3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2 VMware, Inc.
Contents
About Installing and Administering VMware vSphere Update Manager9
Updated Information11
Understanding Update Manager13
1
Overview of the Update Manager Interface 14
About the Update Manager Process 15
Conguring the Update Manager Download Source 16
Downloading Updates and Related Metadata 16
Importing ESXi Images 18
Creating Baselines and Baseline Groups 18
Aaching Baselines and Baseline Groups to vSphere Objects 20
Scanning Selected vSphere Objects 20
Reviewing Scan Results 21
Staging Patches and Extensions to Hosts 21
Remediating Selected vSphere Objects 22
Installing Update Manager on Windows25
2
System Requirements 26
Update Manager Hardware Requirements 26
Supported Windows Operating Systems and Database Formats 26
Update Manager Compatibility with vCenter Server and vSphere Web Client 27
Required Database Privileges 27
Preparing the Update Manager Database 28
Create a 64-Bit DSN 29
About the Bundled Microsoft SQL Server 2012 Express Database Package 29
Maintaining Your Update Manager Database 29
Congure a Microsoft SQL Server Database Connection 29
Congure an Oracle Database 31
Prerequisites for Installing the Update Manager Server on Windows 33
Obtain the Update Manager Installer 34
Install the Update Manager Server 35
Enable the Update Manager Web Client Plug-In 37
VMware, Inc.
Uninstalling Update Manager that Runs on Windows39
3
Uninstall the Update Manager Server 39
Upgrading Update Manager that Runs on Windows41
4
Upgrade the Update Manager Server 42
Upgrade the Update Manager Java Components 43
3
vSphere Update Manager Installation and Administration Guide
Using Update Manager with the vCenter Server Appliance45
5
Start, Stop, or Restart Update Manager Service in the vCenter Server Appliance 45
Migrating Update Manager from Windows to the vCenter Server Appliance47
6
Download and Run VMware Migration Assistant on the Source Update Manager Machine 48
Roll Back a Migration of vCenter Server Appliance with Update Manager 48
Best Practices and Recommendations for Update Manager Environment51
7
Update Manager Deployment Models and Their Usage 52
Installing, Seing Up, and Using Update Manager Download Service53
8
Compatibility Between UMDS and the Update Manager Server 54
Installing UMDS on a Windows Operating System 54
Install UMDS on a Windows Operating System 54
Installing and Upgrading UMDS on a Linux-Based Operating System 56
Supported Linux-Based Operating Systems and Databases for Installing UMDS 56
Congure PostgreSQL Database for UMDS on Linux 56
Install UMDS on a Linux OS 58
Uninstall UMDS from a Linux OS 59
Seing Up and Using UMDS 59
Set Up the Data to Download with UMDS 59
Change the UMDS Patch Repository Location 60
Congure URL Addresses for Hosts 61
Download the Specied Data Using UMDS 61
Export the Downloaded Data 62
Conguring Update Manager65
9
Update Manager Network Connectivity Seings 66
Change the Update Manager Network Seings 67
Conguring the Update Manager Download Sources 68
Congure Update Manager to Use the Internet as a Download Source 69
Add a New Download Source 70
Use a Shared Repository as a Download Source 71
Import Patches Manually 72
Congure the Update Manager Proxy Seings 73
Congure Checking for Updates 73
Conguring and Viewing Notications 74
Congure Notications Checks 75
View Notications and Run the Notication Checks Task Manually 76
Types of Update Manager Notications 76
Conguring Host and Cluster Seings 77
Congure Host Maintenance Mode Seings 78
Congure Cluster Seings 79
Enable Remediation of PXE Booted ESXi Hosts 80
Take Snapshots Before Remediation 81
Congure Smart Rebooting 82
Congure the Update Manager Patch Repository Location 82
Restart the Update Manager Service 83
4 VMware, Inc.
Run the VMware vSphere Update Manager Update Download Task 83
Update Manager Privileges 84
Contents
Working with Baselines and Baseline Groups85
10
Creating and Managing Baselines 87
Create and Edit Patch or Extension Baselines 87
Create and Edit Host Upgrade Baselines 92
Create and Edit a Virtual Appliance Upgrade Baseline 95
Delete Baselines 97
Creating and Managing Baseline Groups 97
Create a Host Baseline Group 98
Create a Virtual Machine and Virtual Appliance Baseline Group 98
Edit a Baseline Group 99
Add Baselines to a Baseline Group 100
Remove Baselines from a Baseline Group 100
Delete Baseline Groups 101
Aach Baselines and Baseline Groups to Objects 101
Detach Baselines and Baseline Groups from Objects 102
Scanning vSphere Objects and Viewing Scan Results103
11
Manually Initiate a Scan of ESXi Hosts 103
Manually Initiate a Scan of Virtual Machines and Virtual Appliances 104
Manually Initiate a Scan of a Container Object 104
Schedule a Scan 105
Viewing Scan Results and Compliance States for vSphere Objects 105
View Compliance Information for vSphere Objects 106
Review Compliance with Individual vSphere Objects 107
Compliance View 107
Compliance States for Updates 110
Baseline and Baseline Group Compliance States 111
Viewing Patch Details 112
Viewing Extension Details 113
Viewing Upgrade Details 113
Host Upgrade Scan Messages in Update Manager 115
Host Upgrade Scan Messages When Cisco Nexus 1000V Is Present 117
VMware Tools Status 118
Remediating vSphere Objects119
12
Orchestrated Upgrades of Hosts and Virtual Machines 119
Remediating Hosts 120
Remediation Specics of ESXi Hosts 122
Remediating Hosts That Contain Third-Party Software 122
Remediating ESXi 5.5 or ESXi 6.0 Hosts Against ESXi 6.5 Image 123
Remediation Specics of Hosts That Are Part of a vSAN Cluster 124
Remediating vSAN Clusters Against System Managed Baselines 124
Stage Patches and Extensions to ESXi Hosts 125
Remediate Hosts Against Patch or Extension Baselines 126
Remediate Hosts Against an Upgrade Baseline 129
VMware, Inc. 5
vSphere Update Manager Installation and Administration Guide
Remediate Hosts Against Baseline Groups 132
Cluster Remediation Options Report 134
Remediating Virtual Machines and Virtual Appliances 135
Rolling Back to a Previous Version 136
Remediate Virtual Machines and Virtual Appliances 136
Upgrade VMware Tools on Power Cycle 137
Scheduling Remediation for Hosts, Virtual Machines, and Virtual Appliances 138
