Run needrestart on Debian and Ubuntu, or dnf needs-restarting on RPM systems. Both compare running processes with the files on disk and list the ones still using a replaced library. Restart those services, or reboot if the kernel or core system packages changed.
Why the package update is not the fix
When a package manager replaces a shared library, programs that already loaded the old copy keep using it until they restart. A patched OpenSSL on disk protects nothing if your web server has been running since last month. This is the gap between "installed" and "in effect," and scanners that read package databases cannot see it.
On Debian and Ubuntu
The needrestart manual says it checks which daemons need to be restarted after library upgrades. It has three modes:
| Mode | Behaviour |
|---|---|
| list | Reports affected services without restarting them |
| interactive | Prompts before restarting; falls back to list mode when run non-interactively, for example from unattended-upgrades |
| automatic | Restarts affected services without prompting |
A kernel check is also available. To look without changing anything:
sudo needrestart -r l
sudo needrestart -k
The Ubuntu Server documentation adds that since Ubuntu 24.04 LTS, needrestart restarts the affected services automatically by default, skipping a built in list such as the display manager. Check what your release does before assuming either way.
Debian's security FAQ points to checkrestart from the debian-goodies package for the same job.
On Fedora and RHEL style systems
The dnf needs-restarting plugin reports processes that use files from packages updated after the process started. Three options are useful:
dnf needs-restarting
dnf needs-restarting -s
dnf needs-restarting -r
The first lists processes. The second lists only the affected systemd services. The third reports only whether a reboot is needed, and returns exit code 1 if so and 0 if not, which makes it easy to use in a script or monitoring check.
Protect services you cannot bounce mid day
Ubuntu's documentation shows how to keep a critical service from restarting automatically: add a file under /etc/needrestart/conf.d/ and override the restart behaviour for that service, or set the restart mode to list only. Then restart it in your maintenance window.
A simple routine
- Apply updates.
- Run the restart check in list mode.
- Restart services in order, least critical first.
- Reboot if the check says the kernel or core packages changed.
- Record the time of the restart, not just the time of the update.
Step five matters for evidence. A patch date with no restart date overstates your position.
Containers and managed platforms
In containers the same idea has a different shape. You do not restart services inside a running container after updating a library. You rebuild the image and replace the container, which restarts everything with the new code. On a managed platform, the provider handles host level restarts, and your job is to redeploy your own code when a dependency changes.
Quick check
Does apt upgrade restart services?
Not by itself. needrestart, which runs as a hook on Debian and Ubuntu, is what lists or restarts them.
Is a restart always required?
No. The DNF documentation notes that processes often keep working after an update, but security updates often call for a restart, so treat the list as a to do list.
Safeguard's asset discovery and SBOM scanning show which packages and versions are present, so you know what to check after each patch cycle.
Sources
- needrestart manual (Debian)
- Automatic updates (Ubuntu Server documentation)
- dnf needs-restarting (DNF plugins)
- Debian security FAQ
Last reviewed: 19 October 2026.
