https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500782#M17191 <P>Depends on your distribution toolset (yum, zypper, apt, ...)</P> <P>Write a script to integrate patches etc. into your system. The Script should be able to analyse the installation and generate useful logdata four your syslog (local or remote).<BR /> The TA for unix has an update-script, which is only useful for redhat or darwin based systems. For "linux", aka redhat-based distros, the output of yum check-update is parsed via awk. So you have to use a tool for integrating the patches. </P> Wed, 04 Dec 2019 19:28:30 GMT st14014 2019-12-04T19:28:30Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500780#M17189 <P>Hi , Our most of the splunk servers are Linux based systems , How can i create a splunk query to verify if Linux OS patch has been successful or not ?</P> Tue, 03 Dec 2019 22:06:15 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500780#M17189 Prakash493 2019-12-03T22:06:15Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500781#M17190 <P>Hello. I would install the Linux add on to collect data about your operating system.</P> <P><A href="https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About">https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About</A></P> <P>There's version.sh which would collect the data.</P> <P>Then I would figure out what the current version is on your situation and alert on hosts that need patching.</P> Wed, 04 Dec 2019 06:02:52 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500781#M17190 burwell 2019-12-04T06:02:52Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500782#M17191 <P>Depends on your distribution toolset (yum, zypper, apt, ...)</P> <P>Write a script to integrate patches etc. into your system. The Script should be able to analyse the installation and generate useful logdata four your syslog (local or remote).<BR /> The TA for unix has an update-script, which is only useful for redhat or darwin based systems. For "linux", aka redhat-based distros, the output of yum check-update is parsed via awk. So you have to use a tool for integrating the patches. </P> Wed, 04 Dec 2019 19:28:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500782#M17191 st14014 2019-12-04T19:28:30Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500783#M17192 <P>Thank you so much for the update yes we do have that add-on and version.sh file is disabled , i will turn the logging for it.</P> Fri, 06 Dec 2019 16:37:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500783#M17192 Prakash493 2019-12-06T16:37:25Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500784#M17193 <P>i am not aware of any script i got the file name on the add-on what needs to be turned on.</P> Fri, 06 Dec 2019 16:38:09 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-query-to-see-Linux-patching/m-p/500784#M17193 Prakash493 2019-12-06T16:38:09Z