Applying selected firmware updates using compliance policies

After Lenovo XClarity Administrator identifies a device as not compliant, you can manually apply and activate the firmware updates on these managed devices. You can choose to apply and activate all firmware updates that apply to a firmware-compliance policy or only specific firmware updates in a policy. Only downloaded firmware updates are applied.

Learn more

Before you begin

Read the firmware-update considerations before you attempt to update firmware on your managed devices (see Firmware-update considerations).
Initially, devices that are not supported for updates are hidden from the view. Devices that are not supported cannot be selected for updates.
By default, all detected components are listed as available for applying updates; however, down-level firmware might prevent a component from appearing in inventory or reporting full-version information. To list all policy-based packages that are available for you to apply updates, click All Actions > Global Settings, and selecting Enhanced Support for Down-Level Devices. When this option is selected, Other Available Software is listed in the Installed Version column for undetected devices. For more information, see Configuring global firmware-update settings.
Note
- The global settings cannot be changed when updates to managed devices are in progress.
- It takes a few minutes to generate the additional options. After a few moments, you might need to click the Refresh icon () to refresh the table.
Ensure that no jobs are currently running on the target server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
When enabled, the Wake-on-LAN boot option can interfere with XClarity Administrator operations that power off the server, including firmware updates if there is a Wake-on-LAN client in your network that issues Wake on Magic Packet commands.
Ensure that power-on password and setup password are both disabled. If these passwords are enable and the servers are restarted automatically, the firmware update will fail during the readiness check.

Ensure that the firmware-updates repository contains the firmware packages that you intend to deploy. If not, refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).
Note
When XClarity Administrator is initially installed, the product catalog and the repository are empty.
Attention
If you intend to install prerequisite firmware, ensure that the correct version of the prerequisite firmware is downloaded in the repository. The prerequisite firmware versions are available in the package metadata (xml) and change history (chg) files.
In some cases, multiple versions might be needed to update firmware, and all versions would need to be downloaded to the repository. For example, to upgrade the IBM FC5022 SAN scalable switch from v7.4.0a to v8.2.0a, you must first install v8.0.1-pha, then v8.1.1, and then v8.2.0a. All three versions must be in repository to update the switch to v8.2.0a.
Typically, devices must be restarted to activate the firmware update. If you choose to restart the device during the update process (immediate activation), ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.

For ThinkSystem SR635 and SR655 servers, you can use this traditional update function to apply only baseboard management controller and UEFI firmware updates. Management-controller firmware version AMBT10M or later is required, and UEFI firmware version CFE114L or later is required. To update all components (including the management controller, UEFI, disk drives, and IO options), use the bundle update function (see Applying ThinkSystem SR635/SR655 firmware updates through a BoMC image using compliance policies).

About this task

You can update selected firmware on a maximum of 50 devices at one time. If you choose to update selected firmware on more than 50 devices, the remaining devices are queued. A queued device is taken off the selected-firmware update queue when either the activation completes on an updated device or an updated device is placed in the Pending Maintenance Mode state (if a restart is required on that device). When a device in the Pending Maintenance Mode state is restarted, the device boots into Maintenance Mode and continues the update process, even if the maximum number of firmware updates is already in progress.
You can apply and activate firmware that is later than the currently installed firmware.
You can choose to apply all updates for a specific device. However, you can also choose to expand a device to specify updates for specific components, such as the baseboard management controller or UEFI.
If you choose to install a firmware-update package that contains updates for multiple components, all components to which the update package applies are updated.

Procedure

To apply and activate updates on managed devices, complete the following steps.

