Scanning Patch Compliance

Prerequisites

• Before performing a patch scan, you have created a patch baseline by referring to Creating a Patch Baseline and set it as the preset patch baseline.
• Before performing a patch scan, you have bound the selected instance to an EIP or NAT gateway so that the instance can access the internet.

Precautions

If an instance cannot be selected, check whether:

• The UniAgent status of the instance is normal.
• The OS is supported by the COC patch management function.
• The instance is in the stopped state.

Creating a Patch Scan Task

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Patch Management. The Patch Management page is displayed.
4. On the displayed page, click the Patch Scanning tab and choose a resource type to create.

   By default, ECS is selected.

5. Click Create Patch Scanning Task.
6. Set parameters in the Execution Account & Region area.
   Execution Type: Select Single or Cross Account.

   • Single: Execute this job only under the current account.
   • Cross Account: Execute this job using multiple organization member accounts.
   

   • To use this function, you need to add the account to an organization, configure the agency permissions, and enter the agency name in advance. For details, see Enabling COC Cross-Account Management.

7. Set a scheduled task. The Execution Mode can be Execute immediately or Scheduled execution.
   • Execute immediately: Execute the scanning task immediately after it is created.
   • Scheduled execution: Configure the scheduled task details.

     Table 1 Scheduled task parameters

     Parameter	Description
     Time Zone	Select the time zone where the scheduled task is executed from the drop-down list.
     Timing Type	Select a scheduled type. Single execution: A scheduled task is executed once at a specified time. Periodic execution: A task is periodically executed based on the specified rule until the rule expires.
     Execution Time	It is used together with the timing type. For a one-time execution, set this parameter to the execution time. For periodic execution, select either of the following options: Simple: Select the execution time by week. Cron: Set the execution time using a cron expression. For details, see Using Cron Expressions.
     Rule Expired	This parameter needs to be set when Timing Type is set to Periodic execution. Enter the end time of the periodic execution rule.
     Notification Policy	Policy for sending notifications. The options are Start execution, Execution failed, and Execution succeeded. You can select multiple options. Start execution: When a scan job starts, a notification is sent to the specified recipient. Execution failed: When a scan job fails to be executed, a notification is sent to the specified recipient. Execution succeeded: When a scan job is successfully executed, a notification is sent to the specified recipient.
     Recipient	Select Shift or Individual. Shift: Select a shift scenario and a role from the drop-down lists based on the configured values. For details about how to configure a shift, see Shift Schedule Management. Individual: Select a reviewer. For details about how to configure a reviewer, see Personnel Management.
     Notification Mode	Select a notification channel from the drop-down list. Default: The notification channel selected in the subscription notification settings of the reviewer is used by default. For details about how to set the default notification channel, see Selecting a Notification Method. SMS, WeCom, DingTalk, Lark, and Email: Notifications are sent based on the information reserved by the reviewer. For details about how to set the reviewer information, see Modifying Personnel Information.

8. Configure the basic information.
   • If Execution Mode is set to Execute immediately, set this parameter based on the information in Table 2.

     Table 2 Basic information for immediate execution

     Parameter	Description
     Executed By	The preset value is root and cannot be changed.
     Timeout Interval	The maximum duration allowed for a scan.

   • If Execution Mode is set to Scheduled execution, set this parameter by referring to Table 3.

     Table 3 Basic information about scheduled task execution

     Parameter	Description
     Task Name	You are advised to name the task based on the application scenario. The value can contain 3 to 100 characters, including letters, digits, hyphens (-), and underscores (_).
     Enterprise Project	Select an enterprise project from the drop-down list.
     Version	Enter a version number. The preset version is 1.0.0.
     IAM Agency	Select an agency from the drop-down list. If the selected agency does not have sufficient permissions, the task cannot be executed. Select another agency or create an agency.

9. Click Add and select an instance.

   Table 4 Parameters for selecting an instance

   Parameter	Description
   Selection Method	Select an instance selection method. Manual Selection: Manually select one or more instances based on settings of Enterprise Project, View Type, Resource Type, Region, and Target Instance. Select All: The system automatically selects all instances based on settings of Enterprise Project, View Type, Resource Type, Region, and Target Instance.
   Enterprise Project	Select an enterprise project from the drop-down list. You can choose All.
   View Type	Select a view type. CloudCMDB resources: Select an instance by resource type. CloudCMDB application groups: Select an instance by application group.
   Resource Type	The value can be ECS, CCE, or BMS. Note: When Execution Mode is set to Scheduled execution, Resource Type cannot be set to CCE.
   Region	Select a region from the drop-down list.
   Target Instance	Set filter criteria in the filter box and select the displayed instances manually or automatically.

