Comment 7 for bug 1919929

The problem was caused by inconsistency across multiple units rather than simply needing to run an update. Landscape is OK to tell us when a box needs patches, but that won't tell us that one box is a totally different version of a key application unless we write a very specific query to do so.

We could include the version of a key common package, say neutron-common, in relation data for all Neutron charms. If the versions do not match, issue a warning via an NRPE check - which means that when we update one unit and not the others, we get a warning from the entire set of related charms that there's updates which need to be applied. E.g. we update neutron-api but not neutron-openvswitch, which can cause API version mismatches, we'll at least know that one or more units were missed. Same pattern for other components which must match - Nova has a bunch of similar examples, and the rules are very specific to the application.

This could mean writing a new Nagios plugin, feeding that with something like a minimum version from relation data or the application version information in Juju, and checking the list of packages on the machine against that version, alerting if the package is a lower version than specified.