Category filter
How to Configure Manual Patch Deployment for Linux
TL;DR
Consider manual patch deployment in Hexnode UEM to select specific Linux updates and deploy them to targeted Linux devices. Administrators can choose when the deployment runs, select the devices that receive the updates, configure installation and reboot behavior, and verify deployment results using success criteria.
What is Manual Patching?
Manual patching is an update deployment model where IT administrators individually select, approve, and execute software or operating system updates across managed endpoints, rather than relying on automated policy engines.
In a Unified Endpoint Management (UEM) framework, manual patch deployment allows administrators to review missing updates directly from a centralized console, manually select specific OS updates or application patches, and force immediate installations onto targeted device groups.
How Hexnode Handles Manual Patch Deployment for Linux
In Hexnode UEM, manual patch deployment is configured as a Manual Patch action within an automation. The automation determines when the deployment runs and which Linux devices are targeted, while the Manual Patch action determines which updates are installed and how the installation is handled.
The deployment process consists of selecting the required updates, configuring the installation behavior, assigning the target Linux devices, and saving the automation. When the configured trigger occurs, Hexnode UEM executes the Manual Patch action on the assigned devices. Administrators can then review the automation reports to track execution and deployment results.
When to Use Manual Patching
While automated patching is recommended for recurring update cycles across a large fleet, manual patching is critical for:
- Pilot Testing: Validating patch stability in controlled test environments to avoid system crashes or software conflicts on business-critical systems.
- Urgent Out-of-Band Patches: Forcing immediate, high-priority hotfixes onto specific vulnerable devices.
- Legacy or Custom Environments: Managing complex environments where cumulative or automatic updates risk breaking proprietary enterprise applications.
Manual vs. Automated Patch Deployment
Both deployment methods use the Hexnode automation framework, but they differ in how the Linux updates to be deployed are determined.
| Aspect | Manual Patch Deployment | Automated Patch Deployment |
|---|---|---|
| Update selection | Administrator explicitly selects the Linux updates to deploy. | Hexnode determines which Linux updates to deploy based on configured update criteria. |
| Selection control | Administrator decides exactly which updates are included in the deployment. | Administrator defines the conditions that determine which updates qualify for deployment. |
| Automation framework | Controls when the deployment runs and which Linux devices receive it. | Controls when the deployment runs and which Linux devices receive it. |
| Best suited for | Deploying specific updates to defined Linux devices or groups. | Applying updates that consistently meet predefined criteria across the target Linux devices. |
Supported Linux Distributions and Prerequisites
Before configuring manual patch deployment, ensure that the target Linux devices run a supported Linux distribution and meet the prerequisites listed below.
Supported Linux Distributions
- Ubuntu: Version 18.04 LTS and later
- Linux Mint: Version 21 and later
- Fedora: Version 36 and later
Prerequisites
- The target Linux devices must be enrolled in Hexnode UEM.
- The Hexnode Linux Agent (HLA) must be installed on the device.
Steps to Configure Manual Patch Deployment for Linux
Step 1: Create an Automation for Manual Patch Deployment
- Log in to the Hexnode UEM console.
- Navigate to Automate > New Automation. Alternatively, you can edit an existing automation.
- Select Linux as the platform.
- Under Create New Automation, select Quick.
- Click the Edit icon next to Untitled Automation to configure the Automation Name and an optional Description.
Step 2: Configure When the Automation Runs
The Triggers & Schedules section determines when the automation runs.
- Apply Now – Runs the automation immediately.
- On a Schedule – Runs the automation according to a specified schedule.
- Event – Runs the automation when a specified device event occurs.
Apply Now
Select Apply Now to run the automation immediately.
On a Schedule
Select On a Schedule to configure the automation to run at a specified time or frequency.
Under Schedule Settings, configure the following:
- Frequency: Specifies how often the automation runs.
- Run Once: Runs the automation once at a specified date and time.
- Every Day: Runs the automation every day at a specified time.
- Weekly: Runs the automation on selected days of the week at a specified time.
- Monthly: Runs the automation on a specified day of each month at a specified time.
- Time Settings – Configure the day, date, time, and time zone based on the selected frequency.
- Scheduled Date (for the run once option): Select the date on which the automation should run in the MM/DD/YYYY format.
- Scheduled Time: Specify the exact time for automation execution in the HH:MM format and select the time zone.
Event
Select Event to trigger the automation based on a specified device event or condition.
