0

Good day fellows,

I'm looking to build a centralised dashboard to track the patch management KPI from our organisation, including workstations (Windows) & servers (Linux/Windows).

Basically, I'm mainly looking to see the percentage of endpoints not complying with the latest patches.

We are currently using SCCM/WSUS (Windows) and Redhat Satellite (Linux).

Any ideas on how I can achieve this?

1
  • Were you able to come up with the KPI's for your specific requirement? We are looking for something similar in house
    – Kaustubh
    Aug 18, 2017 at 19:23

1 Answer 1

1

For your Linux systems the short answer is: talk against the RHN Satellite API.

The longer answer is that much depends on how you have implemented your release management within Satellite and your workflow's with regards to Errata (the Red Hat terminology for bug fixes and security updates).

If your organisation followed the common practice to clone the default channels your systems will be subscribed to those. Unless you actually manage Errata they won't appear automatically in cloned channels. The system will appear completely patched, meeting your KPI by the way, when in fact there may available patches that are just not visible.
In the regard that Red Hat may have released an Erratum to fix a security issue, but it isn't released internally and therefor not available for deployment. As far as I know you can't report on how many systems would be effected if an Erratum were to be released into all cloned channels.

The second thing is that you should probably focus on applied/missing Errata and not on RPM packages for multiple reasons:

  • Errata are classified in 3 categories: product enhancements, bug fixes and Security updates (with levels of "moderate", "important" and "critical") and you'll want to place corresponding severity levels on them in your reports
  • Errata can consist of multiple RPM packages
  • From a security perspective you want to see vulnerability such and such addressed, not that package-name.version is on patch number X on RHEL 5 and version.Y on RHEL 6

The API has two approaches:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .