Please enable JavaScript.

Coggle requires JavaScript to display documents.

Patch Management, Centralized Linux Patch Management (Enterprise Level),…

- - - - Patch
      - Verify
      - Continue
    - - Patch
      - Verify
      - Continue
    - - Patch
      - Verify
      - Continue
    - - Patch all servers simultaneously
    - - Lower risk
      - Easy rollback
      - Continuous service availability
      - Faster troubleshooting
      - Better compliance
      - Enterprise recommended
  - - - Server01
      - Server02
      - Server03
      - Server04
      - Patch all together
      - If update fails
        
        Entire service becomes unavailable
        
        Full outage
        
        Business interruption
    - - Patch Server01
        
        Verify
      - Patch Server02
        
        Verify
      - Patch Server03
        
        Verify
      - Patch Server04
        
        Verify
      - If Server02 fails
        
        Stop rollout
        
        Server03 and Server04 remain untouched
        
        Easy investigation
  - - - Inventory file
      - Controller knows every managed server
    - - SSH
      - Python
      - Sudo
      - Ping
  - - - ~/ansible/inventory/hosts.ini
    - - [webservers]
      - server01 ansible_host=192.168.141.130
      - server02 ansible_host=192.168.141.131
      - server03 ansible_host=192.168.141.132
      - server04 ansible_host=192.168.141.133
    - - cat ~/ansible/inventory/hosts.ini
    - - ansible webservers -m ping
    - - SUCCESS
      - pong
  - - - name: Rolling Update
        
        hosts: webservers
        
        become: yes
        
        serial: 1
        
        tasks:
        
        name: Update apt cache
        
        apt:
        
        update_cache: yes
        
        name: Upgrade packages
        
        apt:
        
        upgrade: dist
        
        name: Remove unnecessary packages
        
        apt:
        
        autoremove: yes
    - - Ctrl O
      - Enter
      - Ctrl X
  - - - Controls how many hosts are patched at one time
    - - One server at a time
      - Server01
      - Complete
      - Server02
      - Complete
      - Server03
    - - Banking
      - Healthcare
      - Databases
      - Authentication Servers
      - Critical Infrastructure
    - - Two servers together
      - Server01
      - Server02
      - Complete
      - Server03
      - Server04
    - - Three servers together
    - - Percentage based
      - Example
        
        20 Servers
        
        25%
        
        5 Servers
        
        Batch1
        
        Server01-05
        
        Batch2
        
        Server06-10
        
        Batch3
        
        Server11-15
        
        Batch4
        
        Server16-20
    - - Half infrastructure
      - Faster
      - Higher risk
  - - - Default
      - All servers
    - - serial: 2
    - - serial: 10%
    - - serial: 5%
      - serial: 10%
      - serial: 20%
    - - serial: 1
  - - - Server01
        
        Update Cache
        
        Upgrade Packages
        
        Cleanup
        
        Finish
      - Then
      - Server02
      - Then
      - Server03
      - Then
      - Server04
  - - - Observe server stability
      - Watch monitoring dashboards
      - Confirm application health
    - - pause:
        
        seconds: 30
    - - Patch
      - Pause
      - Next Server
  - - - Ensure services are running after patching
    - - name: Verify SSH
        
        service:
        
        name: ssh
        
        state: started
    - - name: Verify Apache
        
        service:
        
        name: apache2
        
        state: started
    - - name: Verify Nginx
        
        service:
        
        name: nginx
        
        state: started
    - - name: Verify MySQL
        
        service:
        
        name: mysql
        
        state: started
  - - - Stop rollout immediately
    - - Server01
        
        Success
      - Server02
        
        Failed
      - Server03
        
        Not Patched
      - Server04
        
        Not Patched
    - - Prevent cascading failures
  - - - 10 Servers
      - 20%
      - Two failures allowed
      - Third failure
        
        Playbook Stops
    - - Protects large environments
  - - - name: Check SSH Port
        
        wait_for:
        
        port: 22
        
        timeout: 30
    - - name: Check HTTP
        
        uri:
        
        url: http://localhost
        
        status_code: 200
    - - Patch
      - Health Check
      - Healthy
      - Continue
      - Failed
      - Stop
  - - - Kernel updates require reboot
    - - name: Reboot
        
        reboot:
    - - Patch
      - Reboot
      - Wait
      - Health Check
      - Next Server
  - - - name: Wait for SSH
        
        wait_for_connection:
        
        delay: 15
        
        timeout: 300
    - - Wait until server is fully online
    - - Reboot
      - Wait
      - SSH Available
      - Continue
  - - - hosts: webservers
      - become: yes
      - serial: 1
      - any_errors_fatal: true
      - max_fail_percentage: 20
      - tasks:
        
        name: Update apt cache
        
        apt:
        
        update_cache: yes
        
        name: Upgrade packages
        
        apt:
        
        upgrade: dist
        
        name: Remove obsolete packages
        
        apt:
        
        autoremove: yes
        
        name: Reboot if required
        
        reboot:
        
        when: ansible_facts['os_family'] == "Debian"
        
        name: Wait for SSH
        
        wait_for_connection:
        
        delay: 15
        
        timeout: 300
        
        name: Verify SSH Service
        
        service:
        
        name: ssh
        
        state: started
        
        name: Pause before next server
        
        pause:
        
        seconds: 30
  - - - ansible-playbook --syntax-check playbooks/rolling-update.yml
    - - ansible-playbook -i inventory/hosts.ini playbooks/rolling-update.yml --check
    - - ansible-playbook -i inventory/hosts.ini playbooks/rolling-update.yml --limit server01
    - - ansible-playbook -i inventory/hosts.ini playbooks/rolling-update.yml
  - - - ansible all -m ping
    - - ansible all -m command -a "hostnamectl"
    - - ansible all -m shell -a "uptime"
    - - ansible all -m shell -a "apt list --upgradable"
    - - ansible all -m command -a "uname -r"
    - - ansible all -m command -a "df -h"
    - - ansible all -m command -a "free -h"
    - - ansible all -m shell -a "systemctl --failed"
  - - - Maintenance Window
      - Backup
      - Snapshot
      - Change Approval
      - Notify Users
    - - Inventory
      - SSH
      - Sudo
      - Playbook
      - Rolling Update
      - Health Check
      - Logging
    - - Services
      - Applications
      - Databases
      - Web Servers
      - Monitoring
    - - Patch Status
      - Compliance
      - Failed Hosts
      - Successful Hosts
      - Reboot Status
  - - - Verify SSH service
      - Verify Firewall
      - Verify Network
    - - Ping
      - SSH
      - Inventory
    - - Check sudo permissions
      - Test
        
