Patching ESXi host using Command Line
search cancel

Patching ESXi host using Command Line

book

Article ID: 343840

calendar_today

Updated On:

Products

VMware vSphere ESXi 8.0 VMware vSphere ESXi 7.0

Issue/Introduction

This article outlines the steps for updating or installing patches on an ESXi host using the command-line interface.

Notes:
  • The update command is the recommended method for applying patches. It applies all newer content in a patch, including security fixes, while ignoring any content with a lower revision than the existing packages on the system.
  • The install command, on the other hand, overwrites the existing packages with the content from the patch, which may include new packages or removal of old ones. It can also downgrade packages, which is why it should be used cautiously. However, the install command can be used to downgrade a system (for image profiles only) if the --allow-downgrade flag is set.

Environment

  • VMware vSphere ESXi 7.0.x
  • VMware vSphere ESXi 8.0.x

Resolution

Before performing any patch or upgrade activity on an ESXi host, make sure to have a backup of the ESXi host configuration. Follow the official guidance in How to back up and restore the ESXi host configuration.

  1. To download the patch or ISO image, refer to Download latest ISOs and patches for vSphere ESXi
  2. Upload the patch to a datastore on your ESXi host using the Datastore Browser from the vCenter Server or a direct connection to the ESXi host using the vSphere client.
    Note: Broadcom recommends creating a new directory on the datastore and uploading the patch file to this directory.

Preparation steps

Before initiating any patch- or upgrade activity, make sure that the ESXi host is in maintenance mode:

  1. Log in to the ESXi Shell on the host. For details on how to enable and use ESXi Shell, see Using ESXi Shell in ESXi.
  2. Migrate or power off all virtual machines and then set the host into maintenance mode:
    # vim-cmd /hostsvc/maintenance_mode_enter
  3. Confirm that the host is in maintenance mode before continuing with the next steps:
    # vim-cmd /hostsvc/hostsummary | grep inMaintenanceMode

Using the "esxcli software profile update" command

This command compares the VIB already included in the software profile on the ESXi with the ones included in the specified profile in the offline bundle:

  • VIBs that are installed in the host and included in the specified software profile in the offline bundle will be updated.
  • VIBs that are included in the specified software profile in the offline bundle, but are not installed on the ESXi will be installed
  • However, VIBs that are installed on the ESXi but are not included in the specified software profile, will remain untouched.

To use the esxcli software profile update:

  1. List the profile name(s) included in the offline bundle:
    # esxcli software sources profile list -d /vmfs/volumes/<datastore>/<foldername>/<patchname>.zip
    or
    # esxcli software sources profile list -d /vmfs/volumes/<UUID>/<foldername>/<patchname>.zip
    where PatchName.zip is the name of the offline bundle uploaded to the datastore earlier.
  2. Update the existing image profile by running the below command:
    # esxcli software profile update -p <name_of_the_Image_Profile> -d /vmfs/volumes/<datastore>/<foldername>/<patchname>.zip

Using the "esxcli software profile install" command

Attention: Using esxcli software profile install is an invasive and potentially destructive activity. This command will overwrite the full software profile currently installed on the ESXi host against the specified profile included in the offline bundle. Any VIBs that are not included in the profile will be removed from the ESXi host, so if there are any OEM VIBs installed that should be kept, the "install" command should not be used.
  1. List the profile name(s) included in the offline bundle:
    # esxcli software sources profile list -d /vmfs/volumes/<datastore>/<foldername>/<patchname>.zip
    or
    # esxcli software sources profile list -d /vmfs/volumes/<UUID>/<foldername>/<patchname>.zip
    where PatchName.zip is the name of the offline bundle uploaded to the datastore earlier.
  2. Install the specified software profile on the ESXi:
    # esxcli software profile install -p name_of_the_Image_Profile -d /vmfs/volumes/Datastore/DirectoryName/PatchName.zip

