All examples use fictional data: server beispielserver.example.com.
Starting Point
This morning, the daily health check on beispielserver reported:
=== Pending Patches ===
044_npppd
045_iked
The OpenBSD mailing list had already announced the patches. But the health check answers a different question: not “Which patches have been released?”, but “Is anything missing on this particular server?”
1. Check Pending Patches
ssh beispielserver
doas syspatch -c
The output confirms the health check report:
044_npppd
045_iked
2. Install Patches
doas syspatch
Get/Verify syspatch78-044_npppd.tgz 100%
Installing patch 044_npppd
Get/Verify syspatch78-045_iked.tgz 100%
Installing patch 045_iked
Errata can be reviewed under /var/syspatch
3. Verify the Result
doas syspatch -c
No more output - both patches are installed, nothing remains pending.
syspatch installs the updated binaries but does not automatically restart affected services. On beispielserver, npppd and iked were not running at the time of the patch (rcctl check iked / rcctl check npppd reported failed), so a restart was not an issue here. If the services are active on your systems, it is worth checking rcctl check <service> after patching and, if necessary, running rcctl restart <service>.
The Health Check Behind It
The small check already runs daily along with disk space, load, and service checks.
You can find the OpenBSD Health Check used here in the public Lazy Admin Tools Repository. The project is also available as a mirror on GitHub.
Result
Health check report → syspatch -c check → installation → empty syspatch -c check. Not a 2,000-word tutorial about syspatch, but the small operational experience around it.
