Chapter 7. Performing post-upgrade tasks on the RHEL 9 system

1. Remove any remaining Leapp packages from the exclude list in the /etc/dnf/dnf.conf configuration file, including the snactor package, which is a tool for upgrade extension development. During the in-place upgrade, Leapp packages that were installed with the Leapp utility are automatically added to the exclude list to prevent critical files from being removed or updated. After the in-place upgrade, these Leapp packages must be removed from the exclude list before they can be removed from the system.

   • To manually remove packages from the exclude list, edit the /etc/dnf/dnf.conf configuration file and remove the desired Leapp packages from the exclude list.

   • To remove all packages from the exclude list:

     # dnf config-manager --save --setopt exclude=''

2. Remove remaining RHEL 8 packages, including remaining Leapp packages.

   1. Remove the old kernel packages from the RHEL 9 system. For more information on removing kernel packages, see What is the proper method to remove old kernels from a Red Hat Enterprise Linux system?

   2. Locate remaining RHEL 8 packages:

      # rpm -qa | grep -e '\.el[78]' | grep -vE '^(gpg-pubkey|libmodulemd|katello-ca-consumer)' | sort

   3. Remove remaining RHEL 8 packages from your RHEL 9 system. To ensure that RPM dependencies are maintained, use DNF when performing this action. Review the transaction before accepting to ensure no packages are unintentionally removed.

      For example:

      # dnf remove $(rpm -qa | grep \.el[78] | grep -vE 'gpg-pubkey|libmodulemd|katello-ca-consumer')

   4. Remove remaining Leapp dependency packages:

      # dnf remove leapp-deps-el9 leapp-repository-deps-el9

3. Optional: Remove all remaining upgrade-related data from the system:

   # rm -rf /var/log/leapp /root/tmp_leapp_py3 /var/lib/leapp

   Important

   Removing this data might limit Red Hat Support’s ability to investigate and troubleshoot post-upgrade problems.

4. Disable DNF repositories whose packages are not RHEL 9-compatible. Repositories managed by RHSM are handled automatically. To disable these repositories:

   # dnf config-manager --set-disabled <repository_id>

   Replace repository_id with the repository ID.

5. Set the current kernel command line arguments to the new default to ensure that future kernel updates boot with correct parameters:

   # BOOT_OPTIONS="$(tr -s "$IFS" '\n' </proc/cmdline | grep -ve '^BOOT_IMAGE=' -e '^initrd=' | tr '\n' ' ')"
   # echo $BOOT_OPTIONS > /etc/kernel/cmdline

6. Replace the old rescue kernel and initial RAM disk with the current kernel and disk:

   1. Remove the existing rescue kernel and initial RAM disk:

      # rm /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 

   2. Reinstall the rescue kernel and related initial RAM disk:

      # /usr/lib/kernel/install.d/51-dracut-rescue.install add "$(uname -r)" /boot "/boot/vmlinuz-$(uname -r)"

   3. If your system is on the IBM Z architecture, update the zipl bootloader:

      # zipl

7. Re-evaluate and re-apply your security policies. Especially, change the SELinux mode to enforcing. For details, see Applying security policies.

Verification

1. Verify that the previously removed rescue kernel and rescue initial RAM disk files have been created for the current kernel:

   # ls /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 
   # lsinitrd /boot/initramfs-*rescue*.img | grep -qm1 "$(uname -r)/kernel/" && echo "OK" || echo "FAIL"

2. Verify the rescue boot entry refers to the existing rescue files. See the grubby output:

   # grubby --info $(ls /boot/vmlinuz-*rescue*)