Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let me start by saying I have been forbidden to enable automatic updates on our Ubuntu servers, for both security and regular packages.

When I log into any of my four Ubuntu servers, the welcome message contains this:

39 packages can be updated.
26 updates are security updates.

However, when I run the Nagios plugin that monitors APT, I get:

% /usr/lib/nagios/plugins/check_apt
APT WARNING: 33 packages available for upgrade (0 critical updates). 

I need to know how to properly detect that there are pending security updates, and regular updates. Once I can do that, I plan to write a Nagios script that will return WARNING for pending regular updates, and CRITICAL for pending security updates.

Anyone know how to detect those two conditions?

share|improve this question
up vote 7 down vote accepted

The Nagios plugin /usr/lib/nagios/plugins/check_apt does not detect critical updates in Ubuntu correctly due how it detects critical updates via apt combined with how Ubuntu non-critical updates are published. More details are in the bug here:

Using /usr/lib/update-notifier/apt-check instead is a reliable workaround.

share|improve this answer

Turns out that the number of pending regular updates can be found using:

/usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 1

And the number of pending security updates can be found using:

/usr/lib/update-notifier/apt-check 2>&1 | cut -d ';' -f 2

In the end, my Nagios plugin was as follows:

# Standard Nagios plugin return codes.

# Query pending updates.
updates=$(/usr/lib/update-notifier/apt-check 2>&1)
if [ $? -ne 0 ]; then
    echo "Querying pending updates failed."

# Check for the case where there are no updates.
if [ "$updates" = "0;0" ]; then
    echo "All packages are up-to-date."
    exit $STATUS_OK

# Check for pending security updates.
pending=$(echo "${updates}" | cut -d ";" -f 2)
if [ "$pending" != "0" ]; then
    echo "${pending} security update(s) pending."

# Check for pending non-security updates.
pending=$(echo "${updates}" | cut -d ";" -f 1)
if [ "$pending" != "0" ]; then
    echo "${pending} non-security update(s) pending."

# If we've gotten here, we did something wrong since our "0;0" check should have
# matched at the very least.
echo "Script failed, manual intervention required."
share|improve this answer

Why not simply using the apt-get command?:

apt-get -s dist-upgrade | grep "^Inst" | grep -i security | wc -l
share|improve this answer
This hack will not reliably distinguish between security and non-security updates. For example, on Ubuntu, security updates are also published to the updates pocket. If the updates pocket is listed first in sources.list, your suggestion will lead to missing security update notifications. apt will choose to download them from the updates pocket instead, and so your grep will miss them. – Robie Basak Jan 25 at 1:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .