[pca] Oracle removed support from patchdiag.xref for --minimal option in pca?

[Jeff]

Different sysadmins have different reasons for their patching strategy.  I
am a business sysadmin, I value stability above all things.  I patch to fix
stability issues and security vulnerabilities.  I use the CPU because I have
700+ servers to patch and need a baseline to standardize on, because of the
length of time it takes to go through a patch cycle.  I also want to follow
Oracle's documented best practices so when stuff breaks and they tell me to
install a patch to fix it, I can ask why it wasn't in the CPU.

I also hope Oracle spends more time testing the CPU as an integrated group.
Nothing is more frustrating then the way Sun/Oracle releases patches for
someone looking at stability.  I would rather the patch was thoroughly
tested before release rather then quickly released.  We've seen over and
over several revisions of the same patch released within the same week,
mostly to fix problems introduced with patches released earlier in the
week.  For me, the creation of the CPU was a good thing, rather then the
insanity of the old recommended patch bundle that changed several times a
week.
Hopefully Oracle will change the old Sun patching culture, they seem to
prize stability with their database products.  My assumption is it will also
change with Solaris 11 and IPS, since the updates will be by package instead
of the kludge they use now.



On Wed, Jun 15, 2011 at 7:21 AM, Rajiv Gunja <opn.src.rocks at gmail.com>wrote:

> Martin,
> I kind of disagree on using CPU for couple of reasons.
> 1. CPU tends to change within the given release, hence the different
> revisions (Am I wrong in this assessment?)
> 2. CPU tends to install on the minimum patch revision which will get the OS
> off the vulnerability. I like to patch my servers with given Xref, which
> will solve all the issues. Example April 2011 CPU has patches from March and
> before, where most of them are obsolete/replaced when the CPU came out. So
> if we look at the latest patch included in that CPU (April 01 2011), then we
> can safely assume that if we use April 01 2011 Xref, we should get all the
> patches via PCA.
>
> Please let me know if I have my theory straight. Thanks
>
> -GGR
> --
> Rajiv G Gunja
> Blog: http://ossrocks.blogspot.com
>
>
>
> On Wed, Jun 15, 2011 at 06:24, Martin Paul <martin at par.univie.ac.at>wrote:
>
>> Ateeq Altaf wrote:
>>
>>> Could we approach this a different way by first getting a list of missing
>>> patches relevant to a patchdiag slightly *newer* than the CPU, then
>>> filter
>>> that list with the list of patches on the CPU?
>>>
>>
>> Should get you close. It also depends whether you succeed in finding the
>> closest patchdiag.xref. As soon as it contains at least one patch with a
>> newer rev than in the CPU, things get complicated.
>>
>> Another idea is to use archived copies of the various xref files and try
>> to find the one which contains all (or at least the most) of the
>> patches+revisions in the CPU list. Then you could that with "pca -l
>> all_patch_IDs_of_CPU".
>>
>>
>>  I haven't tried any of the above to see if it produces a list as I'm
>>> dreading
>>> trying to navigate Oracle support to see if there's a way to get the
>>> recent
>>> CPU patch_order file without downloading the 2GB zip file.
>>>
>>
>> I'm donwloading the 2GB file right now as I wanted to take a look at it -
>> it takes more than 12 hours. This should make clear why we all try to avoid
>> the CPU, I guess.
>>
>> There's a "Read Me" button in the flash interface of MOS, which leads to a
>> file including the patch list.
>>
>> Martin.
>>
>>
>


-- 
Jeff
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.univie.ac.at/pipermail/pca/attachments/20110615/24908527/attachment-0001.html>