Remove any remaining obsolete directories:

      # rm -r /lib/modules/*el7*

      Copy to Clipboard Toggle word wrap

3. If you used RHEL 7 ELS billing through the host metering agent, remove the ELS certificate:

   # rm -f /etc/pki/product/204.pem

   Copy to Clipboard Toggle word wrap

4. Optional: Remove all remaining upgrade-related data from the system:

   # rm -rf /var/log/leapp /root/tmp_leapp_py3 /var/lib/leapp

   Copy to Clipboard Toggle word wrap
   Important

   Removing this data might limit Red Hat Support’s ability to investigate and troubleshoot post-upgrade problems.

5. Disable YUM repositories whose packages cannot be installed or used on RHEL 8. Repositories managed by RHSM are handled automatically. To disable these repositories:

   # yum config-manager --set-disabled <repository_id>

   Copy to Clipboard Toggle word wrap

   Replace <repository_id> with the repository ID.

6. Replace the old rescue kernel and initial RAM disk with the current kernel and disk:

   1. Remove the existing rescue kernel and initial RAM disk:

      # rm /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 

      Copy to Clipboard Toggle word wrap

   2. Reinstall the rescue kernel and related initial RAM disk:

      # /usr/lib/kernel/install.d/51-dracut-rescue.install add "$(uname -r)" /boot "/boot/vmlinuz-$(uname -r)"

      Copy to Clipboard Toggle word wrap
      Note

      If your system’s kernel package has a different name, such as on real-time systems, replace kernel-core with the correct package name.

   3. If your system is on the IBM Z architecture, update the zipl boot loader:

      # zipl

      Copy to Clipboard Toggle word wrap
7. Optional: Review, remediate, and then remove the rpmnew, rpmsave, and leappsave files. Note that rpmsave and leappsave are equivalent and can be handled similarly. For more information, see What are rpmnew & rpmsave files?
8. Re-evaluate and re-apply your security policies. Especially, change the SELinux mode to enforcing. For details, see Applying security policies.

Verification

1. Verify that the old kernels have been removed from the boot loader entry:

   # grubby --info=ALL | grep "\.el7" || echo "Old kernels are not present in the boot loader."

   Copy to Clipboard Toggle word wrap

2. Verify that the previously removed rescue kernel and rescue initial RAM disk files have been created for the current kernel:

   # ls /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 
   # lsinitrd /boot/initramfs-*rescue*.img | grep -qm1 "$(uname -r)/kernel/" && echo "OK" || echo "FAIL"

   Copy to Clipboard Toggle word wrap

3. Verify the rescue boot entry refers to the existing rescue files. See the grubby output:

   # grubby --info $(ls /boot/vmlinuz-*rescue*)

   Copy to Clipboard Toggle word wrap

4. Verify that you have removed all RHEL 7 packages:

   # rpm -qa | grep -e '\.el[67]' | grep -vE '^(gpg-pubkey|libmodulemd|katello-ca-consumer)' | sort

   Copy to Clipboard Toggle word wrap
   Note

   This command might also list third-party packages.

5. If you used RHEL 7 ELS billing through the host metering agent, verify that ELS add-on is not longer installed and the related certificate is not present on the system:

   # subscription-manager list --installed
   # ls /etc/pki/product/204.pem && echo "The ELS certificate is still present."

   Copy to Clipboard Toggle word wrap

   If any installed products have an engineering product ID of 204 or the certificate is present, then ELS might be still active on the system and you might continue to be billed.