        ansible all -m command -a "whoami" --become
    - - Check
        
        sudo lsof /var/lib/dpkg/lock
    - - Increase
        
        wait_for_connection timeout
    - - Review
        
        journalctl
        
        systemctl status
  - - - Updating servers gradually in controlled batches to minimize downtime and reduce deployment risk.
    - - Controls how many hosts execute the play simultaneously.
    - - serial 1 updates one server at a time.
      - serial 25% updates 25 percent of the inventory at a time.
    - - Stops the rollout immediately if one host fails.
    - - Stops deployment when failures exceed the configured threshold.
    - - Waits until the rebooted server is reachable before continuing.
    - - Confirms critical services are healthy after patching.
    - - Allows monitoring and validation before continuing.
    - - Change Request
      - Maintenance Window
      - Backup
      - Snapshot
      - Validate Inventory
      - SSH Verification
      - Syntax Check
      - Dry Run
      - Test One Server
      - Rolling Deployment
      - Health Checks
      - Service Validation
      - Reboot
      - Wait for Connection
      - Continue Next Batch
      - Compliance Report
      - Close Change Request
- - - - Connects via SSH + Ansible
    - - Ubuntu01 192.168.100.20
      - Ubuntu02 192.168.100.21
      - Debian01 192.168.100.40
      - Rocky01 192.168.100.30
      - Alma01 192.168.100.31
  - - - Ubuntu example NAME Ubuntu VERSION 24.04 LTS
      - Rocky example NAME Rocky Linux VERSION 9
  - - - sudo hostnamectl set-hostname ubuntu01
    - - sudo hostnamectl set-hostname debian01
    - - sudo hostnamectl set-hostname rocky01
    - - sudo hostnamectl set-hostname alma01
    - - hostnamectl
      - hostname
  - - - 127.0.0.1 localhost
      - 192.168.100.10 ansible-controller
      - 192.168.100.20 ubuntu01
      - 192.168.100.21 ubuntu02
      - 192.168.100.30 rocky01
      - 192.168.100.31 alma01
      - 192.168.100.40 debian01
    - - ping ubuntu01
      - ping ansible-controller
  - - - dpkg l grep openssh Ubuntu Debian
      - rpm q openssh-server Rocky Alma
    - - Ubuntu Debian sudo apt update
      - sudo apt install -y openssh-server
      - Rocky Alma sudo dnf install -y openssh-server
    - - Ubuntu sudo systemctl enable ssh
      - sudo systemctl start ssh
      - Rocky Alma sudo systemctl enable sshd
      - sudo systemctl start sshd
    - - systemctl status ssh or sshd
      - ss -tlnp grep 22
  - - - sudo adduser bilal Ubuntu Debian
      - sudo useradd m bilal Rocky Alma
      - sudo passwd bilal Rocky Alma
    - - id bilal
  - - - sudo usermod -aG sudo bilal
    - - sudo usermod -aG wheel bilal
    - - groups bilal
    - - Ubuntu bilal sudo
      - Rocky Alma bilal wheel
  - - - bilal ALL=(ALL:ALL) NOPASSWD:ALL
    - - bilal ALL=(ALL) NOPASSWD:ALL
    - - sudo apt update or sudo dnf check-update
    - - Enterprise best practice avoid passwordless sudo use Ansible become instead
  - - - sudo apt update
      - sudo apt install -y python3
    - - sudo dnf install -y python3
    - - python3 version
      - which python3
  - - - chmod 700 ~/.ssh
      - chmod 600 ~/.ssh authorized_keys
  - - - executable usr bin python3
  - - - pong from all hosts
  - - - systemctl status ssh or sshd
      - ss -tlnp grep 22
    - - groups bilal
      - sudo whoami
    - - install python3 apt or dnf
    - - ssh-keygen -R target IP
  - - - SSH enabled by default
      - Python preinstalled
      - Admin user created
      - Consistent hostname format
      - Centralized sudo policy
      - Security hardening applied
- - - - Ubuntu Server 24.04
      - Hostname
        
        ansible-controller
      - IP Address
        
        192.168.100.10
    - - Ubuntu
        
        ubuntu01
        
        ubuntu02
      - Rocky Linux
        
        rocky01
      - AlmaLinux
        
        alma01
      - Debian
        
        debian01
    - - SSH Port 22
      - No Agent Required
      - Push-based Automation
      - Secure SSH Authentication
    - - Centralized Management
      - Faster Administration
      - Consistent Configuration
      - Automated Patching
      - Secure Access
      - Easy Scaling
      - Reduced Human Error
  - - - Verify server is ready before installing Ansible
    - - hostname
      - Expected
        
        ansible-controller
      - Why
        
        Easy server identification
        
        Used in documentation
        
        Enterprise naming standards
    - - ip addr show
      - Why
        
        Confirm correct network interface
        
        Verify static IP
    - - ip route
      - Why
        
        Check default gateway
        
        Verify network routing
    - - ping -c 4 8.8.8.8
      - ping -c 4 google.com
      - Why
        
