Splunk query to see Linux patching

[Prakash493]

Hi , Our most of the splunk servers are Linux based systems , How can i create a splunk query to verify if Linux OS patch has been successful or not ?

[st14014]

Depends on your distribution toolset (yum, zypper, apt, ...)

Write a script to integrate patches etc. into your system. The Script should be able to analyse the installation and generate useful logdata four your syslog (local or remote).
The TA for unix has an update-script, which is only useful for redhat or darwin based systems. For "linux", aka redhat-based distros, the output of yum check-update is parsed via awk. So you have to use a tool for integrating the patches.

[Prakash493]

i am not aware of any script i got the file name on the add-on what needs to be turned on.

[burwell · Accepted solution]

Hello. I would install the Linux add on to collect data about your operating system.

https://docs.splunk.com/Documentation/AddOns/released/UnixLinux/About

There's version.sh which would collect the data.

Then I would figure out what the current version is on your situation and alert on hosts that need patching.

[Prakash493]

Thank you so much for the update yes we do have that add-on and version.sh file is disabled , i will turn the logging for it.