Checking whether a Linux host needs a reboot or a service restart after updates

Goal

After applying package updates, determine whether the host needs a full reboot (kernel or core library changed) or only specific services restarted (a shared library changed but the kernel did not), without guessing.

Prerequisites

Root or sudo access; updates already applied via the distribution's package manager.

Steps

1. On Debian and Ubuntu, check for the marker file the update tooling itself writes: test -f /var/run/reboot-required && echo "reboot required". The file is written by package hooks, not by apt itself — on Ubuntu by update-notifier-common, on Debian by the kernel hook of unattended-upgrades — so on a Debian host without those packages its absence proves nothing. Where needrestart is installed it can additionally restart affected services after an upgrade, configured in /etc/needrestart/needrestart.conf and drop-ins under /etc/needrestart/conf.d/.
2. Still on Debian/Ubuntu, or as a cross-check anywhere needrestart is installed, run it directly to list (or, with the right mode, restart) services using now-outdated files: needrestart -b for a non-interactive, batch-style report suitable for scripting.
3. On RHEL, Fedora and other DNF/YUM-based systems, use the needs-restarting capability of dnf-plugins-core (or yum-utils): dnf needs-restarting -r (or yum needs-restarting -r) exits 1 if a reboot is recommended and 0 if not, making it directly usable in a script's exit-code check; drop -r to instead list the individual processes using deleted or updated files. Fedora 41 and later ship DNF5, whose needs-restarting takes different options; check dnf needs-restarting --help there instead of assuming the DNF4 flags.
4. On any systemd-based distribution regardless of family, compare the currently running kernel against the newest one installed: uname -r gives the running kernel release; compare it against the latest entry from rpm -q kernel --last (RHEL family) or dpkg -l 'linux-image-*' / ls /boot/vmlinuz-* (Debian family). A mismatch means a kernel update is installed but not yet running.
5. Decide the action from the combined evidence: a kernel or glibc mismatch calls for a reboot; a needs-restarting/needrestart list naming only specific services calls for restarting just those (systemctl restart <unit> for each).

Expected result

A clear yes/no on reboot, backed by either the marker file or a kernel-version comparison, plus an explicit list of any services that need restarting short of a reboot.

Limits and test basis

Based on the Ubuntu Server documentation's automatic-updates page and the dnf-plugins-core needs-restarting plugin documentation, with uname(1) for the kernel-version comparison. /var/run/reboot-required is Debian/Ubuntu-specific tooling behavior, not a kernel or systemd feature, so its absence on another distribution family says nothing; always fall back to the kernel-version comparison, which works everywhere. There is nothing to undo in checking; the reboot or service restart it recommends is the action, and it can be deferred to a maintenance window once identified.