Hi everyone,
Can anyone explain the best practice for keeping an AIX environment up to date? I have 12 AIX LPARs and a whole slew of vulnerabilities. These vulnerabilities vary from OS issues to WebSphere/MQ issues and more. I went through all of them and created a list of APARs I need to apply and which LPARs they apply to. However, I can't find out where to download these APARs on IBMs site.

I read further on IBM's site and saw that multiple service packs are released for each technology level. Is this the way to patch AIX? Do you apply service packs as they are released? Or do you apply APARs individually?

I'm currently on AIX 6.1 technology level 2. oslevel -r shows 6100-02. I'm thinking I should apply the latest service pack for TL 2, which is SP 4. But I'm not sure if this is what other people do for patching AIX...

If anyone can shed some light on the topic of patching AIX it would be much appreciated.

Thanks in advance,
Ryan

First off, a sound update strategy in my experience is to update when you must, not update when you can. Every update introduces some risk and if you don't have to take this risk then let the system alone.

Having said this: it seems you are not quite aware what an APAR or a fix is. You might want to read this article to learn about what fixes, APARs, maintenance/technical levels, etc. are. You might also want to read this thread for some further information.

There are some threads pinned in the top of the forum with some useful links, IBMs Fix Central should be among them. There you can download all the IBM fixes.

I hope this helps.

bakunin

Thanks, Bakunin. I read through the stickies and the threads you recommended. I have a better understanding now of how all the different fixes (APARs, maintenance levels, technology levels, service packs, etc.) are related. It sounds like the interim fixes I'm looking to apply get rolled up into service packs and then technology levels to be distributed. I also read on IBM's site that interm fixes should not be applied without being instructed to do so by IBM documentation or support.

The problem I'm facing is that our internal auditors want our AIX systems "up to date." And it sounds like being "up to date" in the AIX world means applying the latest TL and SP. Is that correct? Sorry, I'm just trying to get a second opinion before I start installing the latest TL. And according to IBM's site here IBM Support: Fix Central, the latest is TL3 or AIX 6.1.

Thanks

I don't know what your auditors want exactly but the IBM AIX update policy goes about like this: There are two maintenance cycles per year for AIX software maintenance. The major upgrade release is around February/March. The minor upgrade release is around August. IBM recommends to do those two updates. From this follows that as long as you don't stay more than two TL behind the current TL you should not have problems when opening a PMR with IBM.
Then there are the Servicepacks aka Fixpacks that almost never include new features but help correcting errors in a certain Technology Level. Avoiding known errors is always a good idea and doing so would certainly count as keeping a system "up to date".

Btw to avoid a widening gap between oslevels and microcodes Firmware upgrade should be done always when a planned system outage takes place.