topic Re: RPM detection in Splunk Search

RPM detection

catch_mili — Fri, 08 Mar 2013 09:57:55 GMT

How to detect if new rpm installed in Centos OS using Splunk. OR
How should I monitor rpm -qa in Splunk.

Re: RPM detection

MuS — Fri, 08 Mar 2013 10:38:28 GMT

Hi catch_mili

like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.

for example:

you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input.

cheers,
MuS

Re: RPM detection

catch_mili — Tue, 12 Mar 2013 08:51:17 GMT

Hi MuS, Thanks.

Re: RPM detection

dwaddle — Wed, 29 May 2013 13:30:58 GMT

RPM gives you one additional option too, the --queryformat option, which can give you additional data, like the install time. An example is as such:

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME}\n" -qa

Re: RPM detection

blebit — Fri, 16 Jan 2015 10:51:29 GMT

hi MuS,
can you tell how this script would be please?
Thank you

Re: RPM detection

blebit — Fri, 16 Jan 2015 10:56:09 GMT

hi dwaddle,
how to convert install time into readable format ?
thanks

Re: RPM detection

MuS — Fri, 16 Jan 2015 11:32:34 GMT

although this is completely un-related to Splunk I provide an answer here 😉

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME:date}\n" -qa

found here http://www.nbtnet.newboundary.com/support/docs/ppm/ppm/ppm_6_3/general_unix/ppm0362.htm after one single google search 🙂

Re: RPM detection

MuS — Fri, 16 Jan 2015 11:33:17 GMT

This is not possible, since i don't know your environment nor your requirement.