View Update Manager Events139
13
Patch Repository and Virtual Appliance Upgrades141
14
Add or Remove Patches From a Baseline 141
Troubleshooting143
15
Update Manager Web Client Remains Visible in the vSphere Web Client After Uninstalling
Update Manager Server 143
Connection Loss with Update Manager Server or vCenter Server in a Single vCenter Server System 144
Gather Update Manager Log Bundles 144
Gather Update Manager and vCenter Server Log Bundles 145
Log Bundle Is Not Generated 145
Host Extension Remediation or Staging Fails Due to Missing Prerequisites 146
No Baseline Updates Available 146
All Updates in Compliance Reports Are Displayed as Not Applicable 147
All Updates in Compliance Reports Are Unknown 147
VMware Tools Upgrade Fails if VMware Tools Is Not Installed 147
ESXi Host Scanning Fails 148
ESXi Host Upgrade Fails 148
The Update Manager Repository Cannot Be Deleted 148
Incompatible Compliance State 149
Updates Are in Conict or Conicting New Module State 150
Updates Are in Missing Package State 150
Updates Are in Not Installable State 151
Updates Are in Unsupported Upgrade State 151
Database Views153
16
VUMV_VERSION 154
VUMV_UPDATES 154
VUMV_HOST_UPGRADES 154
VUMV_VA_UPGRADES 155
VUMV_PATCHES 155
VUMV_BASELINES 155
VUMV_BASELINE_GROUPS 156
VUMV_BASELINE_GROUP_MEMBERS 156
VUMV_PRODUCTS 156
VUMV_BASELINE_ENTITY 157
VUMV_UPDATE_PATCHES 157
VUMV_UPDATE_PRODUCT 157
VUMV_ENTITY_SCAN_HISTORY 157
6 VMware, Inc.
VUMV_ENTITY_REMEDIATION_HIST 158
VUMV_UPDATE_PRODUCT_DETAILS 158
VUMV_BASELINE_UPDATE_DETAILS 158
VUMV_ENTITY_SCAN_RESULTS 159
VUMV_VMTOOLS_SCAN_RESULTS 159
VUMV_VMHW_SCAN_RESULTS 159
VUMV_VA_APPLIANCE 160
VUMV_VA_PRODUCTS 160
Index161
Contents
VMware, Inc. 7
vSphere Update Manager Installation and Administration Guide
8 VMware, Inc.
About Installing and Administering VMware
vSphere Update Manager
Installing and Administering VMware vSphere Update Manager provides information about installing,
conguring, and using VMware® vSphere Update Manager to scan and remediate the objects in your
vSphere environment. It also describes the tasks that you can perform to update your vSphere inventory
objects and make them compliant against aached baselines and baseline groups.
For scanning and remediation, Update Manager works with the following ESXi versions:
For VMware Tools and virtual machine hardware upgrade operations, Update Manager works with 5.5,
n
ESXi 6.0, and ESXi 6.5.
For ESXi host patching operations, Update Manager works with ESXi 5.5, ESXi 6.0, and ESXi 6.5.
n
For ESXi host upgrade operations, Update Manager works withESXi 5.5, ESXi 6.0, and their respective
n
Update releases.
Intended Audience
This information is intended for anyone who wants to install, upgrade, migrate, or use Update Manager.
The information is wrien for experienced Windows or Linux system administrators who are familiar with
virtual machine technology and data center operations.
VMware, Inc.
9
vSphere Update Manager Installation and Administration Guide
10 VMware, Inc.
Updated Information
This Installing and Administering VMware vSphere Update Manager documentation is updated with each
release of the product or when necessary.
This table provides the update history of the Installing and Administering VMware vSphere Update Manager.
RevisionDescription
04 OCT 2017
EN-002609-00 Initial release.
Added prerequisite information about Administrator access requirement for using UMDS on
n
Windows to download patches. The updated topics are following: Chapter 8, “Installing, Seing Up,
and Using Update Manager Download Service,” on page 53, “Seing Up and Using UMDS,” on
page 59, “Download the Specied Data Using UMDS,” on page 61, “Export the Downloaded
Data,” on page 62.
VMware, Inc. 11
vSphere Update Manager Installation and Administration Guide
12 VMware, Inc.
Understanding Update Manager1
Update Manager enables centralized, automated patch and version management for VMware vSphere and
oers support for VMware ESXi hosts, virtual machines, and virtual appliances.
With Update Manager, you can perform the following tasks:
Upgrade and patch ESXi hosts.
n
Install and update third-party software on hosts.
n
Upgrade virtual machine hardware, VMware Tools, and virtual appliances.
n
Update Manager requires network connectivity with VMware vCenter Server. Each installation of
Update Manager must be associated (registered) with a single vCenter Server instance.
The Update Manager module consists of a server component and of a client component.
You can use Update Manager with either vCenter Server that runs on Windows or with the
vCenter Server Appliance.
If you want to use Update Manager with vCenter Server, you have to perform Update Manager installation
on a Windows machine. You can install the Update Manager server component either on the same Windows
server where the vCenter Server is installed or on a separate machine. To install Update Manager, you must
have Windows administrator credentials for the computer on which you install Update Manager.
VMware, Inc.
If your vCenter Server system is connected to other vCenter Server systems by a common vCenter Single
Sign-On domain, and you want to use Update Manager for each vCenter Server system, you must install
and register Update Manager instances with each vCenter Server system. You can use an Update Manager
instance only with the vCenter Server system with which it is registered.
The vCenter Server Appliance delivers Update Manager as an optional service. Update Manager is bundled
in the vCenter Server Appliance.
In vSphere 6.5, it is no longer supported to register Update Manager to a vCenter Server Appliance during
installation of the Update Manager server on a Windows machine.
The Update Manager client component is a plug-in that runs on the vSphere Web Client. The
Update Manager client component is automatically enabled after installation of the Update Manager server
component on Windows, and after deployment of the vCenter Server Appliance.
You can deploy Update Manager in a secured network without Internet access. In such a case, you can use
the VMware vSphere Update Manager Download Service (UMDS) to download update metadata and
update binaries.
