Chapter 9. Managing Errata

Red Hat Satellite 6 provides various methods to manage and apply errata. As discussed in Section 7.4, “Content Filters”, we can use Content Views and content filters to limit errata. Such filters include:

As an example, we can create a content filter to exclude errata after a certain date. This ensures our production systems in the application life cycle are kept up to date to a certain point. Then we can modify the filter’s start date to introduce new errata into our testing environment. This is so we can test the compatibility of new packages into our application life cycle.

For instructions on creating a content filter, see Section 7.4.1, “Creating a Content Filter”.

When a Content View contains errata, we can apply it to our systems. Each system registered to your Red Hat Satellite 6 includes an errata management screen where you can apply multiple errata to the system. In addition, Red Hat Satellite 6 contains an errata management feature where you can search, review, and apply errata to multiple systems.

The following procedure describes how to view and filter the available errata and how to display metadata of the selected advisory.

For this procedure, we aim to apply some errata to a system. This procedure follows on from Section 8.2, “Using Activation Keys” and assumes you registered a test Red Hat Enterprise Linux 7 system to your Satellite Server. In this example, we aim to apply the following erratum:

Errata ID:   RHSA-2016:0008
Title:       Moderate: openssl security update
Type:        security
Severity:    Moderate
Issued:      2016-01-07
Updated:     2016-01-07
Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

Let’s apply errata for OpenSSL. Navigate to the search bar and enter title ~ openssl. This searches for any errata with openssl in the title. Select the RHSA-2016:0008 errata and click Apply Selected. A confirmation message appears. Click Apply.

Satellite Server starts a task to update all packages associated with the selected errata. When the task completes, Satellite Server lists the packages updated and their new versions in the Details section. For example:

1:openssl-1.0.1e-51.el7_2.2.x86_64
1:openssl-libs-1.0.1e-51.el7_2.2.x86_64

Log in to the client system and confirm the errata updates:

[root@client ~]# yum list openssl openssl-libs

# hammer host errata list \
--host client.example.com \
--search "title ~ openssl" \
--organization "ACME"

Apply the most recent erratum to the client system. Identify the erratum to apply using the Errata ID:

# hammer host errata apply \
--host client.danssat.net \
--errata-ids RHSA-2016:0008 \
--organization "ACME"

Log in to the client system and confirm the errata updates:

[root@client ~]# yum list openssl openssl-libs

The Red Hat Satellite 6 Web UI provides an errata management tool to help review and apply errata to multiple systems. For this example, we use the same erratum (RHSA-2016:0008) from Section 9.3, “Applying Errata to Individual Systems”.

Let’s apply a single OpenSSL errata to our systems through this tool. Navigate to the search field and enter title ~ openssl. This shows all errata relating to OpenSSL. Although this includes bug fixes and enhancements, note that Satellite Server cannot install these errata to our test system due to the filter we created in Section 7.4.1, “Creating a Content Filter”.

Click on the most recent OpenSSL errata. In our example, this is RHSA-2016:0008.

The Details screen for this erratum appears and provides a description of what the erratum resolves.

Navigate to the Content Hosts subtab. This displays a list of all applicable systems for this errata. We select Only show content hosts where the errata is currently installable in the host’s Lifecycle Environment to limit this list to systems that can actually install the errata.

Select our test system and click Apply to Hosts. A confirmation screen appears regarding the errata installation. Click Confirm.

Satellite Server starts a task to update the erratum’s packages for each selected system. When the task completes, log in to the client system and confirm the errata updates:

[root@client ~]# yum list openssl openssl-libs

List all OpenSSL errata:

# hammer erratum list --search "title ~ openssl" --organization "ACME"

Search again, restricting the list to installable errata:

# hammer erratum list \
--errata-restrict-installable true \
--search "title ~ openssl" --organization "ACME"

Find out details about this errata:

# hammer erratum info --id RHSA-2016:0008

List the systems that this erratum is applicable:

# hammer host list \
--search "applicable_errata = RHSA-2016:0008" \
--organization "ACME"

Apply the errata to a single system:

# hammer host errata apply \
--host client.example.com \
--errata-ids RHSA-2016:0008

Enter the following command for each client system and replace --host with the name of the system for each execution.

# for HOST in `hammer \
--csv --csv-separator "|" host list \
--search "applicable_errata = RHSA-2016:0008" \
--organization "ACME" | tail -n+2 | awk \
-F "|" '{ print $2 }'` ; do echo \
"== Applying to $HOST ==" ; hammer host errata apply \
--host $HOST --errata-ids RHSA-2016:0008 ; done

This command identifies all hosts with RHSA-2016:0008 as an applicable erratum and then applies the erratum to each host.

Log in to the client system and confirm the errata updates:

[root@client ~]# yum list openssl openssl-libs

You can configure email notifications for Satellite users as described in Configuring Email Notifications in Administering Red Hat Satellite. Users can receive a summary of applicable and installable errata, notifications on Content View promotion or after synchronizing a repository.

This chapter provided some guidelines on how Red Hat Satellite 6 manage errata and applies them to systems.

The next chapter explores container management in Red Hat Satellite 6.