How to Verify Missing Patches in Linux (Debian-based Systems)
ServiceOps Patch Management may report patches as missing on Debian-based Linux endpoints. This guide shows you how to verify whether those patches are genuinely pending installation or are false positives, using native Debian package manager commands.
This guide applies to Debian 11, Debian 12, and Debian 13.
Prerequisites
- Patch repository updated successfully on the ServiceOps server.
- A supported ServiceOps Agent installed and active on the endpoint.
- The endpoint communicating successfully with the ServiceOps server.
- A Patch Scan completed on the endpoint with results available in Patch Management.
- The endpoint online and accessible via SSH or local terminal.
Symptoms
You may need this guide if you observe any of the following:
- Patch scan reports patches as missing, but the endpoint appears fully updated.
- Missing patches continue to appear after rescanning.
- Reported patch versions do not align with repository information.
Steps
Step 1: Refresh Repository Metadata
Run the following command on the endpoint to pull the latest package metadata from the repository:
apt update
This ensures that subsequent version checks reflect the current repository state, not stale cached data.
Step 2: Check Available Upgrades
List all packages currently available for upgrade:
apt list --upgradable
Interpretation:
- If the package reported as missing appears in the output, the patch is available and pending installation.
- If the package does not appear, it may already be installed at the required version.
Step 3: Verify the Patch Version
Check the installed and candidate versions of a specific package:
apt-cache policy <package-name>
Example:
apt-cache policy imagemagick
Interpretation:
| Result | Meaning |
|---|---|
| Installed = Candidate | Patch already installed. No action needed. |
| Installed < Candidate | Patch is genuinely missing. Deploy it via ServiceOps. |
| Installed > Candidate | Repository inconsistency. Check repository sync. |
Step 4: Confirm the Installed Package
Cross-check the installed version using the package database:
dpkg -l | grep <package-name>
This confirms what is actually installed on the endpoint, independent of the repository.
Step 5: Compare Results
Compare three data points: the patch version reported by ServiceOps, the installed version from dpkg, and the candidate version from apt-cache policy.
| Scenario | Conclusion |
|---|---|
| Installed = Candidate | Patch already installed. |
| Installed < Candidate | Patch is genuinely missing. |
| Scanner reports missing but versions match | Potential false positive. Trigger a rescan. |
| Candidate unavailable | Repository synchronization issue. |
Example Investigation (Debian 13)
The following example shows verification for three patches reported as missing: libhttp-daemon-perl, imagemagick, and gst-plugins-good1.0.
apt update
apt list --upgradable
apt-cache policy imagemagick
dpkg -l | grep imagemagick
Run these commands for each reported package and compare the installed and candidate versions using the table in Step 5 to determine the correct conclusion.
Post-Deployment Validation
After deploying missing patches through ServiceOps, confirm successful installation by running:
apt list --upgradable
Expected result: The command returns no upgradable packages, indicating that all missing patches are installed.
If packages still appear as upgradable, investigate whether the deployment failed, the patch installation is pending, or a rescan is required in ServiceOps.