On a Ubuntu 12.04 webserver we´re sending a nigthly report about upgrades for this machine running a cron with upgrade in dry run

apt-get update && upgrade --dry-run

In past we created a snapshot and after that run all of the upgrades. A bit worried that an upgrade could break something we´re now thinking about not upgrading every package apt-get tells us. This brings confusion which is the best way to go.


  1. it common to upgrade every package apt-get tells us? - or only to defined packages

    apt-get install --only-upgrade packagename

    If we only upgrade defined packages will apt-get still care about dependencies?

  2. If it´s adviseable to not run every available upgrade for this machine is it better to run only defined upgrades as written above or to hold back packages with:

    apt-mark hold package_name

  3. If none of them is best practise (define or hold packages) is it adviseable to check for security upgrades only with

    apt-get -s dist-upgrade |grep "^Inst" |grep -i securi

    and run them with

    apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install

  • 1
    It is generally advisable to regression test upgrades in a lab environment before pushing them to production. – user9517 Sep 5 '14 at 12:35

Yes, it is common to update everything. Do you know how messy administration is going to be if you are holding back random packages across your environment?

The solution is to perform all your upgrades in a staging environment and test everything to make sure everything still works before rolling to prod.

| improve this answer | |
  • ok thanks and point 3 (security upgrades only) is also not a good practice? – t Book Sep 5 '14 at 12:42
  • Hi Peter, once again me. Yes performing upgrades before this on a staging server makes sense, but do really bigger companies have the time and money to run everything on an identic server? Thats why I asked if there is a best practise to not upgrade everything but security. – t Book Sep 5 '14 at 14:05
  • @tBook i guess if you had to choose few to install, it would be best to install the security ones first. If you don't have the time or finances to have a staging env, then you can do whatever you like, I guess (yes, you can update packages on a per-package basis). Going to be very tricky if you ever need to do a distro upgrade. – Peter Sep 5 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.