patch Commands

Use Oracle Fleet Patching and Provisioning (Oracle FPP) commands with the patch keyword to apply or roll back one-off patches to the specified working copy using the in-place patching method.

rhpctl apply patch

Applies one-off patches to the specified working copy using in-place patching method.

Syntax

rhpctl apply patch -workingcopy workingcopy_name
  [-image image_name | -patchloc patch_location_on_target] [-online [-dbname unique_db_name] [-patchid patch_ids | -security {YES|NO}]]
  [-eval] [-datapatchargs arguments_list] [-targetnode target_node_name {-root | -cred cred_name | -sudouser sudo_username
  -sudopath path_to_sudo_binary | -auth plugin_name [-arg1 name1:value1
  [-arg2 name2:value2 ...]]}] [-schedule timer_value] [-nodatapatch] [-jobtag tag_name]

Parameters

Table: rhpctl apply patch Command Parameters

Parameter	Description
`-workingcopy` `workingcopy_name`	Specify a name for the working copy that you want to patch.
`-image` `image_name`	Specify the name of a deployed working copy that you want to patch. Note: This option is available only for Oracle FPP Server Mode.
`-patchloc` `patch_location_on_target`	Specify the absolute path for the unzipped patch directory on the target.
`-online`	Specify this parameter to indicate that the patch type is online.
`-dbname` `unique_db_name`	Specify the unique name of the database ( `DB_UNIQUE_NAME` without `DB_DOMAIN` ) that you are patching.
`-patchid` `patch_ids`	Optionally, specify `-patchid` when you use the `-online` option. Specify a comma-separated list of numeric patch IDs that exist under the directory specified for `-patchloc`. Use this parameter when the staging area contains multiple online patches and you want to apply a subset of those patches. If you omit this parameter, Oracle FPP discovers applicable patch IDs automatically. You cannot use `-patchid` with `-security`.
`-security {YES\|NO}`	Specify `YES` to apply only eligible online patches whose OPatch metadata identifies them as containing security fixes. Specify `NO` to apply eligible online patches without filtering for security fixes. The default is `NO`. This parameter requires `-online` and cannot be used with `-patchid`. OPatch version 12.2.0.1.52 or later and the `contains_security_fix` patch metadata property are required.
`-eval`	Optionally, you can use this parameter to evaluate the impact of this command on the system without actually running the command.
`-targetnode` `target_node_name`	Specify the name of an `rhpclient` -less target.
`-root \| -cred` `cred_name` `\| -sudouser` `sudo_user_name` `-sudopath` `sudo_binary_location` `\| -auth` `plugin_name` `plugin_args`	If you choose to use the `-targetnode` parameter, then you must choose either `root`, a credential name, `sudo`, or an authentication plugin to access the remote node. Choose `-root` to perform super user operations as `root`. Alternatively, you can choose either to specify a credential name to associate the user name and password credentials to access a remote node, to perform super user operations as a `sudo` user by specifying a `sudo` user name and the path to the `sudo` binary, or to use an authentication plugin to access the remote node.
`-schedule` `timer_value`	Optionally, you can use this parameter to schedule a time to run this operation, in ISO-8601 format, as in the following example: `2024-04-15T19:13:17+05` If `NOW` is specified or the option is omitted, then the job is scheduled immediately. If `PAUSE` is specified, then the job starts in the paused state and you need to resume the job using the `rhpctl resume job -jobid job_id` command.
`-nodatapatch`	Optionally, you can use this parameter to indicate not to run `datapatch` for image being patched.
`-jobtag` `tag_name`	Optionally, you can associate a user-defined tag with the scheduled jobs.

Note:

Security-only online patching requires OPatch version 12.2.0.1.52 or later and the contains_security_fix metadata property in the one-off patches. For a Monthly Recommended Patch (MRP), this requirement applies to its constituent one-off patches. With -security YES, Oracle FPP selects only eligible online patches for which this property is true. If the property is absent, Oracle FPP cannot identify the patch for security-only selection.

The -security option requires -online and cannot be used with -patchid, whether you specify YES or NO. The default is NO, which applies eligible online patches without filtering for security fixes; it does not exclude security patches.

Examples

To patch a working copy on a client cluster:

rhpctl apply patch -workingcopy workingcopy_name -image image_name -online -patchid patch_ids

To evaluate an online patching operation for a database without applying the patches:

rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -dbname unique_db_name -eval

To apply online patches to a database after evaluating the operation:

rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -dbname unique_db_name

To evaluate security-only online patching:

rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -security YES -dbname unique_db_name -eval

If you omit -dbname, Oracle FPP evaluates the eligible databases configured on the working copy.

To apply the security patches after evaluating the operation:

rhpctl apply patch -workingcopy workingcopy_name -patchloc patch_location_on_target -online -security YES -dbname unique_db_name

If no eligible online patches are marked as containing security fixes, the command reports an error. Specify a patch location containing eligible patches with the required metadata, or omit -security YES if you intend to apply eligible online patches without filtering for security fixes.

rhpctl rollback patch

Rolls back the specified patch in the specified working copy.

The -security option is not available for this command. To roll back security patches applied from an MRP, specify their individual patch IDs as a comma-separated list using -patchid. Review the patch readme for rollback requirements and verification steps.