This chapter includes the following topics:
“Overview of the Update Manager Interface,” on page 14
n
“About the Update Manager Process,” on page 15
n
13
vSphere Update Manager Installation and Administration Guide
Overview of the Update Manager Interface
The Update Manager server has a client interface for the vSphere Web Client.
The Update Manager Web Client is automatically enabled in the vSphere Web Client after you install the
Update Manager server component on Windows, or deploy the vCenter Server Appliance.
The Update Manager Web Client appears as an Update Manager tab in vSphere Web Client. The Update
Manager tab is on the same level as the Monitor tab, the tab, the Datacenters tab, the Host &
Clusters tab, and so on.
To be able to see the Update Manager Web Client in vSphere Web Client you must have the View
Compliance Status privilege.
The Update Manager client Interface have two main views, Administration view and Compliance view.
To access the Administration view for the Update Manager Web Client, navigate to Home > UpdateManager and select the IP Address of the Update Manager instance you want to use.
In the Update Manager Administration view, you can do the following tasks:
Congure the Update Manager seings
n
Create and manage baselines and baseline groups
n
View Update Manager events
n
Review the patch repository and available virtual appliance upgrades
n
Review and check notications
n
Import ESXi images
n
To view Compliance view information for a selected inventory object with the Update Manager Web Client,
select Hosts and Clusters or VMs and Templates inventory view of the vSphere Web Client, and click theUpdate Manager tab.
In the Update Manager Compliance view, you can do the following tasks:
View compliance and scan results for each selected inventory object
n
Aach and detach baselines and baseline groups from a selected inventory object
n
Scan a selected inventory object
n
Stage patches or extensions to hosts
n
Remediate a selected inventory object
n
If your vCenter Server system is connected to other vCenter Server systems by a common vCenter Single
Sign-On domain, and you have installed and registered more than one Update Manager instance, you can
congure the seings for each Update Manager instance. Conguration properties that you modify are
applied only to the Update Manager instance that you specify and are not propagated to the other instances
in the group. You can specify an Update Manager instance by selecting the name of the vCenter Server
system with which the Update Manager instance is registered from the navigation bar.
For a vCenter Server system that is connected to other vCenter Server systems by a common vCenter Single
Sign-On domain, you can also manage baselines and baseline groups as well as scan and remediate only the
inventory objects managed by the vCenter Server system with which Update Manager is registered.
14 VMware, Inc.
About the Update Manager Process
Upgrading vSphere objects and applying patches or extensions with Update Manager is a multistage
process in which procedures must be performed in a particular order. Following the suggested process helps
ensure a smooth update with a minimum of system downtime.
The Update Manager process begins by downloading information (metadata) about a set of patches,
extensions, and virtual appliance upgrades. One or more of these patches or extensions are aggregated to
form a baseline. You can add multiple baselines to a baseline group. A baseline group is a composite object
that consists of a set of nonconicting baselines. You can use baseline groups to combine dierent types of
baselines, and scan and remediate an inventory object against all of them as a whole. If a baseline group
contains both upgrade and patch or extension baselines, the upgrade runs rst.
A collection of virtual machines, virtual appliances, and ESXi hosts or individual inventory objects can be
scanned for compliance with a baseline or a baseline group and later remediated. You can initiate these
processes manually or through scheduled tasks.
Conguring the Update Manager Download Source on page 16
n
You can congure the Update Manager server to download patches, extensions, and virtual appliance
upgrades either from the Internet or from a shared repository. You can also import patches and
extensions manually from a ZIP le.
Chapter 1 Understanding Update Manager
Downloading Updates and Related Metadata on page 16
n
Downloading virtual appliance upgrades, host patches, extensions, and related metadata is a
predened automatic process that you can modify. By default, at regular congurable intervals,
Update Manager contacts VMware or third-party sources to gather the latest information (metadata)
about available upgrades, patches, or extensions.
Importing ESXi Images on page 18
n
You can upgrade the hosts in your environment to ESXi 6.5 by using host upgrade baselines. To create
a host upgrade baseline, you must rst upload at least one ESXi 6.5 .iso image to the Update Manager
repository.
Creating Baselines and Baseline Groups on page 18
n
Baselines contain a collection of one or more patches, extensions, service packs, bug xes, or upgrades,
and can be classied as patch, extension, or upgrade baselines. Baseline groups are assembled from
existing baselines.
Aaching Baselines and Baseline Groups to vSphere Objects on page 20
n
To use baselines and baseline groups, you must aach them to selected inventory objects such as
container objects, virtual machines, virtual appliances, or hosts.
Scanning Selected vSphere Objects on page 20
n
Scanning is the process in which aributes of a set of hosts, virtual machines, or virtual appliances are
evaluated against all patches, extensions, and upgrades from an aached baseline or baseline group,
depending on the type of scan you select.
Reviewing Scan Results on page 21
n
Update Manager scans vSphere objects to determine how they comply with baselines and baseline
groups that you aach. You can lter scan results by text search, group selection, baseline selection,
and compliance status selection.
Staging Patches and Extensions to Hosts on page 21
n
You can stage patches and extensions before remediation to ensure that the patches and extensions are
downloaded to the host. Staging patches and extensions is an optional step that can reduce the time
during which hosts are in maintenance mode.
VMware, Inc. 15
vSphere Update Manager Installation and Administration Guide
Remediating Selected vSphere Objects on page 22
n
Remediation is the process in which Update Manager applies patches, extensions, and upgrades to
ESXi hosts, virtual machines, or virtual appliances after a scan is complete.
Configuring the Update Manager Download Source
You can congure the Update Manager server to download patches, extensions, and virtual appliance
upgrades either from the Internet or from a shared repository. You can also import patches and extensions
manually from a ZIP le.
Conguring the Update Manager download source is an optional step.
If your deployment system is connected to the Internet, you can use the default seings and links for
downloading upgrades, patches, and extensions to the Update Manager repository. You can also add URL
addresses to download virtual appliance upgrades or third-party patches and extensions. Third-party
patches and extensions are applicable only to hosts that are running ESXi 5.0 and later.
If your deployment system is not connected to the Internet, you can use a shared repository after
downloading the upgrades, patches, and extensions by using Update Manager Download Service (UMDS).
For more information about UMDS, see Chapter 8, “Installing, Seing Up, and Using Update Manager
Download Service,” on page 53.
With Update Manager, you can import both VMware and third-party patches or extensions manually from a
ZIP le, also called an oine bundle. Import of oine bundles is supported only for hosts that are running
ESXi 5.0 and later. You download the oine bundle ZIP les from the Internet or copy them from a media
drive, and save them on a local or a shared network drive. You can import the patches or extensions to the
Update Manager patch repository later. You can download oine bundles from the VMware Web site or
from the Web sites of third-party vendors.
N You can use oine bundles for host patching operations only. You cannot use third-party oine
bundles or oine bundles that you generated from custom VIB sets for host upgrade from ESXi 5.5.x and
ESXi 6.0.x to ESXi 6.5.
For detailed descriptions of the procedures, see “Conguring the Update Manager Download Sources,” on
page 68.
Downloading Updates and Related Metadata
Downloading virtual appliance upgrades, host patches, extensions, and related metadata is a predened
automatic process that you can modify. By default, at regular congurable intervals, Update Manager
contacts VMware or third-party sources to gather the latest information (metadata) about available
upgrades, patches, or extensions.
VMware provides information about patches for ESXi hosts and virtual appliance upgrades.
Update Manager downloads the following types of information:
Metadata about all ESXi 5.5 and ESXi 6.x patches regardless of whether you have hosts of such versions
n
in your environment.
Metadata about ESXi 5.5 and ESXi 6.x patches as well as about extensions from third-party vendor URL
n
addresses.
Notications, alerts, and patch recalls for ESXi 5.5 and ESXi 6.x hosts.
n
Metadata about upgrades for virtual appliances.
n
Downloading information about all updates is a relatively low-cost operation in terms of disk space and
network bandwidth. The availability of regularly updated metadata lets you add scanning tasks for hosts or
appliances at any time.
16 VMware, Inc.
Chapter 1 Understanding Update Manager
Update Manager supports the recall of patches for hosts that are running ESXi 5.0 or later. A patch is
recalled if the released patch has problems or potential issues. After you scan the hosts in your environment,
Update Manager alerts you if the recalled patch has been installed on a certain host. Recalled patches cannot
be installed on hosts with Update Manager. Update Manager also deletes all the recalled patches from the
Update Manager patch repository. After a patch xing the problem is released, Update Manager downloads
the new patch to its patch repository. If you have already installed the problematic patch, Update Manager
noties you that a x was released and prompts you to apply the new patch.
If Update Manager cannot download upgrades, patches, or extensions—for example, if it is deployed on an
internal network segment that does not have Internet access—you must use UMDS to download and store
the data on the machine on which UMDS is installed. The Update Manager server can use the upgrades,
patches, and extensions that UMDS downloaded after you export them.
For more information about UMDS, see Chapter 8, “Installing, Seing Up, and Using Update Manager
Download Service,” on page 53.
You can congure Update Manager to use an Internet proxy to download upgrades, patches, extensions,
and related metadata.
You can change the time intervals at which Update Manager downloads updates or checks for notications.
For detailed descriptions of the procedures, see “Congure Checking for Updates,” on page 73 and
“CongureNotications Checks,” on page 75.
Types of Software Updates and Related Terms
Update Manager downloads software updates and metadata from Internet depots or UMDS-created shared
repositories. You can import oine bundles and host upgrade images from a local storage device into the
local Update Manager repository.
Bulletin
Depot
Host upgrade image
A grouping of one or more VIBs. Bulletins are dened within metadata.
A logical grouping of VIBs and associated metadata that is published online.
An ESXi image that you can import in the Update Manager repository and
use for upgrading ESXi 5.5 or ESXi 6.0 hosts to ESXi 6.5.
Extension
A bulletin that denes a group of VIBs for adding an optional component to
an ESXi host. An extension is usually provided by a third party that is also
responsible for patches or updates to the extension.
Metadata
Extra data that denes dependency information, textual descriptions, system
requirements, and bulletins.
Offline bundle ZIP
An archive that encapsulates VIBs and corresponding metadata in a selfcontained package that is useful for oine patching. You cannot use thirdparty oine bundles or oine bundles that you generated from custom VIB
sets for host upgrade from ESXi 5.5 or ESXi 6.0 to ESXi 6.5.
Patch
A bulletin that groups one or more VIBs together to address a particular
issue or enhancement.
Roll-up
A collection of patches that is grouped for ease of download and
deployment.
VA upgrade
VIB
VMware, Inc. 17
Updates for a virtual appliance, which the vendor considers an upgrade.
A VIB is a single software package.
vSphere Update Manager Installation and Administration Guide
Importing ESXi Images
You can upgrade the hosts in your environment to ESXi 6.5 by using host upgrade baselines. To create a host
upgrade baseline, you must rst upload at least one ESXi 6.5 .iso image to the Update Manager repository.
With Update Manager 6.5 you can upgrade hosts that are running ESXi 5.5 or ESXi 6.0 to ESXi 6.5. Host
upgrades to ESXi 5.0, ESXi 5.1, ESXi 5.5, or ESXi 6.0 are not supported.
Before uploading ESXi images, obtain the image les from the VMware Web site or another source. You can
create custom ESXi images that contain third-party VIBs by using vSphere ESXi Image Builder. For more
information, see Customizing Installations with vSphere ESXi Image Builder.
You can upload and manage ESXi images from the ESXi Images tab of the Update Manager Administration
view.
ESXi images that you import are kept in the Update Manager repository. You can include ESXi images in
host upgrade baselines. To delete an ESXi image from the Update Manager repository, rst you must delete
the upgrade baseline that contains it. After you delete the baseline, you can delete the image from the ESXiImages tab.
For more information about importing ESXi images and creating host upgrade baselines, see “Create a Host
Upgrade Baseline,” on page 93.
Creating Baselines and Baseline Groups
Baselines contain a collection of one or more patches, extensions, service packs, bug xes, or upgrades, and
can be classied as patch, extension, or upgrade baselines. Baseline groups are assembled from existing
baselines.
Host baseline groups can contain a single upgrade baseline, and various patch and extension baselines.
Virtual machine and virtual appliance baseline groups can contain up to three upgrade baselines: one
VMware Tools upgrade baseline, one virtual machine hardware upgrade baseline, and one virtual appliance
upgrade baseline.
When you scan hosts, virtual machines, and virtual appliances, you evaluate them against baselines and
baseline groups to determine their level of compliance.
