How to patch the OS under Red Hat satellite server

I am using Red hat Satellite 6.7 version.

OS info:

NAME="Red Hat Enterprise Linux Server" VERSION="7.8 (Maipo)"

I Know how to patch systems using Red Hat Satellite server.

But I do not know how to patch the OS under Red Hat Satellite server.

This is my server config right now.

[root@satellite ~]# subscription-manager config
[server] hostname = [subscription.rhsm.redhat.com]

Assume my satellite server URL is satellite.mycompany.com

My first question do I need to register my satellite server to itself like below to patch ?

[root@satellite ~]# subscription-manager config
[server] hostname = [satellite.mycompany.com]

Second question if I run yum update in satellite server I am getting below warning.

WARNING: Excluding 10771 packages due to foreman-protector.
Use foreman-maintain packages install/update <package>
to safely install packages without restrictions.
Use foreman-maintain upgrade run for full upgrade.

After searching I found this:

Previously, when using yum to update or install packages on the Satellite base operating system might also update the packages related to Red Hat Satellite and resulted in system inconsistency. With this release, Red Hat Satellite prevents users from installing and updating packages with yum.

So they gave the solution like this

satellite-maintain packages unlock
yum update
satellite-maintain packages lock
satellite-installer --upgrade

Is the above commands are proper ?

will satellite-installer --upgrade will upgrade satellite version also ?

I do not want to change satellite version , I just want to fix patches to base system.

2 Answers

Look at the manual section 11.5 Managing Packages on the Base Operating System of Satellite Server.

Typically your satellite server should be dedicated to satellite and all updates to OS packages should be managed with satellite-maintain package update. It's a packaged appliance this way.

But if you really really want to update via yum (say you have non-satellite packages installed) then you use the unlock and lock commands.

And no, satellite-installer --upgrade should not change the version number of your satellite installation. It is used to run checks for issues, to conform with the currently installed version, restart services etc. But you shouldn't run it by itself, use satellite-maintain packages update and let it take care of itself.

The GitHub project RedHatSatellite /capsule-maintainmight be a solution.

Among others, it can do:

• Target server(s) for Capsule installation/upgrade.
• You can run install/upgrade/update on one or more capsule servers at one time.

This might give you the flexibility and precision that you are looking for.