Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a sys admin newb, otherwise I would figure this out on my own. I have a slicehost slice and I noticed that there are a couple scripts that get run (the ones I mentioned in my question title) that look like they do system updating. I am wondering if that is not such a good idea to have these automatically run without supervision. The server runs an ecommerce site and any kind of upgrade that broke the server would be unfortunate. Please advise on best practice? Should I save those off somewhere and not have cron fire them unsupervised daily? What exactly are they doing? Thanks!

share|improve this question
add comment

migrated from stackoverflow.com Sep 2 '09 at 4:38

This question came from our site for professional and enthusiast programmers.

3 Answers

Short answer: both /etc/cron.daily/apt and /etc/cron.daily/aptitude are probably safe to leave enabled, and not causing you any unexpected upgrades.

Long answer:

/etc/cron.daily/aptitude on a default Hardy install just maintains a backup of your package state files in /var/backup as files named aptitude.pkgstates.0 through aptitude.pkgstates.6 (with files 1-6 being gzipped).

/etc/cron.daily/apt is more complex, and can do a variety of things based on your apt configuration settings, which are maintained in /etc/apt/apt.conf and the various include files under /etc/apt/apt.conf.d/

If you wonder if the daily apt script is performing unattended upgrades, check the output of this apt-config command. The following is default, and indicates that unattended upgrades are NOT being performed:

$ apt-config shell UnattendedUpgradeInterval APT::Periodic::Unattended-Upgrade
UnattendedUpgradeInterval='0'

For more information on the "unattended upgrade" process (which i would NOT recommend for a production system), see /usr/share/doc/unattended-upgrades/README -- if that file is not present, you probably don't have the package "unattended-upgrades" installed.

The daily apt script at /etc/cron.daily/apt is well commented, and by default it runs an "apt-get update" every day. This simply keeps the cache of available package files current. It does not install or remove packages.

You CAN configure it to download updated package files which you can then manually install later, and you can configure it to clean up the downloaded package files (which are not needed after being installed).

All of this behavior is configured via the configuration settings stored in /etc/apt/apt.conf.d/10periodic -- these settings default to:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "0";
APT::Periodic::AutocleanInterval "0";
APT::Periodic::Unattended-Upgrade "0";

I'd recommend verifying those settings and reading through the scripts that are in place in /etc/cron.daily, but you probably do not currently have anything performing unattended and unexpected upgrades.

share|improve this answer
1  
Wow! Fantastic feedback Jeff, thanks! I will try out your suggestions. –  user18536 Sep 2 '09 at 4:47
    
Running apt-config shell UnattendedUpgradeInterval APT::Periodic::Unattended-Upgrade actually produces no output. Not sure how to interpret that result. Any ideas? –  user18536 Sep 2 '09 at 4:55
    
Well, I looked through the apt script some more and it looks like it is just keeping the cache updated, as you said. I am not 100% confident about that, but nearly. –  user18536 Sep 2 '09 at 5:00
    
if "apt-config shell UnattendedUpgradeInterval APT::Periodic::Unattended-Upgrade" returns no output, then the /etc/cron.daily/apt script will use its internally specified default value for that variable, which is 0, meaning no unattended upgrades should be initiated by that script. –  jeff Sep 2 '09 at 5:04
    
Ok, thanks for the info Jeff. That gives me confidence. –  user18536 Sep 3 '09 at 5:21
add comment

That may not be enough info. You really have to read the scripts themselves to see what they are doing with that particular host. If they are indeed upgrading (vs just updating) you will definitely want to disable that on a production server. However just an update it fine as it is only updating the local cache of available programs from the repository. Some hosts even override the default distribution (hardy) repos with their own for more control. So check them out, but any decent host won't be updating any core components automatically on you. Sorry I don't have any personal experience with SliceHost to share.

share|improve this answer
    
Thanks for the quick response Ryan. The apt script is fairly complicated. It references quite a few externally defined variables that I hope to not chase. Hopefully someone will weigh in who has experience on ubuntu hardy (and perhaps on slicehost). I appreciate y our input though. I am hoping, like you, that it is only keeping downloaded packages fresh, but not installing them. –  user18536 Sep 2 '09 at 4:45
add comment

Since I can't just edit stuff, and didn't like the scattered style here, I went ahead and asked and answered more systematically at this question.

share|improve this answer
    
Ok, thanks, I read your answer there. –  user18536 Sep 3 '09 at 5:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.