Preventative Software Maintenance

Scheduled patching, updates, health checks and backup verification across your estate

Preventative Software Maintenance

Most problems that cause outages, breaches, or data loss were preventable. Unpatched software, unchecked logs, disks filling quietly, backups that stopped working weeks ago. These are the things that bite. GEN's Preventative Maintenance service runs a structured, scheduled programme of work across your estate to make sure none of them do.


Our PM platform maintains an asset registry of your systems and drives maintenance activity on two tracks: scheduled work at defined intervals, and condition-triggered work in response to events such as new CVE disclosures, vendor advisories, or threshold breaches detected by monitoring. When a task is due, an engineer connects, works through the checklist for that asset type, and logs the outcome. Nothing is marked complete until it has been verified.

Platform Coverage

Preventative maintenance runs across the full technology stack: servers, desktops, storage, virtualisation, network, and hardware. Each platform has its own specific maintenance checklist reflecting what matters for that type of asset.


Servers & Virtualisation

  • Linux (all major distributions)
  • Windows Server
  • Proxmox VE
  • VMware ESXi / vSphere
  • Ceph
  • and more...

Storage & Desktop

  • Synology NAS (DSM)
  • HPE Nimble Storage
  • HPE Alletra 10000
  • Windows Desktop
  • Linux Desktop
  • and more...

Network & Hardware

  • DrayTek routers and firewalls
  • Arista switching
  • Mellanox / NVIDIA networking
  • Juniper / HPE Aruba (JunOS)
  • Ubiquiti (UniFi, EdgeMAX)
  • HPE servers (iLO, firmware)
  • and more...

What an Engineer Does

Each maintenance visit, whether scheduled or triggered, follows a structured checklist for that asset type. The engineer connects, works through every item, and records the outcome. The result is a verified record, not a presumption.


Security & Patching

  • Apply outstanding OS and package security updates
  • Verify patch application completed cleanly
  • Apply vendor firmware updates (network devices, HPE iLO, drives)
  • Review installed packages and remove unnecessary attack surface
  • Check open ports and exposed services against expected baseline
  • Review user accounts, sudo access, and SSH configuration

Logs & Health

  • Review system logs and application logs for errors, warnings, and anomalies
  • Verify log rotation is configured correctly and running
  • Check filesystem usage and clear stale files, temp data, and old packages
  • Review RAID array state; identify degraded arrays, failed members, and rebuild status
  • Check service states, failed systemd units, and scheduled task outcomes
  • Review TLS certificate expiry and renew where required

Backup Verification

  • Confirm backup jobs completed successfully since last visit
  • Test restore of a recent backup to verify restorability
  • Check backup storage consumption and retention policy adherence
  • Verify offsite or cloud copy is current

Network & Hardware

  • Apply firmware updates to routers, switches, and firewalls in maintenance windows
  • Review firewall rules and ACLs for redundant or overly permissive entries
  • Check interface error rates, spanning tree state, and neighbour adjacencies
  • Review VPN tunnel health and IPsec SA state

Asset Profiles

Every managed asset has a YAML profile that describes exactly what is expected on that system. Before an engineer begins a maintenance visit, they have a complete picture of the asset: what should be running, what should not, and what normal looks like. The job is then straightforward: verify everything matches the profile, and investigate anything that does not.


What a Profile Contains

  • Operating system, installed stack, and key package versions
  • Services that must be running and services that must not be present
  • Open ports: what is expected, and whether each is local or internet-facing
  • Network path to the outside world and expected ingress/egress points
  • Expected CPU, RAM, and disk utilisation ranges
  • Authorised user accounts, sudo and administrator access
  • Backup schedule, retention policy, and destination

Why It Matters

The profile is the baseline. An unexpected open port, an unfamiliar user with sudo access, a service that should not be running, or resource usage outside the expected range; all of these are immediately visible because the engineer knows precisely what the system should look like.

We have tooling that takes the profile and automates much of the comparison work: checking open ports against the expected list, detecting new or removed user accounts, flagging unusual file ownerships, identifying services not in the profile, and spotting excessive log file generation. The tooling produces a diff of what has changed or drifted since the last visit, and the engineer's focus goes straight to the things that need investigation rather than manually working through the whole checklist from scratch.

That is what makes the process fast. An experienced engineer can complete a full PM of a Linux server running a LAMP stack in around ten minutes, not a half-day exercise. Ten minutes weekly, monthly, or on whatever schedule suits the asset.

Scheduled and Condition-Triggered

Maintenance work runs on two tracks. Scheduled work fires at defined intervals, daily, weekly, or monthly, depending on the asset type and criticality. Condition-triggered work fires when something changes: a significant CVE is published against software you run, a vendor releases a critical advisory, or monitoring detects a threshold that warrants investigation before it becomes an incident.


Scheduled Maintenance

  • Regular patching windows matched to your change control process
  • Monthly full-estate health review across all registered assets
  • Quarterly deep review: security posture, capacity trends, backup integrity
  • Annual configuration audit against hardening baseline

Condition-Triggered Maintenance

  • CVE published with CVSS score above threshold: patch task raised against affected assets
  • Vendor critical advisory: firmware or configuration review triggered
  • Monitoring alert (RAID degradation, disk failure, service): investigation task auto-raised
  • Backup failure detected: immediate verification and remediation task

Reporting

Every maintenance visit produces a written record: what was checked, what was found, what was done, and whether any items require customer attention or follow-up. Reports are held in the platform and accessible at any time.


  • Per-visit report: checklist outcome for each asset, findings, and actions taken, with engineer sign-off.
  • Patch log: full record of every package, firmware, or OS update applied, including version before and after.
  • Backup verification log: record of each restore test, confirming what was restored and that it was verified clean.
  • Outstanding items: any findings that could not be resolved automatically and require a decision, budget, or change approval.
  • Monthly summary: estate-wide view of maintenance completion, any recurring issues, and trend indicators for capacity or health.

Why It Matters

The majority of serious incidents are not caused by sophisticated attacks or freak hardware failures; they are caused by things that were known about and not acted on. A patch that sat in the queue for three months. A backup that silently stopped running. A RAID array that had been degraded for weeks. A log directory that filled the root filesystem overnight.


Preventative maintenance closes those gaps systematically. The estate is not assumed to be healthy; it is checked, verified, and kept that way. For organisations that need to demonstrate due diligence around security and availability, the maintenance log also provides an auditable record of the work that has been done.

Contact Us