Does it need a reboot?

Installing an update replaces files on disk. Programs that are already running keep the old code in memory until they restart, and the kernel keeps running until you reboot. Here is how to see what is still running old code.

Published 30 October 2026. Ubuntu and Debian servers using apt. The reboot-required file comes from Ubuntu's update-notifier-common; needrestart is in both distributions.

• Why updates aren't done when apt finishes
• The reboot-required file
• Check the running kernel
• Find services running old code with needrestart
• Restart services safely
• Reboot at a time you choose

Why updates aren't done when apt finishes

When apt upgrades OpenSSL, the new library lands on disk. Nginx, which loaded the old one at start, keeps using the old copy in memory. The hole you just patched stays open in that process until it restarts. The kernel is the extreme case: a new kernel package does nothing until the machine boots into it.

So after updates there are two questions. Does the machine need a reboot? And which services need a restart?

The reboot-required file

On Ubuntu, packages that can't take effect without a reboot (kernels, libc6, dbus and a few others) create a flag file when they are installed. The hooks come from update-notifier-common, which is installed on every Ubuntu flavour.

ls /var/run/reboot-required
cat /var/run/reboot-required.pkgs

/var/run points to /run, so you may also see these as /run/reboot-required. If the first file exists, a reboot is due. The .pkgs file lists the packages that asked for it, which tells you whether it's a kernel or something smaller. Both live in /run, which is cleared at boot, so they disappear once you reboot.

Ubuntu Server also mentions it in the login message (MOTD). That's easy to scroll past, so check the file itself in scripts.

This file is a hint from package scripts, not a full check. It doesn't track every library that running services still hold open. For that, use needrestart.

Check the running kernel

Compare the kernel you are running with the ones installed:

uname -r
ls /boot/vmlinuz-*

If uname -r shows an older version than the newest vmlinuz file, the security fixes in the new kernel are not active yet. Only a reboot changes that. On Ubuntu, Livepatch from Ubuntu Pro can apply some high and critical kernel fixes without a reboot, but you still boot into new kernels eventually.

Find services running old code with needrestart

needrestart looks at running processes, finds the ones that still use deleted or replaced libraries, and maps them to systemd services. It also checks for an obsolete kernel. Install it if it's missing:

sudo apt install needrestart

To only see what would need a restart, without restarting anything, use list mode:

sudo needrestart -r l

Useful flags from the manual page:

• -r l, -r i, -r a: restart mode. List only, ask interactively, or restart automatically.
• -k: only check for an obsolete kernel.
• -l: only check for obsolete libraries.
• -b: batch mode, with plain output that is easy to read from a script.

needrestart also runs at the end of every apt run, including runs by unattended-upgrades. Know what it does there. Since Ubuntu 24.04 it restarts affected services directly, instead of only listing them in non-interactive runs. If a service must never be restarted by apt, add it to $nrconf{override_rc} in /etc/needrestart/needrestart.conf, or in a file under /etc/needrestart/conf.d/.

Restart services safely

A restart is cheaper than a reboot, but it still drops connections. Go one service at a time and check each one before the next:

sudo systemctl restart nginx
systemctl status nginx --no-pager
sudo journalctl -u nginx -n 20 --no-pager

Check the config first when the service has a test mode: nginx -t for nginx, sshd -t for OpenSSH. A restart is when a config that was edited weeks ago and never loaded finally gets read.

Some processes are not safe to restart on a live system, dbus among them. When needrestart lists those, or the kernel is out of date, plan a reboot.

Reboot at a time you choose

A reboot is the only way to be sure everything runs the new code. Before you do it, check that the services you care about are enabled to start at boot (systemctl is-enabled nginx) and that your containers have a restart policy. After the reboot, check uname -r again and confirm the flag file is gone.

If you let unattended-upgrades reboot for you, it uses this same reboot-required file as its signal. Doing it by hand once first tells you whether the server comes back on its own.

Sources

1. Ubuntu Discourse: Ubuntu .deb maintainer scripts, hooks and triggers (reboot-required)
2. needrestart(1) manual page (Ubuntu 24.04)
3. Ubuntu Discourse: needrestart changes in Ubuntu 24.04: service restarts
4. Ubuntu Pro client docs: Exploring your system's security with Pro (Livepatch)
5. sshd(8) manual page (Ubuntu 24.04)