HP-UX Patch Ratings

HP-UX patches have a corresponding quality rating called the HP rating. HP assigns a patch rating of 1 (numeral or star) to each HP-UX patch when it is released. Over time, HP may update the rating value to 2 or 3 (numeral or stars) to convey increased confidence in the patch. The higher the rating, the lower the risk of side effects and the more suitable the patch is for mission-critical environments.

You can use the ITRC's Patch Database to find the rating value for a specific patch. The ITRC graphically represents a patch's rating by displaying one to three stars beside the patch ID in the results of a patch search. “Obtaining Information Using the ITRC” provides details on how to do this.

If HP learns of a problem caused by or exposed by an HP-UX patch, HP issues a patch warning describing the problem and ceases recommending the patch, but does not change the patch rating. If a patch has a warning associated with it, you will no longer be able to view the rating on the ITRC's Patch Database. For more information on patch warnings, see “Patch Warnings”.

The following rating related information pertains only to patches that have no associated warnings.

HP Patch Rating of 1

Although these patches have passed rigorous prerelease testing, HP recommends that you use these patches only if all of the following conditions are true:

• If you are in a reactive patching situation.

• The highest-rated patch that addresses the problem is rated 1.

• You cannot wait for the patch to increase to a higher rating.

Whenever possible, you should wait until the patch gains more exposure and achieves a rating of 2 or 3. For more information on reactive and proactive patching, see Chapter 4: “Patch Management Overview”.

Rating Details

The following list provides more details about patch ratings of 1:

• Upon release, patches are assigned a rating of 1.

• These patches have successfully completed internal testing by HP.

• Because they are new, these patches have an inherent level of risk associated with them that you may find unacceptable. However, they are made available in case you are willing to accept the increased risk because the patch resolves a specific issue on a system.

• If you choose to use one of these patches, you should evaluate and test it carefully prior to deployment on a system.

HP Patch Rating of 2

HP recommends that you use patches rated 2 for both proactive and reactive patching and when a patch rated 3 is not available.

Patches rated 1 may be upgraded to a rating of 2 on any given day (based on the amount of customer exposure). Therefore, if you chose to defer patch installation to wait for a patch rating to be upgraded to a rating of 2, you can check for this upgrade on a daily basis.

Rating Details

The following list provides more details on patch ratings of 2:

• These patches have met minimum criteria based on the number of days available to customers and the number of times downloaded with no problems reported.

• These patches may appear in the recommended column of the ITRC's Patch Database patch search results page (provided they have no associated patch warnings).

HP Patch Rating of 3

Rating 3 is the highest rating HP assigns to a patch. These patches represent the lowest level of risk. HP recommends you use patches rated 3 whenever possible for both proactive and reactive patching.

If you are waiting for a specific patch to reach a rating of 3, check the patch quarterly to determine whether it has been promoted from a rating of 2 to a rating of 3.

Rating Details

The following list provides more details on patch ratings of 3:

• These patches have passed more levels of testing than patches rated 1 or 2.

• These patches may appear in the recommended column of the ITRC's Patch Database patch search results page (provided they have no associated patch warnings).