Update Manager includes two predened patch baselines and three predened upgrade baselines. You
cannot edit or delete the predened virtual machine and virtual appliance upgrade baselines. You can use
the predened baselines, or create patch, extension, and upgrade baselines that meet your criteria. Baselines
you create, and predened baselines, can be combined in baseline groups. For more information about
creating and managing baselines and baseline groups, see Chapter 10, “Working with Baselines and Baseline
Groups,” on page 85.
Baseline Types
Update Manager supports dierent types of baselines that you can use when scanning and remediating
objects in your inventory.
Update Manager provides upgrade, patch, and extension baselines.
18 VMware, Inc.
Chapter 1 Understanding Update Manager
Upgrade Baselines
BaselineDescription
Host Upgrade
Baseline
Virtual Appliance
Upgrade Baseline
Virtual Machine
Upgrade Baseline
Denes to which version to upgrade the hosts in your environment. With Update Manager 6.5,
you can upgrade ESXi hosts from version 5.5 and 6.0 to ESXi 6.5.
Denes to which version to upgrade a selected virtual appliance. For example, you can upgrade
to the latest released virtual appliance version by using the predened VA Upgrade to Latest
(Predened) baseline.
Denes to which version to upgrade virtual hardware or VMware Tools. With
Update Manager 6.5 you can upgrade to hardware version vmx-13 and to the latest VMware
Tools version on hosts that are running ESXi 6.5.
Patch Baselines
Patch baselines dene a number of patches that must be applied to a given host. Patch baselines can be
either dynamic or xed.
BaselineDescription
Dynamic Patch
Baseline
Fixed Patch BaselineYou manually specify which patches to include in the xed patch baseline from the total set of
The contents of a dynamic baseline are based on available patches that meet the specied criteria.
As the set of available patches changes, dynamic baselines are updated as well. You can explicitly
include or exclude any patches.
patches available in the Update Manager repository.
Extension Baselines
BaselineDescription
Extension
Baseline
Contains extensions (additional software such as third-party device drivers) that must be applied to a
given host. Extensions are installed on hosts that do not have such software installed on them, and
patched on hosts that already have the software installed. All third-party software for ESXi hosts is
classied as a host extension, although host extensions are not restricted to just third-party software.
Update Manager Default Baselines
Update Manager includes default baselines that you can use to scan any virtual machine, virtual appliance,
or host to determine whether the hosts in your environment are updated with the latest patches, or whether
the virtual appliances and virtual machines are upgraded to the latest version.
Critical Host Patches
(Predefined)
Non-Critical Host
Patches (Predefined)
VMware Tools Upgrade
to Match Host
(Predefined)
VM Hardware Upgrade
to Match Host
(Predefined)
Checks ESXi hosts for compliance with all critical patches.
Checks ESXi hosts for compliance with all optional patches.
Checks virtual machines for compliance with the latest VMware Tools
version on the host. Update Manager supports upgrading of VMware Tools
for virtual machines on hosts that are running ESXi 5.5.x and later.
Checks the virtual hardware of a virtual machine for compliance with the
latest version supported by the host. Update Manager supports upgrading to
virtual hardware version vmx-13 on hosts that are running ESXi 6.5 .
VA Upgrade to Latest
(Predefined)
VMware, Inc. 19
Checks virtual appliance compliance with the latest released virtual
appliance version.
vSphere Update Manager Installation and Administration Guide
Baseline Groups
Baseline groups can contain patch, extension, and upgrade baselines. The baselines that you add to a
baseline group must be non-conicting.
A baseline group is limited to a combination of patches, extensions, and upgrades. The following are valid
combinations of baselines that can make up a baseline group:
Multiple host patch and extension baselines.
n
One upgrade baseline, multiple patch and extension baselines.
n
For example, one ESXi upgrade baseline and multiple ESXi patch or extension baselines.
Multiple upgrade baselines, but only one upgrade baseline per upgrade type (like VMware Tools,
n
virtual machine hardware, virtual appliance, or host).
For example, VMware Tools Upgrade to Match Host baseline, VM Hardware Upgrade to Match Host
baseline and one VA Upgrade to Latest baseline. You cannot create a baseline group containing two
virtual appliance upgrade baselines.
Attaching Baselines and Baseline Groups to vSphere Objects
To use baselines and baseline groups, you must aach them to selected inventory objects such as container
objects, virtual machines, virtual appliances, or hosts.
Although you can aach baselines and baseline groups to individual objects, a more ecient method is to
aach them to container objects, such as folders, vApps, clusters, and data centers. Individual vSphere
objects inherit baselines aached to the parent container object. Removing an object from a container
removes the inherited baselines from the object.
For a detailed description of the procedure, see “Aach Baselines and Baseline Groups to Objects,” on
page 101.
Scanning Selected vSphere Objects
Scanning is the process in which aributes of a set of hosts, virtual machines, or virtual appliances are
evaluated against all patches, extensions, and upgrades from an aached baseline or baseline group,
depending on the type of scan you select.
You can scan a host installation to determine whether the latest patches or extensions are applied, or you can
scan a virtual machine to determine whether it is up to date with the latest virtual hardware or
VMware Tools version.
Update Manager supports the following types of scan:
Host patch scan
Host extensions scan
Host upgrade scan
VMware Tools scan
You can perform patch scans on ESXi 5.5 and later.
You can scan ESXi 5.5 and later for extensions (additional software modules).
You can scan ESXi 5.5 and ESXi 6.0 for upgrading to ESXi 6.5.
You can scan virtual machines running Windows or Linux for the latest
VMware Tools version. You can perform VMware Tools scans on online or
oine virtual machines and templates. You must power on the virtual
machine at least once before performing a VMware Tools scan.
20 VMware, Inc.
Chapter 1 Understanding Update Manager
Virtual machine
hardware upgrade scan
Virtual appliance
upgrade scan
You can use VMware Studio 2.0 and later to automate the creation of ready-to-deploy vApps with prepopulated application software and operating systems. VMware Studio adds a network agent to the guest so
that vApps bootstrap with minimal eort.Conguration parameters specied for vApps appear as OVF
properties in the vCenter Server deployment wizard. For more information about VMware Studio, see the
VMware SDK and API documentation for VMware Studio. For more information about vApp, you can also
check the VMware blog site. You can download VMware Studio from the VMware website.