From the XClarity Administrator menu bar, click Provisioning > Firmware Updates: Apply/Activate. The Firmware Updates: Apply/Activate page is displayed.
Click the Update with Policy tab.
Select one or more devices and devices to which firmware updates are to be applied.
You can sort the table columns to make it easier to find specific servers. In addition, you can filter the list of displayed devices by selecting an option in the Show menu to list only devices in a specific chassis, rack, or group, by entering text (such as a name or IP address) in the Filter field, or by clicking the following icons to list only devices with a specific status.
- Hide compliant devices icon ()
- Hide non-compliant devices status icon ()
- Hide devices without an assigned compliance policy icon ()
- Hide devices not being monitored icon ()
- Hide devices with firmware pending activation icon ()
- Hide devices with compliance errors icon ()
- Hide devices not supported for updates icon ()
- Hide devices undergoing firmware updates icon ()
- Hide options that require a restart to update firmware icon ()
The Groups column indicates the groups of which each device is a member. You can hover over the Groups column to get a complete list of groups, by group type
The Installed Version column indicates the installed firmware version, compliance status, or device status.
The compliance status can be one of the following:
- Compliant
- Compliance Error
- Not Compliant
- No Compliance Policy Set
- Not Monitored
The device status can be one of the following:
- Updates Not Supported
- Update in Progress
Note
If the installed firmware version is pending activation, "(Pending Activation)" is appended to the installed firmware version or compliance status of each applicable device, for example "2.20 / A9E12EUS (Pending Activation)." To see the pending-activation status, the following firmware version must be installed on the primary baseboard management controller in the server.
- IMM2: TCOO46F, TCOO46E, or later (depending on the platform)
- XCC: CDI328M, PSI316N, TEI334I, or later (depending on the platform)
Click the Perform Updates icon (). The Update Summary dialog is displayed.
Select one of the following update rules
- Stop all updates on error. If an error occurs while updating any of the components (such as an adapter or management controller) in the target device, the firmware-update process stops for all selected devices in the current firmware-update job. In this case, none of the updates in the update package for the device are applied. The current firmware that is installed on all selected systems remains in effect.
- Continue on error. If an error occurs while updating any of the devices in the device, the firmware-update process does not update the firmware for that specific device; however, the firmware-update process continues to update the other devices in the device and continues to update all other devices in the current firmware-update job.
- Continue to next system on error. If an error occurs while updating any of the devices in the device, the firmware-update process stops all attempts to update the firmware for that specific device, so the current firmware that is installed on that device remains in effect. The firmware-update process continues to update all other devices in the current firmware-update job.
Select one of the following activation rules:
- Immediate activation. The firmware update process starts immediately. During the update process, the device might be restarted automatically several times until the entire update process is complete. Ensure that you quiesce all applications on the device before you proceed.
- Prioritized activation. The firmware update process starts immediately. Firmware updates on the baseboard management controller are activated immediately; all other firmware updates are firmware updates are activated the next time the device is restarted. Additional restarts are then performed until the update operation completes. This rule is supported only for servers.
  For ThinkSystem V4 servers, firmware updates on the management controller are activated immediately; other firmware updates are downloaded to the server, and applied and activated the next time the devices is restarted. XClarity Administrator does not perform additional power actions after the update process on device is complete.
  An event is raised when the status changes to Pending Firmware Maintenance Mode to notify you when the server needs to be restarted.
- Delayed activation. The firmware update process starts immediately; however, some but not all update operations are performed. Devices must be manually restarted to continue the update process. Additional restarts are then performed until the update operation completes.
  An event is raised when the status changes to Pending Firmware Maintenance Mode to notify you when the server needs to be restarted.
  If a device restarts for any reason, the delayed update process completes.
  This activation rule is supported for only servers and rack switches. CMMs and Flex switches are immediately activated, regardless of this setting.
  Note
  For ThinkSystem V4 servers:
  The applicable update packages are downloaded to the server, but the update process does not start until the next time the server is restarted. No additional power actions are performed after the update process is complete.
  Updating firmware on the backup management controller is not supported. If you attempt to update firmware on the backup management controller, the update job for the backup management controller is skipped with warning.
  The delayed update process completes when the device is restarted for any reason (including a manual restart). There is no time limit when the server must be restarted.
  XClarity Administrator can apply updates with delayed activation for up to 50 devices at one time. If you attempt to apply updates with delayed activation for more than 50 devices, the remaining devices are queued. A device comes off the queue when a device being updated is placed in the Pending Firmware Maintenance Mode state.
  Important
  If XClarity Administrator is restarted during the update job, the update job will stop with error.
  If a server in the Pending Firmware Maintenance Mode state is restarted while XClarity Administrator is down or unreachable, the server boots to the BMU, but because XClarity Administrator cannot connect to the BMU and times out after 60 seconds, the system power status is restored by the baseboard management controller (powers off if it was off, restarts if it was powered on).
- OnReset activation. The applicable update packages are downloaded to the server, but the update process does not start until the next time the server is restarted. Additional restarts are then performed until the update operation completes.
  This activation rule is supported only for ThinkSystem v4 servers.
  Note
  Updating firmware on the backup management controller is not supported. If you attempt to update firmware on the backup management controller, the update job for the backup management controller is skipped with warning.
  The update job can be canceled until you restart the device.
  An event is raised when the status changes to Pending Restart to notify you that the server needs to be restarted.
Optional: Select Force update to update firmware on the selected components even if the firmware level is up to date or to apply a firmware update that is earlier than the one currently installed on the selected components.
Note
You can apply earlier version of firmware to device options, adapters, and drives that support down-leveling. See your hardware documentation to determine if down-leveling is supported.
Optional: Clear Install prerequisite firmware if you do not want to install prerequisite firmware. Prerequisite firmware is installed by default.
Note
When using Delayed Activation or Prioritized Activation for prerequisite firmware updates, you might need to restart the server to activate the prerequisite firmware. After the initial restart, the remaining firmware updates are installed using Immediate Activation.
Optional: If you selected Immediate activation, select Memory Test to run a memory test after firmware update completes if server is reboot during update.
This option is supported for ThinkSystem v1 and v2 servers (excluding ThinkSystem SR250 V2, SR258 V2, ST250 V2, ST258 V2, SR635, SR645, SR655, SR665 servers).
Click Perform Update to update immediately, or click Schedule to schedule this update to run at a later time.
If needed, you can perform power actions on the managed devices. The power actions are useful when Delayed Activation is selected and you want the updates to continue when the device is waiting in the Pending Maintenance state. To perform a power action on a managed device from this page, click All Actions > Power Actions, and then click one of the following power actions.
- Power on
- Power down OS and power off
- Power off
- Shut down OS and restart
- Restart

