Automation - #6 - Azure Update Management
ฝัง
- เผยแพร่เมื่อ 16 ต.ค. 2024
- #TheAzureAcademy #AzureAutomation #AzureUpdateManagement
Learn how to maintain your Windows, and Linux systems, onPrem or in Azure, with Azure Update Management today at The Azure Academy
You can use the Update Management solution in Azure Automation to manage operating system updates for your Windows and Linux computers in Azure, in on-premises environments, and in other cloud providers.
You can quickly assess the status of available updates on all agent computers and manage the process of installing required updates for servers.
Azure Automation Overview - 1:23
Deploy Automation Account - 3:40
Add VMs to Update Mgmt - 4:40
Update Mgmt Reporting - 7:08
Create Linux Deployment - 9:20
Import Runbook Automation - 13:19
Create Windows Deployment - 14:35
Monitor Update Jobs - 16:41
📲 Follow Azure Academy
►Twitter: / msazureacademy
►LinkedIn: / dean-cefola-2902934b
►Facebook: / azure-academy-87979521...
💰 Support Azure Academy
►Patreon: / azureacademy
📡 Contact Azure Academy
►Email: Dean.Cefola@Microsoft.com
►MAIN Channel: / azureacademy
🤣Playlists
►Azure Governance: aka.ms/AzureAc...
►Azure Fundamentals: aka.ms/AzureAc...
►Azure Blueprints: aka.ms/AzureAc...
►Azure AD Series: aka.ms/AzureAc...
►Azure ARM Templates: aka.ms/AzureAc...
►Azure Automation: aka.ms/AzureAc...
►Azure Networking: aka.ms/AzureAc...
►Azure Migrations: aka.ms/AzureAc...
►Azure Backup: aka.ms/AzureAc...
►Azure New Features: aka.ms/AzureAc...
►Windows Virtual Desktop: aka.ms/AzureAc...
►Cloud Adoption Framework:aka.ms/AzureAc...
Hey Dean, great Vid again!! Great Job!
Thanks for the feedback Andy! Is there a video topic you would like us to create?
@@AzureAcademy Privat Link would be nice :-)
I am working on it now...stay tuned!
@@AzureAcademy Is there a chance to connect directly / securly to an paas services without the need of an gateway?
It depends on which services you are talking about.
VMs use Azure Bastion
Storage accounts use SAS Tokens
PaaS services use private link
But for private link you need to get to Azure first. So if you are on prem you will need to get to Azure and you will need a gateway
As usual First class azure howto, Thank you Dean
Suggestions for future videos:
1- Azure Single sign on , How it works and how to apply it.
2- How to to setup , configure and apply Cerificates
3- Different Azure firewalls types and how they work
Thanks for the suggestions Abu!
Can you give me more info on the SSO video?
Are you talking about Azure SSO or ADFS SSO with Azure AD Connect?
Also apply Certs to...what exactly?
For the Firewall types...do you mean all the different vendors who have products in Azure or NAT /ACLS vs. products that do IPS/IDS?
@@AzureAcademy Sorry for the confusion Dean:
1- I believe there are 3 ways of configuring SSO within Azure
2- I meant how does the PKI certification work/used within Azure
3- I meant the different types of Gateways within Azure [ Layer 4 (Load Balancer) & layer 7 (Application/frontdoor) ]
Makes sense
Thank you for posting this video, it was useful.It crystal clear for working on Azure Update Management.
Happy to help!
Exceptional. All your training is first class
Thanks James! Please share The Azure Academy with others so they can learn as well
Thanks Dean fantastic step by step demo, Excellent Work !