You can initiate scans on container objects, such as data centers, clusters, vApps, or folders, to scan all the
ESXi hosts or virtual machines and appliances in that container object.
You can congure Update Manager to scan virtual machines, virtual appliances, and ESXi hosts against
baselines and baseline groups by manually initiating or scheduling scans to generate compliance
information. Schedule scan tasks at a data center or vCenter Server system level to make sure that scans are
up to date.
For manual and scheduled scanning procedures, see Chapter 11, “Scanning vSphere Objects and Viewing
Scan Results,” on page 103.
You can scan virtual machines running Windows or Linux for the latest
virtual hardware supported on the host. You can perform hardware-upgrade
scans on online or oine virtual machines and templates.
You can scan powered-on virtual appliances that are created with VMware
Studio 2.0 and later.
Reviewing Scan Results
Update Manager scans vSphere objects to determine how they comply with baselines and baseline groups
that you aach. You can lter scan results by text search, group selection, baseline selection, and compliance
status selection.
When you select a container object, you view the overall compliance status of the container against the
aached baselines as a group. You also see the individual compliance statuses of the objects in the selected
container against all baselines. If you select an individual baseline aached to the container object, you see
the compliance status of the container against the selected baseline.
If you select an individual virtual machine, appliance, or host, you see the overall compliance status of the
selected object against all aached baselines and the number of updates. If you select an individual baseline
aached to this object, you see the number of updates grouped by the compliance status for that baseline.
The compliance information is displayed on the Update Manager tab. For more information about viewing
compliance information, see “Viewing Scan Results and Compliance States for vSphere Objects,” on
page 105.
Staging Patches and Extensions to Hosts
You can stage patches and extensions before remediation to ensure that the patches and extensions are
downloaded to the host. Staging patches and extensions is an optional step that can reduce the time during
which hosts are in maintenance mode.
Staging patches and extensions to hosts that are running ESXi 5.0 or later lets you download the patches and
extensions from the Update Manager server to the ESXi hosts without applying the patches or extensions
immediately. Staging patches and extensions speeds up the remediation process because the patches and
extensions are already available locally on the hosts.
I Update Manager can stage patches to PXE booted ESXi hosts.
For more information about staging patches, see “Stage Patches and Extensions to ESXi Hosts,” on page 125.
VMware, Inc. 21
vSphere Update Manager Installation and Administration Guide
Remediating Selected vSphere Objects
Remediation is the process in which Update Manager applies patches, extensions, and upgrades to ESXi
hosts, virtual machines, or virtual appliances after a scan is complete.
Remediation makes the selected vSphere objects compliant with patch, extension, and upgrade baselines.
As with scanning, you can remediate single hosts, virtual machines, or virtual appliances. You can also
initiate remediation on a folder, a cluster, or a data center level.
Update Manager supports remediation for the following inventory objects:
Powered on, suspended, or powered o virtual machines and templates for VMware Tools and virtual
n
machine hardware upgrade.
Powered on virtual appliances that are created with VMware Studio 2.0 and later, for virtual appliance
n
upgrade.
ESXi hosts for patch, extension, and upgrade remediation.
n
You can remediate the objects in your vSphere inventory by using either manual remediation or scheduled
remediation. For more information about manual and scheduled remediation, see Chapter 12, “Remediating
vSphere Objects,” on page 119.
Remediating Hosts
Update Manager 6.5 supports upgrade from ESXi 5.5.x and ESXi 6.0.x to ESXi 6.5.
I If you enable the seing from the ESX Host/Cluster page of the tab, or
from the Remediate wizard, you can patch PXE booted ESXi hosts.
After you upload ESXi images, upgrades for ESXi hosts are managed through baselines and baseline groups.
Typically, if the update requires it, hosts are put into maintenance mode before remediation. Virtual
machines cannot run when a host is in maintenance mode. To ensure a consistent user experience,
vCenter Server migrates the virtual machines to other hosts within a cluster before the host is put in
maintenance mode. vCenter Server can migrate the virtual machines if the cluster is congured for vMotion
and if VMware Distributed Resource Scheduler (DRS) and VMware Enhanced vMotion Compatibility (EVC)
are enabled. EVC is not a prerequisite for vMotion. EVC guarantees that the CPUs of the hosts are
compatible. For other containers or individual hosts that are not in a cluster, migration with vMotion cannot
be performed.
I After you have upgraded your host to ESXi 6.5, you cannot roll back to your version ESXi 5.5.x
or ESXi 6.0.x software. Back up your host conguration before performing an upgrade. If the upgrade fails,
you can reinstall the ESXi 5.5.x or ESXi 6.0.x software that you upgraded from, and restore your host
conguration. For more information about backing up and restoring your ESXi conguration, see vSphere
Upgrade.
Remediation of ESXi 5.5 and 6.0 hosts to their respective ESXi update releases is a patching process, while
the remediation of ESXi hosts from version 5.5 or 6.0 to 6.5 is an upgrade process.
Remediating Virtual Machines and Virtual Appliances
You can upgrade virtual appliances, VMware Tools, and the virtual hardware of virtual machines to a later
version. Upgrades for virtual machines are managed through the Update Manager default virtual machine
upgrade baselines. Upgrades for virtual appliances can be managed through both the Update Manager
default virtual appliance baselines and custom virtual appliance upgrade baselines that you create.
N Update Manager 6.5 does not support virtual machines patch baselines.
22 VMware, Inc.
Chapter 1 Understanding Update Manager
Orchestrated Upgrades
With Update Manager, you can perform orchestrated upgrades of hosts and virtual machines. With
orchestrated upgrades, you can upgrade hosts and virtual machines in your vSphere inventory by using
baseline groups.
You can perform an orchestrated upgrade of hosts by using a baseline group that contains a single host
upgrade baseline and multiple patch or extension baselines. Update Manager rst upgrades the hosts and
then applies the patch or extension baselines.
You can perform an orchestrated upgrade of virtual machines by using a virtual machine baseline group
that contains the following baselines:
VM Hardware Upgrade to Match Host
n
VMware Tools Upgrade to Match Host
n
You can use orchestrated upgrades to upgrade the virtual hardware and VMware Tools of virtual machines
in the inventory at the same time. The VMware Tools upgrade baseline runs rst, followed by the virtual
machine hardware upgrade baseline.
Orchestrated upgrades can be performed at a cluster, folder, or a data center level.
