How often to you update your important servers?

[netman4ttm]

This week I started updating my major servers. DNS BIND, Apache and Zimbra. Normally, I doggedly follow BIND and update religiously, but hold off on other servers like Apache unless a critical flaw is found.
I am amazed at the number of 1.2, 1.3 Apache servers still out on the Internet, servers that you would expect had at least been upgrade to 2.0.
As system administrator, I think that keeping systems updated is one of the most important aspects of the job.

Do you update only for flaws, or do you build it and forget it, or chase every update, staying on the leading edge.

[wige]

Thats nothing. I have found Windows NT 4.0 IIS servers within the past year. Thats what, 12 years past when MS stopped supporting them?

Internally, I wait about 24 hours for any patch for file servers and domain controllers, just in case issues with the patch come to light. Externally, for things like Apache, it depends on what the patch is for. If it is fixing a general security issue, such as a buffer overflow, I will apply the patch as soon as possible. For other issues (such as the TRACE and TRACK exploit) which can be mitigated through other means, I will apply the alternative fix and wait for the next stable release to patch.

[speed]

Pretty much continuously update with the latest patches, we owe it to our hosting clients to try and keep the servers up to date with patches and secure.

Kernels we hold off sometimes because they require a reboot, but it really depends on the flaw(s) fixed, anything major we update overnight when it's quiet.

[raj011]

After every one week.
Rocky
Drug Intervention Minnesota