AspiringSysadmin.com

Solaris is bundled with a tool called smpatch but my personal experience from using it is very poor. It is slow and not always that easy to use. This is of course only my personal opinion.

Fortunately Martin Paul has created a tool called Patch Check Advanced (PCA). It is fast and I find it very simple to use. The only requirement is that you have a Sun Online Account and you get it for free here. With the free account you will have access to security and driver patches. If you want access to all patches you need to purchase a service plan.

It is very easy to install pca. It is just matter of downloading the script (it is written in Perl).

If you want to see what patches you are missing you run it with the followin arguments


# ./pca -l missing


If you haven’t patched your system in a while the list may be quite long. When we only want to see the missing security patches we run pca like this

# ./pca -l missings
Using /var/tmp/patchdiag.xref from Jun/13/07
Host: xyz (SunOS 5.10/Generic_125101-08/i386/i86pc)
List: missings

Patch  IR   CR RSB Age Synopsis
------ -- - -- --- --- -------------------------------------------------------
119116 26 < 28 -S-   9 Mozilla 1.7_x86 patch
119255 36 < 38 RS-   3 SunOS 5.10_x86: Install and Patch Utilities Patch
120037 13 < 19 RS-  13 SunOS 5.10_x86: libc nss ldap PAM zfs patch
120095 11 < 12 RS-  13 X11 6.6.2_x86: xscreensaver patch
120273 06 < 13 RS-  16 SunOS 5.10_x86: SMA patch
122213 18 < 19 -S-   2 GNOME 2.6.0_x86: GNOME Desktop Patch
124259 05 < 06 RS-   2 SunOS 5.10_x86: ufs and nfs driver patch
125101 08 < 09 RS-   2 SunOS 5.10_x86: Kernel Update patch
125720 03 < 08 RS-   1 X11 6.8.0_x86: Xorg server patch

The first column shows the patch id, IR is the installed revision, CR is the current revision, RSB is Recommended/Security/Bad (type of patch), Age is how many days the patch has been available (it is approx. 16 days since I last patched my server).

Lets say we want to see the readme file for 125101-09 patch. You then run pca like this


# ./pca --user=my.user.name --passwd=my.password -r 125101-09

As you can see you must now give your SOA username and password. The readme file will be downloaded and it will be viewed in a pager.

The next step would be to install a specific patch. To install one single patch you can do it like this

# ./pca --user=my.user.name --passwd=my.password -i 125101-09


This will download the patch and install it for you. To install all missing security patches

# ./pca --user=my.user.name --passwd=my.password -i missings


Now if you want to make it very easy for yourself you run pca from cron once every week (or every day if you are paranoid) and email the result. You will get a list of all missing patches within one week without having to follow all security announcements all the time.

There are many more options. You can e.g collect informations on remote machines and run pca in one location. pca can then download all the missing patches and you can slowly build your own local repository of patches that you can push out to the other machines. Take a look at the man page for pca for more information.

Do you need system administration assistance? If you like what you are reading please consider subscribing to the RSS feed. If you have feedback or if you find the article useful please leave a comment below.