Update Packages

When to use it

Regular patching, and immediately after a security advisory. Run it on a group of servers with Try one server first turned on, so one server takes the updates and you review it before the rest follow.

Choosing the options

Updates

• All available updates upgrades every installed package that has a newer version in the repositories the server already uses. On Ubuntu and Debian this is apt-get upgrade --with-new-pkgs; on the RHEL family dnf upgrade, or yum update where dnf is not installed.
• Security updates only installs only updates marked as security fixes. On Ubuntu and Debian this uses unattended-upgrade, which needs the unattended-upgrades package; on the RHEL family and Amazon Linux it is dnf upgrade --security, which relies on the security advisories the distribution publishes.

Choose Security updates only for servers you want to change as little as possible, such as a database in production. Choose All available updates for regular maintenance.

What it does on the server

1. Lists what would be upgraded. A dry run stops here and shows the list.
2. Installs the updates non-interactively. Configuration files you changed by hand are kept.
3. Never removes a package to make an upgrade fit. On Ubuntu, packages held back by phased updates or that would need a removal stay at their current version, and the run says how many.
4. Checks whether a reboot is needed (/var/run/reboot-required on Ubuntu and Debian, needs-restarting -r on the RHEL family). The platform never reboots a server.

Package locks held by another process, and mirrors that do not answer, are retried automatically, up to twice.

After the run

If the output says "A reboot is needed to finish applying these updates", restart the server at a convenient time. Until then, a new kernel or core library is installed but not running.

Common problems

"Security-only updates on this server need the unattended-upgrades package" — Install it once with the Command Runner: apt-get install -y unattended-upgrades, or run the playbook with All available updates.

"No waiting update is marked as a security fix, though other updates are waiting" — Some distributions and third-party repositories publish no security information, so nothing counts as a security fix. Run the playbook with All available updates to install them.

"… package(s) were kept back" — Normal on Ubuntu, which releases some updates to a percentage of servers at a time. They install on a later run.

"Installing … failed for a reason that is usually temporary" — Another process held the package lock, often an automatic update running at the same moment, or a mirror did not answer. The step was retried; run it again later if it still failed.