PatchWardLinux Patching & Inventory
Request an evaluation
Version 1.0 · self-hosted
A single agent on each host reports what is installed and what is missing. Work is scheduled in waves; PatchWard executes them, confirms that every host has returned to service, and records what changed — package by package, host by host.
Debian · Ubuntu · RHEL · Rocky · Alma · SUSE · Arch
The console
Inventory, waves, execution history, calendar and the printable report.
Capabilities
Know
Hardware, operating system, kernel, packages, pending updates and systemd services for every enrolled host. Refreshed on a schedule and again after each patch run, so the data acted upon is the state of the machine rather than a manually maintained record.
Act
Hosts are grouped by environment, application or organization unit, with scope set to all available updates or security updates only. Waves can be scheduled once, weekly or monthly, suspended during a change freeze, and gated behind the four-eyes principle, which requires a second person to approve the run before any package is installed. A wave triggered twice does not patch the same host twice.
Verify
Not at the point the command is issued. PatchWard waits for the agent to report a new boot id, then records the time of return and the uptime since. Outstanding reboots remain visible until they are completed.
Governance
Patching touches production systems, so both questions carry a documented answer.
Access control
Viewer has read and print access only. Application user sees only the servers belonging to the applications they own and may request an exception. Operator creates and executes waves. Admin approves runs and administers users. Superadmin additionally controls company branding and licensing.
Every account is scoped to the applications it belongs to: a team lead opens the console and sees the systems under their responsibility, not the entire estate.
Exceptions
The application owner submits the request with a justification — a change freeze, a ticket reference, a month-end close — and an administrator approves or rejects it. Once approved, the host is skipped on its next run and the exception is consumed, so it cannot become a permanent exclusion that no one remembers granting.
The requester, the justification, the approver and the run that consumed the exception are all retained, and the skipped host is reported as an exception rather than counted as patched.
Operation
The same five steps in every cycle, from five hosts to several thousand.
The console connects to the host over SSH, installs the agent and begins receiving reports within a minute, with the log streamed live.
Each agent reports inventory and pending updates on its own cadence, or on demand when an immediate refresh is required.
Hosts are assigned to a wave with a defined scope and window — test tier on Tuesday, production on the second Saturday — in line with the change process.
The wave dispatches one job per host, each with a live console and per-host outcomes as they complete. Kernel CVEs can be applied without a reboot through kpatch on RPM hosts.
Coverage, failures, pending reboots and the exact version changes, printable for the auditor, the service owner or the next engineer on call.
Evidence
Every execution is recorded and printable: the host, the package, the version before and after, who triggered the run and who approved it. Coverage and success rate for the window, the hosts that failed, and the reboots still outstanding.
No prepared demonstration data. The software is installed on a machine you control, onboarded against your own hosts and exercised in a real patch window. Provide the approximate host count and the distributions in use, and the installation bundle is sent to you.
Request an evaluationleandro.gomes@patchward.net · no sales call, no form, no account
Common questions
Three containers on a single machine — console, API and PostgreSQL — from pre-built images. There is no build step and no internet access is required on that machine. Managed hosts receive a single agent, deployed from the console over SSH.
No. Agents communicate only with your own server. There is no telemetry, no outbound reporting and no account to create.
Debian and Ubuntu, RHEL, Rocky, Alma and CentOS Stream, SUSE, and Arch. Kernel live-patching through kpatch on the RPM family.
Stop the three containers and drop the volume. On each host the agent is a single systemd service and one directory, and the console can remove it.
