# How to Configure Manual Patch Deployment for Linux What is Manual Patching? ------------------------ Manual patching is an update deployment model where IT administrators individually select, approve, and execute software or operating system updates across managed endpoints, rather than relying on automated policy engines. In a Unified Endpoint Management (UEM) framework, manual patch deployment allows administrators to review missing updates directly from a centralized console, manually select specific OS updates or application patches, and force immediate installations onto targeted device groups. How Hexnode Handles Manual Patch Deployment for Linux ----------------------------------------------------- In Hexnode UEM, manual patch deployment is configured as a Manual Patch action within an automation. The automation determines when the deployment runs and which Linux devices are targeted, while the Manual Patch action determines which updates are installed and how the installation is handled. The deployment process consists of selecting the required updates, configuring the installation behavior, assigning the target Linux devices, and saving the automation. When the configured trigger occurs, Hexnode UEM executes the Manual Patch action on the assigned devices. Administrators can then review the automation reports to track execution and deployment results. When to Use Manual Patching --------------------------- While automated patching is recommended for recurring update cycles across a large fleet, manual patching is critical for: - **Pilot Testing:** Validating patch stability in controlled test environments to avoid system crashes or software conflicts on business-critical systems. - **Urgent Out-of-Band Patches:** Forcing immediate, high-priority hotfixes onto specific vulnerable devices. - **Legacy or Custom Environments:** Managing complex environments where cumulative or automatic updates risk breaking proprietary enterprise applications. Manual vs. Automated Patch Deployment ------------------------------------- Both deployment methods use the Hexnode automation framework, but they differ in how the Linux updates to be deployed are determined. AspectManual Patch DeploymentAutomated Patch DeploymentUpdate selectionAdministrator explicitly selects the Linux updates to deploy.Hexnode determines which Linux updates to deploy based on configured update criteria.Selection controlAdministrator decides exactly which updates are included in the deployment.Administrator defines the conditions that determine which updates qualify for deployment.Automation frameworkControls when the deployment runs and which Linux devices receive it.Controls when the deployment runs and which Linux devices receive it.Best suited forDeploying specific updates to defined Linux devices or groups.Applying updates that consistently meet predefined criteria across the target Linux devices.Supported Linux Distributions and Prerequisites ----------------------------------------------- Before configuring manual patch deployment, ensure that the target Linux devices run a supported Linux distribution and meet the prerequisites listed below. ### Supported Linux Distributions - Ubuntu: Version 18.04 LTS and later - Linux Mint: Version 21 and later - Fedora: Version 36 and later ### Prerequisites - The target Linux devices must be enrolled in Hexnode UEM. - The Hexnode Linux Agent (HLA) must be installed on the device. Steps to Configure Manual Patch Deployment for Linux ---------------------------------------------------- ### Step 1: Create an Automation for Manual Patch Deployment 1. Log in to the Hexnode UEM console. 2. Navigate to **Automate > New Automation**. Alternatively, you can edit an existing automation. 3. Select **Linux** as the platform. 4. Under **Create New Automation**, select **Quick**. 5. Click the Edit icon next to **Untitled Automation** to configure the Automation Name and an optional Description. ### Step 2: Configure When the Automation Runs The **Triggers & Schedules** section determines when the automation runs. - **Apply Now** – Runs the automation immediately. - **On a Schedule** – Runs the automation according to a specified schedule. - **Event** – Runs the automation when a specified device event occurs. #### Apply Now Select **Apply Now** to run the automation immediately. #### On a Schedule Select **On a Schedule** to configure the automation to run at a specified time or frequency. Under **Schedule Settings**, configure the following: - **Frequency:** Specifies how often the automation runs. - **Run Once:** Runs the automation once at a specified date and time. - **Every Day:** Runs the automation every day at a specified time. - **Weekly:** Runs the automation on selected days of the week at a specified time. - **Monthly:** Runs the automation on a specified day of each month at a specified time. - **Time Settings** – Configure the day, date, time, and time zone based on the selected frequency. - **Scheduled Date** (for the run once option): Select the date on which the automation should run in the MM/DD/YYYY format. - **Scheduled Time:** Specify the exact time for automation execution in the HH:MM format and select the time zone. #### Event Select **Event** to trigger the automation based on a specified device event or condition. After configuring the required trigger, click **Next**. ### Step 3: Configure the Manual Patch Action Under **Choose Actions**, select **Manual Patch** from Patches and Updates. Under **Targeted Updates**, select the Update Type to specify the type of Linux updates to deploy. The available update types are: - **Security Updates** – Updates that address security vulnerabilities and security-related issues. - **Non-Security Updates** – Updates that address bug fixes, performance improvements, and general software maintenance. ### Step 4: Select Updates to Deploy The **Available Updates** section displays Linux updates that match the selected update type. Select the updates that you want to deploy to the target Linux devices. 