IBM Support

SUSE Manager: How to find missing CVE patches by client host.

How To


Summary

We need to find which SUMA clients which particular CVE patches are missing.

Objective

The SUMA interface give us option to search by CVE number, but not bulk searches by host.
The spacelawk command give us option to search by host, but returns erratas, not CVEs.
We need to find which SUMA clients which particular CVE patches are missing.

Environment

SUMA 4.3

Steps

We have to compile command which finds the erratas per hostname first

spacewalk-report errata-systems --where-hostname=<<YOUR HOSTNAME HERE>>

and

to extract the CVEs from the erratas

spacewalk-report errata-list

Here the full command:

for i in $( spacewalk-report errata-systems --where-hostname=<<YOUR HOSTNAME HERE>> | cut -d, -f2 | sort | uniq | grep -v advisory ); do spacewalk-report errata-list | grep $i; done | grep CVE | awk -F "," '{print $4}' | awk -F";" -v OFS="\n" '{$1=$1}1' | sed s'/ //g' | sort | uniq

Additional Information

As per the article

https://documentation.suse.com/suma/4.3/en/suse-manager/administration/reports.html#spacewalk-report-reporting-db

  • the report data is not changing in real-time, but it’s updated only by the execution of a scheduled task;

this mean, when patched the test machine 10.1.0.84, I can see that there are no more patches to be applied:

mvs-suma:~ # spacewalk-report system-currency

Warning: system-currency does not exists as a reporting database report. Using the legacy one

system_id,org_id,name,critical,important,moderate,low,bug,enhancement,score

1000010003,1,10.1.0.24,0,23,11,0,32,3,523

1000010004,1,10.1.0.84,0,0,0,0,0,0,0

but the command still returning advisories to be applied:

mvs-suma:~ # spacewalk-report errata-systems --where-hostname=sle-ha01.ibm.com

mgm_id,advisory,system_id,profile_name,hostname,ip_address,ipv6_address,synced_date

1,SUSE-15-2023-4403,1000010004,10.1.0.84,sle-ha01.ibm.com,10.1.0.84,fe80::546f:82ff:fec1:17 (link),2024-01-04 22:00:12.394846+00:00

1,SUSE-15-SP5-2023-4024,1000010004,10.1.0.84,sle-ha01.ibm.com,10.1.0.84,fe80::546f:82ff:fec1:17 (link),2024-01-04 22:00:12.394846+00:00

1,SUSE-15-SP5-2023-4044,1000010004,10.1.0.84,sle-ha01.ibm.com,10.1.0.84,fe80::546f:82ff:fec1:17 (link),2024-01-04 22:00:12.394846+00:00

... output omitted

so one have to manually run "mgr-update-reporting-bunch" from Admin>>Task Schedules>>Schedule update-reporting-default (takes some time)

To refresh the database and get empty output:

mvs-suma:~ # spacewalk-report errata-systems --where-hostname=sle-ha01.ibm.com

mgm_id,advisory,system_id,profile_name,hostname,ip_address,ipv6_address,synced_date

Related Information

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SGMV168","label":"IBM Support for SUSE Linux Enterprise Server"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"15.0.0"}]

Document Information

Modified date:
10 February 2025

UID

ibm17105449