Hacker News Reader

Comment by pureagave | Hacker News Reader

In the late ‘90’s I used to brag about my Linux uptime being over a year. And that was a system was directly exposed to the internet. I can’t imagine how many unknown security holes it had during that time.

View on HN

These days it's still possible to patch and have a high kernel uptime due to in-kernel Kernel Live Patching (KLP) support. I've written a few KLP patches to solve kernel bugs without rebooting just because rebooting every system takes a long time to complete.

I'm not a systems person and pretty new using Linux, so have a lot to learn. I have Ubuntu installed on a computer here at home and recently enabled Canonical Livepatch. I also update whatever needs updating when I SSH in based on the "x packages can be updated. x updates are security updates." messages I get. Some of these require a restart. This isn't a problem for me since I'm just messing around. I'm wondering how this is done in a production environment?

I assume that a lot of the packages I update either don't need to be updated or aren't getting updated on a production server, and therefore less restarts are needed?

Go to /etc/apt/apt.conf.d/ and have a look at 50unattended-upgrades and 10periodic. My 10periodic looks like this:

    APT::Periodic::Update-Package-Lists "1";
    APT::Periodic::Download-Upgradeable-Packages "1";
    APT::Periodic::AutocleanInterval "7";
    APT::Periodic::Unattended-Upgrade "1";

And 50unattended-upgrades:

    Unattended-Upgrade::DevRelease "false";
    Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
    Unattended-Upgrade::Remove-Unused-Dependencies "false";
    Unattended-Upgrade::Automatic-Reboot "true";
    Unattended-Upgrade::Automatic-Reboot-Time "02:00";

No more worrying about updates :)

The highest uptime I've ever seen was a 11yr and change on a Cisco switch on a state university campus. We made up some little commemorative plaques with a CNC router and affixed one to the case before eBaying it. Hopefully it delivered reliable service to the second owner.

Reply on news.ycombinator.com