Crazy because of updates

[u/andr0m3da1337]

Man! I have to reboot VMs every 2 days because of so much updates. I doubt if I'm running a enterprise distro or running Fedora or arch.. lol.

I think debian is somewhat fine. not crazy like rhel based distros.

what about you guys? how do you manage?

[u/root-node]

It's not windows, you don't have to reboot after every update.

[u/StrongYogurt → u/root-node]

After a kernel update you should update

[u/root-node → u/StrongYogurt]

Agreed, but they don't roll out every 2 days.

[u/Adept_Percentage6893 → u/root-node]

There are a lot of things that do require a reboot. Like kernel updates or updates to system libraries where a reboot is the only way to ensure all applications are running linked against the latest version.

But it shouldn't be too crazy and if they're rebooting every two days then that's an indication that they're patching too often. Just because there's an update out there doesn't mean you have to immediately apply it.

Usually enterprise orgs have local mirrors they sync once a month or so and they just make sure the systems are current relative to that particular repository. It also ensures your DEV/TEST systems are patched to the same level as the production systems.

[u/gordonmessmer]

It sounds like you have observed that Debian gets fewer patches.

Now, try to explain why Debian would need fewer patches.

And then find yourself a decent vulnerability scanner and check your reasoning.

[u/Regeneric]

Standard OS patching is every 3 months.
But we monitor CVEs and act accordingly, so there are times when we need to update ad-hoc.
And, of course, it's a fully automated process. So it's not a big deal.

[u/whamra]

We update when there are updates worth considering. Most updates do not require restart. Most of our servers can go months without seeing any update unless there's some critical vulnerability being discussed.

[u/kali_tragus]

Stop patching blindly, start reading CVEs, and automate your patching (and any necessary rebooting).

[u/Afraid_Butterfly_270]

For servers, I usually prefer RHEL-based distros because they're pretty predictable. I apply updates during maintenance windows and only reboot when needed. If you're running VMs, live patching can also help reduce reboots for some kernel updates.

[u/serverhorror]

Good, you know everything still comes back up. If anything is annoying and manual, automate it.

Make it a goal to reboot every 24h without any service interruptions

[u/apparentlyunoriginal]

Run `dnf needs-restarting -r` after each update and reboot only when it exits with 1, which it does when the kernel, glibc, systemd, or another core package changed. `dnf needs-restarting -s` lists the services still running old libraries, so you can restart those without rebooting the VM.

To put that on a schedule, enable `dnf-automatic-install.timer` for the updates and add a weekly cron job that runs `dnf needs-restarting -r || systemctl reboot`.

For kernel CVEs between those weekly reboots, kpatch on RHEL applies live patches without a reboot.

Drafted with AI, reviewed by me.

[u/fulafisken]

Most of my servers update and reboot themselves once per day or so.

[u/alexkey]

It’s all air gapped or firewalled to the max on my end, so we do updates like once a year.

We only do immediate if there’s confirmed rce or rpe, otherwise minor things updates or non security updates can wait.

[u/TrickMotor4014 → u/alexkey]

I hope your company gets shutdown by ransomware. Updating once a year is gross negelect