Chapter 7. Performing post-upgrade tasks on the RHEL 9 system

After the in-place upgrade, clean up your RHEL 9 system by remove unneeded packages, disable incompatible repositories, and update the rescue kernel and initial RAM disk.

7.1. Performing post-upgrade tasks

This procedure lists major tasks recommended to perform after an in-place upgrade to RHEL 9.


and you have been able to log in to RHEL 9.


After performing the upgrade, complete the following tasks:

  1. Remove any remaining Leapp packages from the exclude list in the /etc/dnf/dnf.conf configuration file, including the snactor package, which is a tool for upgrade extension development. During the in-place upgrade, Leapp packages that were installed with the Leapp utility are automatically added to the exclude list to prevent critical files from being removed or updated. After the in-place upgrade, these Leapp packages must be removed from the exclude list before they can be removed from the system.

    • To manually remove packages from the exclude list, edit the /etc/dnf/dnf.conf configuration file and remove the desired Leapp packages from the exclude list.
    • To remove all packages from the exclude list:

      # dnf config-manager --save --setopt exclude=''
  2. Remove remaining RHEL 8 packages, including remaining Leapp packages.

    1. Locate remaining RHEL 8 packages:

      # rpm -qa | grep -e '\.el[78]' | grep -vE '^(gpg-pubkey|libmodulemd|katello-ca-consumer)' | sort
    2. Remove remaining RHEL 8 packages, including the old kernel package, from your RHEL 9 system. For more information on removing kernel packages, see What is the proper method to remove old kernels from a Red Hat Enterprise Linux system?
    3. Remove remaining Leapp dependency packages:

      # dnf remove leapp-deps-el9 leapp-repository-deps-el9
  3. Optional: Remove all remaining upgrade-related data from the system:

    # rm -rf /var/log/leapp /root/tmp_leapp_py3 /var/lib/leapp

    Removing this data might limit Red Hat Support’s ability to investigate and troubleshoot post-upgrade problems.

  4. Disable DNF repositories whose packages are not RHEL 9-compatible. Repositories managed by RHSM are handled automatically. To disable these repositories:

    # dnf config-manager --set-disabled <repository_id>

    Replace repository_id with the repository ID.

  5. Set the current kernel command line arguments to the new default to ensure that future kernel updates boot with correct parameters:

    # BOOT_OPTIONS="$(tr -s "$IFS" '\n' </proc/cmdline | grep -ve '^BOOT_IMAGE=' -e '^initrd=' | tr '\n' ' ')"
    # echo $BOOT_OPTIONS > /etc/kernel/cmdline
  6. Replace the old rescue kernel and initial RAM disk with the current kernel and disk:

    1. Remove the existing rescue kernel and initial RAM disk:

      # rm /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 
    2. Reinstall the rescue kernel and related initial RAM disk:

      # /usr/lib/kernel/install.d/51-dracut-rescue.install add "$(uname -r)" /boot "/boot/vmlinuz-$(uname -r)"
    3. If your system is on the IBM Z architecture, update the zipl bootloader:

      # zipl
  7. Re-evaluate and re-apply your security policies. Especially, change the SELinux mode to enforcing. For details, see Applying security policies.


  1. Verify that the previously removed rescue kernel and rescue initial RAM disk files have been created for the current kernel:

    # ls /boot/vmlinuz-*rescue* /boot/initramfs-*rescue* 
    # lsinitrd /boot/initramfs-*rescue*.img | grep -qm1 "$(uname -r)/kernel/" && echo "OK" || echo "FAIL"
  2. Verify the rescue boot entry refers to the existing rescue files. See the grubby output:

    # grubby --info $(ls /boot/vmlinuz-*rescue*)