Some bulletins are obsoleted by the host after patch remediation

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

When you use an ESXi 5.0 update release offline bundle (.zip) that is distributed by VMware to create a patch baseline, and remediate your ESXi 5.0 host against it, some bulletins in the patch baseline appear in an Obsoleted By Host compliance state.

Steps to reproduce:

1. Import a distributed by VMware ESXi 5.0 update release ZIP to the patch repository of Update Manager.
2. Create a patch baseline with the imported bulletins.
3. Scan an ESXi 5.0 host against the patch baseline.

The bulletins appear in a Missing compliance state.

• Stage bulletins from the patch baseline to the ESXi 5.0 host.

Some bulletins are staged and some bulletins appear Missing.

• Remediate the ESXi 5.0 host against the patch baseline.

Some of the bulletins from the patch baseline are installed, and some bulletins appear in an Obsoleted By Host compliance state.

Environment

VMware vSphere Update Manager 5.0.x

Resolution

The bulletins that are obsoleted by the host are the security-only bulletins from the patch.

Starting with ESXi 5.0 Update 1, VMware patch and update releases contain general and security-only bulletins.

A bulletin is a container object of one or more VIB files. Each VIB file has a version number. A VIB from a later version, contains all fixes from an earlier version of the same VIB, plus new fixes in the current release.
During patching process, existing VIB on the system is replaced by the VIB of the latest version from the patch that is used.

Security-only bulletins contain only security fixes on top of the last version of the VIBs. General bulletins contain both the new security and bug fixes on top of the last version of the VIBs, so their content is larger compared to the security-only bulletins, and are of a later version than the security-only bulletins.

During remediation Update Manager detects that the general bulletins contain VIBs with the latest version so they supersede the security-only bulletins, and installs only the general bulletins. As a result, the bulletins that contain only security fixes appear as Obsoleted By Host after remediation.

For example, the ESXi 5.0 Update 1 bundle update-from-esxi5.0-5.0_update01.zip contains 15 bulletins. Three of the bulletins are security-only bulletins and the rest are general bug fix bulletins. After remediating an ESXi 5.0 host against the patch, the security-only bulletins appear as Obsoleted By Host, and the rest of the bulletins from the offline bundle are successfully installed on the host.

For more information about specific update release patch distributed by VMware, search the VMware Knowledge Base.