Docs

Elastic Compute Service

Managing patch plans

Creating patch plans

You can create patch plans to systematically control patch installation time, instance scope, execution frequency, and methods to achieve:

Regular patch fixing and timely vulnerability blocking, with flexible installation time configuration to avoid impacts on business operations.

Elimination of manual operations through rapid unified patch deployment, reduction of human errors in emergency handling, improvement of O&M efficiency, and guarantee of resource security.

Prerequisites

You have a patch baseline that meets your business requirements.

By default, preset patch baselines are provided. Learn more.

If preset patch baselines do not meet your business requirements, you can create a custom patch baseline.

The instance for which patches are to be installed has the cloud assistant Agent installed.

To use tags to filter target instances in batches for patch scanning or scan-and-install, first associate the corresponding tags with the instances.

Usage notes

Patch installation may involve potential risks such as service interruptions, CPU spikes, and I/O spikes, which can affect normal business operations. Perform patch installation during an appropriate period, such as off-peak hours. Risks include:

Server restart is required after kernel patch installation, which directly interrupts services on the deployment node.

Operations such as file decompression, signature verification and system file replacement during patch installation can easily cause CPU and I/O resource contention. This impairs business performance and causes application crashes and other issues. This process may also consume a large amount of network bandwidth, affecting cross-node service communication.

Procedure

In the left-side navigation pane, select "Maintenance & Monitoring > Patch Management".

In the top menu bar, select the region where your business is located.

On the Patch management page, click the "Patch plan" tab.

Click the "Create patch plan" button. Configure the parameters described in the following table.

Basic information and patching method

Parameter			Description	Sample value
Basic information
Plan name			Enter the name of the patch plan.	Patch task executed immediately
Patching method
Execution mode	Select the patching execution mode. You can select "Now", "Timed execution", or "Periodic".			Now
		Now (default)	After the task is created, it is executed immediately.
		Timed	The task is executed automatically once at the time you specify. tip The execution time must be accurate to the minute and can not be earlier than the current time.
		Periodic	The task is executed automatically based on the configured interval (daily/weekly/monthly) or Cron expression from the specified start time, and stops automatically at the cycle end time. You need to configure the following information: Recurrence Specify the interval at which the task is executed repeatedly. The interval must be longer than the timeout period. Value: By day/month/week: The minimum interval is 1 day. tip By month: If the specified execution date is 29th, 30th, or 31st and there is no date after the 28th day of the selected month (for example, February), the task will not run by default in that month. If the specified execution date is the 31st, and the selected month does not have 31 days (for example, April), the task will not run by default in that month. Cron expression: The task automatically repeats from the start time based on the rules defined in the Cron expression until the cycle end time. Learn more. Execution start time Specify the time when the periodic task is first executed. This time must be later than the current time. Expired at Specify the time when periodic task stops. The task automatically stops at this time. If the task is not being executed at the stop time, it automatically stops and will never be executed again. If the task is being executed at the stop time, it automatically stops after the execution is complete and will never be executed again. If the interval between the stop time and the start time is less than one repeat cycle, the task is executed only once. tip The execution interval is independent of the actual execution duration of the task and is calculated based on the "Execution time" you specify. For example: If the execution time is 2025-12-20 11:00:00 and the repeat cycle is 1 hour, and the duration of the first execution is 3 minutes, the second execution starts at 2025-12-20 12:00:00.

Repair action

Parameter	Subparameter	Description	Sample value
Action type	Scan (default)	Checks patch status, troubleshoots all instances within the patch plan scope, and generates a compliance report. No installation is performed without business risk involved. This configuration is applicable for initial baseline compliance verification, troubleshooting after patch installation failure, and status verification after manual actions.	Scan
Action type		Scan and install	Scan	First performs patch status checks for all instances within the patch plan scope, then automatically installs relevant patches to fix issues, and generates a compliance report after completion. This configuration is applicable to scenarios such as emergency response and compliance remediation. warning Patch installation may involve potential risks such as service interruptions, CPU spikes, and I/O spikes, which can affect business operations and service performance. Please proceed with caution.
Create snapshots for the system	-	Select whether to create snapshots for the system. This parameter is required only when "Scan and install" is selected. tip We recommend that you select "Create snapshots for the system". Patch installation may involve updates to the operating system kernel, which are high-risk operations that may fail or cause system exceptions. Creating a snapshot can effectively ensure system recoverability and reduce O&M risks. If "Create snapshots for the system" is selected, when an unexpected crash occurs during patch installation, you can roll back system volume data using the snapshot. By default, system volume snapshots are retained for 7 days, and you can extend the retention period as needed. Learn more. tip Snapshots are created per instance, with a unified name prefix of "PatchManager". If "Create snapshots for the system" is not selected, the target instance will not have backup corresponding to this patch operation, and fault recovery cannot be achieved via snapshots.	Select "Create snapshots for the system"
Allow restart	-	Select whether to automatically restart the instance after patch installation. This parameter is required only when "Scan and install" is selected. If you select "Allow restart", the system will automatically restart the instance after patch installation to make the patches take effect. If you do not select "Allow restart", the system will not automatically restart the instance after patch installation, and you need to manually restart the instance. tip Whether a restart is required after patch installation depends on the type of corresponding component. Generally, there are two types: Restart required to take effect Kernel-related patches, core system library patches, daemon/service package patches, and other types. Take effect without restart User-mode tools, CLI tool types, and other types.	Allow restart

