AWS systems-manager documentation change
Summary
Added macOS support documentation and troubleshooting guidance for concurrent patching lock errors. Removed outdated concurrent operation CLI check and refocused on lock file conflicts.
Security assessment
The changes address operational stability by preventing concurrent patching operations via lock files, but there is no evidence of addressing a specific security vulnerability. The documentation explains error resolution for scheduling conflicts rather than patching security flaws.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-troubleshooting.md b/systems-manager/latest/userguide/patch-manager-troubleshooting.md index 6db9db8a1..5594b480f 100644 --- a//systems-manager/latest/userguide/patch-manager-troubleshooting.md +++ b//systems-manager/latest/userguide/patch-manager-troubleshooting.md @@ -5 +5 @@ -Issue: "Invoke-PatchBaselineOperation : Access Denied" error or "Unable to download file from S3" error for baseline_overrides.jsonIssue: Patching fails without an apparent cause or error messageIssue: Unexpected patch compliance resultsErrors when running AWS-RunPatchBaseline on LinuxErrors when running AWS-RunPatchBaseline on Windows ServerUsing AWS Support Automation runbooksContacting AWS Support +Issue: "Invoke-PatchBaselineOperation : Access Denied" error or "Unable to download file from S3" error for baseline_overrides.jsonIssue: Patching fails without an apparent cause or error messageIssue: Unexpected patch compliance resultsErrors when running AWS-RunPatchBaseline on LinuxErrors when running AWS-RunPatchBaseline on Windows ServerErrors when running AWS-RunPatchBaseline on macOSUsing AWS Support Automation runbooksContacting AWS Support @@ -24,0 +25,2 @@ Use the following information to help you troubleshoot problems with Patch Manag + * Errors when running AWS-RunPatchBaseline on macOS + @@ -77,15 +78,0 @@ When you create a patch policy, an Amazon S3 bucket is also created to store the -**Possible cause** : If more than one invocation of `AWS-RunPatchBaseline` occurs at a time, they can conflict with one another, causing patching tasks to fail. This might not be indicated in patching logs. - -To check whether concurrent patching operations might have interrupted each other, review the command history in Run Command, a tool in AWS Systems Manager. For a managed node with a patching failure, check to see if multiple operations attempted to patch the machine within 2 minutes of one another. This scenario can sometimes cause a failure. - -You can also use the AWS Command Line Interface (AWS CLI) to check for concurrent patching attempts by using the following command. Replace the value for `node-id` with the ID for your managed node. - - - aws ssm list-commands \ - --filter "key=DocumentName,value=AWS-RunPatchBaseline" \ - --query 'Commands[*].{CommandId:CommandId,RequestedDateTime:RequestedDateTime,Status:Status}' \ - --instance-id node-id \ - --output table - -**Solution** : If you determine that patching failed because of competing patching operations on the same managed node, adjust your patching configurations to avoid this occurring again. For example, if two maintenance windows specify overlapping patching times, remove or revise one of them. If a maintenance windows specifies one patching operation, but a patch policy specifies a different one for the same time, consider removing the task from the maintenance window. - @@ -96 +83 @@ You can also use the AWS Command Line Interface (AWS CLI) to check for concurren -If you determine that conflicting patching operations or external reboots weren't the cause of the failure in this scenario, we recommend contacting AWS Support. +If you determine that external reboots weren't the cause of the failure in this scenario, we recommend contacting AWS Support. @@ -160,0 +148,2 @@ When a `Scan` operation runs, it overwrites the compliance details from the most + * Issue: Cannot acquire lock. Another patching operation is in progress. + @@ -587,0 +577,20 @@ When Patch Manager applies locks for rejected patches during `Install` operation +### Issue: Cannot acquire lock. Another patching operation is in progress. + +**Problem** : When you run `AWS-RunPatchBaseline`, patching fails with error code 4 and the following error message. + + + [ERROR]: Cannot acquire lock on /var/log/amazon/ssm/patch-baseline-concurrent.lock. Another patching operation is in progress. + +**Cause** : This error occurs when multiple patching operations are attempting to run on the same managed node at the same time. The lock file prevents concurrent patching operations to avoid conflicts and ensure system stability. + +**Solution** : Ensure that patching operations are not scheduled to run at the same time on the same managed node. Review the following configurations to identify and resolve scheduling conflicts: + + * **Patch policies** : Check your Quick Setup patch policy configurations to ensure they don't overlap with other patching schedules. + + * **Maintenance windows** : Review your maintenance window associations to verify that multiple windows aren't targeting the same managed nodes with patching tasks at overlapping times. + + * **Manual Patch now operations** : Avoid initiating manual **Patch now** operations while scheduled patching is in progress. + + + + @@ -601,0 +611,2 @@ When Patch Manager applies locks for rejected patches during `Install` operation + * Issue: Cannot acquire lock. Another patching operation is in progress. + @@ -827,0 +839,49 @@ The following are some common causes and their solutions. +### Issue: Cannot acquire lock. Another patching operation is in progress. + +**Problem** : When you run `AWS-RunPatchBaseline`, patching fails with error code 4 and the following error message. + + + Cannot acquire lock on C:\ProgramData\Amazon\SSM\patch-baseline-concurrent.lock. Another patching operation is in progress. + +**Cause** : This error occurs when multiple patching operations are attempting to run on the same managed node at the same time. The lock file prevents concurrent patching operations to avoid conflicts and ensure system stability. + +**Solution** : Ensure that patching operations are not scheduled to run at the same time on the same managed node. Review the following configurations to identify and resolve scheduling conflicts: + + * **Patch policies** : Check your Quick Setup patch policy configurations to ensure they don't overlap with other patching schedules. + + * **Maintenance windows** : Review your maintenance window associations to verify that multiple windows aren't targeting the same managed nodes with patching tasks at overlapping times. + + * **Manual Patch now operations** : Avoid initiating manual **Patch now** operations while scheduled patching is in progress. + + + + +## Errors when running `AWS-RunPatchBaseline` on macOS + +###### Topics + + * Issue: Cannot acquire lock. Another patching operation is in progress. + + + + +### Issue: Cannot acquire lock. Another patching operation is in progress. + +**Problem** : When you run `AWS-RunPatchBaseline`, patching fails with error code 4 and the following error message. + + + [ERROR]: Cannot acquire lock on /var/log/amazon/ssm/patch-baseline-concurrent.lock. Another patching operation is in progress. + +**Cause** : This error occurs when multiple patching operations are attempting to run on the same managed node at the same time. The lock file prevents concurrent patching operations to avoid conflicts and ensure system stability. + +**Solution** : Ensure that patching operations are not scheduled to run at the same time on the same managed node. Review the following configurations to identify and resolve scheduling conflicts: + + * **Patch policies** : Check your Quick Setup patch policy configurations to ensure they don't overlap with other patching schedules. + + * **Maintenance windows** : Review your maintenance window associations to verify that multiple windows aren't targeting the same managed nodes with patching tasks at overlapping times. + + * **Manual Patch now operations** : Avoid initiating manual **Patch now** operations while scheduled patching is in progress. + + + +