[pca] specifying a specific date instead of minage

[Martin Paul]

amy.rich at tufts.edu wrote:
> If you're always using an out of date patchdiag.xref file, how can you tell
> what patches you're behind on on every client machine?  I think the main issue
> I'm having is that I want to compare to BOTH the latest and a specified
> baseline on every client.  

You really will have to deal with different copies of patchdiag.xref, 
then. As Sun removes information about old patch revisions from the xref 
file when a new revision is published, there's no way to correctly 
calculate a state X days ago. Therefore, the minage option doesn't work 
flawlessly either. Here's an example:

On Jan 1st, patch 111111-01 required 222222-01. Two weeks later, 
111111-02 is released. While 222222-01 still only requires 111111-01, 
information about that rev. 01 will be gone from the xref file, and pca 
will show 111111-02 in the list of missing patches, although it is newer 
than minage.

What about this approach: Most probably you already have a local caching 
proxy, and xrefurl set to point at the proxy on all clients. So "pca -l" 
on all clients will always get a recent copy from the proxy and show the 
current list of missing patches.

Now create sub-directories like "20080801" on your webserver (doesn't 
have to be the same as the proxy server) and put patchdiag.xref from 
that date into these directories. Now you can run:

   pca -X /tmp --xrefurl http://www/xref/20080801

on a client to get a list of missing patches based on the xref file from 
Aug 1st. Collect multiple xref files in similar directories for 
different baselines.

Caveat: pca will not overwrite a newer xref file with an older xref file 
(that's because Sun at some time had problems with SunSolve; instead of 
updating the xref file they placed random old versions of the file on 
sunsolve.sun.com). You might have to remove /tmp/patchdiag.xref first 
when going to an older xref file.

You could create e.g. /var/tmp/pca/20080801/ directories on the clients 
and put a pca.conf in there, setting xrefurl to the same date and 
xrefdir to ".". When running "pca" in that directory, it will 
automatically produce the correct output for that date. It's easy to 
compare the patch reports for two different dates (baseline, current) 
then with tkdiff/diff.

> * information about how machines compare to the latest released patches
> * baseline install consistency during a patch cycle
> * information about how machines compare to said baseline during a patch cycle
> * the flexibility of installing a specific patch on a given machine when the
>   need arises

If I get it right, all of this should be possible with the above 
approach, and maintenance (like collecting the different xref files) is 
simple enough.

Hope this helps,

Martin.