After configuring the required trigger, click Next.
Step 3: Configure the Manual Patch Action
Under Choose Actions, select Manual Patch from Patches and Updates.
Under Targeted Updates, select the Update Type to specify the type of Linux updates to deploy.
The available update types are:
- Security Updates – Updates that address security vulnerabilities and security-related issues.
- Non-Security Updates – Updates that address bug fixes, performance improvements, and general software maintenance.
Step 4: Select Updates to Deploy
The Available Updates section displays Linux updates that match the selected update type. Select the updates that you want to deploy to the target Linux devices.
- View the available Linux updates from the Patches tab, or under the Patches and Updates sub-tab of a selected device under Manage.
- Search for the required updates using the Update Name, Package Name, or Version shown for the update.
- Click the + icon next to each update you want to deploy.
- Verify that the updates appear under Selected Updates.
- Click Confirm.
Step 5: Configure Automation Rules
Use Configure automation rules to define the installation order, reboot behavior, and success criteria for the selected Linux updates.
Under Configure Automation Rules, configure the following:
-
Update Sequence
Arrange the selected updates in the order in which they should be installed.
-
Reboot After Installation
Choose from the following reboot options:
- Reboot once after all installations are complete – The device reboots only after all updates have been installed.
- Reboot once after every successful installation – The device reboots after each update installation.
- Reboot once after specific update installations – The device reboots after installing selected updates. Multiple updates can be chosen for this option.
-
Configure Success Criteria
Success criteria define the conditions for determining whether an update was successfully deployed.
Success Criteria for Linux Updates
- Script Output – Execute a selected script on the target device after the update installation is completed. The script output is compared with the configured expected value to determine whether the update deployment is successful.
- Select Script – Choose a script from your script repository.
- Enter Value – Specify the expected output of the script (e.g., OK, TRUE, or the update version number).
- Enter Arguments – Optional parameters that customize the script’s behaviour without modifying its code.
- Script Output – Execute a selected script on the target device after the update installation is completed. The script output is compared with the configured expected value to determine whether the update deployment is successful.
After configuring the required deployment settings, click Next.
Step 6: Assign Target Linux Devices
Use the Assignments section to specify which Linux devices receive the manual patch deployment.
You can define targets using:
- Included Groups
- Excluded Groups
- Filters
Include Groups
Use Included Groups to specify the groups to which the automation applies.
- Click Add Groups.
- Select the required device or user groups.
- Verify the selected groups.
Note: At least one included group is required for the automation.
Exclude Groups
Use Excluded Groups to prevent specific groups from receiving the automation.
- Click Add Groups.
- Select the device or user groups that should be excluded.
- Verify the selected groups.
The automation is not applied to the groups selected under Excluded Groups.
Configure Target Filters
Use Filters to target devices based on supported device attributes.
- Click Add filter.
- Select the required category and subcategory.
- Select a comparator.
- Specify the value for the comparison.
- Add additional filters if required.
You can combine multiple filters using AND or OR operators:
- AND: The target must satisfy all specified conditions.
- OR: The target must satisfy at least one of the specified conditions.
After configuring the target devices and filters, click Next.
Step 7: Review and Save the Automation
Before saving the automation, review the configured automation settings.
- Click Edit to modify a configuration, if required.
- Review the updated configuration.
- Click Save to create the automation.
View, Track, and Verify Manual Patch Deployment
Once saved, access the automation from Automate > Active Automations or Patches > Automations. Click the automation to open its summary page. Use the Configuration sub-tab to view the saved settings and Edit to modify them. Use the Reports sub-tab to track execution details, status, timestamps, and deployment history across target Linux devices. You can also filter and export the history log.
When the automation runs, Hexnode deploys the selected updates to the targeted Linux devices according to the configured installation and reboot settings. After the update installation is completed, Hexnode evaluates the configured success criteria to determine the deployment result.
To verify that an update was installed on a Linux device, check its installation status in the Patches and Updates tab of devie details page or verify the installed update on the Linux device.
Frequently Asked Questions
What happens when a selected update has a dependency on another update that was not selected?
The dependency packages required by the selected update are automatically installed first, followed by the selected update. This is the default behavior of Linux package managers such as APT and DNF.
Why might the success evaluation differ from the actual update status?
The automation’s success criteria are evaluated after the update installation process completes. If the criteria use Script Output, an incorrect or faulty script can return an inaccurate success evaluation.