Thanks Shredhar! Please share The Azure Academy with others so they can learn as well ☺️
Wow. You're simply amazing sir. Recently I have cleared my AZ-104 exam. But this topic doesn't come in Az-104. So your video helped me understand something good. Just a small doubt.. If we want to use Runbook we must have one automation account & log analytics workspace, am I right? And what can we do with DSC in Run book? Thanks.. I just subscribed to ur channel.. Loved it.🤗😊
Thanks Hr daniel. To use a runbook, you only need an automation account. Only some scenarios require a log analytics workspace. DSC Runbooks can do ANYTHING. if you are familiar with PowerShell DSC...it is the same thing, but managed by Azure, not a DSC server. Thanks for subscribing! Let me know what other content you are interested in so I can make it 😉
@@AzureAcademy oh. that's interesting.. So what about cost/billing paths? does automation account cost separately or something else? and if yes, how billing works i meant based on what.? and of course if we use Log analytics workspace there would be separate cost. can you make video on ARM template i am poor in ARM template. 😀😊 Thanks a lot once again.. 🙏🤩
@@AzureDevOpsPulse Yes, Automation has its own cost structure. check out the Azure Calculator for more details
azure.microsoft.com/en-us/pricing/calculator/?OCID=AID2100131_SEM_5eca258d1c531308f10245cb7b79e500:G:s&ef_id=5eca258d1c531308f10245cb7b79e500:G:s&msclkid=5eca258d1c531308f10245cb7b79e500
Great Explanation - Thanks
Thanks for watching
Fantastic video!
Thanks!
Great video, I have a question about how we can do roll back if something happen while using Azure automation and schedule automatic updates ?! Should we do backup and take snapshot from the VMs first or there's another options ?!
Yes...but, So we are talking about the same thing, can you define “roll back” for me
Also in what scenario would you think you needed to roll back?
@@AzureAcademy for example if a new update cause a compatibility issue with any hosted application on the server and we need to do a rollback by uninstall this update.
You would need to log into windows find which update caused the issue and remove it
Hi Dean. I got impressed and at the same time I don't know if we are just wasting the time by installing SCCM in my company.😅😅
But I have a doubt, we want to manage servers, and I don't think any P2P technology will be possible to be used because they are splitted in security bastions.
Is it very expensive to use Azure Update for patching? All the servers on premise would have to download the patches from Azure. I mean each one?
BR,
Thanks
It is not very expensive at all. One thing to be aware of is that you cannot use Azure Update Management for windows client OS today...only server OS supported
@Azure Academy Hi Dean. Thank you for your answer. And sorry for maybe bothering you too much. 😜
After checking carefully the documentation now I realize that wouldn't be expensive at all because patches are being downloaded from WSUS or from Windows Update, not from Azure as I understood. That means that I should either set up a WSUS server and having to manage it or open the communications between all my servers and Windows Update? Would be other options, like a caching PAAS service on Azure or something like that?
On the other hand, I see that at the time to schedule an update deployment, I can select the update classification and exclude some KBs, but I cannot filter the data when these ones were published, so this is only allowing me to install until the last released patch. What If want to deploy only patches released until November?
BR
You don’t need your own WSUS, that is what the service providers give you
Hi Dean, thanks for a great tutorial. A couple of questions, first I see that in your example after the updates were applied the "Other missing updates" field is still showing up a lot of pending updates. How can I make sure that all those updates are also installed?.
The second question is about the actual installation process, after checking the VMs I see that the updates are there, available to be installed, but waiting for the administrator to Click the Button "Install" instead of automatically installing then. In the end, the job is reported as successful but the machines are reported as non-complian because the updates were not installed. Any ideas?
thanks Walter, I think you may be seeing a reporting issue rather than it isn't done issue.
When you install the updates the local windows device would have the latest info, but it may not have updated back to Azure. this is the same issue if you have a ConfigMgr environment...it takes a little longer to update the reporting side.
As for the "other updates" In my experience of using Azure Update Management this fixes itself over time...and I think that is the key. If you want Azure to manage the updates so you don't have to worry about it...this is the way to go. If you want to have more manual or direct control than another tool or script that you manage may give you the experience you expect.
