emgr Command

Purpose

Starts the interim fix manager, which installs, removes, lists, and checks system interim fixes.

Syntax

emgr -l [ -L Label | -n interimfixNumber | -u VUID ] [-v{1|2|3|4} ] [ -X ] [-a path]

emgr -e interimfixPackage | -f ListFile [-w Directory ] [ -b | -k | -I ] [ -p ] [ -q ] [ -m ] [ -o ] [ -X ] [-a path]

emgr -i interimfixPackage | -f ListFile [ -w Directory ] [ -C ] [ -p ] [ -q ] [ -X ] [ -a path ]

emgr -C -i interimfixPackage | -f ListFile [ -w Directory ] [ -p ] [ -q ] [ -X ] [ -a path ]

emgr -C -L Label [ -p ] [ -q ] [ -X ]

emgr -r -L Label | -n interimfixNumber | -u VUID | -f ListFile [-w Directory ] [-a path] [ -b | -k | -I ] [ -p ] [ -q ] [ -X ]

emgr -c [ -L Label | -n interimfixNumber | -u VUID | -f ListFile ] [ -w Directory ] [-a path] [-v{1|2|3} ] [ -X ]

emgr -M | -U [ -L Label | -n interimfixNumber | -u VUID | -f ListFile ] [ -w Directory ] [-a path] [ -X ]

emgr -R interimfixLabel [ -w Directory ] [-a path] [ -X ]

emgr -P [ Package ] [-a path] [ -X ]

emgr -d -e interimfixPackage | -f ListFile [-w Directory ] [-v{1|2|3} ]

Description

The emgr (interim fix manager) command can be used to install and manage system interim fixes. The interim fix manager installs packages that are created with the epkg command and maintains a database that contains the interim fix information. The emgr command performs the following operations:

interim fix package installation
interim fix removal
interim fix listing
interim fix checking
interim fix mounting
interim fix unmounting
package locks displaying
installed interim fix forced removal

Notes:

If an attempt is made to update a fileset (by using the installp, install_all_updates, or smit update_all command) that is locked by the interim fix manager, a notice is displayed that indicates which filesets are locked. Sometimes, there is no notice to indicate why a fileset was prevented from being installed. The lslpp command shows that any locked filesets are in the EFIXLOCKED state.
Any library or executable program that is updated by an interim fix or service update that is in use by an active process is not reflected in that process unless it is restarted. For example, an update that changes the ksh does not have the changes reflected in any ksh processes that are already running. Likewise, an update to the libc.a library is not reflected in any process that is already running. In addition, any process that is using a library and does a dlopen operation of the same library after the library is updated could experience inconsistencies if it is not restarted.

Referencing an Ifix

The ways to reference an interim fix are as follows:

Reference by Label

Each interim fix that is installed on a given system has a unique interim fix label. This interim fix label is the unique key that binds all of the different database objects. To reference an interim fix by label, pass the label as a parameter to the -L flag. For example, to run a check operation on an interim fix with label ABC123, enter:

emgr -cL ABC123

Reference by Ifix ID

Each interim fix that is installed on a given system has an interim fix ID. The interim fix ID is simply the order number in which the interim fix is listed in the interim fix database. Using this option might be convenient if you are performing operations on interim fixes based on interim fix listings. The emgr command converts the interim fix ID into an interim fix label before performing the given operation. To reference an interim fix by ID, pass the ID as a parameter to the -n flag.

Note: Ifix IDs can change as interim fixes are removed and added. Always verify the current interim fix ID number by using the -l flag to list the specific interim fix or all interim fixes.

For example, to run a check operation on the first interim fix with ID equal to 1, enter:

emgr -cn1

Reference by VUID

Because interim fix packages are not formally tracked by any entity, it is possible that the same interim fix label could be used for more than one interim fix package. However, the emgr command does not accept the installation of more than one interim fix with the same interim fix label at the same time. The VUID (Virtually Unique ID) can be used to differentiate packages with the same interim fix label. The emgr command converts the VUID into an interim fix label before performing the given operation. For example, to list an installed interim fix with VUID equal to 000775364C00020316020703, enter:

emgr -l -u 000775364C00020316020703

Note: The VUID is displayed in the preview phase of interim fix installation and removal. The VUID is also displayed when listing with verbosity level set to 3 with the -v flag.

