Package Inventory

Overview

The Packages page is PatchMon's fleet-wide package inventory. It aggregates every package reported by every agent across your fleet into a single searchable list, with one row per unique package name, showing how many hosts have it installed, how many need updates, whether any of those updates are security-flagged, and which repositories supply the latest version.

This page walks through the Packages list, the filters, the per-package detail page, and how the inventory ties into the Outdated Packages card on the Dashboard.

Permission required: can_view_packages to view packages. can_manage_hosts to trigger patch runs from this page.

Getting There

Click Packages in the left navigation. The page shows a summary row, a filter toolbar, and a paginated table.

You can also deep-link:

• /packages?host=<hostId>: pre-filter to a specific host.
• /packages?filter=outdated: only packages with at least one pending update.
• /packages?filter=security or /packages?filter=security-updates: only packages with security updates available.
• /packages?filter=regular: only packages with non-security updates.

The Dashboard's Outdated Packages card and the Host Detail cards use these query-string shortcuts.

Summary Cards

The heading tells you what the cards are counting, and the cards always match it.

Arriving without a host filter, the heading reads Packages on all Hosts and five cards summarise your whole fleet:

Arriving with a host filter, for example by clicking Outdated Packages on a Host Detail page, the heading reads Packages for Host and carries a Clear filter button that returns you to the fleet view. Three cards are shown, and every figure counts that host alone:

Installations and Outdated Hosts are hidden when a host filter is active. Both are fleet measures: on a single host each package is installed exactly once, so Installations would only restate Packages, and Outdated Hosts is not a per-host figure at all.

The Outdated Packages and Security Packages cards keep whatever host filter is active, so clicking them narrows the list rather than resetting your scope. The Outdated Hosts card jumps you out to the Hosts page rather than filtering in-place.

Note: the fleet-wide figures come from a periodic statistics snapshot rather than a live query, so shortly after an agent reports they can trail the table by a few minutes. The host-scoped figures are read live and always agree with the list beneath them.

The Filter Toolbar

Above the table:

• Search: free-text search across package names (debounced, matched server-side).
• Category: package category as reported by the underlying package manager (only populated for managers that expose categories, primarily apt/dpkg).
• Update Status: the main filter. Four options:
  • All Packages
  • Packages Needing Updates
  • Security Updates Only
  • Regular Updates Only
• Host: limits the list to packages present on a single host. When set, the page shows only that host's packages and unlocks the Patch all button to run a patch on just that host.
• Columns: customise which columns are visible and in which order.

Note: The toolbar filters by a single host, not by host group. To review packages across a group, open the Hosts page, filter by group, bulk-select the hosts, and review their packages via the individual host links or patch wizards. Group-wide patching is driven from the Patching page, not from here.

Reading the Table

Default columns:

The Columns button lets you hide any column except the select checkbox, drag to reorder, and reset to default. The column layout is persisted locally in your browser.

How "Installed On" is calculated

The count includes every host PatchMon has seen reporting the package, regardless of version. The "needs updates" part of N/M hosts is hosts whose currently installed version is older than the latest version available from their configured repositories.

Security vs Regular updates

A package is "security" when at least one host sees a security-flagged update for it (typically because the update is pulled from a distribution's security channel such as *-security on Debian/Ubuntu or a vendor advisory on RHEL). Regular updates are non-security package upgrades. The Status column surfaces whichever priority is higher.

Sorting and Pagination

• Click any sortable column header to toggle sort direction.
• The status sort uses a priority: Security Update Available first, then Update Available, then Up to Date, so ascending order puts the highest-risk packages at the top.
• The page size selector (bottom of the table) supports 25, 50, 100, or 200 rows. Your choice is remembered per browser.

Clicking into a Package

Clicking a package name (or using the filter chip from a host's detail page) opens /packages/<id>, the Package Detail page. Two tabs:

Hosts tab (default)

Lists every host where the package is installed. Key elements:

• Top summary cards: Updates Needed, Latest Version, Updated (when PatchMon last saw a report for the package), Hosts with Package, Up to Date.
• A Source Repositories strip showing every repo across the fleet that supplies this package (click through to a repo detail).
• Description panel: the package description as reported by the host's package manager.
• Only pending filter: ticked by default; untick to see every host, including ones already up to date.
• Search: filters the host list.
• Per-row actions: for Linux/FreeBSD hosts, you can trigger a targeted patch of this one package. Windows hosts are marked as managed via Windows Update / WinGet.
• Select multiple rows and use Patch selected to run the same upgrade across many hosts in one patch run.

Activity tab

Recent patch runs in which this specific package was upgraded, with timestamps, target hosts, and outcomes. Useful for "when was this CVE closed across the fleet?" audits.

Bulk Patch from the Packages Page

Two flows produce a patch run from the Packages page:

Patch selected packages across chosen hosts

1. Tick the checkbox on each package to include. The header shows N selected.
2. Click Patch selected (N) (top right).
3. The Patch wizard opens in multi-host mode, discovers which hosts have the selected packages installed and need updates, and lets you pick which to include.
4. If the Host filter is already set to a single host, the wizard locks to that host to avoid offering unrelated hosts.

Patch all on a single host

1. Set the Host filter to one host.
2. Click Patch all (top right, only appears when a single non-Windows host is filtered).
3. Confirm in the wizard to upgrade every outdated package on that host.

Both flows route you into the Patching chapter. See the patch-run pages there for what happens next.

The Outdated Packages Dashboard Card

The Dashboard shows a Outdated Packages card near the top of the Cards layout (the actual position depends on your personal dashboard customisation). The number shown is the fleet-wide count of packages with at least one host needing an update, which is the same figure as the Outdated Packages card on the Packages page when that page is not filtered to a single host.

Clicking the Dashboard card navigates to /packages?filter=outdated, which:

• Sets the Update Status filter to Packages Needing Updates.
• Clears the Category filter.
• Leaves other filters at their defaults.

From there, you can drill into individual packages, set up a patch run, or narrow to a specific host.

Tips

• Live list, periodic backing data. Rows are fetched from the PatchMon server and reflect the most recent reports submitted by each host. To refresh a host's data immediately, open the host's detail page and click Fetch Report. The Packages list picks up the new state on its next refetch (or click Refresh on the Packages page).
• Drilling down into patch state. The Hosts page is the better starting point when you care about which hosts are behind on updates. Use the Packages page when you care about which packages expose the fleet.
• Windows hosts. Package reporting works for Windows (via winget, chocolatey, and MSI inventory), but the Patch all / Patch selected actions do not target Windows. Patching on Windows is managed via Windows Update or WinGet directly on the host.

Related Pages

• Host Detail Page: per-host package summary and fetch-report actions.
• Repository Tracking: see which repositories each package comes from.
• Managing the PatchMon Agent: how the agent collects package data.
• Integration API Documentation: fetch the same inventory programmatically.