        Verify DNS
        
        Verify Internet connectivity
        
        Required for package installation
    - - Fix networking before continuing
      - Never install packages on broken network
    - - Difference between
        
        ip addr
        
        ip route
      - Why static IP is required
      - Why hostname matters
  - - - Install latest security updates
    - - sudo apt update
    - - sudo apt upgrade -y
    - - sudo apt full-upgrade -y
      - Difference
        
        upgrade
        
        Upgrades packages
        
        full-upgrade
        
        Resolves dependencies
        
        Installs new packages
        
        Removes obsolete packages if needed
    - - sudo apt autoremove -y
    - - sudo apt autoclean
    - - sudo reboot
    - - cat /etc/os-release
    - - Security patches
      - Stable controller
      - Compliance
      - CVE mitigation
    - - apt update
      - apt upgrade
      - full-upgrade
      - autoremove
      - autoclean
  - - - sudo apt install -y software-properties-common curl wget git vim nano tree zip unzip python3 python3-pip python3-venv openssh-client
    - - software-properties-common
        
        Manage repositories
      - curl
        
        Download data
        
        API testing
      - wget
        
        Download files
      - git
        
        Version control
        
        Infrastructure as Code
      - vim
        
        Enterprise editor
      - nano
        
        Beginner editor
      - tree
        
        Display directory structure
      - zip
        
        Compress files
      - unzip
        
        Extract archives
      - python3
        
        Required by Ansible
      - python3-pip
        
        Python package manager
      - python3-venv
        
        Virtual environments
      - openssh-client
        
        SSH connectivity
    - - python3 --version
      - git --version
      - ssh -V
    - - Standard administration toolkit
      - Automation support
      - Version control
      - Secure connectivity
  - - - sudo apt install -y ansible
    - - ansible --version
    - - which ansible
    - - /usr/bin/ansible
    - - Controller pushes commands
      - Agentless architecture
      - Uses SSH
      - Uses Python on target
    - - What is Ansible
      - Why agentless
      - Advantages over Puppet or Chef
  - - - Controller
        
        SSH
        
        Ubuntu
        
        Debian
        
        Rocky
        
        AlmaLinux
    - - SSH Server
      - Python Installed
      - User Account
      - Sudo Privileges
    - - No agents
      - Less maintenance
      - Secure communication
      - Easy deployment
      - Cross-platform support
    - - Why Python required
      - Why SSH used
      - Explain Push Model
  - - - mkdir -p ~/ansible
    - - cd ~/ansible
    - - pwd
    - - /home/bilal/ansible
    - - Organized automation
      - Easier backup
      - Git integration
  - - - mkdir inventory
      - mkdir playbooks
      - mkdir roles
      - mkdir group_vars
      - mkdir host_vars
      - mkdir files
      - mkdir templates
      - mkdir logs
    - - tree
    - - inventory
        
        Managed hosts
      - playbooks
        
        Automation scripts
      - roles
        
        Reusable modules
      - group_vars
        
        Variables for groups
      - host_vars
        
        Variables per server
      - files
        
        Static files
      - templates
        
        Jinja2 templates
      - logs
        
        Execution reports
    - - Maintain clean structure
      - Easy collaboration
      - Git friendly
      - Modular automation
  - - - ls -la ~/.ssh
    - - ssh-keygen -t ed25519 -C "ansible-controller"
    - - Press Enter
    - - Lab
        
        Leave empty
      - Production
        
        Strong passphrase
    - - ls ~/.ssh
    - - id_ed25519
        
        Private Key
        
        Never Share
      - id_ed25519.pub
        
        Public Key
        
        Copy to Servers
    - - ED25519 preferred
      - Protect private key
      - Rotate keys regularly
    - - Difference
        
        Private Key
        
        Public Key
      - Why ED25519
      - Why Passwordless SSH
  - - - ssh-copy-id bilal@192.168.100.20
      - ssh-copy-id bilal@192.168.100.21
      - ssh-copy-id bilal@192.168.100.30
      - ssh-copy-id bilal@192.168.100.31
      - ssh-copy-id bilal@192.168.100.40
    - - Type
        
        yes
      - Enter Password
    - - Public key copied
      - Stored in authorized_keys
      - Enables passwordless authentication
    - - What does ssh-copy-id do
      - Where is authorized_keys located
  - - - ssh bilal@192.168.100.20
    - - Login without password
    - - Secure automation
      - No plaintext passwords
      - Required for Ansible
  - - - nano ~/ansible/inventory/hosts.ini
    - - Groups
        
        ubuntu
        
        rocky
        
        alma
        
        debian
      - Parent Group
        
        linux
      - Variables
        
        ansible_user
        
        ansible_become
        
        ansible_become_method
        
        ansible_python_interpreter
    - - ansible_host
        
        Server IP Address
      - ansible_user
        
        SSH Login User
      - ansible_become
        
        Enable sudo
      - ansible_become_method
        
        Use sudo
      - ansible_python_interpreter
        
        Python location
    - - Logical grouping
      - Easy targeting
      - Centralized management
      - Reusable playbooks
    - - Difference
        
        Inventory
        
        Host Group
        
        Children Group
        
        Variables
  - - - ansible-inventory -i inventory/hosts.ini --list
    - - ansible-inventory -i inventory/hosts.ini --graph
    - - Detect inventory mistakes
      - Validate hierarchy
      - Confirm grouping
  - - - ansible all -i inventory/hosts.ini -m ping
    - - SUCCESS
      - pong
    - - Confirms
        
        SSH
        
        Python
        
        Inventory
        
        Authentication
        
        Network
    - - Explain ping module
      - Why pong returned
  - - - Check
        
        Server running
        
        SSH access
        
        Correct IP
        
        SSH service
        
        Port 22
    - - Check
        
        ssh-copy-id completed
        
        authorized_keys exists
      - Permissions
        
        chmod 700 ~/.ssh
        
        chmod 600 ~/.ssh/authorized_keys
    - - Ubuntu Debian
        
        sudo apt install -y python3
      - Rocky AlmaLinux
        
        sudo dnf install -y python3
    - - Network
      - SSH
      - Authentication
      - Inventory
      - Python
      - Sudo
- - - - Manages infrastructure
      - Executes Ansible playbooks
      - Monitors patch status
    - - Central management server
      - Stores inventories
      - Stores playbooks
      - Uses SSH for automation
      - No agent required
    - - Ubuntu Server
      - Debian Server
      - Rocky Linux
      - AlmaLinux
      - Future expansion
        
