# How to Automate Linux Patch Deployment? Why Use Automated Patch Deployment for Linux? --------------------------------------------- Use automated patch deployment when you need to deploy Linux updates across multiple managed devices without selecting each update individually. Automated patch deployment is suitable for: - **Security patching:** Automatically deploy Linux updates based on their severity. For example, configure the automation to deploy updates classified as Critical or Important. - **Regular patching:** Keep Linux devices up to date by periodically deploying newly available updates that match the configured criteria. - **Scheduled patching:** Run the automation at a specified date, time, or recurring interval to evaluate and deploy updates that meet the configured conditions. - **Maintenance-window deployment:** Restrict the installation of qualifying updates and device reboots to the configured maintenance window. - **Controlled targeting:** Deploy updates to specific Linux device groups or devices that meet defined target filters. Supported Linux Distributions and Prerequisites ----------------------------------------------- Before configuring automated patch deployment, ensure that the target Linux devices run a supported Linux distribution and meet the prerequisites listed below. ### Supported Linux Distributions - Ubuntu: Version 18.04 LTS and later - Linux Mint: Version 21 and later - Fedora: Version 36 and later ### Prerequisites - The target Linux devices must be enrolled in Hexnode UEM. - The Hexnode Linux Agent (HLA) must be installed on the device. Steps to Configure Automated Patch Deployment for Linux ------------------------------------------------------- ### Step 1: Create an Automation 1. Log in to the Hexnode UEM console. 2. Navigate to **Automate > New Automation**. Alternatively, you can edit an existing automation. 3. Select **Linux** as the platform. 4. Under **Create New Automation**, select **Quick**. 5. Click the Edit icon next to **Untitled Automation** to configure the Automation Name and an optional Description. ### Step 2: Configure When the Automation Runs The **Triggers & Schedules** section determines when the automation runs. - **Apply Now** – Runs the automation immediately. - **On a Schedule** – Runs the automation according to a specified schedule. - **Event** – Runs the automation when a specified device event occurs. #### Apply Now Select **Apply Now** to run the automation immediately. #### On a Schedule Select **On a Schedule** to configure the automation to run at a specified time or frequency. Under **Schedule Settings**, configure the following: - **Frequency:** Specifies how often the automation runs. - **Run Once:** Runs the automation once at a specified date and time. - **Every Day:** Runs the automation every day at a specified time. - **Weekly:** Runs the automation on selected days of the week at a specified time. - **Monthly:** Runs the automation on a specified day of each month at a specified time. - **Time Settings** – Configure the day, date, time, and time zone based on the selected frequency. - **Scheduled Date** (for the run once option): Select the date on which the automation should run in the MM/DD/YYYY format. - **Scheduled Time:** Specify the exact time for automation execution in the HH:MM format and select the time zone. #### Event Select **Event** to trigger the automation based on a specified device event or condition. After configuring the required trigger, click **Next**. ### Step 3: Choose Actions to Automate Under **Choose Actions**, select **Auto Patch** from Patches and Updates. #### Configure Update Criteria Under **Update Criteria**, define the conditions that an update must meet to qualify for automated deployment to your Linux devices. Each condition consists of: - **Data Column:** Specifies the update attribute to evaluate. - **Comparator:** Specifies how the attribute should be evaluated. - **Value:** Specifies the value that the update must match. The available data column options are: - **Product:** The product associated with the update. - **Release Date:** The date on which the update was released. - **Severity:** The severity assigned to the update. - **Update Classification:** The classification assigned to the update. - **Update Name:** The name of the update. For example, to deploy updates with a Critical severity, select **Severity** as the Data Column, select **Is** as the comparator, and enter **Critical** as the Value. #### Add Multiple Update Conditions You can combine multiple conditions to create more specific deployment criteria. 1. Click the **+** icon to add a nested filter. 2. Click **New filter** to add another filter. 3. Configure the required Data Column, Comparator, and Value. 4. Select the appropriate logical operator when configuring multiple filters. The available operators are: - **AND:** All specified conditions must be met. - **OR:** At least one of the specified conditions must be met. Nested filters use the AND operator, so all conditions within a nested filter must be satisfied. After configuring the required criteria, click **Confirm**. ### Step 4: Specify Updates to Ignore Use **Specify updates to ignore** to exclude specific updates from automated deployment. Updates selected here are not deployed even if they meet the configured automation criteria. 1. View the available Linux updates from the **Patches** tab, or under the **Patches and Updates** sub-tab of a selected device under **Manage**. 2. Search for the required updates using the Update Name, Package Name, or Version shown for the update. 3. Click the **+** icon next to each update you want to exclude. 4. Verify that the updates appear under **Selected Updates**. 5. Click **Confirm**. ### Step 5: Configure Automation Rules Use **Configure automation rules** to define how eligible patches and updates are deployed to Linux devices. #### Require Update Approval Enable **Require update approval** to deploy only Linux updates that have been approved by an administrator to the target devices. To approve an update: 1. Go to **Patches and Updates > Patches**. 2. Select the required update 3. Click **Actions > Approve**. Alternatively, open the update to view its summary page and click **Approve**. 4. Click **Proceed** to confirm the approval. **Notes:** Approve an update after testing it on applicable Linux devices and verifying that it is compatible with the target environment and does not introduce unexpected issues. #### Install and Reboot During the Maintenance Window Enable **Install and reboot only during maintenance window** to restrict update installation and device reboot to the device’s maintenance window. **Notes:** - Configure the maintenance window in Update Preferences under the Patches and Updates policy for Linux and apply the policy to the target Linux devices. When this option is enabled, updates are installed and devices are rebooted only during the configured maintenance window. - When Run Once is configured under On a Schedule, the specified date and time trigger the automation. If Install and reboot only during maintenance window is enabled, the eligible updates are installed during the next configured maintenance window after the automation is triggered. - If no maintenance window is configured, the device’s default maintenance window is used. #### Configure Technician Notifications Use **Configure Technician Notifications** to send email notifications to selected technicians about update installation status. Configure the following options: - **Notify installation failures every:** Specify how frequently to send email notifications about failed update installations. The supported interval is 1–23 hours. For example, if the interval is set to 2 hours, the portal sends failure notifications at 2-hour intervals. - **Notify installation status every:** Specify how frequently to send email notifications about update installation status. The supported interval is 1–23 hours. - **Choose technicians to notify:** Select the technicians who should receive the configured update installation notifications. #### Configure Retries Enable **Configure retries** to automatically retry the automation action when its execution fails. Configure the following settings: - **Number of retries:** Specify the maximum number of retry attempts. The supported range is 1-3. - **Retry delay in minutes:** Specify the delay between retry attempts. The supported range is 10-180 minutes. After configuring the required deployment rules, click **Next**. ### Step 6: Assign Target Linux Devices Use the **Assignments** section to specify which Linux devices receive the automated patch deployment. You can define targets using: - Included Groups - Excluded Groups - Filters #### Include Groups Use **Included Groups** to specify the groups to which the automation applies. 1. Click **Add Groups**. 2. Select the required device or user groups. 3. Verify the selected groups. **Note:** At least one included group is required for the automation. #### Exclude Groups Use **Excluded Groups** to prevent specific groups from receiving the automation. 1. Click **Add Groups**. 2. Select the device or user groups that should be excluded. 3. Verify the selected groups. The automation is not applied to the groups selected under Excluded Groups. #### Configure Target Filters Use **Filters** to target devices based on supported device attributes. 1. Click **Add filter**. 2. Select the required category and subcategory. 3. Select a comparator. 4. Specify the value for the comparison. 5. Add additional filters if required. You can combine multiple filters using AND or OR operators: - **AND:** The target must satisfy all specified conditions. - **OR:** The target must satisfy at least one of the specified conditions. After configuring the target devices and filters, click **Next**. ### Step 7: Review and Save the Automation Before saving the automation, review the configured automation settings. 1. Click **Edit** to modify a configuration, if required. 2. Review the updated configuration. 3. Click **Save** to create the automation. View, Track and Verify Patch Automation --------------------------------------- Once saved, access the automation from **Automate > Active Automations** or **Patches > Automations**. Click the automation to open its summary page. Use the **Configuration** sub-tab to view the saved settings and **Edit** to modify them. Use the **Reports** sub-tab to track execution details, status, timestamps, and deployment history across target Linux devices. You can also filter and export the history log. When the automation runs, Hexnode identifies updates that match the configured update criteria and deploys them to the targeted Linux devices according to the configured installation and reboot settings. For example, if the automation is configured to deploy updates with **Severity = Critical**, matching Critical updates are deployed to the targeted Linux devices when the automation runs. To verify that an update was installed, check its installation status in the **Patches and Updates** tab or verify the installed update on the Linux device.