@@AzureAcademy Thanks for the quick answer. I managed to find what I think is the reason for the updates waiting for somebody to click Install. We are migrating away from SCCM to Azure Update Management and despite the Group policy pointing the update services in the servers to Microsoft, the SCCM agent was still running on the servers. The Logs of the Azure Update service was saying "Using SCCM for Update Deployment". After removing the SCCM agent the updates were actually deployed. The other issue of the "Other missing updates" listing updates despite the machines being reported as Compliant is still there, like in your tutorial. I don't think that its a delay in reporting. I will appreciate your input.
Thanks Walter!
tried the pre-script using the update management turn on VMs script published, but it doesn't turn on VMs that are disallocated. When I look into the pre-script output, it found it machine that was powered off but took no action to power on. What did I do wrong?
Sorry to hear that…do you have any network security on your VMs that might be blocking ports?
Great video! You should complete one on how you created the dashboard for Update Management :D
ThNks for the suggestion…I’ll add it to the list!
if you add the turnoff VM as post-scripts it will turn off ALL VMS, even the ones that were ON before patching?
If they are all in the same resource group...yes
@@AzureAcademy Is there a way to find dynamically powered off vms and then turn them on-apply update-turn off without impacting already powered on machines?
Look at this video for the answer th-cam.com/video/GbSjkg8MZrE/w-d-xo.htmlsi=bCwXKfNeOXYXpfF2
Just want to know how update Management get updates, by MS update portal or backend WSUS server ?
yes...LOL It is windows updates added into the Azure portal
Hi Dean. Can the application updates be scheduled from the same console ?
Azure Update Management is specifically for Windows Server and Linux OS Updates.
So, no you can't do updates on Office of AutoCad from here...However, you can script out those updates and create your own runbook in the same automation account to do them
Thanks for the video, much helpful.
Can you please let me know the pros and cons of Azure update management vs SCCM
Pros of Azure update management is you need no infrastructure or SCCM experience. Cons of Azure update management vs SCCM is that SCCM has more management options and abilities. Application delivery configuration management etc
Can we also get a list of VMs complaint/Non compliant through powershell?
I haven’t tried from power shell…but I don’t know why it wouldn’t work
Can it be possible to patch the VM's which are hosted in AWS by using Azure Automation Update Management Update
good question...I never tried to do that, but it should be possible with Azure Automation directly or with Azure ARC
@@AzureAcademy Let me also check with the Microsoft support team to know more about this to implement.
Sounds good
@@AzureAcademy
Successfully I have added 4 aws instances and started doing patches.
Update management will support non azure vms and on-premise physical machine and vm
did you have to setup Azure ARC for those systems?
Great intro video. Got a patreon page?
Please show us how best to exclude a specific KB continually for a group of systems.
That would be most helpful to enterprise.
Perhaps delayed reboot with after script log search confirmation that KB is excluded.
Thanks! here is my Patreon - www.patreon.com/AzureAcademy
I can add your request to my list of videos for sure.
Can you explain the last part a little more?
"delayed reboot with after script log search confirmation"
Thanks again!
Wow! nice video. What if the VM is already "ON" and i don't want to turn it "OFF" post the update is finished.
you can configure that
video was helpful. however, I am running into an issue where the vm turn off runbook is not being executed. The job says complete but the output states no virtual machines to turn off. I used this as a post-script. could you please provide some insight?
To be clear on the issue: You are running the start/step VM Runbook, or are you running the automatic updates runbook, and the stop VM portion of the runbook is not working?
Azure Academy nevermind It’s working. I had to wait for the update deployment, thanks is there a way you can test them using the test pane for those specific pre and post scripts simultaneously?
@@donovangraham1518 YES, go into the runbook and click EDIT. then you can start the runbook manually and watch the output for results.
nice video, thanks
Thanks 👍👍
Top Top Top! Great Job!
Thanks very much...Let me know what other videos I can make for you!
I am looking for a post script that checks all services with status automatic and makes sure they are started on running, if not it query on with stopped status and restart
sounds like you want a custom runbook, or a VM custom script extension. The extension will run a powershell or other script directly, the Runbook would store that script as a runbook in Azure to be able to be reused on multiple VMs at once, or again and again over time.
if i have 2012 X1,2016X1, Redhat X1, CentOS x1, how many update deployment should I create? 1 windows + 1 Linux?
