One or two thoughts on Live Patching

[Nüüül]

Good morning,

great to have CPLP there and running! Saves lots of people on doing panic-update sessions on several customers.

One or two thoughts i have on this:

- the option to enable this (enabled by default) is a bit hidden or not naming it by its name

  - please give it a more prominent place, as that is a very good and important feature; you should promote it like that (i.e. as Option at the General Properties of devices)

- given that this is a Global Property

    - would it be possible to en-/disable CPLP by machine  (i.e. as Option at the General Properties of devices)

    - some might have issues with having software (or parts) installed automatically or might want to stage or manually approve the application of automated software changes, because of processes

 - I am not sure on that, but looking at regulated customers,  externally changing software can be an issue or at least something that has to be specifically looked at, defined, approved and documented.  

Perhaps setting the whole CPLP thin to devices General Properties and let the admin decide, if this is fully automated or downloaded and applied after an approval would be good. But thats only my opinion.

Again, great that CPLP is there and thanks for that!

[Wolfgang]

We are too really happy with Check Points Live Patch feature. Saved us a lot of time regarding the last new CVEs. All of our gateways are patched live without any interaction and without problems (ClusterXL, single gateways, Maestro, VSX). Isolated environments or gateways with more restriction have to be patched manually.

!!! GREAT FEATURE  !!!

I recommend @Nüüül thoughts.

- enabling/disabling by gateway

- information in SmartConsole that something changed automatically (like the security issues or maybe as installed patch). patch is installed but we have to dig through Audit-Logs to see this

- possibility for an installation with approval only 

[Alex-]

CPLP reports ro SC in the Audit Logs.

Edit: Thats what you wrote. We export the logs and use filtering for events.

Maybe Playblocks can help there.

[Parabol]

We found that live update was not in place on all of our firewalls unfortunately, and so the protection was only applied to about half the firewalls, despite them all being on the same version.

We see now on our perimeter that the download and install parameters for auto update were set to false for some reason:

 autoupdatercli show auto_updater

product-name: deployment_products

component-name: auto_updater
component-branch: Infra_AutoUpdate
GA-Version: 0
download-scheduler-active: false
install-scheduler-active: false
download-action: idle

I think a feature to alert us that live update was not enabled so that we could have sorted this on the gateways, ensuring that they are ready for these situations would have been helpful. 

[Gaurav_Pandya]

I agree with the concern that there should be some form of notification or alert before a live patch is applied. This would provide administrators with greater visibility into patching activities, help with change tracking, and allow teams to assess any potential impact in advance. Such a notification mechanism would improve operational awareness and make the live patching process more transparent.

[Hugo_vd_Kooij]

I found a silly issue with cplp.

We login with TACACAS accounts and get to clish mode. We then escalate with the `expert`command to get a bash prompt. But that way the splp command isn't working as expected.  because in that case it's not the PATH variable. A directlogin with a user with bash shell allows it to work.

Alternative in expert mode yu can run `/usr/local/bin/cplp`and that takes care of things as well.

Not a big issue but rather silly if a less experience collegue volunteers to validate CPLP status on a number of machines and fails.