RHEL 8 dnf-automatic Timer Not Applying Security Updates

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Expected automatic patching does not occur, leaving hosts behind security baseline and audit deadlines.

Environment & Reproduction

Check configured dnf-automatic on RHEL 8 and compare package age against policy window.

Root Cause Analysis

Timer disabled, apply_updates set false, or email/report-only mode used unintentionally.

Quick Triage

Run systemctl status dnf-automatic.timer and review /etc/dnf/automatic.conf values.

Step-by-Step Diagnosis

Inspect last timer runs, parse journalctl -u dnf-automatic, and test repo access under timer context.

Solution – Primary Fix

Set apply_updates=True, enable and start dnf-automatic.timer, then verify next scheduled run.

Solution – Alternative Approaches

Use centralized patch orchestration via Ansible or Satellite for stricter maintenance windows.

Verification & Acceptance Criteria

Timer runs on schedule and security advisories are applied within policy-defined timeframe.

Rollback Plan

Disable timer and return to manual patch cycles if automation introduces operational conflicts.

Prevention & Hardening

Monitor timer health and report systems with stale package age beyond acceptable thresholds.

Related Errors & Cross-Refs

Related: timer not found, skipped runs, and unmet dependencies during unattended updates.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See RHEL 8 dnf-automatic configuration and security patch management docs.