Linux Patch Management

Linux patch management includes identifying, prioritizing, and testing patches in a pilot group of computers. Then deploy and monitor the updates. With Endpoint Central, you can perform these processes from a centralized console. Use manual or automated deployment to install Linux security and non-security updates. These updates help keep Linux machines on the network current with critical and recent patches and address vulnerabilities.

A package update can restart affected services without restarting the operating system. For example, Ubuntu 24.04 uses needrestart to restart services affected by updated libraries. See Ubuntu's service-restart explanation. Excluding a computer from a deployment reboot does not prevent a package or its maintenance scripts from restarting a service.

Compare package-manager and service logs for the deployment period. Record the distribution, updated packages and deployment task. Collect Linux agent logs if the cause is unclear. A systemd daemon re-execution is a separate event; its timestamp alone does not identify what restarted a service. See the systemctl documentation. Do not attribute a service restart to the agent from timing alone.

Use the Linux task and log checks to compare the deployment with the affected package and service events.

Linux patching is not available on old server builds. Upgrade the server to the latest build from the service pack page before you deploy Linux security and non-security updates. If a Linux computer appears in Inventory but not under Threats & Patches → Systems → Scan Systems, the distribution may require a later server build. Upgrade, then run a patch scan.

Linux repository manager (dcrepolistmanager)

dcrepolistmanager maintains the enabled repositories on a Linux agent for patching. Linux agent binaries are not digitally signed, so antivirus can flag them as malware; that detection is a false positive. The agent downloads the binaries from the Endpoint Central server and verifies them with a checksum. Exclude the Endpoint Central agent installation path from antivirus scanning.

Check the current supported-applications list for your product, Linux edition and version: Endpoint Central patching, Patch Manager Plus patching, or Vulnerability Manager Plus assessment. Patching and vulnerability-assessment coverage are maintained separately. Use the list for the required product and capability; do not infer one from the other.

In the Download Agent dialog that provides a Processor field, select x64 for a 64-bit Intel or AMD Linux computer. This dialog selects x64 by default when you select Linux. ARM processor choices depend on availability.

If the Processor field is absent, do not assume that the downloaded package is 32-bit. Do not determine the installer architecture from the archive name alone. Check the supported operating system and processor requirements for your product and build. If you cannot identify the required package, provide Support with the server build, operating system and processor details, and a screenshot of the dialog.

If a supported distribution has an individual package failure, follow Linux package-failure and service-restart checks.

The supported Linux flavors for patching using Endpoint Central include: