Deploying VMWare Patches to ESX 3.x Servers

Recently, VMware released their Update Manager to handle patch management of ESX servers.

For those of you who haven't implemented it, here's a setup of reasonably robust scripts to do the patching via the Deployment console.

Use the ESX-100xxxx patch number as the job name.

1. Check to see if the patch is installed

#Check to see if this patch is already installed
#!/bin/sh
esxupdate query | grep %JOBNAME%

Set this job to STOP on a "Success" (exit code zero), and Continue (sucessfully) on exit code 1.

grep will return exit code 0 if the text is found (ie patch is installed), 1 if it is not.

2. Check that the host is in maintenance mode

#Check maintenance mode status
#!/bin/sh
#There needs to be a 2 minute delay, just in case this is running straight after another patch which caused a reboot
sleep 120
test `vimsh -n -e hostsvc/runtimeinfo | grep 'inMaintenanceMode' |awk '{print $3}' | sed 's/,//'` = true

For this task, have the job continue on error code 0 and stop on error code 1.

3. Create patch directory

#Create patch directory
#!/bin/sh
mkdir -p /var/updates

4. Download Patch

#Download patch
#!/bin/sh
cd /var/updates
esxcfg-firewall -e smbClient
smbclient --user=username //%SITE%/eXpress "password" -c 'cd "\path\to\ESX\patches"; get %JOBNAME%.tgz'
smbclient --user=username //%SITE%/eXpress "password" -c 'cd "\path\to\ESX\patches"; get %JOBNAME%.tgz.md5'
esxcfg-firewall -d smbClient

To ensure the file transfer works, have both the patch file and an MD5 has in your depot. This is checked in Step 5.

5. Verify MD5 hash

#Verify MD5 sum
#!/bin/sh
cd /var/updates/
md5sum --status --check %JOBNAME%.tgz.md5

Once again, the return code for md5sum will determine whether or not the job is successful. 0 is good, 1 is bad.

6. Decompress and install patch

#Decompress and install patch
#!/bin/sh
cd /var/updates
gzip -d %JOBNAME%.tgz
tar -xf %JOBNAME%.tar
cd %JOBNAME%
esxupdate update

7. Clean up after install

#Clean up after install
#!/bin/sh
cd /var/updates
rm -rf %JOBNAME%
rm -f %JOBNAME%.tar
rm -f %JOBNAME%.tgz.md5

Always leave the camp site in the same or better condition!

It is possible to add a script to bring the server out of maintenance mode after clean-up, but that's not all that useful if you're deploying a number of patches. So, I recommend leaving it as a manual process.