Notes:If the esxcli software profile update or esxcli software profile install command fails with a
[HardwareError]
Hardware precheck of profile <profile_name> failed with warnings: <CPU_SUPPORT WARNING: The CPU on this host may not be supported in future ESXi releases. Please plan accordingly. Please refer to KB 82794 for more details.>
Append a --no-hardware-warning to the command to allow it to process. Further options are available for esxcli software profile commands. The option to bypass hardware compatibility check warnings is only available for ESXi 6.7 Update 1 or later. Do not bypass verification on production systems.
  • --profile / -p - Specifies the image profile name for the host update. (Required)
  • --depot / -d - Specifies the full remote URL of the depot index.xml or the offline bundle (.zip) file location. (Required)
  • --dry-run - Performs a simulation of the installation, reporting actions without making changes.
  • --force / -f - Bypasses dependency and security checks. Not recommended unless instructed by VMware Support; triggers a warning in the vSphere Client.
  • --maintenance-mode - Simulates maintenance mode for installations that require it but does not affect reboot-required remediations.
  • --allow-downgrades Installs VIBs that update, downgrade, or are new to the host. Without this option, only updates and new VIBs are installed.
  • --no-live-install - Forces installation to /altbootbank even if live installation is possible; skipped for PXE-booted hosts.
  • --no-sig-check - Disables security verification, including signing, posing a high security risk and triggering a SECURITY ALERT in vSphere Client.
  • --no-hardware-warning - Skips any warnings that occur during the hardware pre-check.
  • --proxy - Defines the proxy server for HTTP, FTP, and HTTPS connections in the format proxy-url:port.
  • --help - For options help.
Multiple options can be combined. For example --dry-run and --no-hardware-version can be used within the same command at the same time.

Steps to Patch or Upgrade an ESXi Host using the "esxcli software vib" name space (Alternate way to Patch prior to ESXi 8.0.2)

Attention: Starting with ESXi 8.0 Update 2, upgrading or updating ESXi using the commands esxcli software vib update or esxcli software vib install is no longer supported.
  1. To Update the host using esxcli software vib:
    1. Using a local file:
      # esxcli software vib update -d "/vmfs/volumes/<datastore>/<foldername>/<patchname>.zip"
      where <patchname>.zip is the name of the patch file uploaded to the datastore.
      Alternatively the datastore UUID can be used instead of the DirectoryName:
      # esxcli software vib update -d "/vmfs/volumes/<UUID>/<foldername>/<patchname>.zip"
    2. Using a file from stored in a web repository:
      # esxcli software vib update -v <viburl>
      where <viburl> is the URL to the http(s) depot where the VIB package resides.
      Example:
      # esxcli software vib update -v https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/tools-light/VMware_locker_tools-light_5.0.0-0.7.515841.vib
  2. To Install the patch using esxcli software vib, replace esxcli software vib update against esxcli software vib install.
  3. Verify that the VIBs are installed on the ESXi host:
    # esxcli software vib list
    Example:
    Name                           Version                                Vendor  Acceptance Level  Install Date
-----------------------------  -------------------------------------  ------  ----------------  ------------
atlantic                       1.0.3.0-8vmw.703.0.20.19193900         VMW     VMwareCertified   2022-07-11
bnxtnet                        216.0.50.0-44vmw.703.0.50.20036589     VMW     VMwareCertified   2023-04-26
bnxtroce                       216.0.58.0-23vmw.703.0.50.20036589     VMW     VMwareCertified   2023-04-26
brcmfcoe                       12.0.1500.2-3vmw.703.0.20.19193900     VMW     VMwareCertified   2022-07-11
elxiscsi                       12.0.1200.0-9vmw.703.0.20.19193900     VMW     VMwareCertified   2023-04-26
...
  4. After a patch was been installed, reboot the ESX host:
    # esxcli system shutdown reboot -r 'apply patch'
  5. After the host has finished booting, exit maintenance mode and power on the virtual machines:
    # vim-cmd hostsvc/maintenance_mode_exit

Additional Information

Powered by Wolken Software