Remediation of vSphere patches when vCops and vShield is in use poses several problems. These problems came to be as I prepared myself to apply the most recent set of updates. Actually my first updates since moving to vSphere 5. The problems can be surmised as two VMware Update Manager failures:
- Failure to “Disable any removable media devices connected to the virtual machines on the host” even though that options was unchecked during the upgrade
- Failure to properly shutdown vShield Firewalls
The details of the problems are:
When running VMware vCenter Operations Suite 5.0, the UI VM could not be moved to another host automatically by VUM due to a CDROM device that the UI VM uses. Why it uses this device and requires it to be always connected is unknown by me. But VUM did not like this behavior. VUM failed to put the host into maintenance mode.
Solution: vMotion the UI VM of VMware vCenter Operations 5.0 before patch remediation.
When running VUM, one host could not shutdown the local vShield Edge and Endpoint instances residing on that host. The errors were not forthcoming so entry into maintenance mode was once more delayed.
Solution: Shutdown these VMs by hand.
None of these problems were disastrous but hopefully this will help others when they upgrade their vSphere 5 environment. Since, the work arounds are to by hand actions, it seems reasonable to expect the automated tools to perform the actions satisfactorily as well.
