Qutzl Insights

Tutorial

How to update Red Hat Enterprise Linux

Keep RHEL (and close cousins like AlmaLinux or Rocky) patched with dnf: check subscription/repos, update safely, reboot for new kernels, and verify services.

2 min readBy Michael NarehoodLinux

Advertisement

Red Hat Enterprise Linux updates are straightforward with dnf, but production hosts still deserve a short checklist. The same flow covers RHEL itself and most RHEL-compatible rebuilds (AlmaLinux, Rocky Linux) with only small repo differences.

1. Confirm the system and access

hostnamectl
cat /etc/os-release
uptime

Have console or iDRAC/iLO-style access ready if this is a remote server. Know whether a reboot is allowed in this window.

On genuine RHEL, subscription/repos should be healthy before you update:

sudo subscription-manager status
sudo subscription-manager repos --list-enabled

Rebuilds will use their own mirrors instead. Just make sure dnf repolist looks clean.

2. Refresh metadata and review

sudo dnf check-update

Exit code 100 means updates are available (that is normal, not a failure). Skim for kernel, openssl, httpd/nginx, database, or panel-related packages.

3. Apply updates

Standard update:

sudo dnf update

On modern DNF, update and upgrade behave the same for this purpose. Let it complete without killing the session mid-transaction.

If you use specific modules or app streams, stick to your documented stream. Do not casually reset modules on a production box during routine patching.

4. Clean caches (optional)

sudo dnf clean packages

Or a broader clean when disk is tight:

sudo dnf clean all

5. Reboot when a new kernel lands

rpm -q kernel
uname -r

If the newest installed kernel is newer than the running one, plan a reboot:

sudo systemctl reboot

On RHEL you can also check needs-restarting if the helpers are installed:

sudo dnf install -y yum-utils
sudo needs-restarting -r

6. Validate services

After reboot:

  • Host is reachable
  • systemctl --failed is clean (or understood)
  • Application endpoints respond
  • Monitoring stops complaining

Automation notes

Many shops use Satellite, Insights, or simple cron/dnf-automatic for security updates. Automated security patches are fine; blind full upgrades on app servers without a window are not. Keep a human in the loop for hosts that run customer-facing workloads.

Bottom line

Healthy repos → dnf check-update → dnf update → reboot for new kernels → verify. Same discipline as Ubuntu, different package manager.