How can I tell if a package is safe to update on CentOS?

Question

I have a simple two-node CentOS cluster based on DRBD, Corosync and KVM.
When I try to update its packages via yum it lists something like

Updating:
 clusterlib             x86_64    3.0.12.1-23.el6_2.1          updates     94 k
 corosync               x86_64    1.4.1-4.el6_2.3              updates    188 k
 corosynclib            x86_64    1.4.1-4.el6_2.3              updates    171 k
 drbd83-utils           x86_64    8.3.13-1.el6.elrepo          elrepo     223 k
 glibc                  x86_64    2.12-1.47.el6_2.12           updates    3.8 M
 glibc-common           x86_64    2.12-1.47.el6_2.12           updates     14 M
 kernel-firmware        noarch    2.6.32-220.23.1.el6          updates    6.3 M
 kernel-headers         x86_64    2.6.32-220.23.1.el6          updates    1.6 M
 kmod-drbd83            x86_64    8.3.13-1.el6.elrepo          elrepo     174 k
 libvirt                x86_64    0.9.4-23.el6_2.9             updates    1.5 M
 libvirt-client         x86_64    0.9.4-23.el6_2.9             updates    2.8 M
 libvirt-python         x86_64    0.9.4-23.el6_2.9             updates    308 k
 matahari               x86_64    0.4.4-12.el6_2               updates     18 k
 matahari-agent-lib     x86_64    0.4.4-12.el6_2               updates     40 k
 matahari-broker        x86_64    0.4.4-12.el6_2               updates     25 k
 matahari-host          x86_64    0.4.4-12.el6_2               updates     43 k
 matahari-lib           x86_64    0.4.4-12.el6_2               updates     43 k
 matahari-network       x86_64    0.4.4-12.el6_2               updates     36 k
 matahari-service       x86_64    0.4.4-12.el6_2               updates     51 k
 matahari-sysconfig     x86_64    0.4.4-12.el6_2               updates     32 k
 qemu-img               x86_64    2:0.12.1.2-2.209.el6_2.5     updates    338 k
 qemu-kvm               x86_64    2:0.12.1.2-2.209.el6_2.5     updates    1.2 M
 qpid-cpp-client        x86_64    0.14-14.el6_2                updates    996 k
 qpid-cpp-client-ssl    x86_64    0.14-14.el6_2                updates    106 k
 qpid-cpp-server        x86_64    0.14-14.el6_2                updates    990 k
 qpid-cpp-server-ssl    x86_64    0.14-14.el6_2                updates     58 k
 qpid-qmf               x86_64    0.14-7.el6_2                 updates    410 k

How can I tell if updating a particular package would imply some kind of downtime? (For example, requiring to reboot a VM or the whole machine)

Answer 1

Restarting a service is pretty much always required after updating said service.
If youre asking whether this restart is performed automatically by yum during the update, then there is no guaranteed way to know (short of extracting the RPM preinstall/postinstall scripts of every package). The RPM preinstall/postinstall script can do whatever it wants.

Your best practice should always to be to have development/test environments which mirror production so that you can perform tests like this in those environments first.
Not only is this good to determine if the package upgrade will cause a service restart, but it will also let you find any incompatibilities or issues that would arise before going into production.

Answer 2

kmod-drbd83 is your DRBD-Kernel-module. If this update should be made active you have to unload it (i.e. stop drbd). This would imply a downtime for drbd.

After a glibc-update you should reboot, too.

So switch or fail over all services, install the updates, reboot and fail back.

Answer 3

In most cases you will not have to reboot the server, but rather a service will be restarted in the update process. That being said, looking at your update list, I see you have kernel updates which almost always require a reboot of the server to load the new kernel.

Answer 4

If you had not manually changed any repositories then it is safe to install these updates. For downtime, before installation, yum will inform you about this. Or least, post installation, it will ask you what to do