        RHEL
        
        Oracle Linux
        
        Amazon Linux
  - - - Enterprise desktop virtualization
      - Snapshot support
      - Easy cloning
      - Network isolation
      - Testing before production
    - - Enable Intel VT-x or AMD-V in BIOS
      - Windows Task Manager
        
        Performance
        
        CPU
        
        Virtualization = Enabled
  - - - CPU
        
        8 Cores
      - RAM
        
        32 GB
      - Storage
        
        1 TB SSD
    - - Ansible Controller
        
        2 CPU
        
        4 GB RAM
        
        40 GB Disk
      - Ubuntu01
        
        1 CPU
        
        2 GB RAM
        
        20 GB Disk
      - Ubuntu02
        
        1 CPU
        
        2 GB RAM
        
        20 GB Disk
      - Rocky01
        
        1 CPU
        
        2 GB RAM
        
        20 GB Disk
      - Alma01
        
        1 CPU
        
        2 GB RAM
        
        20 GB Disk
      - Debian01
        
        1 CPU
        
        2 GB RAM
        
        20 GB Disk
    - - Leave resources for Host OS
      - Avoid CPU overcommit
      - Store VMs on SSD
  - - - 192.168.100.0/24
    - - 192.168.100.2
    - - 8.8.8.8
      - 1.1.1.1
    - - VMware NAT
    - - Controller communicates through SSH
      - Servers require Internet for updates
      - Static IPs simplify automation
  - - - 192.168.100.10
    - - 192.168.100.20
    - - 192.168.100.21
    - - 192.168.100.30
    - - 192.168.100.31
    - - 192.168.100.40
    - - Keep numbering organized
      - Leave space for future servers
  - - - Ubuntu Server
      - Name
        
        ansible-controller
      - CPU
        
        2
      - RAM
        
        4096 MB
      - Disk
        
        40 GB
      - Network
        
        NAT
    - - Ubuntu01
      - Ubuntu02
      - Rocky01
      - Alma01
      - Debian01
      - Settings
        
        CPU
        
        1
        
        RAM
        
        2048 MB
        
        Disk
        
        20 GB
        
        Network
        
        NAT
  - - - Language
        
        English
      - Keyboard
        
        US
      - Network
        
        DHCP during installation
      - Storage
        
        Use Entire Disk
      - Username
        
        bilal
      - Server Name
        
        ansible-controller
      - Install OpenSSH Server
        
        Required
        
        Enables Ansible communication
    - - Ubuntu
      - Debian
      - Rocky
      - AlmaLinux
    - - Keep usernames identical
      - Simplifies automation
      - Reduces inventory complexity
  - - - DHCP changes IP
      - Inventory becomes invalid
      - Static IP ensures stability
    - - Edit Netplan
        
        sudo nano /etc/netplan/*.yaml
      - Example
        
        dhcp4 false
        
        address 192.168.100.20/24
        
        gateway 192.168.100.2
        
        dns
        
        8.8.8.8
        
        1.1.1.1
      - Apply
        
        sudo netplan apply
    - - ip addr
      - ip route
    - - Configure using nmcli
    - - Static addressing
      - Proper gateway
      - Reliable DNS
  - - - Easy identification
      - Inventory readability
      - Logging
      - Monitoring
    - - sudo hostnamectl set-hostname ansible-controller
      - sudo hostnamectl set-hostname ubuntu01
      - sudo hostnamectl set-hostname rocky01
    - - hostname
      - hostnamectl
  - - - sudo nano /etc/hosts
    - - 192.168.100.10 ansible-controller
      - 192.168.100.20 ubuntu01
      - 192.168.100.21 ubuntu02
      - 192.168.100.30 rocky01
      - 192.168.100.31 alma01
      - 192.168.100.40 debian01
    - - Local hostname resolution
      - Works without internal DNS
      - Faster troubleshooting
  - - - ip addr
    - - ip route
    - - cat /etc/resolv.conf
    - - hostname
      - hostnamectl
  - - - ping -c 4 ubuntu01
    - - ping -c 4 192.168.100.20
    - - ping -c 4 8.8.8.8
    - - ping -c 4 google.com
    - - Local works Internet fails
        
        NAT or Gateway issue
      - Internet works DNS fails
        
        DNS issue
      - Nothing works
        
        Network configuration problem
  - - - ssh bilal@192.168.100.20
    - - Type yes
      - Enter Password
    - - Secure remote management
      - Required by Ansible
      - Agentless automation
  - - - sudo apt update
      - sudo apt upgrade -y
    - - sudo dnf update -y
    - - sudo reboot
    - - Always begin automation from fully updated systems
  - - - Stable automation
      - Inventory consistency
    - - Required for Ansible
      - Secure encrypted communication
    - - Easier administration
      - Better logging
      - Simpler troubleshooting
    - - Security patches
      - Package consistency
      - Prevent dependency issues
    - - Internet access
      - Package downloads
      - Repository synchronization
    - - Simplifies SSH
      - Simplifies inventory
      - Easier automation
    - - Safe testing
      - Snapshots
      - Isolation
      - Enterprise lab environment
    - - SSH is the communication layer
      - If SSH fails Ansible fails
    - - Build Infrastructure
      - Configure Networking
      - Configure Static IP
      - Configure Hostnames
      - Configure DNS Resolution
      - Verify Connectivity
      - Verify SSH
      - Update Operating Systems
      - Ready for Phase 2
        
