PatchPilot · Guides

How to check whether a Debian or Ubuntu server needs a reboot

On most machines one file answers it: /var/run/reboot-required. Below is where that file comes from, why a Debian server often never writes it, what to check instead, and how to ask the same question of more than one server.

The short answer

if [ -f /var/run/reboot-required ]; then
  echo "reboot required by:"; cat /var/run/reboot-required.pkgs
else
  echo "no reboot requested"
fi

If the file exists, a package asked for a restart when it was installed, and reboot-required.pkgs lists which ones — usually a kernel, sometimes libc6 or systemd. The file lives on a tmpfs, so a reboot is also what removes it.

"No reboot requested" is weaker than "no reboot needed". The file only exists if something on the machine writes it, and on Debian that is not a given.

Where the file comes from

On Ubuntu

The update-notifier-common package — a dependency of ubuntu-server, so present on practically every Ubuntu server — ships a helper that the kernel, libc6 and a handful of other packages call from their install scripts. The *** System restart required *** line you see when you log in is the login banner reading the same file.

On Debian

Debian has no update-notifier. The file is written by a kernel install hook, /etc/kernel/postinst.d/unattended-upgrades, which the unattended-upgrades package ships. Two consequences:

Without unattended-upgrades installed, a Debian server never writes the file. Its absence tells you nothing.
With it, only kernel installs write it. A libc6 or openssl update does not — see needrestart below for those.

When the file is missing: compare kernels

The one check that works everywhere is whether the kernel you are running is the newest one installed:

uname -r
ls -1 /boot/vmlinuz-* | sort -V | tail -n 1

If the second line names a newer version than the first, the machine installed a kernel it has not booted yet. That is the most common reason for a reboot, and the one the file exists to report.

Services, not the machine: needrestart

An updated library does not reach programs that already have the old copy loaded. After an OpenSSL update, a web server that has been running for a month is still serving with the old code until it is restarted — no reboot needed, but no fix applied either. needrestart finds those processes. ubuntu-server recommends it, so it is usually installed; on Debian, apt install needrestart.

sudo needrestart -r l    # list what needs a restart, restart nothing
sudo needrestart -b      # the same, as machine-readable lines

In batch mode, the line NEEDRESTART-KSTA: is the kernel verdict — 1 means the running kernel is current, 2 and 3 mean a newer one is installed and waiting for a reboot, 0 means it could not tell. Each NEEDRESTART-SVC: line is a service still running old code.

On RHEL, Rocky and Alma

The equivalent is dnf needs-restarting -r from dnf-plugins-core: exit status 1 means a reboot is needed, 0 means it is not. It is here for completeness — PatchPilot covers Debian, Ubuntu and the apt-based distributions only.

The same question for more than one server

for host in web-1 web-2 db-1; do
  printf '%s: ' "$host"
  ssh "$host" '[ -f /var/run/reboot-required ] && echo "reboot required" || echo ok'
done

It works, for the moment you run it and for the hosts you remembered to put in the list. The kernel update that makes the answer change arrives on a night when nobody is running loops.

Where PatchPilot comes in

PatchPilot's agent asks this question on every server it runs on, and the dashboard flags each machine that is waiting for a reboot — next to what is pending, what is a security fix, and which release has run out of support.

It never restarts a machine. The flag is ours; pressing the button is yours. More on the PatchPilot home page, and on checking that unattended-upgrades is actually running.