How to Find Services That Need a Restart After Updates with needrestart

When an update replaces a library such as OpenSSL or glibc, programs that are already running keep using the old copy in memory until they restart. Until then, a patched security hole stays open in Nginx, your database or your app, even though the update shows as installed.

needrestart finds processes using replaced libraries. Ubuntu 24.04 normally installs it and invokes its package-manager hook after package installation or upgrades, not after every apt command. Ubuntu can restart affected services automatically; inspect the installed configuration and arrange a maintenance window before updating a service whose restart would interrupt users.

Before you start

You need an Ubuntu 24.04 server with sudo access. Check that needrestart is installed and up to date:

$ apt policy needrestart

Install the currently supported security update from your configured Ubuntu repositories. A historical minimum version is not a guarantee against later vulnerabilities. Review apt policy needrestart for both the installed and candidate version:

$ sudo apt update
$ sudo apt install needrestart

What happens after an upgrade

Run your updates as usual:

$ sudo apt upgrade

At the end of an upgrade, inspect the report. This shortened illustrative output shows the kinds of entries to look for; service names and actions depend on your server:

Running kernel seems to be up-to-date.

Restarting services...
 systemctl restart cron.service demo-api.service mariadb.service nginx.service ssh.service systemd-journald.service systemd-resolved.service

Service restarts being deferred:
 /etc/needrestart/restart.d/dbus.service
 systemctl restart getty@tty1.service
 systemctl restart systemd-logind.service
 systemctl restart unattended-upgrades.service

User sessions running outdated binaries:
 ubuntu @ session #13: bash[4261], sshd[4197,4260]

The report has three parts:

• Restarting services: services listed here were selected for restart. A database restart can interrupt active connections; verify recovery in the application rather than assuming a package update was disruption-free.
• Service restarts being deferred: these were not restarted, because restarting them on a running system can break logins or the system bus. They keep running old code until you deal with them.
• User sessions running outdated binaries: your own login session, including the SSH connection you’re using. Log out and back in to fix it.

Unattended package upgrades can invoke the same hook. Review their schedule and the effective needrestart restart policy together. Test policy changes on a noncritical service; postponing a restart also postpones loading patched code.

Check for pending restarts at any time

To see what still runs old code without restarting anything, use list mode:

$ sudo needrestart -r l

If a newer kernel is installed but not yet running, a full-screen Pending kernel upgrade notice appears first. Press Enter to dismiss it and see the list. The output looks like this (shortened):

Running kernel seems to be up-to-date.

Services to be restarted:
 systemctl restart mariadb.service
 systemctl restart nginx.service
 systemctl restart ssh.service

Service restarts being deferred:
 systemctl restart systemd-logind.service

For scripts, the batch mode prints one line per item (shortened):

$ sudo needrestart -b

NEEDRESTART-KCUR: 6.8.0-137-generic
NEEDRESTART-KEXP: 6.8.0-137-generic
NEEDRESTART-KSTA: 1
NEEDRESTART-SVC: mariadb.service
NEEDRESTART-SVC: nginx.service

NEEDRESTART-KSTA uses 0 for unknown, 1 for no pending kernel upgrade, 2 for a pending ABI-compatible upgrade and 3 for a pending version upgrade. Review pending kernel changes and schedule the required reboot; an unknown result is not an all-clear.

For monitoring tools such as Nagios, Icinga or a simple cron script, the -p option prints a one-line status and sets the exit code. It exits with 0 only when nothing is pending:

$ sudo needrestart -p

OK - Kernel: 6.8.0-146-generic, Services: none, Containers: none, Sessions: none|Kernel=0;0;;0;2 Services=0;;0;0 Containers=0;;0;0 Sessions=0;0;;0

Finish the restarts

Restart the services in the list yourself, at a time that suits you:

$ sudo systemctl restart nginx.service

Or let needrestart restart everything it’s allowed to restart in one go:

$ sudo needrestart -r a

Deferred services are left alone even then. systemd-logind can be restarted with systemctl, but dbus, the login consoles (getty) and unattended-upgrades are best handled with a reboot during a quiet period.

When a kernel update was installed, the report after apt says so:

Pending kernel upgrade!
Running kernel version:
  6.8.0-137-generic
Diagnostics:
  The currently running kernel version is not the expected kernel version 6.8.0-146-generic.

Only a reboot loads the new kernel:

$ sudo reboot

Afterwards, sudo needrestart -p should report OK again.

Stop automatic restarts for a service

Restarting a database in the middle of the day, or in the middle of the night during automatic updates, may not be acceptable. You can tell needrestart to leave specific services alone and only report them.

Create the file /etc/needrestart/conf.d/50-local.conf with this content:

# Never restart MariaDB automatically; list it instead
$nrconf{override_rc}{qr(^mariadb)} = 0;

The pattern is matched against the service name, so ^mariadb covers mariadb.service. Add one line per service, for example qr(^postgresql) or qr(^my-app). The setting takes effect at needrestart’s next run.

After the next library update, MariaDB moves from the restarted list to the deferred list, while other services are still restarted automatically:

Service restarts being deferred:
 systemctl restart mariadb.service

The service now keeps running old code until you restart it. Plan that restart for your maintenance window, and use sudo needrestart -r l to see which services are waiting.

Switch to list-only mode

To stop all automatic restarts and only get the report, create /etc/needrestart/conf.d/60-list-only.conf:

$nrconf{restart} = 'l';

With this setting effective, needrestart uses list-only mode rather than automatically restarting affected services. Confirm the behavior after a package upgrade on this Ubuntu release, including unattended upgrades. Other package scripts can still restart services independently. Monitor pending restarts and complete them during a maintenance window.

In list-only mode, a pending kernel also brings up the full-screen kernel notice during apt runs in a terminal, and apt waits until you press Enter. Automatic updates are not held up by it. To get the kernel notice as plain text instead, add this line to the same file:

$nrconf{kernelhints} = -1;

To return to Ubuntu’s default automatic restarts, delete the file.

Troubleshooting

“Disabling Ubuntu mode, explicit restart mode configured” appears after apt. This is expected once you set $nrconf{restart}. It only means needrestart is using your setting instead of Ubuntu’s default.

apt or needrestart stops at a “Pending kernel upgrade” screen. A newer kernel is installed. Press Enter to continue, and reboot when you can. The kernelhints line above turns the screen into a text message.

Your SSH session is still listed after sshd was restarted. Existing connections keep their old process. Log out and connect again.

needrestart -p still reports a problem after you restarted everything. Look at the Kernel and Sessions parts of the line. A pending kernel needs a reboot, and outdated sessions clear when those users log out.

Reference: needrestart batch status documentation. Check the documentation for your installed version before applying changes.