Nagios Support Forum

The latest gnuTLS security issue has put the need front and center to keep our Nagios box patched. Generally I crontab yum updates on RHEL/CentOS boxes, but I haven't done so on this box because I didn't want to break NagiosXI.

The box is a minimal install of CentOS 6.4 with Base installed. (Plus tmux and htop for convenience.) 64 bit. Can we safely run yum update without breaking Nagios?

I update mine monthly and have yet to have an issue. Don't yell at me if you do though

There is always the chance that package updates, particularly php and mysql can cause issues. I'd recommend doing this on a mirrored testing XI box first, just to be sure.

You should be ok. About the only issue I have seen is that there has some breakage between really old openssl packages on clients (primarily old salaris boxes) and the newest version from yum on the XI system. This can break check_http -S (ssl) checks. But if the monitored systems in your environment are not ancient, you should be fine, at least when it comes to ssl.

I'll have to do this too soon. Would it be safe enough to just take a vmware snapshot and restore in case problems arise? As I don't have a test XI server...

WillemDH wrote:I'll have to do this too soon. Would it be safe enough to just take a vmware snapshot and restore in case problems arise? As I don't have a test XI server...

I can't see why that wouldn't work as a rollback option just in case.

Yep, that would work fine! Keep in mind that your XI license is good for 3 installations, you can create a test, and also a backup server with it.

I completely agree with bandit, snapshots are the way to go for system wide changes on vms!

Our box is running on the metal and I don't have a testbed. I'd really like to cron yum updates; however, I'm getting the feeling from the responses that might not be a good idea. Any official word from Support?

cron updates... I would not suggest that route, as it takes away the human aspect of making sure its checked before install, and knowing if there is an issue post update. Honestly though if you do a full xi backup, move that off the system, then do your updates. I see no reason you should be concerned with it, provided you are using standard yum repos and not trying to push in super new packages that otherwise would not be available. Most of us in office, keep everything as up to date as possible and never have valid issues due to yum/packaging, just our own testing issues.(which are somewhat expected)