Disabling Ubuntu Unattended Upgrades on Zixi Broadcaster Hosts

disclaimer whether unattended upgrades should remain enabled is a decision for your network and it security teams, not a zixi recommendation automatic security patching reduces exposure to unpatched vulnerabilities, but as this ticket shows, it can also restart the broadcaster process (or the host itself) without warning and interrupt live outgoing streams the steps below let you keep os security updates flowing while controlling when the restart happens please make sure to review them against your own security policy before applying broadcaster instances running on customer managed ubuntu hosts can restart unexpectedly when the os applies an unattended (automatic) security update that includes a kernel or systemd package update requiring a reboot, or that triggers a service restart via needrestart this is an os level behavior, separate from zixi there is no zixi side auto update mechanism broadcaster software upgrades only occur when explicitly initiated through zen master’s install version screen or manually on the box, and every such event is logged this guide covers how to convert unattended upgrades from a surprise reboot into planned maintenance, on ubuntu hosts you manage yourself (aws, on prem or otherwise) root cause ubuntu's unattended upgrades package runs its scheduled apt daily upgrade service, installs an update and triggers an automatic reboot / service restart this in turn restarts the zixibc service (and the host machine if a reboot required package was involved) and interrupts streams resolution there are two independent settings to change you can apply either one on its own but applying both is a good option option a stop unattended upgrades from automatically rebooting the host option b tell needrestart not to restart the zixibc service when packages are updated, even without a reboot applying both means package security updates can still install in the background (recommended don’t fully disable security patching) but neither the host or the zixi service can then restart without your confirmation you can then restart the service yourself during a planned maintenance window step by step step 1 disable automatic reboot first check whether unattended upgrades is configured to reboot the host automatically after installing updates edit the unattended upgrades config file and set automatic reboot to false sudo nano /etc/apt/apt conf d/50unattended upgrades find or add the following line and set it to "false" unattended upgrade automatic reboot "false"; save and exit this stops the automatic reboot from occurring the host will flag that a reboot is pending (visible via /var/run/reboot required) instead of rebooting itself, so you can schedule it at a convenient time step 2 ubuntu configuration check if needrestart is configured to automatically restart the zixibc service when its dependent packages are updated this can restart the broadcaster even without a host reboot edit the needrestart config and add an override so zixibc is left unaffected sudo nano /etc/needrestart/needrestart conf under the $nrconf{override rc} section, add \# zixi service — exclude from automatic restart qr(^zixibc\\ service$) => 0, save and exit step 3 (optional not recommended) fully disable unattended upgrades check with your it and security teams before taking these steps to confirm if they would prefer to control all os patching manually rather than let security updates install automatically in the background reconfigure the package outright sudo dpkg reconfigure plow unattended upgrades select “no” when prompted note this stops automatic security patching entirely you will need a separate process to keep the host patched most customers prefer steps 1 and 2 over this option, since it keeps security updates flowing while removing the disruptive restart step 4 verify the change verify the settings are in place after editing both files grep automatic reboot /etc/apt/apt conf d/50unattended upgrades grep a2 override rc /etc/needrestart/needrestart conf check the first command returns false check the second command shows the zixibc service exclusion line inside the override rc block quick reference file setting effect /etc/apt/apt conf d/50unattended upgrades unattended upgrade automatic reboot "false"; host no longer reboots itself after updates /etc/needrestart/needrestart conf qr(^zixibc\\ service$) => 0, under override rc zixibc service is not auto restarted by needrestart n/a (package level) dpkg reconfigure plow unattended upgrades → no unattended upgrades disabled entirely (optional) decision tree if the broadcaster restarts continue after applying the fix, work through this before opening a new support ticket restart correlates with apt daily upgrade service in syslog? > yes > recheck steps 1 & 2 were saved correctlyl confirm with the verification commands in section 4 no apt daily upgrade entry, but restart still occurs on a schedule? > yes > check for aws side events (ie schedule maintenance, instance retirement, auto scaling) via cloudtrail / the ec2 console for the affected instance id no os level or aws level event found? > escalate to zixi support using the checklist below escalation checklist when escalating to zixi support, include the following broadcaster instance name(s) affected (e g zb distrib aws ire1) exact restart timestamp(s), in utc confirmation of whether steps 1–2 (section 3) have already been applied syslog excerpt covering the restart window (look for apt daily upgrade service entries) aws instance id and region, plus cloudtrail/ec2 console findings if checked broadcaster version involved whether the restart caused an outgoing stream interruption and for how long