Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Let me start by saying I have been forbidden to enable automatic updates on our Ubuntu servers, for both security and regular packages.

When I log into any of my four Ubuntu servers, the welcome message contains this:

39 packages can be updated.
26 updates are security updates.

However, when I run the Nagios plugin that monitors APT, I get:

% /usr/lib/nagios/plugins/check_apt
APT WARNING: 33 packages available for upgrade (0 critical updates). 

I need to know how to properly detect that there are pending security updates, and regular updates. Once I can do that, I plan to write a Nagios script that will return WARNING for pending regular updates, and CRITICAL for pending security updates.

Anyone know how to detect those two conditions?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

The Nagios plugin /usr/lib/nagios/plugins/check_apt does not detect critical updates in Ubuntu correctly due how it detects critical updates via apt combined with how Ubuntu non-critical updates are published. More details are in the bug here:

Using /usr/lib/update-notifier/apt-check instead is a reliable workaround.

share|improve this answer

Turns out that the number of pending regular updates can be found using:

/usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 1

And the number of pending security updates can be found using:

/usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 2

In the end, my Nagios plugin was as follows:


# Standard Nagios plugin return codes.

# Query pending updates.
updates=$(/usr/lib/update-notifier/apt-check 2>&1)
if [ $? -ne 0 ]; then
    echo "Querying pending updates failed."

# Check for the case where there are no updates.
if [ "$updates" = "0;0" ]; then
    echo "All packages are up-to-date."
    exit $STATUS_OK

# Check for pending security updates.
pending=$(echo "$updates" | cut -d ";" -f 2)
if [ "$pending" != "0" ]; then
    echo "$pending security update(s) pending."

# Check for pending non-security updates.
pending=$(echo "$updates" | cut -d ";" -f 1)
if [ "$pending" != "0" ]; then
    echo "$pending non-security update(s) pending."

# If we've gotten here, we did something wrong since our "0;0" check should have
# matched at the very least.
echo "Script failed, manual intervention required."
share|improve this answer

Why not simply using the apt-get command?:

apt-get -s dist-upgrade | grep "^Inst" | grep -i security | wc -l
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.