10. Configure Batch Policy and Suspension Policy.

    Table 5 Parameter description

    Parameter	Description
    Batch Policy	Select Automatic, Manual, or No Batch. Automatic: The selected instances on which you want to perform operations are automatically divided into multiple batches based on the default rule. Manual: You can manually create multiple batches and add instances to each batch as required. No Batch: All instances on which you want to perform operations are in the same batch.
    Suspension Policy	A preset rule for automatically stopping the asset patch compliance scan task. You can set a target execution success rate. If the number of failed servers reaches the threshold derived from this success rate, the service ticket is flagged as abnormal and execution stops immediately. The success rate ranges from 0 to 100 with precision to one decimal point.

11. Click OK. In the displayed dialog box, confirm the information and click OK again to start the service ticket.

    The system automatically directs you to the service ticket details page. You can view the patch scan ticket execution records by referring to Viewing the Execution Records of a Patch Scan Service Ticket.

Viewing the Execution Records of a Patch Scan Service Ticket

1. Log in to COC.
2. In the navigation pane on the left, choose Task Management > Execution Records. The task execution records page is displayed.
3. Click Patch Tickets. The patch ticket record page is displayed.
4. Click the patch ID of the patch service ticket whose Ticket Type is set to Scan. The service ticket details page is displayed.

   On the service ticket details page, you can view the service ticket execution status, such as the start time, end time, status, and execution duration.

5. Perform the operations listed in the following table based on the service ticket status.

   Table 6 Operation description

   Service Ticket Status	Operation
   Executing	If you want to pause the next batch when the current batch is executed, click Pause in the upper right corner.
   	Click Forcibly End in the upper right corner to stop the patch scan service ticket.
   Paused	Click Continue in the upper right corner to continue the patch scan service ticket.
   	Click Forcibly End in the upper right corner to stop the patch scan service ticket.
   Abnormal	Click the Abnormal tab in the Execution Information area. Locate an abnormal batch and click Retry in the Operation column.
   	Click the Abnormal tab in the Execution Information area. Locate an abnormal batch and click Cancel in the Operation column.

Checking Patch Scan Results

The patch scan and patch repair results are also called patch compliance reports. A patch compliance report will only retain the most recent scan or repair record.

To view details about a patch in the compliance report, perform the following operations:

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Patch Management.
4. On the Patch Scanning tab page, select the resource type of the instance whose patch needs to be viewed.

   By default, ECS is selected.

5. Locate the instance whose patch needs to be viewed and click Summary in the Operation column.
   The patch summary page displays the patch name, category, severity, compliance status, patch baseline, installation time, and status.

   Table 7 Patch status description

   Patch Status	Description
   Installed	The patch complies with the patch baseline and has been installed on an ECS. No update is available.
   Non-baseline patches installed	The patch is not included in the patch baseline but has been installed on the ECS.
   Installed-to be Restarted	The patch has been repaired, and can take effect only after the ECS instance is restarted.
   Rejected	The rejected patch defined in the abnormal patches of a patch baseline. This patch will not be repaired even if it is compliant with the patch baseline.
   Pending Repair	The patch complies with the baseline, but the patch version is earlier than the baseline version.
   Patch Repair Failed	A patch repair operation is performed, but the repair fails.

Helpful Links

• COC can scan OS patches of hosts, provide compliance reports, and repair non-compliant patches. For details, see Identifying Compliance Issues Using Patch Scan on COC.
• What Can I Do If the Corresponding Resources Cannot Be Selected When I Create a Patch Scan Task?
• What Can I Do If Exception "all mirrors were tried" Is Recorded in the Patch Service Ticket Log?
• What Can I Do If "lsb_release not found" Is Reported During Patch Operations?
• COC can call APIs to obtain node compliance reports and query patch details on nodes by page. For details, see Patch Management.