Security Patches
Flag VMs and containers with pending security updates.
Update Manager
Scans the VM/CT of Proxmox VE to find the available updates, security patches included. The module is read-only: it shows the pending updates and changes nothing.
Features
Section titled “Features”Update Inventory
Per VM/CT: pending normal updates, pending security updates, reboot required.
On-demand or scheduled
Trigger a run manually from the UI, or schedule recurring runs with a cron expression, using the built-in editor that shows a human-readable description and the next occurrence.
Check for updates without making system changes.
Export PDF / Excel
Download results as PDF (colored table with footer and page numbers) or Excel (autofilter-enabled sheet for slicing, pivoting and sharing). Format chosen from a split-button dropdown.
Parallel Scanning
The Max parallel requests setting (default 5) speeds up scans on large clusters; set to 1 to fall back to sequential mode. A failure on one resource is isolated to that item: the rest of the scan keeps running.
Notifier Integration
Attach the generated report to a notification using any of the configured Notifier channels: handy for nightly cron-based runs.
Why centralise update checks when apt list --upgradable already exists?
One view, every VM
See the pending updates of all running VMs and CTs of the cluster on a single page. You need no SSH session per host and no chain of scripts.
Security signal isolated
Each row has separate Normal, Security and Reboot required flags, so the pending security updates are not hidden among the others.
Read-only by design
The module never installs an update. It is safe to schedule and leave running: you decide when and how to apply the updates.
One broken VM doesn't break the run
An SSH timeout, a missing agent or a parse error affects only that guest. The rest of the scan completes and the report shows the failure.
Sections
Section titled “Sections”- Overview: introduction to the module and its dashboard widget
- Scans: live grid of every running VM/CT, with its current scan status (InScan / Ok / InError / Cancelled), its available updates (Normal / Security) and its reboot required flag. From this page you start a new scan and download the report as PDF or Excel. See Scanning
Scanning
Section titled “Scanning”A scan covers the guests that are running when it starts: stopped guests are not listed. The module runs a search script inside each guest: the Linux script or the Windows script, depending on the guest. From the script it reads back whether normal updates, security updates or a reboot are pending. The default Linux script recognises the common package managers (apt, dnf, yum, zypper, apk, pacman and others).
| Action | What it does |
|---|---|
| Scan | Starts a scan immediately in the background. The grid updates while the guests are scanned |
| Download | Split button: downloads the current result as PDF or Excel. Disabled until a result exists |
The scan appears in the global Task Tracker and can be cancelled from there. When you cancel, the guests not scanned yet are marked Cancelled. A cancelled scan sends no notification, is recorded in the audit log as not successful, and its task log ends with Scan cancelled: no notification sent.
A guest that fails is marked InError, with the message in the Error column. The scan continues with the other guests.
No scan history: Only the result of the last scan is available. It is kept in the application cache until the next scan replaces it (at most 30 days) and is not stored in the database. To see data again, run a new scan or wait for the scheduled one.
Widgets
Section titled “Widgets”| Widget | Content |
|---|---|
| Status | Result of the last scan: number of guests up to date, with updates to install and in error, and the time of the scan |
Settings
Section titled “Settings”Show all settings
Enable scheduling
Turns the scheduled scan on or off. With it off nothing runs by itself on the cluster; Scan, started by hand, stays available
- Default: off
Cron Schedule
When the scheduled scan runs (default: every 12 hours)
Max parallel requests
Maximum number of VM/CT scanned at the same time (1 = sequential, range 1-50). Lower it if the nodes get overloaded during a scan
- Default: 5
Script Windows Search Update
Script run inside Windows guests to detect updates. The refresh button restores the default script
- Default: bundled PowerShell
Script Linux Search Update
Script run inside Linux guests / LXC to detect updates. The refresh button restores the default script
- Default: bundled bash
Notifier
Notifier configurations that receive the PDF report at the end of a scan. The notification is sent only when at least one guest has pending updates or needs a reboot
Permissions
Section titled “Permissions”Assign these to a role under Security.
| Permission | Allows |
|---|---|
| Update Manager | Open the module and its Overview page |
| Scans | Open the page with that name (one permission per page) |
| Status | Use the dashboard widget |
| Scan: Scan | Use the Scan button |
| Scan: Export | Download the scan as PDF or Excel |
| Edit Settings | Change the module settings |
The built-in role of the module includes all of them. A custom role has to be given them explicitly: without the permission the button is hidden.
The module also follows the cluster permissions (VM: Read and Node: Read, see Security):
- Scans lists only the guests and nodes the user can read.
- Scan, which runs a command in every running guest, and the report download, which lists them all, need Read on every VM, node and storage of the cluster: without it the buttons are hidden.
- The widget and the Overview count all the guests of a cluster: they are shown only on the clusters where the user can read every VM, node and storage.
Requirements
SSH SSH access to the cluster nodes is required. Configure it under Admin Area → Proxmox VE Clusters → (cluster) → SSH Credentials: see SSH Configuration.
A PAM user (e.g. root@pam) is needed only when the SSH auth method is Same as WEB API.
Proxmox VE privileges: the base (PVEAuditor) is enough. It works over SSH.
The base and the rules common to all modules are in Proxmox VE Permissions.
