Anyone that follows me on the socials knows that I’m pretty keen on security.
Whilst all those other day-to-day things like performance and uptime etc etc are all important, rest assured; people will generally forgive you for being down for a while; they will forgive you for being slow for a while, but they will never forgive you for being hacked!
On one of my most recent tweets about ensuring that people stay patched and up to date, a friend in the community took me to task, saying, “It’s all well and good for Oracle to be publishing these critical patch update notes, advising us about the security issues that have been fixed, etc. But when I go to actually download the patches, it says the patch is not yet available. That’s incredibly frustrating because now we have to check all the time“.
That’s a fair point and we’re working hard to improve this situation because with AI agents now running amok, the frequency of security patches will surely increase not decrease in future.
But to help out this friend, I reached out to colleague Mike Dietrich for some advice on this and he pointed out to me that whether you’re using AutoUpgrade in its entire functionality to patch your database, or you are using it just to download patches, you can also use it as a simple mechanism of getting all the patches once they become available without needing to worry so much about the “when”.
When AutoUpgrade downloads patches it keeps a record of what it’s downloaded already and what it is yet to get. So you can simply schedule AutoUpgrade on a regular basis, say daily, and simply ask it to download the patch that you are after. Any patch that is available it will go grab and validate it, and any patch that is not yet available it will report in the log file. For example I put together a patch configuration file to download the AIX patches for 19.32 because I know that is still on the “Coming Soon” list.
global.global_log_dir=C:\oracle\autoupgrade\logsglobal.keystore=C:\oracle\autoupgrade\keystoreglobal.folder=C:\oracle\autoupgrade\patches.aixpatch1.target_version=19patch1.platform=AIX.X64patch1.log_dir=C:\oracle\autoupgrade\logspatch1.patch=RU:19.32,OPATCH,OJVM
When I run it, we can see that auto upgrade initially downloaded just OPatch and the OJVM update. However, it did not get release update 19.32 because it is not ready yet.
C:\oracle\autoupgrade>java -jar autoupgrade.jar -config patch.config -patch -mode downloadAutoUpgrade Patching 26.6.260807 launched with default internal optionsProcessing config file ...Loading AutoUpgrade Patching keystoreAutoUpgrade Patching keystore is loadedConnected to MOS - Searching for specified patchesRelease Update 19.32 is unavailable for download for the job with prefix patch1. AutoUpgrade Patching continues to download the remaining requested patches.------------------------------------------------------Downloading files to C:\oracle\autoupgrade\patches.aix------------------------------------------------------OPatch 12.2.0.1.52 for DB 19.0.0.0.0 (Aug 2026) File: p6880880_190000_AIX64-5L.zip - VALIDATEDOJVM RELEASE UPDATE 19.32.0.0.0 File: p39222882_190000_AIX64-5L.zip - VALIDATED------------------------------------------------------
If I run the same job the next day, it will check once again, and skip any patches already download, as evidenced by the “LOCATED” tag.
C:\oracle\autoupgrade>java -jar autoupgrade.jar -config patch.config -patch -mode downloadAutoUpgrade Patching 26.6.260807 launched with default internal optionsProcessing config file ...Loading AutoUpgrade Patching keystoreAutoUpgrade Patching keystore is loadedConnected to MOS - Searching for specified patchesRelease Update 19.32 is unavailable for download for the job with prefix patch1. AutoUpgrade Patching continues to download the remaining requested patches.------------------------------------------------------Downloading files to C:\oracle\autoupgrade\patches.aix------------------------------------------------------OPatch 12.2.0.1.52 for DB 19.0.0.0.0 (Aug 2026) File: p6880880_190000_AIX64-5L.zip - LOCATEDOJVM RELEASE UPDATE 19.32.0.0.0 File: p39222882_190000_AIX64-5L.zip - LOCATED------------------------------------------------------
With that in mind, it’s relatively easy to set up a simple job that runs, say, every day and simply ‘grep’s with the appropriate terms in the standard output and you can use that to know when a patch is available.
C:\oracle\autoupgrade>java -jar autoupgrade_fix.jar ... > autoupgrade.logC:\oracle\autoupgrade>egrep '(LOCATED|VALIDATED|unavailable)' autoupgrade.logRelease Update 19.32 is unavailable for download for the job with prefix patch1. AutoUpgrade Patching continues to download the remaining requested patches. File: p6880880_190000_AIX64-5L.zip - LOCATED File: p39222882_190000_AIX64-5L.zip - VALIDATED
Whether you’re on Windows or on Unix, you could easily throw together a small shell script which simply looks for the word “unavailable” and if it is not discovered in the patch output, then you throw an email to administrators saying there’s a good chance that everything you want is now available and you can jump in as make your system more secure!
Alternatively, if you’re one of the cool kids you could get your favourite agent to handle this whilst you walk your dog 🙂
╭────────────────────────────────────────────────────╮│ >_ OpenAI Codex (v0.146.1) ││ ││ model: gpt-5.6-sol /model to change ││ directory: C:\oracle\autoupgrade │╰────────────────────────────────────────────────────╯› Work autonomously on this task. Loop: 1. Run: autoupgrade.sh 2. Inspect the output. 3. If the output contains "unavailable", consider this a failure, otherwise deem it a success. 4. If this was a failure, sleep for 12 hours and try again. 5. Is this was a success, Slack me to let me know 6. Repeat until this is successful. Stop after 30 days of failures, and Slack me to let me know. gpt-5.6-sol · C:\oracle\autoupgrade
Another very cool use for AutoUpgrade. Happy upgrading!
Leave a Reply