Ifix Logging

The following operations are logged to the emgr command log file, /var/adm/ras/emgr.log:

Installation
Removal
Checking
Mounting
Unmounting
Forced Removal

Enabling Automatic Interim Fix Removal by installp

An interim fix can be packaged by the epkg command to contain an APAR reference file that contains the APAR reference numbers. An APAR reference number allows installp to map an interim fix back to the APARs for all the Technology Levels where the fix was shipped. If installp determines that the interim fix is contained in the Technology Level, Service Pack, or PTF being applied, installp automatically removes the interim fix before applying the updates.

If an interim fix is enabled for automatic removal, the emgr command displays the following message during the installation of the interim fix:

ATTENTION: Interim fix is enabled for automatic removal by installp.

Concurrent Updates

The emgr command supports the installation of a new kind of interim fix that is called a concurrent update. This form of interim fix contains a modification to the AIX kernel, or one of its kernel extensions, that can be applied directly to the system memory and does not require the system to be rebooted. With this direct patching to the system memory, you can safely evaluate and test a kernel modification without modifying the file that contains the system's current kernel on the disk. Any concurrent update applied to the system memory does not persist after a system reboot unless you choose to commit the changes that are introduced by the concurrent update to the disk by using the -C flag. You can apply a concurrent update directly over another patch for the same module. You do not need to remove the previous patch. However, there must be only one version of the module loaded. Also, you cannot run any concurrent update operations (in-memory or on disk) for interim fixes in the REBOOT_REQUIRED state until the system is rebooted.

The emgr command supports the in-memory concurrent updates on NIM thin servers (diskless or dataless clients). Since thin servers share operating system files with other clients (/usr directory is read only), the emgr option to commit a concurrent update to disk (-C flag) is not valid on thin servers.

Note: If the shared operating system files of a thin server need to be patched to disk, an interim fix might be applied to the SPOT resource on the NIM master that serves the thin server. Refer to the Installing an Interim Fix into a SPOT resource section of the Installation Guide or the /usr/lpp/bos.sysmgt/nim/README file (NIM IFIX/EMGR section) on your NIM master for details on installing an interim fix into a SPOT.

The emgr database is located in the /var/emgrdata directory on thin servers, since the /usr file system is read only on thin servers.

Certain emgr operations cannot be supported in a thin server environment, such as bosboot and file system expansion. As a result, the following emgr flags are not supported in a thin server environment: -C, -e, -I, -k, and –X. Also, the –b flag, which skips the bosboot process for interim fixes that require rebooting, are always used when applicable since the bosboot operation cannot be supported for thin servers.

