Ubuntu 12.04 production server upgrade

Question

On a Ubuntu 12.04 webserver we´re sending a nigthly report about upgrades for this machine running a cron with upgrade in dry run

apt-get update && upgrade --dry-run

In past we created a snapshot and after that run all of the upgrades. A bit worried that an upgrade could break something we´re now thinking about not upgrading every package apt-get tells us. This brings confusion which is the best way to go.

Questions:

1. it common to upgrade every package apt-get tells us? - or only to defined packages

   apt-get install --only-upgrade packagename

   If we only upgrade defined packages will apt-get still care about dependencies?

2. If it´s adviseable to not run every available upgrade for this machine is it better to run only defined upgrades as written above or to hold back packages with:

   apt-mark hold package_name

3. If none of them is best practise (define or hold packages) is it adviseable to check for security upgrades only with

   apt-get -s dist-upgrade |grep "^Inst" |grep -i securi

   and run them with

   apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install

Answer 1

Yes, it is common to update everything. Do you know how messy administration is going to be if you are holding back random packages across your environment?

The solution is to perform all your upgrades in a staging environment and test everything to make sure everything still works before rolling to prod.