Using CERMM
Patches
What's waiting to be installed on every machine, security first, and one batch to install it.
Where updates come from
| Manager | Security updates |
|---|---|
| apt | from the -security suites |
| dnf | updateinfo --security |
| pacman | through checkupdates; pacman has no security-only updates |
| flatpak | counted with the rest |
| Windows Update | through its COM API, with severity and KB |
macOS isn't covered yet. Winget app updates aren't either.
When agents check
- A quick look at start and after every job.
- A full check, refreshing the package lists, every six hours.
- Check now on the Patches page or a device asks for one at the next report.
The page
Devices → Patches lists machines by security updates, then by count, with whether a reboot is pending and when they were checked.
Install: Security or All, and Reboot if needed. It's a batch like a software push: one job per machine, an hour's time limit, each machine saying what it would install or why not. Above the approval threshold it waits for someone else (Approval). Installs can run on a schedule.
On a device
The Updates section has the list, Check now, Install, and Reboot when a reboot is pending.
Pending reboots
The agent's health check (every 5 minutes) notices a pending reboot: Debian's reboot-required, a running kernel whose modules are gone, needs-restarting -r, and Windows' servicing and Windows Update keys. One pending longer than 7 days is a warning (Alerts).