1. View the available Linux updates from the **Patches** tab, or under the **Patches and Updates** sub-tab of a selected device under **Manage**. 2. Search for the required updates using the Update Name, Package Name, or Version shown for the update. 3. Click the **+** icon next to each update you want to deploy. 4. Verify that the updates appear under **Selected Updates**. 5. Click **Confirm**. ### Step 5: Configure Automation Rules Use **Configure automation rules** to define the installation order, reboot behavior, and success criteria for the selected Linux updates. Under Configure Automation Rules, configure the following: 1. #### Update Sequence Arrange the selected updates in the order in which they should be installed. 2. #### Reboot After Installation Choose from the following reboot options: - **Reboot once after all installations are complete** – The device reboots only after all updates have been installed. - **Reboot once after every successful installation** – The device reboots after each update installation. - **Reboot once after specific update installations** – The device reboots after installing selected updates. Multiple updates can be chosen for this option. 3. #### Configure Success Criteria Success criteria define the conditions for determining whether an update was successfully deployed. #### Success Criteria for Linux Updates - **Script Output** – Execute a selected script on the target device after the update installation is completed. The script output is compared with the configured expected value to determine whether the update deployment is successful. - **Select Script** – Choose a script from your script repository. - **Enter Value** – Specify the expected output of the script (e.g., OK, TRUE, or the update version number). - **Enter Arguments** – Optional parameters that customize the script’s behaviour without modifying its code. After configuring the required deployment settings, click **Next**. ### Step 6: Assign Target Linux Devices Use the **Assignments** section to specify which Linux devices receive the manual patch deployment. You can define targets using: - Included Groups - Excluded Groups - Filters #### Include Groups Use **Included Groups** to specify the groups to which the automation applies. 1. Click **Add Groups**. 2. Select the required device or user groups. 3. Verify the selected groups. **Note:** At least one included group is required for the automation. #### Exclude Groups Use **Excluded Groups** to prevent specific groups from receiving the automation. 1. Click **Add Groups**. 2. Select the device or user groups that should be excluded. 3. Verify the selected groups. The automation is not applied to the groups selected under Excluded Groups. #### Configure Target Filters Use **Filters** to target devices based on supported device attributes. 1. Click **Add filter**. 2. Select the required category and subcategory. 3. Select a comparator. 4. Specify the value for the comparison. 5. Add additional filters if required. You can combine multiple filters using AND or OR operators: - **AND:** The target must satisfy all specified conditions. - **OR:** The target must satisfy at least one of the specified conditions. After configuring the target devices and filters, click **Next**. ### Step 7: Review and Save the Automation Before saving the automation, review the configured automation settings. 1. Click **Edit** to modify a configuration, if required. 2. Review the updated configuration. 3. Click **Save** to create the automation. View, Track, and Verify Manual Patch Deployment ----------------------------------------------- Once saved, access the automation from **Automate > Active Automations** or **Patches > Automations**. Click the automation to open its summary page. Use the **Configuration** sub-tab to view the saved settings and **Edit** to modify them. Use the **Reports** sub-tab to track execution details, status, timestamps, and deployment history across target Linux devices. You can also filter and export the history log. When the automation runs, Hexnode deploys the selected updates to the targeted Linux devices according to the configured installation and reboot settings. After the update installation is completed, Hexnode evaluates the configured success criteria to determine the deployment result. To verify that an update was installed on a Linux device, check its installation status in the Patches and Updates tab of devie details page or verify the installed update on the Linux device.