Patch Using Kernel Fixlets

To prevent accidental deployment of the wrong kernel family, which could lead to stability issues, and to ensure that systems only receive the correct kernel updates.

BigFix applies the following safeguards:
By default, Fixlets for Non-UEK (Unbreakable Enterprise Kernel) are applicable to Oracle Enterprise Linux (OEL) endpoints. Fixlets targeting the UEK kernel are not applicable unless they are explicitly enabled. This default behavior ensures that only standard (Non-UEK) kernel updates are deployed, unless UEK-specific updates are intentionally required.
  1. Enabling UEK Kernel Fixlets
    1. To make a specific UEK kernel version Fixlet applicable on endpoints, you must deploy a corresponding client setting configuration Fixlet.
    2. These configuration Fixlets set the _BESClient_OEL_RestrictUEK client setting to the specific UEK version you wish to enable.
    3. Available Fixlets of Oracle 8 and 9 are:
      • 301 - Configure OEL8 Client Setting _BESClient_OEL_RestrictUEK to 6
      • 401 - Configure OEL8 Client Setting _BESClient_OEL_RestrictUEK to 7
      • 601 - Configure OEL9 Client Setting _BESClient_OEL_RestrictUEK to 7.
    4. Example:

      Deploying Fixlet 301 for Oracle Linux 8 enables the applicability of UEK6 kernel Fixlets, while disabling all UEK7 and Non-UEK kernel Fixlets. This ensures that only the specified UEK kernel track is applied to the targeted endpoints.

  2. Disabling UEK Kernel Fixlets
    1. If you need to revert the client to the default state (only Non-UEK kernel Fixlets are applicable), you must remove the UEK restriction setting from the endpoint. The following Fixlets perform these actions to remove the restriction:
      • 501 - Delete OEL8 UEK Client Setting _BESClient_OEL_RestrictUEK
      • 501 - Delete OEL9 UEK Client Setting _BESClient_OEL_RestrictUEK.