Patch baseline and target node

Parameter	Description	Sample value
Baseline selection
Baseline selection	Select the baseline to be used for the patch plan. Options: Use recommended default The system preset general configuration, or the general configuration you create and set as the default patch baseline, which is convenient to use. Custom patch baseline A user-defined custom configuration, tailored to business needs for greater precision.	Use recommended default
Target node
Target selection	Select the method for filtering target instances. Multiple dimensions are supported for precise filtering of target instances for patch installation. Choose based on your business requirements. Supported: Manually select instance Manually select target instances from the instance list. This is suitable for temporary or personalized patch installation requirements. After selection, only the selected resources can match this patch plan. Up to 200 instances can be selected. Specify instance tag Filter target instances in bulk based on the custom tags associated with the instances (such as business type, environment identifier, department affiliation). This is suitable for unified management by business domain/deployment environment. After selection, newly created instance resources that meet the condition will automatically match this patch plan. You can select up to 10 tags and specify up to 3 values (Value) for each tag key (Tag). Specify project Filter target instances in bulk based on the project to which instances belong. Only one project can be selected. This is suitable for unified patch deployment management based on enterprise project architecture. After selection, newly created instance resources that meet the condition will automatically match this patch plan.	Specify project
Select instance (optional)	Manually select the target instances for patch scanning or installation. You can select one or multiple instances. tip Required only when the "Target selection" parameter is set to "Manually select instance".	-
Instance tag (optional)	Select the target tag key and value from the instance tag dropdown list. You can click the "Add tags" button to add more instance tags. At least one tag is required, and up to 10 tags can be configured. tip Required only when the "Target selection" parameter is set to "Specify instance tag".	-
Select project (optional)	Click the project dropdown list and select the target project. tip Required only when the "Target selection" parameter is set to "Specify project".	default

Concurrency control

Parameter	Description	Sample value
Concurrency rate	Specify the maximum number of instances that can be batch patched concurrently per task within the same time period. For example, if you have 50 instances and set the concurrency rate to 10, the task will be executed in 5 batches, with 10 instances being patched simultaneously in each batch. Value range: 1-100.	10
Maximum number of errors	Specifies the maximum number or percent of errors allowed when executing a batch instance task within a specific operation or range. Execution stops when the number of errors reaches this value. Error count: Applicable to scenarios where the error count needs attention. Value range: 0-100. If the error count is set to 0, no errors are allowed. That is, if an error occurs even once while performing a task, the entire task will stop (fail). If the error count is set to 100, a maximum of 100 errors is allowed. That is, as long as the number of errors during the execution of a task does not exceed 100, the task will succeed, but if errors exceed 100 before the task is completed, the entire task will stop (fail). tip The next step is allowed to proceed only when the actual number of failures across all batches of the task is less than or equal to the maximum number of errors you specify. Percent: Applicable to scenarios where the impact of errors on the entire task needs attention. Value range: 0-100%. If the maximum error percent is set to 0%, no errors are allowed. That is, if an error occurs even once while performing a task, the entire task will stop (fail). If the maximum error percent is set to 100%, the task will succeed regardless of the number of errors. tip The next step is allowed to proceed only when the actual failure rate (percentage of failed instances) across all batches of the task is less than or equal to the maximum error rate (percentage) you specify.	Error count: 1

Click the "Confirm" button to complete the operation.

After the patch plan task is created, it will begin execution based on the specified execution mode.

Subsequent steps

After the patch plan task completes, you can view the compliance report.

Last updated: 2026.06.18 17:48:27