Libraries are what gets upgraded most often — and then services whose packages did not change need a restart.
Programs take common code from shared libraries — .so files: OpenSSL, zlib, libc. A library is mapped into the memory of every process that uses it, and after its upgrade each of them holds a deleted file. Going through the maps of every process by hand takes long — needrestart does it: it finds processes with deleted programs and libraries and names their services.
apt calls needrestart by itself after an install — that is set in /etc/apt/apt.conf.d/99needrestart. After dpkg -i you run it by hand.
Find the services with the old library
Last night the libexpat1 library — XML parsing — was upgraded. Look at the package version and ask needrestart which services need a restart.
First, predict
Only the libexpat1 package was upgraded; the service packages did not change. Which services will needrestart name?
Now start the exercise, run the command and compare your prediction with the output.
One upgrade cannot be applied by restarting services — the kernel. It is loaded when the machine starts and runs until shutdown. A new kernel is installed next to the old one, in /boot, and the one running is the kernel the machine booted with: uname -r prints its version. needrestart compares them in the NEEDRESTART-KCUR line — the running kernel — and NEEDRESTART-KEXP — the newest one installed. After a kernel install the /run/reboot-required file appears too: the server needs a reboot.
After the nightly updates sudo needrestart -b prints NEEDRESTART-KCUR: 6.8.0-124-generic and NEEDRESTART-KEXP: 6.8.0-130-generic. What will you do?
-
Services run on top of the kernel, and restarting them does not change it:
uname -rstays6.8.0-124-generic. -
daemon-reexecrestarts systemd itself, and the kernel stays the same:uname -ris6.8.0-124-generic. -
The running kernel is the one in
KCUR— 124. The installed 130 starts working only after booting with it.
The kernel is loaded once when the machine starts, so a new kernel starts working only after a reboot. You schedule it for a time when the downtime hurts least.