Well, the "textbook" answer is that you can look at either the CF Admin "Setting Summary" page or the blue "system information" icon in the top right of the Admin. If you have applied any hotfixes or cumulative hotfixes, those will show up in a line on the page labeled "update level" in the first section of data reported at the top of the page. If there is no "update level" line, then you have not applied them. But you ask how to determine "which patches have been installed", and that really requires a much more involved answer. This will be long (and after I get any feedback, I'll turn it into a blog entry), but until then, here's a shot at an answer for you. 1) Beware that the info in the admin pages above shows only one hotfix, even if you have applied more. This is quite unfortunate. So to confirm "which patches have been installed", you technically need to look in the lib/updates directory (which is where the patches get put by the "update file" feature on the "system information" page). 2) So where are those updates stored/found by CF? Well, the easiest way for you to tell is if you have any other updates listed there. In that case, the info shown will indicate the directory where they have been put. If there are none, then it would seem to indicate that there are none yet applied, but you should double-check the directory to be sure. So where is it usually? Well, on a standard/server/standalone deployment, it's the /lib/updates directory, such as C:/ColdFusion9/lib/updates/. On the multiserver edition (multiple instances), it's instead buried deep within each separate instance. For the cfusion instance that would be C:\JRun4\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\updates. For other instances, it's just a little different: C:\JRun4\servers\instance1\cfusion.ear\cfusion.war\WEB-INF\cfusion\lib\updates (the cfusion instance uses dashes for some of the dirnames, where other instances use dots. Confusing, yes. (And if anyone is wondering, this does also clarify that yes you must put hotfixes in each instance. You can't just put them in the cfusion instance and expect that to update other existing instances. It doesn't work that way.) So to your question, I'm saying that you need to look at that directory to see what's there, to know what hotfixes or CHFs have been applied. CF reads all of them there. You don't want to rely solely on what's listed in the "update level" info on the Admin pages above. 3) I'll share one other tip: make sure that any files you see in that directory are for the version of CF you have. The Admin "update file" feature does not validation, and I've seen many people have the wrong hotfixes for their server, such as chf8000001.jar in an 8.0.1 environment (or as bad, a CF9 environment). That 800 in the jar file name means that's for 8.0. An 8.0.1 hotfix jar file would look like chf8010001.jar. The problem is that Java loads any classes in any jars in the classpath (and this updates directory gets put into the classpath), so you could inadvertently be causing problems if CF is loading the wrong classes out of one of these "wrong" jars for your environment. A cause of subtle bugs, I think. 4) And again, in that you seem to be asking to know how to confirm "all" patches/hotfixes that have been applied, technically you can't even rest on looking in the lib/updates directory. Many Cumulative hotfixes (and some hotfixes) do in fact indicate multiple manual steps asking you to update files that may exist in any number of other directories. So there's simply no way to know "have all I need been applied", if that's what you mean, or "have all I need for a given CHF been applied". For that, you'd simply need to look at the hotfix docs to confirm what needs to have been done. 5) That points to one more gotcha that many suffer: be careful not to stop at applying "the latest" cumulative hotfix. Let's say you are on 8.0.1, with no hotfixes (or only the first 1 or 2), and you see that there is a CFH 4 out there. While it's technically true that by applying the CHF jar file in CHF4, you don't then need to do the one for 3 (or 2 or 1, etc.), what's NOT as obvious is that this only takes care of the CHF JAR file. Again, if one of those earlier CHFs had multiple steps in addition to just the CHF jar, you need to do those. This was in fact the case with 8.0.1 CHF3, which lists a separate manual step required for fixing a CFIMAGE bug (and beware that it lists that at the top of the hotfix page, not at the bottom under the "steps to follow", at http://kb2.adobe.com/cps/511/cpsid_51180.html). If you jump to CHF4 from before CHF3, if you miss that manual step in CHF3, you will still suffer the problem. Bottom line: you should always scan all preceding CHFs for a release before skipping them to "go to the latest". Sadly, even the hotfixes don't warn of this, though I did add comments to this regard to the 8.0.1 CHF 4 (http://kb2.adobe.com/cps/529/cpsid_52915.html). 6) Along the same lines, when you move up to a newer CHF from an older one, you should delete or remove the previous CHF jars for that version, if there are any in the lib/updates directory. And be careful trying just to rename them and keep them there "for backup". Again, Java loads classes in any .jar files, you if you rename chf801001.jar, for instance, to chf801001_old.jar, you've done nothing. Java could still load those classes. You could rename it to .jar.bak. It may be best just to delete them, or move them to some other directory entirely outside of CF so that there's no chance it's picked up on its "classpath" (which it builds at startup due to various configuration entries in the Admin or config files.) 7) Yes, I do realize that this all points to a rather lamentable state of affairs with respect to hotfix management. It could certainly be a lot better managed, require less manual effort, require less worry about what has or has not been (or still needs to be) applied. Perhaps Adobe will address that in future releases. 8) In the meantime, there is one free tool out there that tries to help with all this. It's called Merlin Manager, and available at merlinmanager.com. It's definitely worth checking out as it has a lot of nice features to help with all this, including letting you know what updates you need for the version you have, doing that across multiple instances, and much more. That said, I don't know if it solves all the gotchas I've warned of above: I don't know if it deals with checking for whether you have any jars in lib/updates that are "wrong" for your version, nor do I know if it checks for if you still have unneeded older CHF jars there, nor do I know if it checks for whether any "multi-step CHFs" have had all their steps done. I'll email the maker, John Mason, to ask him to confirm and point him here to offer an answer. 9) Finally, whether John handles it or not, I do think it would be helpful if someone (Adobe, someone else) came up with a list of what CHFs for each release did have manual steps that need to be done, so that we could more easily know (when we apply a later one) which earlier ones we need to pay attention to. I'll be interested to hear any feedback to all the above, and then I will blog about it. It's a topic that many could benefit knowing more about. /charlie Providing CF troubleshooting services at carehart.org/consulting charlie@carehart.org
... View more