Splunk Search

RPM detection

catch_mili
Explorer

How to detect if new rpm installed in Centos OS using Splunk. OR
How should I monitor rpm -qa in Splunk.

Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi catch_mili

like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.

for example:

you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input.

cheers,
MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi catch_mili

like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.

for example:

you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input.

cheers,
MuS

dwaddle
SplunkTrust
SplunkTrust

RPM gives you one additional option too, the --queryformat option, which can give you additional data, like the install time. An example is as such:

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME}\n" -qa
0 Karma

blebit
Path Finder

hi dwaddle,
how to convert install time into readable format ?
thanks

0 Karma

MuS
SplunkTrust
SplunkTrust

although this is completely un-related to Splunk I provide an answer here 😉

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME:date}\n" -qa

found here http://www.nbtnet.newboundary.com/support/docs/ppm/ppm/ppm_6_3/general_unix/ppm0362.htm after one single google search 🙂

0 Karma

catch_mili
Explorer

Hi MuS, Thanks.

0 Karma

blebit
Path Finder

hi MuS,
can you tell how this script would be please?
Thank you

0 Karma

MuS
SplunkTrust
SplunkTrust

This is not possible, since i don't know your environment nor your requirement.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...