Patching AIX: Technology Levels, Service Packs, instfix, and emgr interim fixes

Goal

Determine an AIX 7.2/7.3 system's current patch level, apply or preview an update safely, and manage a temporary interim fix without losing the ability to back out.

Prerequisites

Root access; a current mksysb or equivalent backup before any Technology Level or Service Pack update (see the mksysb article in this series); know whether the update source is Fix Central media, a NIM lpp_source, or SUMA.

Steps

1. Establish the current level: oslevel -s prints the Release-TL-SP-Build string. For finer detail on individual filesets, instfix -i | grep ML lists installed Technology/Maintenance Levels and their completeness.
2. Check for a specific fix: instfix -ik <APAR-or-label> prints "All filesets for <APAR> were found." when it is fully installed; "Not all filesets ... were found" or "There was no data ..." means it is missing or incomplete (instfix -icqk <label> | grep :-: lists the down-level filesets).
3. Preview before applying: run installp -p (preview) against the update's lpp_source or media to see what would change without touching the system, including which installed interim fixes would be automatically removed because their permanent fix arrived.
4. Apply a Technology Level or Service Pack as a group with smitty update_all (or the equivalent install_all_updates invocation) rather than installing individual filesets; a partial Technology Level is not a supported configuration.
5. Decide commit vs. apply: a Service Pack can be applied without being committed, leaving a reject path open; a Technology Level update must always be committed and cannot be rejected, so a tested mksysb is the only rollback for a TL.
6. Verify: lslpp -l (or -h for history) confirms fileset versions and installation state after the update, lppchk -v reports inconsistent filesets, and oslevel -s should show the new level.
7. For a single urgent fix outside the normal cycle, use an interim fix (ifix, formerly called an efix) through emgr: emgr -l lists installed ifixes, emgr -X -e <package> installs one, and emgr -r -L <label> removes it. Ifixes are meant to be temporary and are normally superseded by the next Service Pack or Technology Level.

Expected result

oslevel -s and instfix -i agree on the new level; lslpp -l shows no broken or inconsistent filesets; any temporary ifix is either removed automatically by the update or explicitly still tracked in emgr -l.

Limits and test basis

Technology Level and Service Pack updates require a reboot; plan a maintenance window. An ifix locks the filesets it patches: only an update containing the same APAR fix removes it automatically, an ifix that cannot be mapped to such an update makes the update fail until it is removed with emgr -r, and rejecting an update later does not reinstall an auto-removed ifix. Review emgr -l before every update.