Who needs to patch the hypervisor host and the virtual machines?
The hypervisor host and each guest operating system have separate patching requirements. Updating a host does not install updates inside its guests, and patching one guest does not maintain the underlying hardware or hypervisor. Assign responsibility through the actual service agreement and operating model, including firmware and management-controller maintenance.
Before you start
- A known host inventory and agreed responsibility for host and guest maintenance.
Instructions
1. Inventory affected guests before host maintenance
For a libvirt host, list all defined guests rather than only currently running ones. Record service owners, dependencies and which guests can migrate.
virsh --connect qemu:///system list --allStopped guests can still depend on host storage or scheduled startup behaviour. Account for them in the maintenance and recovery plan.
2. Plan the host sequence
Review the platform’s release notes and supported update path. Arrange supported guest migration or orderly shutdown where a host restart is required, and retain console access through the change.
3. Maintain guests and verify applications separately
Apply each guest’s supported OS and application update process within its own change window. After host maintenance, check storage, networks, time and guest state before declaring the service restored.
Check the result
- The host reports the intended supported version, required guests are healthy, and application-level checks pass. The responsibility record names who maintains every layer.
Troubleshooting
- The host update completed but an application is vulnerable
- Check the guest OS and application patch state independently.
- A guest does not restart after host maintenance
- Review autostart policy, available storage and boot errors through the hypervisor’s console.
- Ownership is unclear
- Resolve responsibility for host, guest and firmware work before scheduling changes; do not assume it from the server product name.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.