RE: WSUS/Reboot

• Previous message: webglobe_at_gmail.com: "what is file refcache.ser"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: <larobins@bellatlantic.net>, "'Depp, Dennis M.'" <deppdm@ornl.gov>, "'Martin Mewes'" <mm@mewes.tv>, <focus-ms@securityfocus.com>
Date: Mon, 4 Jul 2005 18:05:35 -0700

While Laura and others have given some good answers, I did want to reply.

I do clearly understand the difference between having to reboot and just
bounce a service. When you're talking about tens of thousands of servers, it
can be very significant. This is why I wanted to make the point that in some
cases, you can experiment and if dropping a service allows you to
essentially do "net stop some_service & apply_patch.exe & net start
some_service", you can improve uptime. Same thing applies with some apps -
if you shut down all the instances of whatever it is, then patch, you'll end
up with fewer reboots.

Ideally, the patch _would_ be smart enough to do that itself, but if it
isn't and _you_ are smart enough to do that, you can save a lot of time and
trouble.

And yes, I've seen systems fail to reboot for a wide variety of reasons,
including failure to properly configure and manage the system so that a
missing keyboard becomes an issue. Systems bounce for a lot of reasons other
than patches, so I always figured that if an admin allows that to be an
issue, then the system wasn't properly configured.

Think of it this way - Microsoft runs it's network on Windows Server and
routers. They have somewhere around a bazillion servers. If there's
something that's causing you a pain in the rear, what must it look like to
the people running OTG (Microsoft's internal ops group)?

BTW, I no longer work for Microsoft, so I certainly don't speak for them,
and am just trying to be helpful. Please direct flames/complaints to
/dev/null.

> -----Original Message-----
> From: Laura A. Robinson [mailto:larobins@bellatlantic.net]
> Sent: Tuesday, June 28, 2005 5:05 PM
> To: 'Depp, Dennis M.'; 'David LeBlanc'; 'Martin Mewes';
> focus-ms@securityfocus.com
> Subject: RE: WSUS/Reboot
>
> There are some [registry, files-in-use] aspects of a Windows
> system that are dynamically built/started/replaced only
> during boot, before the service or component is initialized.
> Additionally, the kernel is not dynamically loadable and
> unloadable, so kernel changes also cannot be made "on the fly".
> It is not service stop/restart that is requiring reboot in
> most cases anymore. When a patch does require a reboot, it is
> generally because the patch is addressing something that
> *requires* a reboot in order to reinitialize or replace a
> service or file (and most of the time these days, it's
> because an in-use file must be replaced and cannot be closed
> without damaging the machine's operation). So, in answer to
> your question about why patches aren't "smart enough to stop
> and restart the necessary services", they often *are*. The
> next time you patch a system, watch service status while
> you're doing it.
>
> Alternately, just read this article. :-)
> http://support.microsoft.com/kb/887012
>
> Laura
>
> > -----Original Message-----
> > From: Depp, Dennis M. [mailto:deppdm@ornl.gov]
> > Sent: Monday, June 27, 2005 12:26 PM
> > To: David LeBlanc; Martin Mewes; focus-ms@securityfocus.com
> > Subject: RE: WSUS/Reboot
> >
> > So why aren't the patches smart enough to stop and restart the
> > necessary services? IMHO there is a big difference in bouncing a
> > service and bouncing the entire box. For starters there is
> a big time
> > differece.
> > It takes much longer to bounce a box than to bounce a
> service. During
> > a server bounce, there is a much greater chance of something else
> > going wrong. Ever have a box reboot with an error "Key board not
> > found, Press
> > F1 to continue."?
> >
> > Dennis
> >
> > -----Original Message-----
> > From: David LeBlanc [mailto:dleblanc@mindspring.com]
> > Sent: Saturday, June 25, 2005 5:53 PM
> > To: 'Martin Mewes'; focus-ms@securityfocus.com
> > Subject: RE: WSUS/Reboot
> >
> >
> > > Did someone ever tell Microsoft that they should have a look on
> > > unixoid systems. The only scenario a unixoid box _must_
> be rebooted
> > > is, when the kernel has been patched or the main glibc must be
> > > changed for some reasons. But even the latter does not mean to
> > > always you need to reboot the system.
> >
> > Reducing reboots is something that I know is a priority for
> Microsoft,
> > and you're right - having systems rebooting all the time is
> a problem,
> > even if they're just desktops. I think you'll see
> improvement on this
> > over time, and one of the new features of WSUS I notice is
> immediate
> > application of patches that don't need reboots.
> >
> > However, they way that you get this system uptime on most
> *nix systems
> > is to drop the service in question, apply patches and restart the
> > service.
> > IMHO,
> > if the system's job is to provide that service, there is
> only a little
> > difference between bouncing the service and bouncing the
> box. If you
> > take the same approach on a Windows server, you will often
> find that
> > you get similar gains. For example, back when there were enough IIS
> > patches to worry about, you could stop the web service and if the
> > patch were applied when then server wasn't up, it didn't need a
> > reboot. You'd then restart the service once the patch was applied.
> > Many of the patches only trigger a reboot if a file that
> needed to be
> > replaced will only get replaced on reboot.
> >
> > IMHO, it would be a good thing if the patch were to do this on it's
> > own, but in the meantime you can certainly do it yourself.
> >
> >
> > --------------------------------------------------------------
> > ----------
> > ---
> > --------------------------------------------------------------
> > ----------
> > ---
> >
> >
> > --------------------------------------------------------------
> > -------------
> > --------------------------------------------------------------
> > -------------
> >
>

---------------------------------------------------------------------------
---------------------------------------------------------------------------

• Previous message: webglobe_at_gmail.com: "what is file refcache.ser"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]