VMware, Inc. 23
vSphere Update Manager Installation and Administration Guide
24 VMware, Inc.
Installing Update Manager on
Windows2
The Update Manager server is a 64-bit application. You can install the Update Manager server for Windows
only on 64-bit Windows machines.
You can install the Update Manager server component either on the same machine where the vCenter Server
is installed or on a separate machine. For optimal performance, especially in large-scale environments,
install the Update Manager server component on a dierent Windows machine.
The Update Manager 6.5 installer for Windows generates a 2048-bit key and self-signed certicate. To
replace the self-signed SSL certicate after installation, you can use the Update Manager Utility.
You can install vCenter Server and the Update Manager server in a heterogeneous network environment,
where one of the machines is congured to use IPv6 and the other is congured to use IPv4.
To run and use Update Manager, you must use a local system account for the machine on which
Update Manager is installed.
During installation, you cannot connect an Update Manager server that is installed on a Windows server to
a vCenter Server Appliance. The vCenter Server Appliance facilitates Update Manager server as a service.
After you install the Update Manager server component, the Update Manager Web Client plug-in is
automatically enabled on the vSphere Web Client, and appears as an Update Manager tab. The Update
Manager tab is on the same level as the Monitor tab, the tab, the Datacenters tab, the Host &
Clusters tab, and so on.
VMware, Inc.
VMware uses designated ports for communication. The Update Manager server connects to vCenter Server,
ESXi hosts, and the Update Manager Web Client plug-in on designated ports. If a rewall exists between
any of these elements and Windows rewall service is in use, the installer opens the ports during the
installation. For custom rewalls, you must manually open the required ports.
You can run Update Manager in deployments that you protect using SRM. Use caution before connecting
the Update Manager server to a vCenter Server instance to which the SRM server is connected. Connecting
the Update Manager server to the same vCenter Server instance as SRM might cause problems when you
upgrade SRM or vSphere, and when you perform daily tasks. Check the compatibility and interoperability
of Update Manager with SRM before you install the Update Manager server.
This chapter includes the following topics:
“System Requirements,” on page 26
n
“Preparing the Update Manager Database,” on page 28
n
“Prerequisites for Installing the Update Manager Server on Windows,” on page 33
n
“Obtain the Update Manager Installer,” on page 34
n
“Install the Update Manager Server,” on page 35
n
“Enable the Update Manager Web Client Plug-In,” on page 37
n
25
vSphere Update Manager Installation and Administration Guide
System Requirements
To run and use the Update Manager server, you must ensure that your environment satises certain
conditions. You also must ensure that the vCenter Server, vSphere Web Client, and Update Manager are of
compatible versions.
Before you install Update Manager on Windows, you must set up an Oracle or Microsoft SQL Server
database. If your deployment is relatively small and contains up to 5 hosts and 50 virtual machines, you can
use the bundled Microsoft SQL Server 2012 Express database, which you can select to install from the
Update Manager installation wizard.
You can install Update Manager on a physical server or on a virtual machine. You can install the
Update Manager server component on the same Windows machine as vCenter Server or on a dierent
machine. After you install the Update Manager server component, to use Update Manager, the
Update Manager client is automatically enabled on the vSphere Web Client.
If your vCenter Server system is connected to other vCenter Server systems by a common vCenter Single
Sign-On domain, you can install and register Update Manager instances with each vCenter Server system.
Update Manager Hardware Requirements
You can run Update Manager on any system that meets the minimum hardware requirements.
Minimum hardware requirements for Update Manager vary depending on how Update Manager is
deployed. If the database is installed on the same machine as Update Manager, requirements for memory
size and processor speed are higher. To ensure acceptable performance, verify that your system meets the
minimum hardware requirements.
Table 2‑1. Minimum Hardware Requirements
HardwareRequirements
ProcessorIntel or AMD x86 processor with two or more logical cores, each with a speed of 2GHz
Network10/100 Mbps
For best performance, use a Gigabit connection between Update Manager and the ESXi
hosts
Memory2GB RAM if Update Manager and vCenter Server are on dierent machines
8GB RAM if Update Manager and vCenter Server are on the same machine
Update Manager uses a SQL Server or Oracle database. You should use a dedicated database for
Update Manager, not a database shared with vCenter Server, and should back up the database periodically.
Best practice is to have the database on the same computer as Update Manager or on a computer in the local
network.
Depending on the size of your deployment, Update Manager requires a minimum amount of free space per
month for database usage. For more information about space requirements, see the VMware vSphere UpdateManager Sizing Estimator.
Supported Windows Operating Systems and Database Formats
Update Manager works with specic databases and operating systems.
The Update Manager server requires a 64-bit Windows system.
26 VMware, Inc.
Chapter 2 Installing Update Manager on Windows
To see a list of the supported Windows operating systems on which you can install the Update Manager
server and the UMDS, see Supported host operating systems for VMware vCenter Server installation. The
supported Windows operating systems for vCenter Server installation listed in the article also apply for
installation of the respective versions of the Update Manager server and the UMDS.
N Make sure the Windows system on which you are installing the Update Manager server is not an
Active Directory domain controller.
The Update Manager server that you install on Windows requires a SQL Server or an Oracle database.
Update Manager can handle small-scale environments using the bundled in the installer SQL Server 2012
Express database. For environments with more than 5 hosts and 50 virtual machines, create either an Oracle
or a SQL Server database for Update Manager. For large-scale environments, set up the Update Manager
database on a dierent computer than the Update Manager server and the vCenter Server database.
To see a list of database formats that are compatible with the Update Manager server and the UMDS, select
the Solution/Database Interoperability option from the VMware Product Interoperability Matrixes at
Update Manager Compatibility with vCenter Server and vSphere Web Client
Update Manager is compatible with vCenter Server and vSphere Web Client of the same version.
Update Manager 6.5 is compatible only with vCenter Server 6.5.
During installation you connect the Update Manager 6.5 server to a vCenter Server 6.5 system that runs on
Windows OS. After the Update Manager server installation, the Update Manager Web Client 6.5 is
automatically enabled on the vSphere Web Client 6.5 that you use to connect to this vCenter Server system.
During installation you cannot connect the Update Manager 6.5 server to a vCenter Server Appliance 6.5.
The vCenter Server Appliance runs its own instance of Update Manager as a service.
