Fixing Non-compliant Patches

Prerequisites

Before using this function, ensure that the patch baseline has been created and set as the preset patch baseline.

Creating a Patch Repair Task

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Patch Management. The Patch Management page is displayed.
4. On the Patch Scanning tab page, select the resource type of the instance whose patch needs to be repaired.

   By default, ECS is selected.

5. Locate the instance you want to repair and click Repair in the Operation column.
6. Set parameters in the Execution Account & Region area.
   Execution Type: Single or Cross Account

   • Single: Execute this job only under the current account.
   • Cross Account: Execute this job using multiple organization member accounts.
   

   To use this function, you need to add the account to an organization, configure the agency permissions, and enter the agency name in advance. For details, see Enabling COC Cross-Account Management.

7. Set parameters in the Scheduled Task area.
   Execution Mode: Execute immediately or Scheduled execution.

   • Execute immediately: Execute the scanning task immediately after it is created.
   • Scheduled execution: Configure the scheduled task details.

     Table 1 Scheduled task parameters

     Parameter	Description
     Time Zone	Select the time zone where the scheduled task is executed from the drop-down list.
     Timing Type	Select a scheduled type. Single execution: A scheduled task is executed once at a specified time. Periodic execution: A task is periodically executed based on the specified rule until the rule expires.
     Execution Time	It is used together with the timing type. For a one-time execution, set this parameter to the execution time. For periodic execution, select either of the following options: Simple: Select the execution time by week. Cron: Set the execution time using a cron expression. For details, see Using Cron Expressions.
     Rule Expired	This parameter needs to be set when Timing Type is set to Periodic execution. Enter the end time of the periodic execution rule.
     Notification Policy	Select Start of execution, Execution failed, or Execution succeeded. Multiple options can be selected.
     Recipient	Select Shift or Individual. Shift: Select a shift scenario and a role from the drop-down lists based on the configured values. For details about how to configure a shift, see Shift Schedule Management. Individual: Select a reviewer. For details about how to configure a reviewer, see Personnel Management.
     Notification Mode	Select a notification channel from the drop-down list. Default: The notification channel selected in the subscription notification settings of the reviewer is used by default. For details about how to set the default notification channel, see Selecting a Notification Method. SMS, WeCom, DingTalk, Lark, and Email: Notifications are sent based on the information reserved by the reviewer. For details about how to set the reviewer information, see Modifying Personnel Information.

8. Configure the basic information.
   • If Execution Mode is set to Execute immediately, set this parameter based on the information in Table 2.

     Table 2 Basic information for immediate execution

     Parameter	Description
     Executed By	The preset value is root and cannot be changed.
     Timeout Interval	Maximum duration for scanning. The value is 1800 seconds by default

   • If Execution Mode is set to Scheduled execution, set this parameter by referring to Table 3.

     Table 3 Basic information about scheduled task execution

     Parameter	Description
     Task Name	You are advised to name the task based on the application scenario. The value can contain 3 to 100 characters, including letters, digits, hyphens (-), and underscores (_).
     Enterprise Project	Select an enterprise project from the drop-down list.
     Version	Enter a version. The preset version is 1.0.0.
     IAM Agency	Select an agency from the drop-down list. If the selected agency does not have required permissions, task execution will fail and you need to select another agency or create one.

9. Set Repair Resources.

   Table 4 Parameter description

   Parameter	Description
   Resources	Click Add and select the target instances to be repaired.
   Batch Policy	Select Automatic, Manual, or No Batch. Automatic: The selected instances on which you want to perform operations are automatically divided into multiple batches based on the default rule. Manual: You can manually create multiple batches and add instances to each batch as required. No Batch: All instances on which you want to perform operations are in the same batch.
   Suspension Policy	A preset rule for automatically stopping the patch compliance repair task. You can set a target execution success rate. If the number of failed servers reaches the threshold derived from this success rate, the service ticket is flagged as abnormal and execution stops immediately. The success rate ranges from 0 to 100 with precision to one decimal point.
   Allow Restart	Some patches need to be restarted for the adjustment to take effect. If you select Yes, the instance is automatically restarted after the patch repair. If you select No, you will need to schedule a restart later.

10. Click OK. In the displayed dialog box, confirm the information and click OK again to start the service ticket.

    The system automatically directs you to the service ticket details page. You can view the patch repair records by referring to Viewing the Execution Records of a Patch Repair Service Ticket.

Viewing the Execution Records of a Patch Repair Service Ticket

1. Log in to COC.
2. In the navigation pane on the left, choose Task Management > Execution Records. The task execution records page is displayed.
3. Click Patch Tickets. The patch ticket record page is displayed.
4. Click the patch ID of the path service ticket whose Ticket Type is set to Repair. The service ticket details page is displayed.

   On the service ticket details page, you can view the service ticket execution status, such as the start time, end time, status, and execution duration.

5. Perform the operations listed in the following table based on the service ticket status.

   Table 5 Operation description

   Service Ticket Status	Operation
   Executing	If you want to pause the next batch when the current batch is executed, click Pause in the upper right corner.
   	Click Forcibly End in the upper right corner to stop the patch scan service ticket.
   Paused	Click Continue in the upper right corner to continue the patch scan service ticket.
   	Click Forcibly End in the upper right corner to stop the patch scan service ticket.
   Abnormal	Click the Abnormal tab in the Execution Information area. Locate an abnormal batch and click Retry in the Operation column.
   	Click the Abnormal tab in the Execution Information area. Locate an abnormal batch and click Cancel in the Operation column.

Checking the Patch Repair Result

A patch compliance report will only retain the most recent repair record.

To view the repair details about a patch in the compliance report, perform the following operations:

1. Log in to COC.
2. In the navigation pane, choose Resource O&M > Automated O&M.
3. In the Routine O&M area, click Patch Management. The Patch Management page is displayed.
4. On the Patch Scanning tab page, select the resource type of the instance whose patch needs to be viewed.

   By default, ECS is selected.

5. Locate the instance whose patch needs to be viewed and click Summary in the Operation column.
   The patch summary page displays the patch name, category, severity, compliance status, patch baseline, installation time, and status.

   Table 6 Patch status description

   Patch Status	Description
   Installed	The patch complies with the patch baseline and has been installed on an ECS. No update is available.
   Non-baseline patches installed	The patch is not included in the patch baseline but has been installed on the ECS.
   Installed-to be Restarted	The patch has been repaired, and can take effect only after the ECS instance is restarted.
   Rejected	The rejected patch defined in the abnormal patches of a patch baseline. This patch will not be repaired even if it is compliant with the patch baseline.
   Pending Repair	The patch complies with the baseline, but the patch version is earlier than the baseline version.
   Patch Repair Failed	A patch repair operation is performed, but the repair fails.

Helpful Links

• COC allows OS patch scan of hosts, provides compliance reports, and repairs non-compliant patches. For details, see Identifying Compliance Issues Using Patch Scan on COC.
• What Can I Do If Exception "all mirrors were tried" Is Recorded in the Patch Service Ticket Log?
• What Can I Do If "lsb_release not found" Is Reported During Patch Operations?

• What Can I Do If a Patch Remains Non-Compliant After It Is Repaired?
• COC can call APIs to obtain node compliance reports and query patch details on nodes by page. For details, see Patch Management.