How can I tell, from the command line, whether the machine requires a reboot?

You can simply check if the file /var/run/reboot-required exists or not.

For example, any of these would tell you "no such file" or "file not found" if you do not need to reboot, otherwise (if you need to reboot) the file would exist and these commands would show information about the file:

file /var/run/reboot-required
stat /var/run/reboot-required
ls /var/run/reboot-required

In a bash script, you can use:

#!/bin/bash
if [ -f /var/run/reboot-required ]; then
  echo 'reboot required'
fi

In the package debian-goodies is a command named checkrestart which is quite useful. Its output can help you avoid a full reboot.

It tells you which running applications have loaded shared libraries that were upgraded while the application was running. You then restart the applications and services manually and avoid a full reboot. Does not help with kernel upgrades, though.

Normally if the file

/var/run/reboot-required 

exists you should reboot. You can see if this file is there by using this simple command in gnome-terminal.

ls /var/run/reboot-required

As well as the most direct methods written by others there is a handy indication if you use byobu - a set of scripts to make GNU screen a little more user friendly. It shows a set of information at the bottom of the screen, and that can include whether a reboot is required - along with whether updates are available, the time, uptime, memory used ...

In this screenshot you can see from the 199! on the bottom line with the red background that there are 199 updates available. A !! means that some are security updates. The menu in the foreground is selecting which status notifications should be displayed.

If a reboot is required then this will be indicated by the symbol (R) displayed in the lower bar with white text on a blue background. More details and other indicators can be read about in the byobu man page.

If you have the reboot-notifier or update-notifier-common packages installed, then you get the files /var/run/reboot-required and /var/run/reboot-required.pkgs

reboot-notifier is newer in Ubuntu Wily and Xenial. Debian stretch, but in jessie-backports

update-notifier-common Is older, in all Ubuntu versions including Xenial and Debian Wheezy. Not in Debian Stretch or Jessie.

( There is some background to the reboot-notifier package at https://feeding.cloud.geek.nz/posts/introducing-reboot-notifier/ )

If you don't have these packages installed then you can compare the version of the linux package installed, with the version running:

tim@tramp:~$ dpkg -l linux-image-*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                              Version               Architecture          Description
+++-=================================-=====================-=====================-=======================================================================
ii  linux-image-3.16.0-4-amd64        3.16.7-ckt20-1+deb8u4 amd64                 Linux 3.16 for 64-bit PCs
ii  linux-image-amd64                 3.16+63               amd64                 Linux for 64-bit PCs (meta-package)
tim@tramp:~$ more /proc/version
Linux version 3.16.0-4-amd64 ([email protected]) (gcc version 4.8.4 (Debian 4.8.4-1) ) #1 SMP Debian <b>3.16.7-ckt20-1+deb8u3</b> (2016-01-17)

You can see here that the latest installed kernel is 3.16.7-ckt20-1+deb8u4 but the kernel running is 3.16.7-ckt20-1+deb8u3. So this system needs a reboot. The u4 vs u3 right at the end.

You might need to scroll the box above. In the /proc/version, it is the version near the end of the line that matters.

The very minor version code change is typical of a Debian security kernel update.

needrestart

Another option is to install the needrestart package.

sudo apt-get install needrestart
sudo needrestart -k

Seems to work even if needrestart was installed after the kernel was upgraded.

The /etc/motd file gets its information about whether a reboot is required from /var/run/reboot-required file.

You can check the content of this file in terminal by using cat /etc/motd command

I added the following to my .bash-aliases file:

alias rr='if [ -f /var/run/reboot-required ]; then echo "reboot required"; else echo "No reboot needed"; fi'

Seemed simpler than installing a package for this relatively simple task. Then I just run:

you@somewhere:~$ rr
No reboot needed
you@somewhere:~$ 

Poor man's solution:

#!/bin/bash

default=$(sed -n 's/^default[   ]*\([0-9][0-9]*\).*/\1/p' /boot/grub/menu.lst | tail -1)
if [ "$default" = "" ]; then default=0; fi

want=$(sed -n 's/^kernel[       ]*\/boot\/vmlinuz-\([^  ]*\).*/\1/p' /boot/grub/menu.lst | sed -n "$((default+1))p")

running=$(uname -r)

if [ "$running" = "$want" ]
then
  : OK, do nothing
else
  echo "Running $running, want $want. Reboot required."
fi

Notice: The three cases of square brackets with white space inside should be "[ <space> <tab> ]".

Not an answer to the question, but a caveat regarding several of the responses: /var/run/reboot-required is not a reliable source of whether or not a reboot is actually required.

Simple test: when a new kernel becomes available, install it, reboot. After the reboot, run apt autoremove to get rid of some old, no longer required, kernels. After you've run that, it will state that a reboot is required, which is complete nonsense.

If you use nagios:

./check_file_age -i -f /var/run/reboot-required -w 86400 -c 604800

just change the time in seconds for warn/crit