[pca] specifying a specific date instead of minage

[Floyd, Chuck]

I keep the proxy server's copy frozen by including nocheckxref in its
config, and update manually for regular releases or as necessary.  We
may also manually adjust the minor revs or the R/S flags to suit our
needs and to address Sun Alerts or known issues without re-doing the
entire baseline.  As long as you know the major and minor patch
versions, you can force the application of those security patches
individually without touching the xref.

Chuck Floyd
AT&T System Hosting

-----Original Message-----
From: pca-bounces at lists.univie.ac.at
[mailto:pca-bounces at lists.univie.ac.at] On Behalf Of amy.rich at tufts.edu
Sent: Wednesday, August 27, 2008 4:15 PM
To: PCA (Patch Check Advanced) Discussion
Subject: Re: [pca] specifying a specific date instead of minage


bliss.kevin> You can either make a local copy of the patchdiag.xref on
all of
bliss.kevin> the servers on the same day.

But then you're once again limited to running pca with --nocheckxref or
it
will update whenever you run, say, pca -l.  The time between patching on
dev
and production can be as much as three months or sometimes more.

bliss.kevin> Or can run pca -d (whatever other flags you use) to
download
bliss.kevin> instead of install on the same day on all of the servers.

That defeats the purpose of having a central patch repository and takes
up too
much space on the thousands of client nodes.  It also doesn't delete the
patches once it's installed them, so you'd have to manually clean them
out
after you've finished a patch cycle.