Update the system safely

Package updates fix security issues and bugs, but they also change a running system. Treat an important server update as a small deployment.

Prepare before changing packages

Confirm you are on the intended host and check basic capacity:

hostname
df -h /

Make sure current backups are restorable. If the machine serves users, choose a maintenance window or confirm that its services can tolerate a restart.

For a remote server, keep one working SSH session open while you update. Do not close it until a second connection succeeds after the change.

Refresh, review, then upgrade

sudo apt update
apt list --upgradable
sudo apt upgrade

apt update refreshes metadata. The list shows what can change. apt upgrade presents the transaction before applying it.

Read packages that are held back instead of forcing them individually. Ubuntu may phase some non-security updates while monitoring them. A held package is not automatically a broken system.

Verify the running services

An updated package can restart a service. A process can also continue using an old library until it restarts.

Check failed units and the services your application needs:

systemctl --failed
systemctl status nginx --no-pager

Run a real health check too. A green service state does not prove the application returns the expected response.

Ubuntu may report that processes or the kernel need a restart. Check whether a reboot is requested:

test -f /run/reboot-required && cat /run/reboot-required.pkgs

Plan the reboot. Do not reboot automatically in the middle of important work.

Know the recovery path

If a service fails, inspect its journal and package history before making another broad change:

sudo journalctl -u nginx -b --no-pager
less /var/log/apt/history.log

Restore a known configuration or package version only when you understand the dependency impact. A backup or server snapshot is not useful until you know how to restore it.

Try this: write an update checklist for one server: pre-checks, commands, application health check, reboot decision, and recovery contact.