checkrestart in debian 13 trixie misreports deleted files causing the vuls function to fail
Author: MrFlibble007Created May 18, 2026Updated Jun 24, 2026
Labelsbug
What did you do? (required. The issue will be closed when not provided.)
Upgraded endpoints from debian 12 to debian 13
What did you expect to happen?
With Fast Root Scan or Deep scan reboot check should not fail
What happened instead?
Failures on multiple machines due to checkrestart output
Example
Warning for 2fauth-01: [Failed to scan need-restarting processes:
github.com/future-architect/vuls/scanner.(*debian).postScan
github.com/future-architect/vuls/scanner/debian.go:259
Failed to LANGUAGE=en_US.UTF-8 checkrestart. status: 1, stdout: 31 non-ignored program(s) or unit(s) need restarting (see checkrestart(8)) The following systemd units started programmes that are using deleted files:
apache2.service:
Program /usr/sbin/apache2 (PID: 1007, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1189, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1190, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1191, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1194, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 1195, CMDLINE: '/usr/sbin/apache2 -k start')
Program /usr/sbin/apache2 (PID: 6261, CMDLINE: '/usr/sbin/apache2 -k start')
auditd.service:
Program /usr/sbin/auditd (PID: 732)
chrony.service:
Program /usr/sbin/chronyd (PID: 884, CMDLINE: '/usr/sbin/chronyd -4 -F 1')
Program /usr/sbin/chronyd (PID: 886, CMDLINE: '/usr/sbin/chronyd -4 -F 1')
cron.service:
Program /usr/sbin/cron (PID: 923, CMDLINE: '/usr/sbin/cron -f')
dbus.service:
Program /usr/bin/dbus-daemon (PID: 755, CMDLINE: '/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only')
exim4.service:
Program /usr/sbin/exim4 (PID: 1187, CMDLINE: '/usr/sbin/exim4 -bdf -q30m')(snipped)
Steps to reproduce the behaviour
I've not quite figured out at what point checkrestart is filled with these, running systemctl try-restart for the services involved temporarily clears the issue.
Configuration (MUST fill this out):
docker based vuls - latest
Comment
I believe the root cause is this bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1083094 however its marked as minor and this is a legacy package.
Can we please switch from checkrestart to needrestart?
Source: future-architect/vuls