        Install and Configure Ansible Controller
        
        Configure SSH Keys
        
        Create Inventory
        
        Test Ansible Connectivity
- - - - Reviews available updates
      - Starts patch job
      - Monitors execution
      - Reviews reports
    - - Reads Inventory
      - Connects using SSH
      - Executes Playbook
      - Applies patches
      - Generates reports
    - - Ubuntu
      - Debian
      - Rocky Linux
      - AlmaLinux
      - Future RHEL Servers
  - - - mkdir -p ~/ansible-patching/inventory
      - mkdir -p ~/ansible-patching/playbooks
      - mkdir -p ~/ansible-patching/roles
      - mkdir -p ~/ansible-patching/reports
      - cd ~/ansible-patching
    - - ansible-patching
        
        inventory
        
        hosts.ini
        
        playbooks
        
        patch.yml
        
        roles
        
        reports
    - - inventory
        
        Store server list
      - playbooks
        
        Automation scripts
      - roles
        
        Reusable enterprise automation
      - reports
        
        Patch logs
        
        Audit reports
        
        Compliance evidence
  - - - inventory/hosts.ini
    - - [ubuntu]
      - server01 ansible_host=192.168.141.130
    - - [all:vars]
      - ansible_user=bilal
      - ansible_become=true
      - ansible_become_method=sudo
      - ansible_python_interpreter=/usr/bin/python3
    - - ansible_user
        
        SSH login user
      - ansible_become
        
        Enable privilege escalation
      - ansible_become_method
        
        Use sudo
      - ansible_python_interpreter
        
        Python used by Ansible modules
    - - ansible-inventory -i inventory/hosts.ini --list
    - - ansible all -i inventory/hosts.ini -m ping
    - - SUCCESS
      - pong
  - - - playbooks/patch.yml
    - - hosts all
      - become yes
      - serial 1
    - - Execute privileged tasks
      - Install packages
      - Remove packages
      - Reboot systems
    - - Patch one server at a time
      - Reduce production risk
      - Prevent entire environment outage
    - - serial 20%
      - Patch twenty percent of servers simultaneously
  - - - Update Package Cache
        
        apt
        
        update_cache yes
        
        cache_valid_time 3600
      - Purpose
        
        Refresh package repository
        
        Avoid downloading cache repeatedly
        
        Improve execution speed
      - Equivalent Linux Command
        
        sudo apt update
    - - Upgrade Packages
        
        apt
        
        upgrade dist
      - Purpose
        
        Install latest packages
        
        Install security updates
        
        Install kernel updates
      - Equivalent Command
        
        sudo apt full-upgrade
    - - Remove Unused Packages
        
        apt
        
        autoremove yes
        
        purge yes
      - Purpose
        
        Remove unused dependencies
        
        Free disk space
        
        Remove obsolete configuration files
      - Equivalent Commands
        
        sudo apt autoremove
        
        sudo apt purge
    - - Check Reboot Requirement
        
        stat
        
        path
        
        /var/run/reboot-required
      - Register Variable
        
        reboot_required
      - Purpose
        
        Detect kernel updates
        
        Detect reboot requirement
      - Equivalent Command
        
        ls /var/run/reboot-required
    - - Reboot System
        
        reboot
        
        reboot_timeout 600
        
        msg
        
        System reboot initiated by Ansible patching
      - Execute Only When
        
        reboot_required.stat.exists
      - Purpose
        
        Avoid unnecessary reboot
        
        Reduce downtime
    - - Wait for Server
        
        wait_for_connection
        
        delay 10
        
        timeout 300
      - Purpose
        
        Wait until SSH becomes available
        
        Continue playbook safely
    - - Validate SSH Service
        
        systemd
        
        name ssh
        
        state started
      - Register
        
        ssh_status
      - Purpose
        
        Verify SSH service
        
        Prevent administrator lockout
    - - Display Status
        
        debug
        
        SSH service is running fine
      - Condition
        
        ssh_status.state equals started
    - - Generate Report
        
        copy
        
        destination
        
        /tmp/patch_report_server.txt
      - Report Includes
        
        Hostname
        
        Patch Date
        
        Reboot Required
        
        SSH Status
      - Purpose
        
        Audit trail
        
        Compliance
        
        Troubleshooting
  - - - ansible-playbook -i inventory/hosts.ini playbooks/patch.yml --check
    - - Preview changes
      - Detect problems
      - Verify syntax
      - Safe testing
    - - ansible-playbook -i inventory/hosts.ini playbooks/patch.yml
    - - ansible-playbook -i inventory/hosts.ini playbooks/patch.yml -v
      - -vv
      - -vvv
  - - - serial 1
      - serial 20%
      - Benefits
        
        High Availability
        
        Zero Mass Failure
        
        Safer Production
    - - delegate_to localhost
      - Save Report
        
        reports
        
        server01.log
      - Purpose
        
        Central reporting
        
        Compliance
        
        Historical records
    - - Validate
        
        ssh
        
        cron
        
        nginx
        
        apache2
        
        mysql
        
        docker
        
        elasticsearch
        
        kibana
        
        logstash
      - Benefits
        
        Ensure business services remain online
    - - command
        
        uname -r
      - Register
        
        kernel_before
      - Compare
        
        Before patch
        
        After patch
      - Purpose
        
        Verify kernel update
        
        Smart reboot decision
  - - - /tmp/patch_report_hostname.txt
    - - ~/ansible-patching/reports
    - - Elasticsearch
      - Grafana
      - Splunk
      - SIEM Dashboard
    - - Hostname
      - Date
      - Updated Packages
      - Failed Packages
      - Reboot Status
      - Service Status
      - Administrator
      - Execution Time
  - - - VMware Snapshot
    - - Easy rollback
      - Disaster recovery
      - Safe production updates
  - - - Entire infrastructure patched simultaneously
      - Large outage risk
    - - Old kernel remains active
      - Security patches incomplete
    - - Server boots
      - Applications fail
    - - No audit trail
      - Difficult troubleshooting
    - - Difficult rollback
      - Longer recovery time
  - - - Slack
      - Email
      - Microsoft Teams
    - - Cron
      - Ansible AWX
      - Ansible Automation Platform
    - - Development
      - Testing
      - UAT
      - Production
    - - Linux Team
      - DevOps Team
      - Security Team
      - Operations Team
  - - - Updating multiple servers from one central controller
    - - Agentless
      - SSH based
      - Easy automation
      - Repeatable
      - Idempotent
    - - Prevents patching every server simultaneously
    - - Execute administrative tasks using sudo
    - - Wait until rebooted server becomes reachable
    - - Reduce downtime
    - - Ensure applications remain operational
    - - Compliance
      - Auditing
      - Troubleshooting
    - - apt update
        
        Refresh repository metadata
      - apt upgrade
        
        Install package updates
      - apt full-upgrade
        
        Install updates including dependency changes
    - - Simulate changes without modifying servers
    - - Store reports on controller instead of managed nodes
    - - Fast rollback if update fails
- - - - Why Phase 6 Exists
        
        Reporting is the final phase of the patch management lifecycle.
        
