Saturday, June 23, 2012

How to apply updates and security patches to ESXi

It is possible to apply ESXi updates and it's free, by installing these updates you will get additional features such as new OS supported to be installed and security patches which are released in a monthly basis. You can get the updates from here: http://www.vmware.com/patchmgr/findPatch.portal

If you have ESXi 4.1 and have not installed any patches ever, I recommend:

  1. update-from-esxi4.1-4.1_update02.zip : It's the latest major upgrade often called as update 2
  2. ESXi410-201206001.zip: It's the latest security patch from June 2012.

ESXi updates are cumulatives, therefore you don't need to install all the patches that have been released to be up to date, by getting the last major update and the last security update, you are good.

The process is as follows:
  1. Download and copy the update-from-esxi4.1-4.1_update02.zip and ESXi410-201206001.zip ESXi:

    On OS X or Linux you can SCP the files to your server, you will need an ssh account.

    # scp update-from-esxi4.1-4.1_update02.zip root@esxi:/
    # scp ESXi410-201206001.zip root@esxi:/



  2. You need to turn off all the VMs and enter in maintenance mode:
    # vim-cmd hostsvc/maintenance_mode_enter
  3. On the ESXi, in the same directory you copy the file, apply the major update:
    Unpacking cross_qlogic-fchba-provider_410.1.3.7-454.. ###################################################################### [100%]
    Unpacking cross_oem-vmware-esx-drivers-scsi-3w-9xxx.. ###################################################################### [100%]

    Unpacking cross_oem-vmware-esx-drivers-net-vxge_400..
    ###################################################################### [100%]

    Unpacking cross_vmwprovider_4x.1.0.1-2.11.502767      ###################################################################### [100%]

    Unpacking cross_swmgmt_4x.1.0.1-1.4.348481            ###################################################################### [100%]

    Unpacking cross_kmodule_4x.1.0.1-1.4.348481           ###################################################################### [100%]

    Unpacking cross_omc_1.1.0-2.11                        ###################################################################### [100%]

    Unpacking cross_hdr_4x.1.0.1-1.4.348481               ###################################################################### [100%]

    Removing packages :qlogic-fchba-provider              ###################################################################### [100%]

    Installing packages :cross_oem-vmware-esx-drivers-s.. ###################################################################### [100%]

    Installing packages :cross_qlogic-fchba-provider_41.. ###################################################################### [100%]
    Running [cim-install.sh]...ok.Running [vmkmod-install.sh]...ok.Running [/sbin/esxcfg-secpolicy -p /etc/vmware/secpolicy]...ok.The update completed successfully, but the system needs to be rebooted for the changes to be effective
  4. On the ESXi, in the same directory you copy the file, apply the security update:
    # esxupdate --bundle=ESXi410-201206001.zip update

    Unpacking deb_vmware-esx-firmware_4.1.0-2.23.721871   ##################################################################### [100%]
    Installing packages :deb_vmware-esx-firmware_4.1.0-.. ##################################################################### [100%]
    The update completed successfully, but the system needs to be rebooted for the changes to be effective.
  5. Once installed, we check the status:
     esxupdate query

    ----Bulletin ID----- -----Installed----- ---------------Summary--------------- 

    ESXi410-Update02     2012-06-23T05:58:57 VMware ESXi 4.1 Complete Update 2
    ESXi410-201206401-SG 2012-06-23T05:15:08 Updates Firmware  
  6. We need to reboot to apply the security updates:
    # reboot
  7. And finally, we can now exit from maintenance mode:
    vim-cmd hostsvc/maintenance_mode_exit
  8. Done!

Summary of vcli commands:

  • vim-cmd hostsvc/maintenance_mode_enter
  • esxupdate --bundle=update-from-esxi4.1-4.1_update02.zip update
  • esxupdate --bundle=ESXi410-201206001.zip update
  • esxupdate query
  • vim-cmd hostsvc/maintenance_mode_exit