Syntax

rhpctl rollback patch -patchid patch_ids -workingcopy workingcopy_name
  [-online [-dbname unique_db_name]] [-targetnode target_node_name {-root | -cred cred_name 
  | -sudouser sudo_username -sudopath path_to_sudo_binary | -auth plugin_name 
  [-arg1 name1:value1 [-arg2 name2:value2 ...]]}] 
  [-schedule timer_value] [-nodatapatch] [-jobtag tag_name]

Parameters

Table: rhpctl rollback patch Command Parameters

Parameter	Description
`-patchid patch_ids`	Specify a comma-separated list of patch IDs that you want to roll back.
`-workingcopy workingcopy_name`	Specify a name for the working copy from which you want to rollback the patch.
`-online`	Specify this parameter to indicate that the patch type is online.
`-dbname` `unique_db_name`	Specify the unique name of the database (`DB_UNIQUE_NAME` without `DB_DOMAIN`) from which you want to rollback the patch.
`-targetnode target_node_name`	Specify the name of an `rhpclient`-less target.
`-root \| -cred cred_name \| -sudouser sudo_user_name -sudopath sudo_binary_location \| -auth plugin_name plugin_args`	If you choose to use the `-targetnode` parameter, then you must choose either `root`, a credential name, `sudo`, or an authentication plugin to access the remote node. Choose `-root` to perform super user operations as `root`. Alternatively, you can choose either to specify a credential name to associate the user name and password credentials to access a remote node, to perform super user operations as a `sudo` user by specifying a `sudo` user name and the path to the `sudo` binary, or to use an authentication plugin to access the remote node.
`-schedule timer_value`	Optionally, you can use this parameter to schedule a time to run this operation, in ISO-8601 format, as in the following example: `2024-04-15T19:13:17+05` If `NOW` is specified or the option is omitted, then the job is scheduled immediately. If `PAUSE` is specified, then the job starts in the paused state and you need to resume the job using the `rhpctl resume job -jobid job_id` command.
`-nodatapatch`	Optionally, you can use this parameter to indicate not to run datapatch for patch being rolled back.
`-jobtag` `tag_name`	Optionally, you can associate a user-defined tag with the scheduled jobs.

Examples

To roll back online patches from a database in a working copy:

rhpctl rollback patch -patchid patch_ids -workingcopy workingcopy_name -online -dbname unique_db_name

rhpctl evaluate patch

Evaluates the specified home or gold image to get the health status and patch recommendations.

Syntax

rhpctl evaluate patch {-image image_name | -path oracle_home_path}
[-applyfrequency ] [-updatelag LATEST | LATEST-1 | LATEST-2]
[-additionalbuglist bug_list] [-generateimage -importtoimage target_image_name]

Table: rhpctl evaluate patch Command Parameters

Parameter	Description
`-image` `image_name`	Specify the name of a deployed working copy that you want to evaluate. Note: This option is available only for Oracle FPP Server Mode.
`-path` `oracle_home_path`	Specify the absolute path for evaluating the Oracle home.
`-updatelag` `update_lag`	Specify the update lag policy for your image or Oracle home. LATEST: most recently released RU (default) LATEST-1: 1 RU before the most recent RU LATEST-2: 2 RUs before the most recent RU The default value is LATEST.
`-applyfrequency` `apply_frequency`	Specify how often you patch your working copy or Oracle home. MONTHLY: update software every month. QUARTERLY: update software every 3 months (Oracle recommended - default). HALF_YEARLY: update software every 6 months. ANNUALLY: update software every 12 months. The default and Oracle recommended patch frequency is QUARTERLY.
`-additionalbuglist` `bug_list`	Comma-separated list of additional bugs that you want to apply along with the Oracle Update Advisor recommended patches.
`-generateimage -importtoimage` `target_image_name`	Specify this parameter to generate a patched image and import the patched image to the specified gold image. Note: This option is available only for Oracle FPP Local Mode.

Examples

To evaluate an Oracle Grid Infrastructure home:

$ rhpctl evaluate patch -image DB236000 -generateimage -importtoimage DB238000
Operation "rhpctl evaluate patch" scheduled with the job ID "53".

rhpctl query patch

Queries the current status of the specified Oracle Update Advisor request ID.

Syntax

Note:

This command is only for Oracle FPP Local Mode.

rhpctl query patch [-requestid request_id]

Parameters

Table: rhpctl query patch Command Parameters

Parameter Description

Parameter	Description
`-requestid` `request_id`	Specify a request ID for which you want to check the status. Note: If you do not specify a request ID, then it displays a list of all the requests.

-requestid request_id

Specify a request ID for which you want to check the status.

Note: If you do not specify a request ID, then it displays a list of all the requests.

Examples

To display status of the specified request ID:

rhpctl query patch -requestid 96643
Software health status: "RED"
Software health comment: "More than one cycle behind your policy.."
Software Type: "DB"
Current version: "23.7.0.0.0"
Recommended version: "23.9"
Image is available to download. Please download it using below command.
rhpctl downloadimage patchplan -requestid 96643 -downloadlocation

To display a list of all the requests:

rhpctl query patch
Home: /u01/app/oracle/product/23.7.0/dbhome_1
  Request id: 96643
  Request time: 2025-09-06 12:14:35
Home: /u01/app/23.7.0/grid
  Request id: 96604
  Request time: 2025-09-05 12:51:43
Home: /u01/app/oracle/product/23.7.0/dbhome_1
  Request id: 96603
  Request time: 2025-09-05 12:16:33