changes to patch motd so nodes can be removed after they restarted - https://github.com/Security-Onion-Solutions/securityonion-saltstack/issues/112

salt/patch/needs_restarting.sls

@@ -0,0 +1,4 @@
+needs_restarting:
+  module.run:
+    - mine.send:
+      - func: needs_restarting.check

salt/patch/os/init.sls

@@ -1,5 +1,6 @@
-{% if grains.os == "CentOS" %}
 include:
+  - patch.needs_restarting
+{% if grains.os == "CentOS" %}
   - yum.packages
 {% endif %}
 
@@ -7,8 +8,4 @@ patch_os:
   pkg.uptodate:
     - name: patch_os
     - refresh: True
-
-needs_restarting:
-  module.run:
-    - mine.send:
-      - func: needs_restarting.check
+    - onchanges_in: needs_restarting