How often do you patch vmware?

azjagazjag Member Posts: 579 ■■■■■■■□□□
in Virtualization
I'm working on an SOP for patching our virtual environment. I wanted to see how others were handling this as it is not windows/linux os patching.

I'm the type of person that will patch vmware via update manager on a monthly basis and firmware (Blade Chassis) on a quarterly basis. My teammate would rather patch vmware every 6 months and firmware every year or two.

What do you think is a good mix of keeping up to date vs. not living on bleeding edge of updates?

Thanks,
Currently Studying:
VMware Certified Advanced Professional 5 – Data Center Administration (VCAP5-DCA) (Passed)
VMware Certified Advanced Professional 5 – Data Center Design (VCAP5-DCD)
· Share on FacebookShare on Twitter

Comments

  • kriscamaro68kriscamaro68 Member Posts: 1,186 ■■■■■■■□□□
    REMOVED UNNECESSARY QUOTE

    Quarterly unless is a critical then ASAP.
    · Share on FacebookShare on Twitter
  • pwjohnstonpwjohnston Member Posts: 441
    We only patch when we upgrade to a new vSphere version. :P This is not my choice though. I work with a lot of Linux types who think that if it's stable don't mess with it. They even resist patching when the vendor advises it if they can't find a reason for the patch in the change log...
    · Share on FacebookShare on Twitter
  • cyberguyprcyberguypr Mod Posts: 6,928 Mod
    Unfortunately my environment is very reactive so only when our vulnerability management products alerts of missing patches.
    · Share on FacebookShare on Twitter
  • VeritiesVerities Member Posts: 1,162
    kriscamaro68 wrote: »
    Quarterly unless is a critical then ASAP.

    We do the same.
    · Share on FacebookShare on Twitter
  • jibbajabbajibbajabba Member Posts: 4,317 ■■■■■■■■□□
    Barely. We tend to 'never break a running system'. VMware sometimes tend to introduce a series of bugs which keeps affecting us so when it works, it works. Another problem is compatibility and required upgrade sequence.

    We use so many VMware features (vCloud, vShield and whatnot) that patching and upgrades can be a nightmare.

    Different thing with PCI-DSS environments of course. There you need to patch every three months or so.
    My own knowledge base made public: http://open902.com :p
    · Share on FacebookShare on Twitter
  • iBrokeITiBrokeIT Member Posts: 1,318 ■■■■■■■■■□
    jibbajabba wrote: »
    Barely. We tend to 'never break a running system'. VMware sometimes tend to introduce a series of bugs which keeps affecting us so when it works, it works. Another problem is compatibility and required upgrade sequence.

    This is our mentality after a few lessons learned the hard way. Also, wait at least a quarter before upgrading to a new version. 5.1 and SSO, enough said.
    2019: GPEN | GCFE | GXPN | GICSP | CySA+ 
    2020: GCIP | GCIA 
    2021: GRID | GDSA | Pentest+ 
    2022: GMON | GDAT
    2023: GREM  | GSE | GCFA

    WGU BS IT-NA | SANS Grad Cert: PT&EH | SANS Grad Cert: ICS Security | SANS Grad Cert: Cyber Defense Ops | SANS Grad Cert: Incident Response
    · Share on FacebookShare on Twitter
  • kj0kj0 Member Posts: 767
    jibbajabba wrote: »
    We use so many VMware features (vCloud, vShield and whatnot) that patching and upgrades can be a nightmare.
    Just make sure you do it in the right order ;)


    We patch only if we really need to, we work the same times as the business is in operation and don't get much time in "Off-Business" seasons to do so.
    2017 Goals: VCP6-DCV | VCIX
    Blog: https://readysetvirtual.wordpress.com
    · Share on FacebookShare on Twitter
  • jibbajabbajibbajabba Member Posts: 4,317 ■■■■■■■■□□
    kj0 wrote: »
    Just make sure you do it in the right order ;) .
    jibbajabba wrote: »
    Another problem is compatibility and required upgrade sequence.

    ;)

    I rember we were between a rock and a hard place once. One bug was fixed with patch #a but patch #b had a known issue which also affected customers. So do you leave a broken system or upgrade to a broken system :D
    My own knowledge base made public: http://open902.com :p
    · Share on FacebookShare on Twitter
  • kj0kj0 Member Posts: 767
    jibbajabba wrote: »
    ;)
    Silly Jibbs ... I meant if you do it in the correct order you shouldn't have an issue.
    2017 Goals: VCP6-DCV | VCIX
    Blog: https://readysetvirtual.wordpress.com
    · Share on FacebookShare on Twitter
  • jibbajabbajibbajabba Member Posts: 4,317 ■■■■■■■■□□
    Well D'ur :)

    I just mean it can be a right pain if you hit build numbers where you run into compatibility issues. A lot of people sometimes even forget what they have in their environment and that you need to check every piece of the puzzle (Oh look, Dataprotection stopped working weeks ago - and how about that Usagemeter :p ).

    So a simple update can mean you are busy for several nights :p
    My own knowledge base made public: http://open902.com :p
    · Share on FacebookShare on Twitter
  • kj0kj0 Member Posts: 767
    REMOVED UNNECESSARY QUOTE

    ]Stop everything > clean install > restore from Veeam > Partay!
    2017 Goals: VCP6-DCV | VCIX
    Blog: https://readysetvirtual.wordpress.com
    · Share on FacebookShare on Twitter
  • bertiebbertieb Member Posts: 1,031 ■■■■■■□□□□
    iBrokeIT wrote: »
    .............. Also, wait at least a quarter before upgrading to a new version. 5.1 and SSO, enough said.

    I'm still crying from that one :D
    The trouble with quotes on the internet is that you can never tell if they are genuine - Abraham Lincoln
    · Share on FacebookShare on Twitter
Sign In or Register to comment.