The windows updates can all go into 1
I have never tried to patch Linux through the same update...but I would suggest 1 for Linux or be brave and try putting all updates into 1.
@@AzureAcademy thx
👍👍
How to pull the report for monthly patching servers( Linux and Windows ) in Azure
Your reporting is done in Log Analytics -> docs.microsoft.com/en-us/azure/automation/update-management/query-logs
Great find; subscribed. Thank you.
Thanks Joe! Let me know if you have any ideas for new videos!
Great Video Azure Academy :)
Thanks for the feedback!
How to fetch the Compliance report for Patching stuff what we done in Azure
The reports are in the Azure automation and log analytics solutions
May I know how to calculate cost involved in this? If we have 700 VMs how much is going to cost for update. And also the log analytics cost as well?? Please help
the Azure Automation and Log Analytics cost can be found in the Azure price calculator - azure.microsoft.com/en-us/pricing/calculator/?OCID=AID2100131_SEM_8d08e701471510d034e3876c9993c4b2:G:s&ef_id=8d08e701471510d034e3876c9993c4b2:G:s&msclkid=8d08e701471510d034e3876c9993c4b2
If u have 700 vms, the cost of NOT updating are incalcuable until you get cryoto'd.
Dump log analytics into its own bucket for cost tracking.
$2.8 / GB daily ingest.
Dont track performance and audit if u want to be stupid cheap.
👍 Thanks For Sharing👍
so to look the logs data on the dashboard do i have to keep the azure-virtual-machine live? I mean i shouldn't stop my machine?
The log data will be stored in Log Analytics. Once there the VM doesn’t need to be powered on to look at the data.
However, new data will not be available unless the VM is online.
@@AzureAcademy sir , can i mail you for further help?
Sure
Hi Dean, really great Video! But I came across the problem that I don't know how I can remove an already added machine now? Do you know the solution?
What service is the machine added into?
@@AzureAcademy Well, this is non-Azure VM (on-premises) added to Azure Update Management by Microsoft Monitoring Agent (in Control Panel)
Was it added through Azure ARC or directly to Azure Automation?
@@AzureAcademy Directly to Azure Automation.
In update management are you able to see any of the VMs you are protecting?
throw some light on hybrid worker groups..unless VM reflect there it won't reflect in Machines. Thats from my experience.
the hybrid worker is a service that is installed on a VM which talks to the Azure Automation Account Service...kinda like a proxy
Very good video. One improvement suggestion: at least rest for 2-3 seconds with your mouse over the place you're gonna click on. You're really fast and I had to rewind the video countless times to get an idea where you clicked
thank you for the feedback! I do take it slower in all my newer videos and use animation and zooming so you know exactly what I am talking about and clicking on. Let me know what you think!
Please how to link an automation account to log analytics workspace?
When linking Azure Automation to Log Analytics you need to look at this doc for the mappings - docs.microsoft.com/en-us/azure/automation/how-to/region-mappings
great Job Dude
Thanks Chandra!
+chandra shekhar thanks
Thanks Dean... Plz create one on Private link and how it's different from service endpoint.. 🙏🙇🙏💕
you're welcome! I am working on the Private Link video...stay tuned, and keep the suggestions coming!
@@AzureAcademy 🙏💕 you rock Dean ✌✌
@@cloudpachehra1113 🙌 anytime!
Here is the video on Private Link - th-cam.com/video/PWKM5KXjWno/w-d-xo.html
awesome
You go way to fast!
Sorry about that...too fast in what way?
Clicking around
Speaking
Etc
No one tells you about how to patch Linux serves in azure no one ☝️
Is that a request for a new video?
Which distro do you want?
Microsoft changes crap to often where you can't find these things in Azure....
Yes things do change and “improve” quickly in fact there are many updates every month to the cloud...but is there something specific you are talking about so I can bring it to the product team?