How to determine if Ubuntu system needs a reboot?

Question

I recently applied a kernel patch (mix of Debian 10 and Ubuntu 18.04) using Ansible. I am trying to figure out a way to check if each machine being updated has been, or needs, a reboot. I've read that test -f /var/run/reboot-required is the official indicator however I've noticed this is not always true. Sometimes the file is there after a kernel upgrade, sometimes not. I'm not using LivePatch so any time there is a kernel update, I need to schedule reboots of all these systems.

In ansible, it was straightforward enough to test for the existence of the file above but since that's not consistent, I came up with the bash code below to test the running kernel version against the newest kernel image laying under /boot. This isn't exactly something you can plug right into ansible without a lot of hammering.

Is there a better way to determine if a reboot is needed?

if [[ $(uname -r) != .*"$(ls -1 /boot/vmlinuz* | sort -V | tail -1)"*. ]]; then
   echo "Needs reboot. Running kernel $(uname -r) is older than $(ls -1 /boot/vmlinuz* | sort -u | tail -1)"
fi

Answer 1

Here is what my solution, in case it's of use to anyone else.

---
- hosts: all

  vars:
    kernel_version: "{{ ansible_kernel }}"

  tasks:

    # sort -V specifically sorts software versions :)
    - name: find newest kernel under /boot
      shell   : ls -1 /boot/vmlinuz* | sort -V | tail -1
      register: latest_kernel

    # running kernel does not match latest kernel - can't do <> comparison since text is involved
    - name: test kernel versions different
      when: kernel_version not in latest_kernel.stdout
      debug:
        msg: "WARNING: needs reboot - running kernel {{ kernel_version }} was not found in variable {{ latest_kernel.stdout }}"

Answer 2

My solution is the OP's code with some additional filtering since /boot/vmlinuz.old is always present and to remove /boot/vmlinuz- so the conditional matching is correct:

if [[ $(uname --kernel-release) != "$(ls -1 /boot/vmlinuz-* | sort --version-sort | tail -1 | sed 's/\/boot\/vmlinuz-//g')" ]]; then
  echo "Needs reboot: Running kernel $(uname --kernel-release) is older than $(ls -1 /boot/vmlinuz-* | sort --unique | tail -1 | sed 's/\/boot\/vmlinuz-//g')"
fi