Re: SOFTWARE_UPDATE on RHEL 7.6

Steve Grubb
2018-08-29T18:34:39Z

Hello,

On Wednesday, August 29, 2018 9:53:05 AM EDT Maupertuis Philippe wrote:
> I have tried to get the SOFTWARE_UPDATE events on a new RHEL 7.6 beta 1
> with audit rebased on 2.8.4 When installing a new rpm I get the
> corresponding event.
> The text format is very easily readable :)
> Unfortunately when I remove the package I get nothing.
> Is it the intending behavior ?

Yes. That is the intended behavior. If package removal events are desired, a
bug report may be filed. OSPP v4.2 requirements are concerned about software
being installed and upgraded. It is silent on software removal.

> If updates are pushed through Redhat satellite or Spacewalk would I get
> the event ?

The patch is in librpm, so it should be recorded by anything that uses it.

-Steve