Flags

Item	Description
-a path	Specifies an alternative directory path for installation. Note: The -a flag works during the removal of an interim fix only if the -e and -a flags of the emgr command were used during the installation of the interim fix. If the interim fix was not installed by using the -e and -a flags, the emgr command does not completely remove an interim fix from the alternative directory path. As a workaround, use the following command to remove an interim fix that was installed in the alternative directory: `chroot /alt_inst /usr/sbin/emgr -r -L efix_label`
-b	Causes the emgr command to skip the usual AIX bosboot process for interim fixes that require rebooting.
-c	Specifies the check operation. Instructs the emgr command to run a check operation on the specified interim fix or interim fixes.
-C	Commits an interim fix that contains concurrent updates to the disk. This option must be used along with the -i option, or can be used after an interim fix is applied with the -i option. This causes the concurrent updates to persist across system reboots. After a concurrent update is committed, removal results in the module being restored to its original unpatched state, regardless of whether other patches for the module exist or not. All prior patches for the module are removed at the time the commit is performed.
-d	Displays the contents and topology. This option is useful with the -v flag in displaying verbosity output.
-e `interimfixPackage`	Specifies the path of the interim fix package file, and installs the interim fix package. The interim fix package file must be created with the epkg command and must end with the 16-bit compression extension, .Z.
-f `ListFile`	Specifies a file that contains one of the following lists: A list of package locations for the installation operation (one per line) A list of interim fix labels for the remove, mount, unmount, and check operations (one per line) The emgr command ignores any blank lines or lines where the first non-white-space character is the `#` character.
-i `interimfixPackage`	Specifies the path of an interim fix package file that contains a concurrent update, and applies the concurrent update to the system memory. The update does not persist across system reboots unless the -C flag is used. You can also use the -i flag to apply one concurrent update over another for the same module. Such a concurrent update is termed a "follow-on".
-I	Runs the low-level debugger for AIX bosboot by using the -I flag of the bosboot command.
-k	Loads the low-level debugger during AIX bosboot by using the -D flag of the bosboot command.
-l	Instructs the emgr command to run the list operation on the specified interim fix or interim fixes.
-L `Label`	Selects the interim fix for this operation by interim fix label.
-m	Instructs the emgr command to perform a mount installation. When and interim fix is mount-installed, the interim fix files are mounted over the target files.
-M	Instructs the emgr command to mount an interim fix or interim fixes that are mount-installed by using the -m flag. The -M flag can be used to mount an interim fix that was installed by using the -m flag and is unmounted by the -U flag or by some other means, such as rebooting the system.
-n `interimfixID`	Selects the interim fix for this operation by specifying the interim fix ID.
-o	Specifies that the interim fix installation can overwrite an existing package.
-p	Instructs the emgr command to perform a preview for either installation or removal. The preview runs all of the check operations, but does not make any changes.
-P [ `Package` ]	Specifies the package-view operation, which displays all packages that are locked by the interim fix manager, their installer, and the locking label or labels.
-q	Suppresses all output other than errors and strong warnings.
-r	Instructs the emgr command to run a remove operation on the specified interim fix or interim fixes. Removal of an active patch reinstates any prior patch for the module, provided one exists. If no prior patch exists, the module is restored to its original unpatched state.
-R `Label`	Instructs the emgr command to run a force-remove operation. This option removes interim fix data and package locks associated with the interim fix label without removing interim fix files, running any remove scripts, or boot processing. This option can be used for only one interim fix at a time. The interim fix label is required to identify the target interim fix. Attention: This method of interim fix removal must be considered an emergency procedure. Because this method can create inconsistencies on the target system, the force remove method must be used only if all other methods of removing the interim fix are unsuccessful. Use the standard removal process (-r flag) to remove an installed interim fix. In emergency procedures, you can use the -R flag to force-remove a label. The -R flag requires the -F flag to remove a label. When you specify the -F flag with the -R flag, for example `emgr -FR ifix_label`, the force-remove option does not delete any of the interim fix files, saved data, or execute remove scripts. This option must be used only if the standard remove process cannot be accomplished.
-u `VUID`	Selects the interim fix for this operation by specifying the `VUID`.
-U	Instructs the emgr command to unmount an interim fix or interim fixes that are mount-installed by using the -m flag.
--v{1\|2\|3}	The -v{1\|2\|3} flag specifies the verbosity level for the listing operation or the verification level for the check operation. The -v4 flag displays a colon-separated output for the listing operation. Valid levels for the -v flag are 1, 2, 3, and 4 where -v4 flag is only supported by the -l flag.
-w `Directory`	Instructs the emgr command to use the specified working directory instead of the default /tmp directory.
-X	Attempts to expand any file systems where there is insufficient space to perform the requested emgr operation. This option expands file systems based on available space and size estimates that are provided by the interim fix package and the emgr command. Note: It is possible to exhaust available disk space during an installation even if the -X flag is used. This is more likely if other files are being created or expanded in the same file systems during an installation. Remote file systems cannot be expanded by the emgr command.

Exit Status

0: All of the emgr command operations completed successfully.
>0: An error occurred.

Security

System administrators or users with the aix.system.install authorization can run the emgr command on a multi-level secure (MLS) system. Ifix data, saved files, and temporary files are accessible only by the root user.

