Minor Release Upgrades

Minor release upgrades (e.g., EL 9.3 to 9.4) are the most common maintenance operation. This guide covers the complete dnf update workflow including pre-checks, execution, verification, and rollback.

Checking Available Updates

Before performing an upgrade, review what packages have updates available.

List All Available Updates

dnf check-update

This command returns exit code 100 when updates are available, 0 when there are none, and 1 on error.

View Security Updates Only

dnf updateinfo list security

View Update Details

dnf updateinfo info --advisories=ALSA-2025:1234

View Update Summary

dnf updateinfo summary

Performing the Minor Release Upgrade

Standard Full Update

dnf update -y

Install Security Updates Only

dnf update --security -y

Exclude Specific Packages

dnf update -y --exclude=kernel* --exclude=php*

Dry Run (No Actual Installation)

dnf update --assumeno

Kernel Update Considerations

Kernel updates install alongside existing kernels rather than replacing them.

Check the Currently Running Kernel

uname -r

List Installed Kernels

rpm -qa kernel-core | sort -V

Update Only the Kernel

dnf update kernel -y

A reboot is required to use the new kernel after updating.

Using needs-restarting

The needs-restarting tool determines which services or the system itself need a restart after updates.

Install needs-restarting

dnf install -y yum-utils

Check If a System Reboot Is Required

needs-restarting -r

Exit code 0 means no reboot required; 1 means a reboot is needed.

List Services That Need Restarting

needs-restarting -s

Batch Restart Affected Services

needs-restarting -s | xargs -I {} systemctl restart {}

Rollback Strategy

View dnf History

dnf history list

View Details of a Specific Transaction

dnf history info <transaction-ID>

Undo a Specific Transaction

dnf history undo <transaction-ID> -y

Rollback to a Point in Time

dnf history rollback <transaction-ID> -y

Kernel Rollback

If a new kernel causes problems, select the old kernel from the GRUB menu at boot time.

grubby --set-default /boot/vmlinuz-<old-version>

Scheduling Maintenance Windows

Recommended Maintenance Workflow

Notify — Inform relevant teams at least 48 hours in advance
Backup — Create system snapshots or back up critical data
Pre-test — Validate updates in a test environment
Execute — Perform updates within the maintenance window
Verify — Check service status and functionality
Rollback readiness — Confirm that the rollback plan is viable

Create a Pre-Update Snapshot (LVM)

lvcreate -s -n pre-update-snap -L 10G /dev/vg0/root

Automated Update Script

#!/bin/bash
set -e

echo "=== Maintenance update started: $(date) ==="

# 1. Record current state
rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /root/pkg-before.txt

# 2. Perform update
dnf update -y

# 3. Record post-update state
rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort > /root/pkg-after.txt

# 4. Show changes
echo "=== Package changes ==="
diff /root/pkg-before.txt /root/pkg-after.txt || true

# 5. Check if reboot is needed
if ! needs-restarting -r &>/dev/null; then
    echo "*** System reboot required ***"
fi

echo "=== Maintenance update completed: $(date) ==="

Set Up Automatic Security Updates (Optional)

dnf install -y dnf-automatic

# Configure to only apply security updates
sed -i 's/^upgrade_type.*/upgrade_type = security/' /etc/dnf/automatic.conf
sed -i 's/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf

systemctl enable --now dnf-automatic.timer