How to detect if new rpm installed in Centos OS using Splunk. OR
How should I monitor rpm -qa in Splunk.
Hi catch_mili
like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.
for example:
you can get with rpm -qa
a full list of installed RPM and with rpm -qi <RPM Name>
you can get the install date. With this you can build a scripted input.
cheers,
MuS
Hi catch_mili
like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.
for example:
you can get with rpm -qa
a full list of installed RPM and with rpm -qi <RPM Name>
you can get the install date. With this you can build a scripted input.
cheers,
MuS
RPM gives you one additional option too, the --queryformat
option, which can give you additional data, like the install time. An example is as such:
rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME}\n" -qa
hi dwaddle,
how to convert install time into readable format ?
thanks
although this is completely un-related to Splunk I provide an answer here 😉
rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME:date}\n" -qa
found here http://www.nbtnet.newboundary.com/support/docs/ppm/ppm/ppm_6_3/general_unix/ppm0362.htm after one single google search 🙂
Hi MuS, Thanks.
hi MuS,
can you tell how this script would be please?
Thank you
This is not possible, since i don't know your environment nor your requirement.