        Every patch execution should produce an audit trail.
        
        Enterprise environments require proof of:
        
        Which servers were patched
        
        Which servers failed
        
        Whether a reboot is required
        
        Number of packages updated
        
        Execution duration
        
        Date and time of execution
        
        Reports help with:
        
        Compliance
        
        Auditing
        
        Troubleshooting
        
        Change Management
        
        Security Monitoring
        
        Patch Verification
      - Enterprise Goals
        
        Identify successful patching
        
        Identify failed patching
        
        Detect reboot requirement
        
        Record execution time
        
        Count upgraded packages
        
        Store reports centrally
        
        Forward reports to SIEM (Wazuh / ELK)
        
        Maintain historical reports
        
        Produce evidence for audits
    - - ~/ansible
        
        ansible.cfg
        
        inventory/
        
        hosts.ini
        
        playbooks/
        
        patch.yml
        
        templates/
        
        report.j2
        
        logs/
        
        patch_report_server01.txt
        
        patch_report_server02.txt
        
        report_server01_2026-07-06T19:35:00Z.txt
        
        files/
        
        roles/
        
        host_vars/
        
        group_vars/
  - - - Contains managed hosts.
    - - Stores automation playbooks.
    - - Stores Jinja2 report templates.
    - - Central location for all patch reports.
    - - Enterprise modular automation.
    - - Patch Starts
        
        ↓
      - Record Start Time
        
        ↓
      - Update Package Cache
        
        ↓
      - Upgrade Packages
        
        ↓
      - Capture Upgrade Output
        
        ↓
      - Count Updated Packages
        
        ↓
      - Detect Reboot Requirement
        
        ↓
      - Record Finish Time
        
        ↓
      - Calculate Execution Time
        
        ↓
      - Determine Status
        
        SUCCESS
        
        FAILED
        
        PARTIAL
        
        REBOOT REQUIRED
        
        ↓
      - Generate Report
        
        ↓
      - Fetch Report to Controller
        
        ↓
      - Store Report
        
        ~/ansible/logs/
        
        ↓
      - Optional
        
        Filebeat
        
        Elasticsearch
        
        Kibana
        
        Wazuh Agent
        
        Wazuh Manager
    - - Directory
        
        cd ~/ansible/templates
      - Create Template
        
        nano report.j2
      - Purpose
        
        Jinja2 template
        
        Creates human-readable reports.
        
        Variables are replaced dynamically.
      - Report Contains
        
        Hostname
        
        Date
        
        Time
        
        OS
        
        OS Version
        
        Kernel Version
        
        Packages Updated
        
        Package Count
        
        Reboot Required
        
        Execution Time
        
        Status
    - - Verify
        
        cd ~/ansible
        
        ls
      - Create
        
        mkdir -p logs
      - Purpose
        
        Central storage
        
        Historical reports
        
        Easy SIEM integration
    - - Open
        
        cd ~/ansible/playbooks
        
        nano patch.yml
      - Reporting Tasks
        
        Add after patch tasks
    - - Task
        
        name: Record start time
        
        set_fact:
        
        patch_start: "{{ ansible_date_time.epoch }}"
      - Purpose
        
        Save Unix Epoch
        
        Used later
        
        Finish Time
        
        Execution Time
      - Interview
        
        Why use Epoch?
        
        Easy subtraction
        
        Accurate timing
    - - Update Cache
        
        apt
        
        update_cache: yes
      - Upgrade
        
        apt
        
        upgrade: dist
        
        register: upgrade_result
      - Purpose
        
        register stores module output
      - Used Later
        
        Package Count
        
        Package List
        
        Report Generation
    - - Task
        
        package_count
      - Purpose
        
        Estimate upgraded packages
      - Enterprise Improvement
        
        Compare
        
        apt list --upgradable
        
        Before
        
        After
        
        More accurate counts
    - - Ubuntu File
        
        /var/run/reboot-required
      - Task
        
        stat module
      - Register
        
        reboot_file
      - Convert
        
        YES
        
        NO
      - Enterprise Importance
        
        Decide
        
        Immediate reboot
        
        Maintenance Window
        
        Deferred reboot
      - Interview
        
        Which file indicates reboot?
        
