When this happens the output from needrestart is very unhelpful, so it's
good for us to know what to do with this situation.

howto/upgrades.md

@@ -268,7 +268,15 @@ Important notes:
      the `reboot` fabric script might not stop the instance's KVM process on the
      ganeti node so is not enough)
 
-2. There's a false alarm that occurs regularly here because there's lag between
+2. Some services are blocked from automatic restarts in the needrestart
+   configuration file. (look for `$nrconf{override_rc}` in `needrestart.conf`)
+   Some of those are blocked in order to avoid killing needrestart itself, like
+   `cron` and `unattended-upgrades`. Those services show up in the "deferred"
+   service restart list in the output from `needrestart -v`. Those need to be
+   manually restarted. If this touches many or most of the hosts you can do this
+   service restart with cumin.
+
+3. There's a false alarm that occurs regularly here because there's lag between
    `needrestart` running after upgrades (which is on a `dpkg` post-invoke hook)
    and the metrics updates (which are on a timer running daily and 2 minutes
    after boot).