This article covers rebooting Linux devices from Automox, including the behavior that differs from Windows and macOS. If you want the general procedure for building a reboot Worklet on any operating system, see Creating a Reboot Worklet.
Consider the patch policy setting first
A separate reboot Worklet is often unnecessary. A patch policy with automatic restart enabled will restart a Linux device if any update in that policy's run flagged the device as needing a restart, checked after the run completes. That is the simpler option when your goal is to finish patching cleanly.
Use a reboot Worklet when you need to restart devices independently of a patch run, for example to clear devices that are already sitting in a pending reboot state. See Patch Policy Automatic Restart Handling for Linux OS.
Linux reboots give the user no warning
This is the most important difference to plan around. Restart notifications and deferrals are available on Windows and macOS only. On Linux they are not triggered, so a reboot Worklet or an automatic restart takes effect without prompting anyone and without any option to postpone.
Schedule Linux reboots into a maintenance window and test against a development group before assigning production devices.
Building the Worklet
- In the console go to Manage > Policies and click Create Policy, then select Worklet.
-
Give the policy a clear name and select Linux as the operating system. Assign a development or test group first, not production.
-
Add the Evaluation and Remediation code described below.
- Set a schedule, or leave it unscheduled to run on demand.
-
Under User Notifications, select Force automatic reboot after worklet completion. This setting is what performs the restart.
How this Worklet actually reboots the device
The scripts do not contain a reboot command, which surprises people reading them for the first time. The restart comes entirely from the Force automatic reboot after worklet completion setting in the policy. The code exists only to make the policy evaluate as needing remediation and then complete successfully, so that the automatic reboot fires.
The basic form is:
Evaluation Code: exit 1 Remediation Code: exit 0
An Evaluation Code of exit 1 reports every assigned device as needing remediation, permanently. Combined with a schedule and a forced reboot, that means every device in the group restarts on every scheduled run, whether or not it needed to. That is sometimes what you want. Often it is not.
Rebooting only the devices that need it
Linux reports its own reboot-required state, and Automox reads that same OS-level signal when it marks a device as needing a restart. You can check it in the Evaluation Code so that only devices genuinely pending a reboot are restarted.
On Debian and Ubuntu, the OS creates a flag file when a package requires a restart:
if [ -f /var/run/reboot-required ]; then
echo "Reboot required by the operating system."
exit 1
else
echo "No reboot required."
exit 0
fiOn Red Hat based distributions, needs-restarting -r reports the equivalent, returning non-zero when a restart is needed. It is provided by the yum-utils or dnf-utils package, so confirm it is installed before relying on it:
if ! command -v needs-restarting >/dev/null 2&1; then
echo "needs-restarting not available."
exit 0
fi
if needs-restarting -r >/dev/null 2&1; then
echo "No reboot required."
exit 0
else
echo "Reboot required by the operating system."
exit 1
fiLeave the Remediation Code as exit 0 in both cases. The reboot still comes from the policy setting.
Devices that keep showing as needing a restart
A Linux device that continues to report a pending restart is usually correct rather than mistaken. Kernel updates in particular install and then wait for a restart, and more than one kernel version can accumulate while the device stays up. The status clears once the device actually restarts.
Before assuming this is a reporting problem, check the reboot flag directly on the device using the commands above. If the operating system says a restart is pending, Automox is reflecting that accurately.