Updating CentOS Stream 9: When to Reboot? Using needs-restarting Effectively – ITFROMZERO

Table of Contents

The “Updated but Not Running” Issue on Linux

When I first started out, I thought that typing dnf update -y and seeing the progress bar reach 100% meant everything was done. Reality was much harsher. Once, I updated OpenSSL to patch an urgent security flaw, but when I rescanned for vulnerabilities, the system still reported it as unpatched. The reason was simple: old processes were still loading the old libraries in RAM. Even though the new patch was on the disk, it hadn’t been activated yet.

Recently, while helping migrate a system from CentOS 7 to CentOS Stream 9, I noticed many people still forget the post-update check. If you don’t reboot the entire server, you need to know exactly which service is still “clinging” to the old code. This is where the dnf-plugins-core toolkit, specifically the needs-restarting command, comes into play.

What are dnf-utils and needs-restarting?

On CentOS Stream 9, dnf is the default package manager. To use advanced features, we need to install dnf-plugins-core (the new name for dnf-utils). This package provides tools to manage repositories and check system status in great detail.

The needs-restarting command scans all running processes and compares them against the executables on disk. If it detects that a .so library has been updated but a process is still using the old version, it will immediately alert you.

Installing dnf-utils on CentOS Stream 9

Many Minimal installations of CentOS Stream 9 often omit this toolkit. You can quickly add it using the command:

sudo dnf install dnf-plugins-core -y

Once installed, you’ll have access to powerful commands like config-manager and needs-restarting.

3 Ways to Use needs-restarting to Control Your System

Don’t reboot your server blindly. On production systems, every second of downtime is valuable. I usually use the following three options to make informed decisions.

1. Check if a Reboot is Mandatory

When updating the Kernel, the only way to apply it is to restart the machine. Use the flag -r to check:

needs-restarting -r

The result will be very clear:

If nothing appears: Your system is fine; no reboot is needed yet.
If the message “Reboot is required” appears: It’s time to schedule maintenance.

2. List Specific Services that Need a Restart

This is the most valuable feature. Instead of restarting the whole machine, you might only need to restart Nginx or MariaDB. Use the flag -s:

needs-restarting -s

For example, after updating glibc, the returned list often includes:

# Actual output:
nginx.service
httpd.service
sshd.service

At this point, you just need to run systemctl restart <service_name> to refresh them.

3. Find the Process ID (PID) Using Old Files

If you run custom apps that aren’t managed via systemd, run the command without any flags:

needs-restarting

The command will list detailed PIDs and file paths. This helps you identify exactly which application is running “vintage” code so you can intervene manually.

Real-world Operational Experience

To ensure the server is always secure without causing unreasonable downtime, I usually follow a 4-step checklist:

Update: Run dnf update during off-peak hours (usually 2 AM).
Check reboot: Use needs-restarting -r to see if a full system reboot is necessary.
Check services: Use needs-restarting -s to filter the list of affected services.
Rolling updates: Prioritize reload first. If needs-restarting still reports issues, then perform a restart.

Once, I updated a system library and the list of services needing a restart was 20 items long. I used a short script to handle it quickly:

# Automatically restart services (Check the list carefully before running)
for svc in $(needs-restarting -s); do
    sudo systemctl restart $svc
    echo "Done: $svc"
done

Warning: Never run this script with large databases like PostgreSQL or MySQL without notifying the Dev team first, as it will cause abrupt disconnections.

A Few Small Notes

The needs-restarting command sometimes gives false positives. The most common case is when a process is holding an old log file that has been deleted by logrotate.

On CentOS Stream 9, the command may take 5-10 seconds to complete because it has to scan the entire /proc directory. This is normal behavior, not a sign that the server has frozen.

Summary

Server administration isn’t just about installing packages and being done. Mastering dnf-utils ensures that security patches are actually working. Get into the habit of checking after every update. It not only keeps the system stable but also demonstrates your professionalism.