Package Yum/Dnf Exclude List

Infrastructure: YUM / DNF / APT Package Exclusion
Platform: RHEL/Rocky 8–10, Ubuntu/Debian 22/24

Overview

When your Linux distribution performs routine package updates (via yum update, dnf upgrade, or apt upgrade), it may automatically upgrade packages that Diskover depends on — such as Elasticsearch, Nginx, PHP, or RabbitMQ. These unplanned upgrades can introduce version incompatibilities, break service configurations, or cause downtime.

To prevent this, Diskover recommends configuring your system's package manager to exclude Diskover-managed packages and its supporting services from automatic updates. This ensures that package upgrades only happen intentionally during a planned Diskover upgrade window.

This guide covers how to configure package exclusion on all supported Linux platforms.

Why This Matters

Diskover's components are installed at specific, tested versions that are known to work together. An unplanned upgrade to any of these packages can cause problems such as:

• Elasticsearch — A major version jump can change index formats or API behavior, breaking Diskover's search and indexing.

• PHP — Upgrading PHP without updating Diskover Web's configuration can cause the web UI to fail.

• Nginx — Configuration directives may change between versions, potentially breaking the reverse proxy setup.

• RabbitMQ — Version upgrades can require Erlang version changes, which may break the message broker.

• Kibana — Must stay version-matched with Elasticsearch; an independent upgrade will fail.

• Diskover packages — The diskover* packages (diskover-web, diskover-admin, diskoverd, diskover-scanner*, diskover-file-action*, diskover-plugin*) should only be upgraded through the official Diskover upgrade process.

By excluding these packages, you maintain full control over when and how upgrades happen.

Packages to Exclude

The following packages should be excluded from automatic updates on all Diskover hosts:

Note: You only need to exclude packages for components that are installed on a given host. For example, a dedicated worker host does not need to exclude nginx* or php*.

Configuration — RHEL / Rocky Linux

DNF (Rocky Linux 8–10, RHEL 8–10)

DNF is the default package manager on Rocky Linux and RHEL 8 and later. To exclude Diskover-managed packages, add an excludepkgs line to /etc/dnf/dnf.conf:

1. Open the DNF configuration file:

sudo vi /etc/dnf/dnf.conf

2. Add the following line under the [main] section:

[main]
excludepkgs=nginx* php* diskover* rabbitmq* kibana* elasticsearch*

3. Save the file. Any future dnf upgrade or dnf update commands will skip these packages automatically.

Tip: If you need to temporarily override the exclusion (for example, during a planned Diskover upgrade), use the --disableexcludes flag:

sudo dnf upgrade --disableexcludes=main

Configuration — Ubuntu / Debian

Ubuntu and Debian use APT as their package manager. The equivalent of a YUM/DNF exclude list is holding packages with apt-mark. Held packages are skipped during apt upgrade.

1. Hold all Diskover-managed packages:

sudo apt-mark hold nginx php8.4* diskover* rabbitmq-server kibana elasticsearch

2. Verify the holds are in place:

apt-mark showhold

Expected output:

diskover*
elasticsearch
kibana
nginx
php8.4-cli
php8.4-common
php8.4-fpm
...
rabbitmq-server

3. Any future apt upgrade commands will skip these packages automatically.

Tip: To remove a hold when you're ready to upgrade a specific package:

sudo apt-mark unhold elasticsearch
sudo apt upgrade elasticsearch
sudo apt-mark hold elasticsearch

Which Hosts Need Exclusions

Not every host requires every exclusion. Configure exclusions based on which components are installed on each host:

Verification

After configuring your package exclusions, verify that the protected packages are not offered for upgrade:

DNF (Rocky/RHEL):

dnf check-update | grep -E "nginx|php|diskover|rabbitmq|kibana|elasticsearch"

Expected result: no output (excluded packages should not appear).

APT (Ubuntu/Debian):

apt-mark showhold

Expected result: all Diskover-managed packages listed as held.

Troubleshooting