        /var/run/reboot-required
    - - Task
        
        patch_finish
      - Purpose
        
        End timestamp
    - - Formula
        
        Finish Time
        
        minus
        
        Start Time
      - Result
        
        Seconds
      - Enterprise Usage
        
        Performance monitoring
        
        Slow server detection
        
        Maintenance reporting
    - - Possible Values
        
        SUCCESS
        
        FAILED
        
        PARTIAL SUCCESS
        
        REBOOT REQUIRED
      - Enterprise Best Practice
        
        Use
        
        block
        
        rescue
        
        always
        
        to assign accurate status
    - - Variable
        
        upgraded_packages
      - Source
        
        upgrade_result.stdout
      - Purpose
        
        Report package names
    - - Module
        
        template
      - Source
        
        templates/report.j2
      - Destination
        
        /tmp/patch_report_hostname.txt
      - Purpose
        
        Report first created
        
        Managed Host
    - - Module
        
        fetch
      - Source
        
        /tmp/report
      - Destination
        
        ~/ansible/logs/
      - Flat
        
        yes
      - Purpose
        
        Copy reports
        
        Managed Host
        
        →
        
        Controller
    - - Commands
        
        cd ~/ansible/logs
        
        ls
        
        cat patch_report_server01.txt
      - Verify
        
        Host
        
        Date
        
        Time
        
        Package Count
        
        Packages
        
        Reboot
        
        Status
        
        Execution Time
    - - Why
        
        Never overwrite
      - Example
        
        report_server01_2026-07-06T19:35:00Z.txt
      - Enterprise Benefit
        
        Historical tracking
        
        Audit trail
        
        Rollback investigations
    - - Example
        
        latest_server01.txt
      - Command
        
        ln -sf newest_report latest_server01.txt
      - Benefit
        
        Monitoring tools
        
        Always access newest report
    - - Requirement
        
        Filebeat Installed
      - Configure
        
        filebeat.inputs
        
        filestream
        
        path
        
        /home/bilal/ansible/logs/*.txt
      - Restart
        
        sudo systemctl restart filebeat
      - Verify
        
        sudo systemctl status filebeat
      - Flow
        
        Logs
        
        →
        
        Filebeat
        
        →
        
        Elasticsearch
        
        →
        
        Kibana Dashboard
      - Benefits
        
        Search reports
        
        Dashboards
        
        Trend analysis
        
        Historical analytics
    - - Requirement
        
        Wazuh Agent
      - Configure
        
        localfile
        
        Monitor
        
        ~/ansible/logs
      - Restart
        
        sudo systemctl restart wazuh-agent
      - Verify
        
        sudo systemctl status wazuh-agent
      - Flow
        
        Reports
        
        →
        
        Wazuh Agent
        
        →
        
        Wazuh Manager
        
        →
        
        Dashboard
      - Benefits
        
        Compliance
        
        Security monitoring
        
        Audit reporting
        
        Alert generation
    - - Hostname
      - Date
      - Time
      - Distribution
      - OS Version
      - Kernel
      - Package Names
      - Package Count
      - Reboot Required
      - Execution Time
      - Patch Status
    - - Never overwrite reports
      - Use timestamped filenames
      - Store reports centrally
      - Use Jinja2 templates
      - Keep controller as single source of truth
      - Integrate with SIEM
      - Retain reports
      - Archive old reports
      - Generate both
        
        Per-host reports
        
        Consolidated summary
      - Measure execution time
      - Detect reboot requirement
      - Log failures
      - Use least privilege
      - Version control playbooks
      - Schedule patching during maintenance windows
    - - block
        
        Perform patching
        
        Record success
      - rescue
        
        Capture errors
        
        Set status FAILED
        
        Continue reporting
      - always
        
        Record finish time
        
        Generate report
        
        Fetch report
        
        Cleanup temporary files
      - Benefits
        
        Reports generated even after failure
        
        Accurate SUCCESS / FAILED status
        
        Eases troubleshooting
        
        Production-ready design
    - - Individual Reports
        
        Server01
        
        Server02
        
        Server03
        
        Server04
      - Controller Summary
        
        Total Servers
        
        Successful
        
        Failed
        
        Reboot Required
        
        Total Packages Updated
        
        Average Execution Time
        
        Patch Window Duration
      - Used By
        
        Linux Team
        
        SOC
        
        Compliance Team
        
        Management
    - - Why generate reports?
        
        Audit evidence
        
        Compliance
        
        Troubleshooting
        
        Verification
      - Why use Jinja2?
        
        Dynamic report generation
      - Why use fetch module?
        
        Copy reports from managed hosts to controller
      - Why use template module?
        
        Render variables into readable reports
      - Why use register?
        
        Store task output for later processing
      - Why use set_fact?
        
        Save calculated values for reuse
      - Why use stat?
        
        Check file existence without modifying the system
      - Why record execution time?
        
        Measure patch performance and SLA compliance
      - How detect reboot?
        
        Check /var/run/reboot-required
      - Why timestamp reports?
        
        Preserve history and avoid overwriting
      - Why integrate with ELK?
        
        Centralized logging, dashboards, search, analytics
      - Why integrate with Wazuh?
        
        Security monitoring, compliance, alerting
      - Why use block rescue always?
        
        Ensure reports are generated even when patching fails
      - Why create a consolidated report?
        
        Executive visibility and fleet-wide patch status
    - - cd ~/ansible/templates
      - nano report.j2
      - cd ~/ansible
      - mkdir -p logs
      - ls
      - cd ~/ansible/playbooks
      - nano patch.yml
      - cd ~/ansible/logs
      - ls
      - cat patch_report_server01.txt
      - ln -sf report_server01_2026-07-06T19:35:00Z.txt latest_server01.txt
      - sudo systemctl restart filebeat
      - sudo systemctl status filebeat
      - sudo systemctl restart wazuh-agent
      - sudo systemctl status wazuh-agent
    - - Patch Execution Completed
        
        ↓
      - Reports Automatically Generated
        
        ↓
      - Reports Copied to Controller
        
        ↓
      - Reports Stored in ~/ansible/logs
        
        ↓
      - Timestamped for History
        
        ↓
      - Latest Report Shortcut Updated
        
        ↓
      - Optional Forwarding to ELK
        
        ↓
      - Optional Forwarding to Wazuh
        
        ↓
      - Consolidated Summary Generated
        
        ↓
      - Enterprise Audit Trail Available
        
        ↓
      - Compliance, Security, Operations, and Management Teams Can Verify Patch Success
- - - - Automatic Asset Discovery
      - Network Discovery
      - Server Registration
      - Cloud Discovery
      - VMware Discovery
      - Physical Servers
      - Virtual Machines
      - Cloud Instances
      - Containers
      - Kubernetes Worker Nodes
      - Load Balancers
      - Application Servers
      - Database Servers
      - Web Servers
      - File Servers
      - Proxy Servers
      - Mail Servers
  - - - Hardware Inventory
        
