apt-daily runs every day and updates nothing

A Debian box that nobody logs into is supposed to look after itself. There is a timer, it fires twice a day, and the service it starts reports success. Here is what that looks like in the journal:

Starting apt-daily.service - Daily apt download activities...
apt-daily.service: Deactivated successfully.
Finished apt-daily.service - Daily apt download activities.

Same second, start to finish. That is the tell. An apt-get update against the Debian mirrors takes several seconds and pulls down tens of megabytes. A service that starts and finishes inside one second did not do it.

Where it goes

apt-daily.service does not run apt-get update unconditionally. It runs apt.systemd.daily, which reads the APT::Periodic::* configuration and decides what, if anything, to do. Every one of those knobs defaults to 0, which means disabled.

apt-config dump | grep -i periodic

If that command prints nothing, or prints all zeroes, the daily job is a very reliable no-op. It will keep being a reliable no-op indefinitely, exiting 0 every time, while the package index quietly ages.

The reason it is off by default is that Debian ships the periodic machinery in apt but the policy in unattended-upgrades, which is not installed on a minimal system. Install the latter and its postinst writes the config that switches the former on. Skip it and you get the timer without the behaviour.

Checking how stale you actually are

The honest measure is the mtime of the package lists, not the timer's last run:

ls -l --time-style=long-iso /var/lib/apt/lists/*_Packages | head

Do not use apt list --upgradable for this. Against a frozen index it cheerfully reports zero upgradable packages, because relative to what it knows about, that is true.

Turning it on

apt-get install unattended-upgrades

# /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";

Then confirm it can actually do the work, rather than confirming the unit is enabled:

unattended-upgrade --dry-run --debug

On automatic reboots

Unattended-Upgrade::Automatic-Reboot defaults to false, and on a box whose job is to hold long-lived connections you should leave it false. The cost is that kernel updates install but do not take effect until you reboot by hand, so put that on a calendar. A host running a six-month-old kernel because nobody rebooted is a different failure from one running a six-month-old kernel because nothing ever downloaded it, but the exposure is identical.