The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

How often should you do Graceful Server Reboot?

Discussion in 'Security' started by yagami_kira, Mar 11, 2017.

  1. yagami_kira

    yagami_kira Member

    Joined:
    Mar 7, 2017
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Tokyo
    cPanel Access Level:
    Website Owner
    Under WHM -->Security Center --> Security Advisor. There's an error saying:

    =====
    Detected processes that are running outdated binary executables.
    Reboot the system in the “Graceful Server Reboot” area. Alternatively, SSH into this server and run ‘/bin/needs-restarting’, then manually restart each of the listed processes.

    =====

    Even after doing Graceful Server Reboot, eventually the above error will appear again. It seems it always happen every time there's a major update to the system. But so far it happens frequently, at least a few times a month. It won't be good if I always do Graceful Server Reboot everytime I see that error since that will always cause a brief downtime.

    The question is in your experiences, generally and practically, how often should one do a Graceful Server Reboot with a good balance of uptime and security ?
     
  2. sktest123

    sktest123 Well-Known Member

    Joined:
    Jan 31, 2017
    Messages:
    69
    Likes Received:
    3
    Trophy Points:
    8
    Location:
    kochin
    cPanel Access Level:
    Root Administrator
    Verify
    /usr/bin/needs-restarting

    Then restart manually the listed services
     
  3. yagami_kira

    yagami_kira Member

    Joined:
    Mar 7, 2017
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Tokyo
    cPanel Access Level:
    Website Owner
    The last time I checked on /bin/needs-restarting, there were about 8 services or processes that need to be restarted. There will also be different commands in restarting each and every one of them of which I don't know how. This will be therefore impractical and time consuming if done manually every time.
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,064
    Likes Received:
    1,287
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    It's important to restart processes that are running outdated binary executables to help prevent the use of exploits on your system. Is there a particular service from the "/usr/bin/needs-restarting" output that you need help with? If so, we're happy to provide guidance.

    Thank you.
     
  5. yagami_kira

    yagami_kira Member

    Joined:
    Mar 7, 2017
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Tokyo
    cPanel Access Level:
    Website Owner
    These are what appears when running the command:

    Code:
    root@host [~]# /usr/bin/needs-restarting
    145 : /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
    1 : /usr/lib/systemd/systemd --system --deserialize 17
    114 : /usr/lib/systemd/systemd-logind
    180 : /usr/sbin/nscd
    152 : /usr/sbin/sshd
    246 : /usr/sbin/atd -f
    13356 : /usr/lib/systemd/systemd-udevd
    139 : /usr/sbin/rsyslogd -n
    237 : /usr/sbin/crond -n
    78 : /usr/lib/systemd/systemd-journald
    I do not know the command though on how to restart each one of them. By the way, will restarting them one by one cause downtime to the web browsing of visitors including disruption of incoming mails?

    I'm eyeing for simple long-term solution. Twice a year we would have an event where there is very few visitors to the site. Is twice a year Graceful Reboot just fine?
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    37,064
    Likes Received:
    1,287
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Some services do require a full reboot of the system. You can use the --reboothint flag to see if that's the case on your system:

    Code:
     /usr/bin/needs-restarting --reboothint
    However, there's no harm in restarting the services that don't require a reboot until you can schedule a good time to reboot the system. For example, you can restart the following services listed in your output without rebooting the system:

    Code:
    /scripts/restartsrv_nscd
    /scripts/restartsrv_sshd
    /scripts/restartsrv_rsyslogd
    /scripts/restartsrv_crond
    
    Access to the services you are restarting should only be limited during the few seconds it takes to complete the restart.

    I'd aim to reboot the system when a new kernel is available, at a minimum. Otherwise, you may want to consider a third-party solution such as KernelCare to avoid reboots during kernel updates:

    CloudLinux - Main | New template

    Thank you.
     
Loading...

Share This Page