        CPU
        
        Memory
        
        Disk
        
        Network Interfaces
      - Operating System Inventory
        
        Distribution
        
        Version
        
        Kernel Version
        
        Architecture
      - Software Inventory
        
        Installed Packages
        
        Installed Services
        
        Installed Applications
      - System Information
        
        Hostname
        
        IP Address
        
        FQDN
        
        Environment
        
        Data Center
        
        Business Owner
        
        Application Owner
      - Configuration Inventory
        
        Repositories
        
        Package Managers
        
        Enabled Services
        
        System Configuration
  - - - APT Packages
      - DNF Packages
      - YUM Packages
      - Zypper Packages
      - Snap Packages
      - Flatpak Packages
      - Held Packages
      - Installed Versions
      - Available Versions
      - Security Updates
      - Bug Fix Updates
      - Enhancement Updates
      - Package Dependencies
      - Repository Status
      - GPG Key Validation
  - - - CVE Collection
      - CVSS Score Analysis
      - Security Bulletins
      - Distribution Advisories
      - Vulnerability Scanners
        
        OpenVAS
        
        Nessus
        
        Qualys
        
        Rapid7
      - Kernel Vulnerabilities
      - Application Vulnerabilities
      - Package Vulnerabilities
      - Configuration Weaknesses
      - Missing Security Updates
      - Exploit Availability
      - Threat Intelligence Correlation
  - - - Critical
      - High
      - Medium
      - Low
      - Business Impact
      - Service Impact
      - Internet Facing Systems
      - Internal Systems
      - Mission Critical Applications
      - Production Environment
      - Development Environment
      - Test Environment
      - End of Life Software
      - Unsupported Operating Systems
  - - - Security Team Approval
      - Application Owner Approval
      - Infrastructure Approval
      - Management Approval
      - Emergency Patch Approval
      - Standard Patch Approval
      - Change Ticket Approval
      - Risk Acceptance Approval
  - - - Lab Environment
      - Development Environment
      - QA Environment
      - Pre-Production Environment
      - Functional Testing
      - Application Testing
      - Integration Testing
      - Performance Testing
      - Regression Testing
      - Kernel Testing
      - Dependency Validation
      - Service Validation
      - Database Validation
      - Container Validation
  - - - VM Snapshot
      - System Snapshot
      - Filesystem Backup
      - Database Backup
      - Application Backup
      - Configuration Backup
      - Boot Partition Backup
      - Critical Data Backup
      - Rollback Snapshot
      - Disaster Recovery Validation
      - Backup Verification
  - - - Business Approval
      - Downtime Notification
      - User Communication
      - Change Freeze Validation
      - Resource Availability
      - Support Team Availability
      - Emergency Contacts
      - Rollback Readiness
  - - - Automation Platform
        
        Ansible
        
        AWX
        
        Ansible Automation Platform
      - Deployment Strategy
        
        Canary Deployment
        
        Pilot Group
        
        Batch Deployment
        
        Phased Deployment
        
        Rolling Deployment
        
        Blue Green Strategy
      - Package Update
      - Security Patch Installation
      - Kernel Update
      - Service Restart
      - Dependency Resolution
      - Reboot Management
      - Cluster Aware Patching
      - Load Balancer Drain
      - Node Maintenance Mode
      - Parallel Execution
      - Serial Execution
      - Retry Failed Hosts
      - Failure Handling
      - Rollback Execution
  - - - Package Verification
      - Installed Version Verification
      - Kernel Version Verification
      - Service Status Verification
      - Running Process Verification
      - Repository Verification
      - Patch Success Validation
      - Reboot Verification
      - Application Availability
      - User Login Validation
      - Configuration Validation
  - - - CPU Usage
      - Memory Usage
      - Disk Usage
      - Filesystem Health
      - System Load
      - Process Status
      - Service Status
      - Network Connectivity
      - DNS Resolution
      - HTTP Response
      - HTTPS Response
      - Database Connectivity
      - Application Health
      - Cluster Health
      - Kubernetes Node Status
      - Log Review
      - Systemd Service Status
  - - - Patch Compliance Percentage
      - Missing Patches
      - Failed Hosts
      - Successful Hosts
      - Pending Reboots
      - Kernel Compliance
      - Security Compliance
      - CVE Compliance
      - Audit Reports
      - Executive Dashboard
      - Technical Dashboard
      - CSV Reports
      - PDF Reports
      - HTML Reports
      - Email Notifications
      - SIEM Integration
      - CMDB Update
  - - - Change Records
      - Patch History
      - Deployment Logs
      - System Logs
      - Approval Records
      - Test Results
      - Rollback Records
      - Known Issues
      - Lessons Learned
      - Runbooks
      - SOP Documentation
      - Recovery Procedures
  - - - Scheduled Patch Scans
      - Daily Compliance Checks
      - Repository Monitoring
      - New CVE Monitoring
      - Security Advisory Monitoring
      - Package Repository Monitoring
      - System Monitoring
      - Log Monitoring
      - SIEM Integration
      - Zabbix Monitoring
      - Prometheus Monitoring
      - Grafana Dashboards
      - Alert Management
      - Email Alerts
      - Slack Notifications
      - Microsoft Teams Notifications
      - Incident Response Integration
      - Configuration Drift Detection
      - Patch Drift Detection
      - Continuous Improvement
  - - - Scheduled Patch Job
      - Discover Assets
      - Collect Inventory
      - Collect Package Information
      - Assess Vulnerabilities
      - Classify Risk
      - Request Approval
      - Test Updates
      - Create Backup
      - Open Maintenance Window
      - Deploy Patches
      - Reboot Systems
      - Verify Installation
      - Run Health Checks
      - Generate Compliance Reports
      - Update Documentation
      - Send Notifications
      - Continuous Monitoring
      - Prepare Next Patch Cycle
    - - Ansible Control Node
      - AWX Automation Controller
      - Inventory Management
      - Dynamic Inventory
      - Git Repository
      - Playbooks
      - Roles
      - Collections
      - Vault
      - SSH Keys
      - Package Repositories
        
        APT Repository
        
        YUM Repository
        
        DNF Repository
        
        Local Mirror Repository
      - Log Management
      - Reporting Server
      - Notification Server
      - Backup Server
      - Monitoring Server
      - SIEM Platform
      - Configuration Management Database
- - - - server01
      - server02
    - - db01
- - - - hosts.ini
    - - patch.yml
      - reboot.yml
      - verify.yml
    - - common
      - patch
      - reporting
      - reboot