Docs

Elastic Compute Service

Patch management

Patch management overview

What is Patch Management

Patch Management is an automated patch installation tool provided by VolcanoEngine for ECS instances. It allows you to install security and other types of patches on target instances in batches to ensure compliance and system security for your ECS instances.

tip

The product is in Beta. If you need a trial, submit a ticket or contact your account manager.

Recommended scenarios

Applicable scenarios	Description
Regular compliance check	Applicable to scenarios such as baseline compliance verification and post-installation patch status validation. It performs routine, automated patch scanning and compliance checks on ECS instances, only verifying patch installation status, identifying vulnerabilities and compliance risks, and generating compliance reports, without installing patches.
Temporary emergency fixing	Applicable to urgent scenarios, such as outbreaks of high-risk vulnerabilities and emergency responses to security incidents. If an ECS instance is affected by high-risk vulnerabilities, or subject to security announcements or emergency compliance requirements, you can scan the target instance immediately and install patches to mitigate security risks as quickly as possible, ensuring stable and secure service operation.

Benefits

Flexible patching: less business impact

Patch management supports scanning instances and generating reports for missing patches, or scanning instances and automatically installing missing patches. These capabilities precisely meet different business needs for patch detection and vulnerability fixing.

Dual baseline support: customization on demand

Patch management offers both preset patch baselines and custom patch baselines for diverse business scenarios.

Update-only policy (no uninstallation): ensures system environment stability

When updating patch packages, the system performs incremental updates only for missing content in installed packages (non-latest versions). It does not uninstall or reinstall entire packages, minimizing the impact of patch installation on your services.

Concepts

Concept	Description
Patch baseline	A patch baseline is a collection of patch rules used as the standard for patch operations and compliance judgments. The system automatically approves or rejects patch installations based on this baseline.

Supported operating systems

Operating system type	Operating system version
Ubuntu	Ubuntu 24.04 Ubuntu 22.04 Ubuntu 20.04 Ubuntu 18.04 Ubuntu 16.04
Debian	Debian 12 Debian 11 Debian 10 Debian 9 Debian 8

Operation flow

Regular compliance check

Step	Description
Select a patch baseline for scanning	View existing patch baselines Determine whether the existing patch baselines meet business requirements. Create patch baseline (optional) If existing patch baselines do not meet your needs, you can create a custom patch baseline to define standards for your patch plan.
Create a patch scanning plan	Create a patch scanning plan to check patch status and troubleshoot issues on target instances, and identify non-compliant items, vulnerabilities, and exceptions in advance.
View compliance report	Check the patch scanning compliance of target instances, including compliance status, number of non-compliant patches, details of missing patches, and risk alerts. These reports support patch fixing and compliance improvement.
Create a scan-and-install patch plan (optional)	For non-compliant instances, create a scan-and-install patch plan to check and install patches in one step for efficient compliance improvement.

Temporary emergency fixing

Step	Description
Select a patch baseline for scanning and installation	View existing patch baselines Determine whether the existing patch baselines meet business requirements. Create patch baseline (optional) If existing patch baselines do not meet your needs, you can create a custom patch baseline to define standards for your patch plan.
Create a scan-and-install patch plan	The system first checks patch status, and then installs patches for detected issues to complete emergency fixing in one step.
View compliance report (optional)	Check the patch installation compliance of target instances, including compliance status, number of non-compliant patches, details of missing patches, and risk alerts. These reports support subsequent patch fixing and compliance improvement. tip Based on compliance reports, you can choose whether to scan for and install patches again. If needed, perform the operations by following the three steps in this table.

Potential risks

Patch installation may cause risks such as service interruptions and sudden increases in CPU and I/O usage, which can affect normal service operation. We recommend that you perform patch installation during off-peak hours and back up your data in advance to enable fast rollback if exceptions occur. This helps ensure system recoverability and reduce O&M risks.

Last updated: 2026.06.18 17:48:27