2.0 KiB
title
| title |
|---|
| WindowsUpdatesPending |
Meaning
The host has updates waiting for installation for longer than
updatePendingDuration, seven days by default. The alert is an info alert, its
value is the number of pending updates, and it needs the update collector,
which queries the Windows Update agent in the background at the interval of
its scrape setting. Updates waiting for uninstallation do not count. Prometheus counts the
duration and restores it after a restart shorter than its
--rules.alert.for-outage-tolerance, one hour by default; a longer outage or
a new server starts the wait again.
Impact
Security updates that wait longer than the patch window leave known vulnerabilities open. Other updates carry fixes for reliability problems. The host may also be waiting for a restart to finish an installation.
Diagnosis
-
List the pending updates with their category and severity:
windows_update_pending_info{job="windows_exporter", instance="<instance>", deployment_action="installation"}windows_update_pending_published_timestampshows how old each update is. -
On the host, check the update client and the last installation attempts:
Get-WindowsUpdateLog Get-WinEvent -LogName Microsoft-Windows-WindowsUpdateClient/Operational -MaxEvents 50 Get-CimInstance -Namespace root/cimv2 -ClassName Win32_QuickFixEngineering | Sort-Object InstalledOn -Descending | Select-Object -First 5 -
Check whether the host is in a maintenance window, a deferral period or a WSUS or Configuration Manager deployment that has not approved the updates yet, and whether a pending restart blocks the installation.
Mitigation
Install the updates in the next maintenance window, or approve them in the
update management tool. Restart the host if an installation waits for it.
Raise updatePendingDuration to the patch window of the environment if seven
days is shorter than the policy, or turn the alert off with
alerts+: { WindowsUpdatesPending: false } where another system tracks patch
compliance.