To see more information about the Update Manager compatibility with vCenter Server and
vSphere Web Client, select the Solution Interoperability option from the VMware Product InteroperabilityMatrixes at hp://www.vmware.com/resources/compatibility/sim/interop_matrix.php.
Required Database Privileges
The set of database privileges needed for the Update Manager installation and upgrade diers from the set
of privileges needed for the Update Manager administration.
Before installing or upgrading Update Manager, you must grant adequate privileges to the database user.
VMware, Inc. 27
vSphere Update Manager Installation and Administration Guide
Table 2‑2. Database Privileges Needed for Installation or Upgrade of Update Manager
DatabasePrivileges
OracleEither assign the DBA role, or grant the following set of privileges to the Update Manager Oracle
database user.
connect
n
execute on dbms_lock
n
create view
n
create procedure
n
create table
n
create sequence
n
create any sequence
n
create any table
n
create type
n
unlimited tablespace
n
Microsoft SQL
Server
Make sure that the database user has either a sysadmin server role or the db_ownerxed database
role on the Update Manager database and the MSDB database. Although the db_owner role is
required for the upgrade, SQL jobs are not created as part of the Update Manager installation or
upgrade.
To run Update Manager, you must grant a set of minimum privileges to the database user.
Table 2‑3. Database Privileges Needed for Using Update Manager
DatabasePrivileges
OracleThe minimum required privileges of the Oracle database user are the following:
create session
n
create any table
n
drop any table
n
Microsoft SQL
Server
The database user must have either a sysadmin server role or the db_ownerxed database role on
the Update Manager database and the MSDB database.
Preparing the Update Manager Database
The Update Manager server and Update Manager Download Service (UMDS) that you install on Windows
require a database to store and organize server data. Update Manager supports Oracle, Microsoft SQL
Server databases.
Before installing the Update Manager server on a Windows machine, you must create a database instance
and congure it to ensure that all Update Manager database tables can be created in it. You can install and
congure the Microsoft SQL Server 2012 Express database that is embedded with Update Manager.
Microsoft SQL Server 2012 Express is recommended for small deployments of up to 5 hosts and 50 virtual
machines.
Update Manager 6.5 server is a 64-bit application, and you can install it only on 64-bit machines.
Update Manager requires a 64-bit DSN.
To use Microsoft SQL Server and Oracle databases, you must congure a 64-bit system DSN and test it with
ODBC.
The Update Manager database you use can be the same as the vCenter Server database. You can also use a
separate type of database, or you can use existing database clusters. For optimal results in a large-scale
environment, use a dedicated Update Manager database that runs on a dierent machine than the
vCenter Server system database.
28 VMware, Inc.
Chapter 2 Installing Update Manager on Windows
The Update Manager server requires administrative credentials to connect to the database. If the database
user name and password change after you install the Update Manager server or UMDS on Windows, you
can recongure Update Manager and UMDS without the need to reinstall them. See the ReconguringVMware vSphere Update Manager documentation.
Before you begin the database setup, review the supported databases. If you create an ODBC connection to a
database server that is not supported, a DSN for the unsupported database might be displayed in the dropdown menu of the Update Manager installation wizard. For more information about the supported database
patches, see the Solution/Database Interoperability option from the VMware Product Interoperability Matrixes
at hp://www.vmware.com/resources/compatibility/sim/interop_matrix.php. If you do not prepare your
database correctly, the Update Manager installer might display error or warning messages.
Create a 64-Bit DSN
The Update Manager 6.5 system must have a 64-bit DSN. This requirement applies to all supported
databases.
Procedure
1From the Windows Start menu, select Control Panel > Administrative Tools > Data Sources (ODBC).
2Create a system DSN.
If you have a Microsoft SQL database, create the system DSN by using SQL Native Client version 10 or
11.
3Test the connectivity.
The system now has a DSN that is compatible with Update Manager. When the Update Manager installer
prompts you for a DSN, select the 64-bit DSN.
About the Bundled Microsoft SQL Server 2012 Express Database Package
The Microsoft SQL Server 2012 Express database package is installed and congured when you select
Microsoft SQL Server 2012 Express as your database during the Update Manager installation or upgrade.
No additional conguration is required.
Maintaining Your Update Manager Database
After your Update Manager database instance and Update Manager server are installed and operational,
perform standard database maintenance processes.
Maintaining your Update Manager database involves several tasks:
Monitoring the growth of the log le and compacting the database log le, as needed. See the
n
documentation for the database type that you are using.
Scheduling regular backups of the database.
n
Backing up the database before any Update Manager upgrade.
n
See your database documentation for information about backing up your database.
Configure a Microsoft SQL Server Database Connection
When you install Update Manager, you can establish an ODBC connection with a SQL Server database.
If you use SQL Server for Update Manager, do not use the master database.
See your Microsoft SQL ODBC documentation for specic instructions on conguring the SQL Server ODBC
connection.
VMware, Inc. 29
vSphere Update Manager Installation and Administration Guide
Procedure
1Create a SQL Server database by using SQL Server Management Studio on SQL Server.
The Update Manager installer creates all tables, procedures, and user-dened functions (UDF) within
the default schema of the database user that you use for Update Manager. This default schema does not
necessarily have to be dbo schema.
2Create a SQL Server database user with database operator (DBO) rights.
Make sure that the database user has either a sysadmin server role or the db_ownerxed database role
on the Update Manager database and the MSDB database.
The db_owner role on the MSDB database is required for installation and upgrade only.
Create a New Data Source (ODBC)
To prepare a Microsoft SQL Server database to work with Update Manager, you have to create a data source
(ODBC).
Procedure
1On your Update Manager server system, select Control Panel > Administrative Tools > Data Sources
(ODBC).
2Click the System DSN tab.
3Create or modify an ODBC system data source.
OptionAction
Create an ODBC system data
source
Modify an existing ODBC system
data source
a Click Add.
b For Microsoft SQL Server 2008, Microsoft SQL Server 2008 R2 Express,
Microsoft SQL Server 2012, or Microsoft SQL Server 2014 select SQLNative Client, and click Finish.
Double-click the ODBC system data source that you want to modify.
To see a detailed list of all Microsoft SQL Server database versions that are compatible with the
Update Manager server and the UMDS, select the Solution/Database Interoperability option from the
VMware Product Interoperability Matrixes at