Splunk Search

RPM detection

catch_mili
Explorer

How to detect if new rpm installed in Centos OS using Splunk. OR
How should I monitor rpm -qa in Splunk.

Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi catch_mili

like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.

for example:

you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input.

cheers,
MuS

View solution in original post

MuS
Legend

Hi catch_mili

like in your Solaris question ... it's the same here: how would you detect a newly installed RPM in CentOS and then provide it into splunk.

for example:

you can get with rpm -qa a full list of installed RPM and with rpm -qi <RPM Name> you can get the install date. With this you can build a scripted input.

cheers,
MuS

dwaddle
SplunkTrust
SplunkTrust

RPM gives you one additional option too, the --queryformat option, which can give you additional data, like the install time. An example is as such:

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME}\n" -qa
0 Karma

blebit
Path Finder

hi dwaddle,
how to convert install time into readable format ?
thanks

0 Karma

MuS
Legend

although this is completely un-related to Splunk I provide an answer here :winking_face:

rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME:date}\n" -qa

found here http://www.nbtnet.newboundary.com/support/docs/ppm/ppm/ppm_6_3/general_unix/ppm0362.htm after one single google search :slightly_smiling_face:

0 Karma

catch_mili
Explorer

Hi MuS, Thanks.

0 Karma

blebit
Path Finder

hi MuS,
can you tell how this script would be please?
Thank you

0 Karma

MuS
Legend

This is not possible, since i don't know your environment nor your requirement.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...