Patching IBM i systems in Concert

Edit online

Concert supports vulnerability detection and remediation for IBM i systems using PTF-based patching. This capability enables you to identify missing fixes and apply them through automated remediation workflows.

IBM i PTF detection during assessment

Concert detects IBM i vulnerabilities during the inventory and advisory ingestion process.

During assessment:
  • CVEs are mapped to affected IBM i versions
  • Required PTFs (Program Temporary Fixes) are identified
  • Remediation actions are generated for systems with missing PTFs

If a required PTF is already installed, the associated CVE is excluded from the assessment results.

If a PTF is missing, the CVE remains visible and a remediation action is created.

IBM i remediation is executed through the IBM Power Auto Remediation workflows.

About IBM i PTF patching

A Program Temporary Fix (PTF) is an update package that addresses specific defects or vulnerabilities in IBM i systems.

PTFs:
  • Remediate one or more CVEs
  • May be applied individually or as part of a group
  • Can require sequencing depending on system requirements
Concert automates:
  • Identification of required PTFs for each system
  • Mapping between CVEs and PTFs
  • Execution of remediation workflows after approval
  • Status tracking during patch execution

Before you begin

Mirror VM requirements for IBM i

IBM i patching requires a Mirror VM configured as an Ansible execution environment.

Ensure the following are installed on the Mirror VM:
  • Python 3.11
  • pip (Python package manager)
  • ansible-core version 2.18.x
  • Required Ansible collections:
    • ibm.power_ibmi
    • ansible.posix

IBM i authentication

Create IBM i authentication in Concert:
  • Service: Config Data
  • Provide IBM i IP address, username, and password
Example: 
{
  "<ibmi_ip>": {
    "username": "<username>",
    "password": "<password>"
  }
}

Review IBM i PTF patches

When missing PTFs are detected, Concert generates a remediation action.

To review:
  1. Go to Dimensions > IBM Power
  2. Select the IBM i system
  3. Go to the Actions tab
  4. Click Review and approve
  5. Open the PTF tab
This panel lists:
  • Available PTFs
  • Associated CVEs
  • Fix details

Select the PTFs you want to apply and click Save.

Approve and apply IBM i patches

  1. Click Approve
  2. Schedule execution time
  3. Confirm approval
After approval:
  • Concert triggers Ansible execution through the Mirror VM
  • PTFs are applied to the IBM i system
  • Status is updated in the Actions tab
Table 1. Remediation states
Status Meaning
Completed All selected PTFs installed successfully.
Partially processed One or more PTFs installed successfully, while others failed
Failed All PTFs failed or the action was aborted

Execution behavior

IBM i patching:
  • Runs through Ansible modules on the Mirror VM
  • Does not directly execute on the IBM i system from Concert
  • Follows the same approval and scheduling model as other platforms

Partial success handling

If one or more PTFs fail:
  • Successfully applied PTFs remain installed
  • Failed PTFs are reported in the action status
  • The overall action may be marked as partially completed