RPM rollback

The RPM Rollback feature offers the possibility to restore your systems to a former working state in the event of an RPM upgrade that caused a failure.

Previous to SA 10.51, this functionality was only available on Linux servers for remediation jobs where the installation was done using RPM versions 4.2 to 4.6. Because the rpm-based rollback functionality has been discontinued, in SA 10.51, we introduced an alternative solution based on yum history. This functionality is available for yum versions 3.2.25 or later. In order for this functionality to be available, the SA Agent must be version 45 or greater, for the rpm-based rollback, and 65 or greater for rollback based on yum history.

The user must have read/write permissions on the server/customer and the permission: Allow Install/Uninstall Software, to be able to view, delete rollback points, or to start a rollback operation. To create rollback points, user needs to have either Allow Install/Uninstall Software (if rollback point is created via Install / Uninstall Software) or read/write Manage Software Policies permission (in case the rollback point is created via a remediation).

There are three use cases around this feature:

• Create a rollback point: This operation preserves the current state so that you can restore it later. For yum history, a new transaction is created and added to the yum database for each yum command that modifies the packages so that the state of the managed server can be restored later.
  
  See Creating a rollback point.
• Roll back to a previous state:This operation allows the user to undo an operation, to restore the state of the managed server. For yum history, this will attempt to undo what the 4specified transaction did. The operation will fail if some packages yum needs to install are no longer available in the SA Software Repository.
  
  See Rolling back to a previous rollback point.
• Delete rollback points: (not available for yum history) Rollback points accumulate over time. You can delete any existing rollback point.
  
  See Deleting a rollback point (not available for Yum history).

How RPM based rollback works

The SA RPM rollback function uses the rpm repackage mechanism, which repackages the currently installed packages and saves them to the repackage directory (/var/spool/repackage by default) at upgrade time. The repackage directory can be configured in the RPM configuration file.

The rollback process undoes all the operations down to the time when the rollback point was created in reverse order:

1. A package that was upgraded will be downgraded to its prior version;
2. A newly installed package will be uninstalled;
3. A package that was removed will be re-installed.

For example, let’s say the following scenario occurs:

1. A software policy is remediated that results in upgrading a number of RPMs, and a rollback point is created.
2. Then the user installs another a new set of RPMs (using SA or manually) on the server.

In this case, when rolling back to the rollback point created by the RPM upgrade (step 1), the newly installed packages (step 2) will be uninstalled as well.

How rollback using Yum history works

yum keeps a database with information about each and every transaction it performs by trans-action ID. Each time you perform a yum command which changes your system packages in some way the history database is updated with this information. The yum history databases are nor-mally found in /var/lib/yum/history/.

The rollback operation uses ‘yum history undo [transaction_id|'last']' command. This will attempt to undo what the specified transaction did. The operation will fail if some packages yum needs to install are no longer available in the SA Software Repository.

yum history does not support the ‘Delete Rollback Point’ operation.

Viewing rollback points

To view the rollback points available on a server:

1. Open the Server Browser window on the server.
2. Go to the Inventory view and then open the Rollback Points pane.

The table in the following image , displays the Name, Type, and Created Date, where type is RPM Repackage or Yum History.

Creating a rollback point

To create a rollback point:

1. Start a package operation using one of the following options:
   1. Start an install of one or more RPM packages on one or more Linux servers.
      See Install software using a software policy.
   2. Start an uninstall of one or more RPM packages on one or more Linux servers.
   3. Start a remediation of one or more software policies on one or more Linux servers. The software policy must contain one or more RPMs.
      See Remediate servers with software policies.

   For RPM-based rollback the packages must have a previous version already installed on a target server and the upgrade flag set in order for a rollback point to be created. In SA, the upgrade flag is set directly on the RPM package. It can be set to either install or upgrade but upgrade is the default value.

2. Select Create rollback point option in the Options set of the installation or remediation process. This option will be enabled by default if the above requirements are met.
   See Step 2 (Optional) - Specify reboot, error handling, and script options for remediation
3. For each rollback point created, a message will be displayed in the details pane of the Registration step for each server.

Rolling back to a previous rollback point

To rollback to a previous rollback point:

1. Right-click one of the rollback points and select Rollback.
2. The Rollback window displays the options for setting up the Rollback job.
   1. Preview: displays information about the rollback operation, including the exact steps that will be attempted:
      • the target device for the rollback
      • the selected rollback point’s name and creation date

      • (for the rpm-based rollback mechanism) an action step for each package that will be altered along with the corresponding operation (rollback or uninstall)

        (for yum history) an action step for the whole transaction with the corresponding operation (rollback) having the output from the yum history undo operation

      • the final action step, Registration, will update the installed packages list.
   2. Scheduling: specify if you want to start the job immediately or at a scheduled date and time.
   3. Notifications: set up email notifications in case of failure or success.
   4. Status:displays detailed progress about the rollback process.

   Similar to the preview step, the Status view displays an action step for each of the packages being rolled back or uninstalled, for the rpm-based rollback mechanism, or an action step for the whole transaction that is being rolled back, for yum history, including Registration as a last step.

3. As the rollback task is run, the steps will be displayed in detail in the status window.

Deleting a rollback point (not available for Yum history)

To delete a rollback point:

1. Right-click one of the rollback points and select Delete.
2. Accept the confirmation dialog window to begin the operation.
3. After the operation is finished the table items will be automatically refreshed.

Viewing details of a rollback point (Only for Yum history)

In the server browser window, select Inventory > Rollback Points.

1. The name of the rollback point is composed of the action(s) that were performed in the transaction (see below) and the number of packages that were involved.
2. Select a rollback point from the list. This will show the details of the selected rollback point in a separate Details panel.

The details of a rollback point consist of the packages involved in the rollback operation and their corresponding action performed on them.

Due to technical limitations, the details content is trunked at 4000 characters.

One or more package actions can be performed in a transaction. In case of more, only the initials will be included in the rollback point name. For example, I , E,U if a transaction contains the actions Install, Erase and Update.

The transactions can include one or more of the following actions:

1. D or Downgrade - Package has been downgraded to an older version.
2. E or Erase - Package has been removed.
3. O or Obsoleting - Package has been marked as obsolete.
4. R or Reinstall - Package has been reinstalled.
5. U or Update - Package has been updated to a newer version.