After running a routine sudo apt upgrade on an Ubuntu server, you may have noticed an interactive prompt asking which system services need to be restarted. This prompt is generated by a utility called needrestart, which scans running processes to determine which ones are still using outdated shared libraries or binaries from before the upgrade. Understanding and correctly using needrestart is essential for maintaining a stable and secure production server, because a service running with an old version of a patched library remains vulnerable until it is restarted.
Why Services Need Restarting After Package Upgrades
When you upgrade a package such as OpenSSL or glibc, the apt package manager replaces the binary files on disk with the new versions. However, any process that was already running before the upgrade continues to use the old version of the library that is still loaded in its memory. This means a critical security patch for OpenSSL will not actually protect your web server until the Nginx or Apache process is restarted and loads the new library from disk. The needrestart utility automates the detection of these stale processes.
Installing needrestart on Ubuntu
On modern Ubuntu Server installations (20.04 LTS and later), needrestart is typically installed by default. If it is missing, you can install it manually.
- Update your package lists:
sudo apt update - Install the package:
sudo apt install needrestart -y
Once installed, needrestart will automatically hook into the apt upgrade process and display its service restart prompts after every package upgrade.
Running needrestart Manually
You do not have to wait for an apt upgrade to check for stale services. You can run the utility at any time to audit your system.
sudo needrestart
The output will list every running service that is using outdated libraries. For each service, needrestart will indicate whether a restart is required and which specific library or binary has been updated. If no services need restarting, it will confirm that the system is up to date.
Configuring Automatic Restart Behaviour
By default, needrestart operates in interactive mode, presenting a dialogue asking you to select which services to restart. On unattended production servers managed via automation tools like Ansible, this interactive prompt can block the upgrade process entirely. You can change this behaviour by editing the configuration file.
- Open the configuration file:
sudo nano /etc/needrestart/needrestart.conf - Locate the line containing
$nrconf{restart}. - Change its value to one of the following options:
'i'— Interactive mode (default). Prompts the user to select services.'a'— Automatic mode. Automatically restarts all affected services without prompting.'l'— List only. Displays which services need restarting but takes no action.
- Save the file and exit nano (Ctrl+O, Enter, Ctrl+X).
For fully automated deployments, setting the value to 'a' ensures that critical security patches are applied to running services immediately after every upgrade without human intervention.
Checking for Pending Kernel Updates
In addition to scanning services, needrestart also checks whether a new Linux kernel has been installed but not yet activated. If a kernel update is pending, the utility will display a prominent warning recommending a full system reboot. Unlike service restarts, a kernel update cannot be applied without rebooting the entire machine. On critical production servers, you should schedule this reboot during a planned maintenance window rather than rebooting immediately.