Last week there were a fair few comments on a slashdot article about whether Unix (or Linux) machines ever need to be rebooted. More than a few of the commenters mentioned having machines with uptimes of several years.
As I understand it, linux boxes need to be rebooted fairly often to apply kernel patches, especially security related ones (such as the ac1db1tch3z exploit). Running uname -r after a 'yum update kernel' seems to show that the old kernel isn't loaded until a reboot.
My question is, how are these boxes achieving multiple year uptimes given this? A few possible solutions I've thought of
- The machines aren't production and/or exposed to users so the security patches aren't as much of a concern.
- All of the posters are using live patching services such as Ksplice
- The kernel security patches can be applied by reloading modules rather than the entire kernel.
- uname -r is reflecting incorrect information after a kernel patch, and the updated kernel is loaded after all.
Are any of these explanations reasonable, or is there something I'm missing in my understanding? Is there another way to minimize the two dozen or so reboots necessary from the last two years?