Pending Approval -Update

[mealliergael]

Hello everyone,

I’m having an issue with version 0.118.2 that I haven’t been able to resolve despite several hours of testing.

In the patch management section for my device, all updates are showing as “Pending approval.”

I created a policy with an approval ring and assigned the policy to the organization. *

However, on the device page, the updates still show as “Pending approval” under the Patches tab, and under the Config tab,

I see:

Thank you in advance for your help.

[ToddHebebrand]

Hi @mealliergael, thanks for the screenshots. They made this much quicker to work through.

Short version: your policy and ring look right. The "Pending Approval" badge on the device's Patches tab isn't showing what your ring will do. The badge only reflects patches someone has approved by hand. Ring auto-approval isn't stored anywhere in advance. Breeze works it out when a scheduled patch job runs, so until your 11:56 daily job has run against that device, every patch there will say "Pending Approval", even though the ring would approve it. That's confusing, and it's on us. I'll explain below and give you a quick way to confirm it.

Where the badge comes from. For each patch, the device Patches tab asks one question: is there a partner-wide approval record with status approved for this patch? If there is, the badge says Approved. If not, it says Pending Approval. The tab never checks your update ring, its severities or its hold days. So with a ring set to auto-approve and nobody approving patches by hand, the device tab will always say Pending Approval.

Where your ring actually takes effect. A background scheduler checks Configuration Policy patch schedules every 60 seconds. When a device's local time matches the policy's schedule (Daily at 11:56 in your case), it creates a patch job. That job runs each device's pending patches through the ring: manual approvals first, then category rules, then the ring's auto-approve settings (severities, the unrated toggle, third-party toggle, hold days). The patches that pass are sent to the agent to install. Your ring (all four severities, unrated patches on, hold 0 days, third-party auto-approve on, third-party sources enabled on the policy) should let the three KBs in your first screenshot through at the next scheduled run. I can't see your instance, so I can't promise that, but it's what the code does with those settings.

The "Auto Approve: No" on the Config tab is a different setting. That card lists the first few raw settings stored on the policy's Patch feature. autoApprove there is the policy-level auto-approve, which is only used when no ring is linked. Since you linked test-ring-mtv-test-2, the ring's settings apply and that "No" has no effect. The card is misleading here too.

How to confirm what's going on:

1. Check whether a scheduled job has run since you saved the policy. Go to Patches → Jobs. You should see a job from Configuration Policy test created at 11:56 (device local time) on a day after you saved the policy. The scheduler only fires in that exact minute, so if you saved the policy after 11:56 today, the first run is tomorrow. "Hours of testing" may simply not have crossed an 11:56 yet.
2. If a job exists, open it and look at that device's result. It will show whether patches were sent and whether anything failed. One example is the battery preflight on laptops. On 0.118.2 the device tab should already show a failed install attempt and its reason instead of "Pending Approval" (that was Patch job fails on battery preflight, but UI shows patches as Pending approval and hides failure reason #4223).
3. To test without waiting a day, go to Configuration Policies → test → Patches → Installation Schedule and set the time a few minutes ahead in the device's timezone. Breeze uses the effective timezone from the device, site, organization or partner, not your browser's timezone. Make sure the device is online, not in a maintenance window with patch suppression, and wait for the job to appear under Patches → Jobs.
4. If you just want these patches installed now, go to Patches → Patches, select them and approve them. Manual approval is stored, so the device tab will then show Approved and the Install buttons on the device page will work. Those buttons only accept manually approved patches today, which is why they're disabled for you.

If a scheduled job ran and the patches still weren't installed, please reply with:

• the device's timezone (and the org/site timezone if they're set), and the time you saved the policy;
• whether Patches → Jobs shows a job from policy test, and if so, its status and that device's result or error text;
• the device's OS and agent version, and whether it was online at 11:56 local time;
• whether you're on Breeze Cloud or self-hosted, and if self-hosted, the API logs around 11:56 that mention [PatchScheduler], [PatchJobExecutor] or [PatchApproval].

With that I can tell whether the job never fired, fired but the ring rejected the patches, or the install failed on the device.

On our side, I've filed #7625 so the device Patches tab shows what the linked ring will do (e.g. "Will auto-approve at next scheduled run" or "Held until ") instead of a flat "Pending Approval", and so the Config tab summary stops showing the unused policy-level autoApprove when a ring is linked.

Docs, for reference:

• Patch scheduling via Configuration Policies: https://docs.breezermm.com/features/patch-management/#patch-scheduling-via-configuration-policies
• Update Rings (auto-approve, hold, unrated patches): https://docs.breezermm.com/features/update-rings/
• Configuration Policies (assignments): https://docs.breezermm.com/features/configuration-policies/

Status: display bug tracked in #7625. Waiting on your result from step 1 or 3.

[mealliergael]

Hello,

All the changes you made have successfully resolved all the issues we encountered.

I can now patch the workstations, and the update approval process is working correctly.

Thank you again for your excellent work.

Best regards,
Gael

[ToddHebebrand]

Glad it's working, @mealliergael, and thanks for confirming. Closing this as resolved. If ring approvals act up again, open a new discussion and link this one.