After you finish

When applying a firmware update, if the server fails to enter maintenance mode, attempt to apply the update again.

If updates were not completed successfully, see Firmware update and repository issues for troubleshooting and corrective actions.

From the Firmware Updates: Apply/Activate page, you can perform the following actions:

Export firmware and compliance information for each managed device by clicking All Actions > Export View as CSV.
Note
The CSV file contains only filtered information in the current view. Information that is filtered out of the view and information in hidden columns are not included.
Cancel an update that is being applied to a device by selecting the device and clicking the Cancel Update icon ().
Note
You can cancel firmware updates that are in the queue to start. After the update process starts, the firmware update is cancelable only when the update process is performing a task other than applying the update, such as changing to maintenance mode or restarting the device.
If delayed activation or prioritized activation is used during a BMU update and if you cancel the job before manually rebooting the device, and then reboot the device, the device does not boot into the BMU.
View the status of the firmware update directly from the Apply / Activate page in the Status column.
Monitor the status of the update process from the jobs log. From the Lenovo XClarity Administrator menu, click Monitoring > Jobs.
For more information about the jobs log, see Monitoring jobs .

When the firmware-update jobs are complete, you can verify that the devices are compliant by clicking Provisioning > Firmware Updates: Apply/Activate to go back to the Firmware Updates: Apply/Activate page, and then clicking the Refresh icon (). The current firmware version that is active on each device is listed in the Installed Version column.

Give documentation feedback