Avoiding Full Reboots on CentOS After dnf Updates with needs-restarting

The problem after a dnf update

On CentOS, running dnf update replaces binaries and shared libraries while the host keeps running. Processes that were started before the update continue to map the old files on disk. The files may be deleted or replaced, creating a stability and security gap until the process is restarted. A full reboot fixes it, but it is often unnecessary and disruptive.

The useful takeaway is to identify only the processes that actually need a restart after an update, and to know when a reboot hint is warranted, instead of rebooting by default.

How needs-restarting works on CentOS

The command needs-restarting is provided by dnf-utils on CentOS Stream. It scans running processes for open file handles to files that have been deleted or replaced by a recent package transaction.

Run it as root on the target host. Verify the tool is present first:

dnf install dnf-utils
needs-restarting --help

On older CentOS releases the equivalent lived in yum-utils, so the package name and path can differ between major versions. Check the man page for your release with man needs-restarting before automating.

Basic scan:

needs-restarting

This lists PIDs and commands that still reference replaced files. It does not restart anything.

From PIDs to systemd units

Restarting by PID is fragile. The -s flag filters output to systemd unit names, which maps directly to services you can manage.

needs-restarting -s

Run this after updates and before any restarts. The output can be used to build a change set of units to restart, for example httpd, sshd, or custom application units. Restarting a service causes brief downtime, so in production orchestrate restarts through a change process or rolling update rather than restarting everything at once.

A practical way to check the result is to run needs-restarting -s again after you have restarted the listed units. A clean run indicates no remaining processes with replaced files.

When a reboot is actually needed

The -r flag provides a reboot hint. It returns exit code 0 when no full reboot is indicated and exit code 1 when a reboot is recommended, for example after a kernel or glibc update.

needs-restarting -r
echo $?

Scripts can branch on the exit status to create a ticket or schedule a maintenance window. Note the limitation: needs-restarting cannot reliably detect a running kernel change by itself. A kernel update installs a new kernel for the next boot, but the running system stays on the old kernel until restart. Treat a kernel update as a reboot-required event regardless of the tool output.

Trade-offs and limits

needs-restarting only reports processes with open handles to replaced files. It does not detect application-level caches, configuration reload requirements, or services that benefit from a restart even if their files are still valid. Application teams may still require restarts for correctness.

Exit codes and flags have evolved across DNF generations. Test the exact command and flags against the CentOS Stream release you use, and do not assume identical behavior on older CentOS versions.

Actionable closing

After patching with dnf, run needs-restarting -s to get a service-level list, review it, and restart only those units. Check needs-restarting -r for a reboot hint, and always schedule a reboot after kernel or glibc updates. Keep the check in a test VM first, compare before and after restart, and document which services are expected to be restart-sensitive in your environment.