How to determine which processes are running on outdated packages and needs restarting?

Question

So, I know that it is possible to view or recover deleted files that are currently being used by a process. I've found out that this also applies to packages that were updated. So, let's say we update a package, but that package is still being used by another process and ultimately running on an older version of that package since it has not been restarted. So, my question is, how do we determine the processes that are running on an older version of that package due to it not being restarted?

Answer 1

Shared libraries inodes are registered in /proc/PID/maps, i.e. for nginx running on Fedora 36:

7f9190a00000-7f9190a9a000 r--p 00000000 103:04 794344                    /usr/lib64/libstdc++.so.6.0.30

The format of this file is explained here.

Basically the fifth field is the inode number. Once you update libraries, you have to traverse /proc/[0-9]+/maps and check whether individual shared libraries correspond to their real filesystem counterparts. To get the real file inode number you could use ls --inode /path/file or stat --printf=%i /path/file.

Here's a script which I've just penned which shows such processes:

#! /bin/bash

cd /proc || exit 1

for i in [0-9]*; do
    test ! -d $i && continue # PID could have already died
    awk '$6 ~ /\// {print $5" "$6}' "$i/maps" | sort -u | while read inode_p so; do
            if [ -f "$so" ]; then
                inode_r=`stat --format=%i "$so"`
                test "$inode_p" != "$inode_r" && echo "PID $i `cat $i/comm` maps stale file '$so'"
            fi
    done
done

It shows all mapped files issues. If you want to limit it to shared libraries only, replace -f "$so" with -e "$so".