Docs

Elastic Compute Service

Patch management

Viewing compliance reports

After a scan or scan-and-install completes based on a patch plan, a compliance report is generated for each instance. The report provides detailed information about installed patches across your instances. You can use patch management compliance reports to check the patch compliance status of target instances, view patch scanning results and details of uninstalled patches.

Prerequisites

The target instance has been scanned for patch status, or scanned with patches installed. Learn more.

Procedure

In the left-side navigation pane, select "Maintenance & Monitoring > Patch Management".

In the top menu bar, select the region where your business is located.

On the Patch management page, click the "Compliance report" tab.

The compliance report list shows reports by instance, including "Instance name/ID", "Operating system", "Compliance status", "Number of non-compliant security patches", "Number of other non-compliant patches", "Baseline ID", and other information. Parameter descriptions are as follows:

Parameter	Description
Instance name/ID	The unique identifier of the ECS instance covered by patch management compliance detection.
Operating system	The operating system type of the ECS instance covered by patch management compliance detection.
Compliance status	The compliance status of the instance, indicating whether the installed patches match the rules defined in the patch baseline. Values: "Compliant" and "Non-compliant".
		Compliant	Patch status of the instance fully matches the patch baseline rules.
		Non-compliant	Patch status of the instance does not match the preset patch baseline rules. We recommend referring to the "Patch" parameter description in the table below for troubleshooting. If the repair type of the patch plan task is "Scan", non-compliance may be due to: Some approved patches that require installation on the instance were not detected during the scan. Rejected patches were not accurately flagged or were misclassified. The information obtained from scanning, such as patch version, compatibility, and severity level, does not match the preset rules of the patch baseline. The scan did not complete as defined by the patch baseline. Incomplete scans occurred such as scan interruptions or unexecuted scans. If the repair type of the patch plan task is "Scan and install", non-compliance may be due to: One or more approved patches (high‑risk and regular) are missing. A rejected patch was installed. Patch installation was not completed within the time period specified by the patch baseline.
Number of non-compliant security patches	The total number of security patches on the target instance that are not installed as specified by the patch baseline rules. For details of non-compliance and repair suggestions, refer to the "Patch" parameter descriptions in the table below.
Number of other non-compliant patches	The total number of non-security patches on the target instance that are not installed as specified in the patch baseline. For details of non-compliance and repair suggestions, refer to the "Patch" parameter descriptions in the table below.
Baseline ID	ID of the patch baseline. Click the ID to view the detailed rules of the patch baseline used for this instance.

In the "Actions" column of the target instance, click the "View details" button to view the following information.

Parameter	Subparameter	Description
Baseline information	-	Displays instance name/ID, patching plan, action type, and other details.
Patch	Displays all patch information about the instance, such as "Patch name", "Type", "Description", "Status", and "Severity level". The main parameter descriptions are as follows:
		Type	The patch category. Valid values Security: Security patches, used to fix operating system security vulnerabilities. These patches are directly related to instance network and data security and should be installed with high priority. Other: Non-security patches, typically used for feature optimization, bug fixes, compatibility improvements, or tool maintenance. These are lower-priority, supplementary patches. tip If only other-type patches are missing after scanning, we recommend scanning and installing them together during a maintenance window. If security-type high-risk patches are missing after scanning, we recommend scanning and installing them immediately during off-peak hours to avoid security risks.
		Description	The detailed information about the patch package.
		Status	The patch status. Supported: Installed The patch was installed, complies with the current patch baseline, and does not require a restart. Uninstalled This patch meets the requirements of the patch baseline rules but has not yet been installed. It might be in the process of being installed. Learn more. Installed and to be restarted The patch has been installed but requires an instance restart to take effect. Restart the instance. Installation failed: Patch installation failed. Go to the patch plan page to view the specific cause and complete remediation. For details, refer to Viewing patch plans. Installed (does not meet the baseline) The patch has been installed but does not meet the baseline. A package in the "Rejected patches" list will be installed only if the package is a dependency of another package, and its status will be "Installed (does not meet the baseline)". Installed (rejected patch) The patch has been installed but it is a rejected patch. If a package was installed before it was added to the "Rejected patches", its status will be "Installed (rejected patch)". If you need to install the patch for your business or the patch is a dependency of a core component: Remove the patch from the "Rejected patches" list in the patch baseline, or add it to the "Approved patches" list. If the patch is a dependency and you want to keep it rejected but allowed as a dependency, change the rejection action to "Allow dependency". If you do not need to install the patch or an installation risk exists: Log in to the instance to manually uninstall the patch, and then scan to verify compliance.
		Severity level	Patch compliance severity level. For supported levels and details, refer to Creating patch baselines.

Last updated: 2026.06.18 17:48:27