Release to master

.done.txt

@@ -53,3 +53,4 @@ x 2018-08-09 2018-08-09 security issues with the yum_params options
 x 2018-08-10 How many kernels should be installed? @Questions
 x 2018-08-10 Should we check that the kernel version installed is the same as the one running? @Questions
 x 2018-08-10 2018-08-10 Get rid of awk and grep
+x 2018-08-10 Do we need to ensure the state of the yum config on the servers prior to patching? @Questions

.todo.txt

@@ -1,4 +1,3 @@
-Do we need to ensure the state of the yum config on the servers prior to patching? @Questions
 Should we ensure that the last puppet run was green before continuing? @Questions
 Should we ensure that the last puppet run was within X hours before starting patching? @Questions
 Should we do a puppet run prior to kicking off the patching to ensure state? @Questions

examples/running_patching_and_capturing_json_output.md

@@ -1,5 +1,15 @@
 # Patch nodes and capture live json output
 
+## Selecting the nodes to patch
+You can use the query parameter to `puppet task` to determine which nodes you wish to act upon.  The easiest example of this is to limit the patching to just nodes assigned to the 'Week3' patch window.:
+
+```bash
+puppet task run os_patching::patch_server --query='nodes[certname] { facts.os_patching.patch_window = "Week3" }'
+```
+
+More details on using queries within tasks can [be found on Puppet's website](https://puppet.com/docs/pe/2018.1/running_tasks_from_the_command_line.html#task-8683)
+
+## Capturing and parsing resuls
 If you want to patch using a script which will parse the results, you can do something similar to this:
 
 ```bash

files/os_patching_fact_generation.sh

@@ -5,6 +5,16 @@
 
 PATH=/usr/bin:/usr/sbin:/bin:/usr/local/bin
 
+LOCKFILE=/var/run/os_patching_fact_generation.lock
+
+if [ -f "$LOCKFILE" ]
+then
+  echo "Locked, exiting" >&2
+  exit 0
+else
+  echo "$$" > $LOCKFILE
+fi
+
 case $(/usr/local/bin/facter osfamily) in
   RedHat)
     PKGS=$(yum -q check-update | awk '/^[a-z]/ {print $1}')
@@ -15,6 +25,7 @@ case $(/usr/local/bin/facter osfamily) in
     SECPKGS=$(apt upgrade -s 2>/dev/null | awk '$1 == "Inst" && /security/ {print $2}')
   ;;
   *)
+    rm $LOCKFILE
     exit 1
   ;;
 esac
@@ -26,6 +37,7 @@ SECUPDATEFILE="$DATADIR/security_package_updates"
 if [ ! -d "${DATADIR}" ]
 then
   /usr/bin/logger -p error -t os_patching_fact_generation.sh "Can't find ${DATADIR}, exiting"
+  rm $LOCKFILE
   exit 1
 fi
 
@@ -41,19 +53,35 @@ do
   echo "$UPDATE" >> ${SECUPDATEFILE} || exit 1
 done
 
-if [ -f '/bin/needs-restarting' ]
+if [ -f '/usr/bin/needs-restarting' ]
 then
-  /bin/needs-restarting -r 2>/dev/null 1>/dev/null
-  if [ $? -gt 0 ]
-  then
-    echo "true" > /etc/os_patching/reboot_required
-  else
-    echo "false" > /etc/os_patching/reboot_required
-  fi
-  /bin/needs-restarting 2>/dev/null >/etc/os_patching/apps_to_restart
+  case $(facter os.release.major) in
+    7)
+      /usr/bin/needs-restarting -r 2>/dev/null 1>/dev/null
+      if [ $? -gt 0 ]
+      then
+        echo "true" > /etc/os_patching/reboot_required
+      else
+        echo "false" > /etc/os_patching/reboot_required
+      fi
+      /usr/bin/needs-restarting 2>/dev/null >/etc/os_patching/apps_to_restart
+    ;;
+    6)
+      OUTPUT=`/usr/bin/needs-restarting`
+      if [ -n "$OUTPUT" ]
+      then
+        echo "true" > /etc/os_patching/reboot_required
+        /usr/bin/needs-restarting > /etc/os_patching/apps_to_restart
+      else
+        echo "false" > /etc/os_patching/reboot_required
+        cat /dev/null > /etc/os_patching/apps_to_restart
+      fi
+    ;;
+  esac
 fi
 
 /opt/puppetlabs/bin/puppet facts upload 2>/dev/null 1>/dev/null
 /usr/bin/logger -p info -t os_patching_fact_generation.sh "patch data fact refreshed"
 
+rm $LOCKFILE
 exit 0