The non-root users with the aix.system.install.list authorization can run the emgr command to list currently installed efixes. If the non-root users have aix.system.install authentication, they can install or remove efixes.

The emgr command looks for a supported MD5 generating command on the system. If one is located, the emgr command displays the MD5 checksum to the user. The user cross-checks this MD5 sum with a secured source. If an MD5 generating command is not located, the emgr command takes no further action.

The user can force set the path to an MD5 command by exporting the EMGR_MD5_CMD shell variable. This variable must contain the absolute path to the MD5 generating command.

Notes:

This feature is not supported in the original release of interim fix management. It is recommended that the user updates to the latest level of interim fix management by updating bos.rte.install to the latest level.
If Trusted Execution (TE) policy is turned on along with the TSD_LOCK policy or the TSD_FILE_LOCK policy, the emgr command fails. To continue with the installation, manually turn off the TSD_LOCK policy or the TSD_FILE_LOCK policy. The emgr command runs successfully with TE policies other than the TSD_LOCK policy or the TSD_FILE_LOCK policy.

Also, when a TE policy is turned on, only one instance of the emgr command is supported.

Examples

To preview the installation of an interim fix package called games.020303.epkg.Z, enter the following command:
```
emgr -p -e games.020303.epkg.Z
```
To install the interim fix package that is called games.020303.epkg.Z and automatically expand file systems if additional space is needed, enter the following command:
```
emgr -X -e games.020303.epkg.Z
```
To list all interim fixes on the system, enter the following command:
```
emgr -l
```
To list all interim fixes separated by colons on the system, enter the following command:
```
emgr -l -v4
```
To do a level 3 listing of interim fix with label games, enter the following command:
```
emgr -lv3 -L games
```
To remove the interim fix with label games, enter the following command:
```
emgr -r -L games
```
To preview the removal of the interim fix labels in the file /tmp/myfixes, enter the following command:
```
emgr -rp -f /tmp/myfixes
```
To check all interim fixes with verification level 2, enter the following command:
```
emgr -cv2
```
To check interim fix ID number 3 with verification level 1 (the default verification level), enter the following command:
```
emgr -c -n3
```
To check an interim fix with VUID of 000775364C00020316020703 and verification level 3, enter the following command:
```
emgr -u 000775364C00020316020703 -c -v3
```
To list all locked packages and their interim fix labels, enter the following command:
```
emgr -P
```
To list all interim fix labels that locked the installp package bos.rte.lvm, enter the following command:
```
emgr -P bos.rte.lvm
```
To mount-install the interim fix package called games.020303.epkg.Z and suppress AIX bosboot, enter the following command:
```
emgr -e games.020303.epkg.Z -mb
```
To mount all interim fix files that are mount-installed on the system by using the -m option, enter the following command:
```
emgr -M
```
To unmount all interim fix files associated with interim fix label games, enter the following command:
```
emgr -U -L games
```
To apply an interim fix package called kernelmod.031007.epkg.Z with concurrent updates to the system memory, enter the following command:
```
emgr -i kernelmod.031007.epkg.Z
```
To commit the concurrent updates that are associated with the interim fix label kernelmod to the disk, enter the following command:
```
emgr -C -L kernelmod
```
To apply an interim fix package called kernelmod2.031007.epkg.Z with concurrent updates to the system memory, and also to commit the concurrent updates to the disk, enter the following command:
```
emgr -i kernelmod2.031007.epkg.Z -C
```
To display level 3 verbosity output on the interim fix package test.102403.epkg.Z, enter the following command:
```
emgr -v3 -d test.102403.epkg.Z
```

Files

Item	Description
/usr/sbin/emgr	Contains the emgr command
/usr/emgrdata/DBS/ifix.db	Contains the interim fix header database
/usr/emgrdata/DBS/files.db	Contains the interim fix files database
/usr/emgrdata/DBS/pkglck.db	Contains the package lock database
/usr/emgrdata/DBS/prereq.db	Contains the prerequisite database
/usr/emgrdata/DBS/e2eprereq.db	Contains the interim fix prerequisite database
/usr/emgrdata/DBS/aparref.db	Contains the APAR reference file database