We have the unattended-upgrades package upgrading our servers with security upgrades every Monday and it works great. Today though, it upgraded all of our servers with a new version of PHP5. Because we have moved the default PHP5-FPM configuration file, apt complains that the file has been moved, and what would we like to do (Install new version, keep old version, show differences, start shell) about it. Since unattended-upgrades didn't know how to deal with this, it just aborted and we were left with dozens of machines down until PHP5-FPM was restarted by monitoring.

So the question is - How can we make sure unattended-upgrades can handle this situation when it happens next time? We'd like to keep our currently installed version always. I tried googling but came up empty.

  • It kind of shocks me that your distro has a package that encourages unattended upgrades. Whoever is your sysadmin should be attending to the upgrades so that such situations never happen. I am unfamiliar with the package, however, so I cannot offer much advice on working around having a responsible sysadmin. – HalosGhost Jun 23 '14 at 16:34
  • 4
    The snide comment is unnecessary, don't you think? The package is very well known in the Debian community we use it on around 300 servers and have never had a problem until today. There is no reason to insult the administrator - You have no idea what policies, politics, and workloads he may be dealing with. THe package is configured to install only critical security updates, has NEVER had an issue, and worked great today as well, save for the fact that it didn't know what to do with that prompt. If you don't have anything to contribute except to insult the maintainer of the system, leave. – Kevin Jun 23 '14 at 17:23
  • I really wasn't trying to be rude or snide, so if that's how my comment came across, I apologize. I was genuinely remarking that maintaining systems across a network through upgrades is a standard part of a sysadmin's job. – HalosGhost Jun 23 '14 at 17:24
  • 2
    And the sysadmin is maintaining upgrades through the use of a well known, well maintained, debian endorsed upgrades package. Do you expect him to log in to each system individually and babysit the update each week? Across 300 servers? For this one client? That's ludicrous. – Kevin Jun 23 '14 at 17:30
  • 2
    What if the changes are required? Like a config fix to a security issue. You don't want to silently changes like that. – Matt Jun 23 '14 at 18:39
up vote 19 down vote accepted

I also want to keep original config files while doing automatic updates. You can add the following to /etc/apt/apt.conf.d/50unattended-upgrades

Dpkg::Options {
   "--force-confdef";
   "--force-confold";
};

See here for a good explanation of the options: http://raphaelhertzog.com/2010/09/21/debian-conffile-configuration-file-managed-by-dpkg/

  • 1
    Would that not potentially break packages? If an update introduces a new syntax, for example, but the configuration cannot be updated to the new syntax. – Rolf Mar 16 at 9:59

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.