Share via

Linux (sles 15.6) patching failed

Shubham Prajapati 40 Reputation points
2026-02-17T11:55:59.3033333+00:00

Hi,

I tried to patch the Linux (sles 15.6) VM from Azure Update manager, but it got failed. When i checked the logs, dry run it is succeeding but during the actual update it is showing the following 12 items are locked and will not be changed by any action: Available:   plymouth plymouth-branding-SLE plymouth-devel plymouth-dracut plymouth-lang plymouth-plugin-label plymouth-plugin-label-ft

after that it is getting failed.

Azure Update Manager
Azure Update Manager

An Azure service to centrally manages updates and compliance at scale.

{count} votes

2 answers

Sort by: Most helpful
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

  2. Suchitra Suregaunkar 9,495 Reputation points Microsoft External Staff Moderator
    2026-02-18T05:34:59.41+00:00

    Hello **Shubham Prajapati**Your Update Manager run is failing because the update operation is trying to install/upgrade packages that the OS package manager treats as not changeable in the current transaction (you see it as “items are locked and will not be changed”). Azure Update Manager relies on the VM’s native Linux package manager and will surface those package-manager errors.

    Update Manager honors the update source/settings on the machine and doesn’t publish/provide updates itself, meaning package-manager constraints on the VM can block the deployment.

    Please follow below suggested Microsoft-supported workaround: Exclude the locked packages in the deployment.

    Azure Update Manager supports Include/Exclude KB ID / package during deployments, and for Linux you can exclude packages by name using wildcards (exactly what you need for plymouth*). Option A:  One-time update (fastest)

    1. Azure portal → Azure Update ManagerOverviewOne-time update
    2. Select the SLES VM → Next
    3. On the Updates pane:
      • Keep the appropriate classifications (ex: Security/Critical) as needed
      • Under Exclude KB ID/package, add the locked packages using wildcards, for example:
      • plymouth*
      • (If needed) plymouth-branding*
    4. Continue → Review + installInstall

    Option B: Scheduled patching / maintenance configuration (recommended for ongoing)

    Use the same Exclude KB ID/package approach when creating the scheduled deployment so every run skips plymouth*.

    • Update Manager runs patching through its Linux VM patch extensions and reports what the OS package manager returns.
    • By excluding the problematic packages, the deployment proceeds with the remaining patches instead of failing the whole run. The Microsoft deployment guidance explicitly supports excluding packages in Update Manager.

    Excluded packages may still appear in assessment results (assessment vs install are different), but they won’t be installed in that deployment. The deployment doc also notes “Selected Updates” is a preview and actual installed updates can vary based on latest assessment/repo state.

    Reference: https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/update-manager/deploy-updates.md

    Kindly let us know if the solution provided worked for you.

    If you need any further assistance, please feel free to reach out.

    Thanks,

    Suchitra.

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.