Hi All , Happy Holidays :) I want to know how can I monitor remote machines rpm database , so that when ever a user on that machine installs a new rpm on the system, thinking that I have root access to the remote machine . when I tried to search in install.log which is in /root directory , it is created only when te distribution is installed and thereby not updated , Where is the path of the rpm database (gdbm) files that rpm maintains and how do I read them ( what could be the keys to read the gdbm files) and from them generate the reports and send a mail to root or a groupmail. Regards, Nikhil. °v° /(_)\ ^ ^

But my question stands as when did the exact change/or installation happen , and what is the significance of numerical extensions .1,.2,.3 in each of the files as I tried to diff

Yup George :) I came to know that crons does them the other day , when I was traversing through /etc/logrotate.d /etc/crons.daily Hey I got the thing that this below command will list the diff itself To report in a more human-readable format: # rpm -qa --last var/log/rpmpkgs is created on a daily basis with an rpm listing. It's then rotated weekly. See /etc/cron.daily/rpm and /etc/logrotate.d/rpm. You could customize these reports if you wanted to. To simply see what's changed this week: # diff /var/log/rpmpkgs /var/log/rpmpkgs.1 On Thu, 30 Dec 2004 00:46:06 -0400, Jorge Fábregas <fabregasj(a)prtc.net&gt; wrote: > On Wednesday 29 December 2004 10:28 am, mnikhil m wrote: > > But my question stands as when did the exact change/or installation > > happen , and what is the significance of numerical extensions .1,.2,.3 > > in each of the files as I tried to diff > > Hi, > > Ok, I just found out about /var/log/rpmpkgs. I didn't know this file existed > at all. I turns out that this file is placed by a job running via /etc/ > cron.daily (see the rpm script there). It is basically the output of: > > rpm -qa (q for query....a for all) > > The files with extensions you see are created by logrotate via: > > /etc/logrotate.d/rpm > > which basically rotates the file based on the rules specified in the above > configuration file. > > I haven't think of a way to keep track if rpm's installed by the > users...Probably you'll need to create a script which will compare (using > diff) the rpmpkgs file with the previous day one...something like that. And > if you want to know WHEN exactly was it installed (hour, minute) that's > another thing. You'll have to investigate further (Google etc..). > > HTH, > Jorge > > -- > fedora-list mailing list > fedora-list(a)redhat.com > To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list >

Now I am  looking at other alternative http://www.tripwire.org/ as someone informed me that  the rpm database can be spoofed.

Gr8 Man , by this way can you also please point me to the docs of this , how to setup and howto .... :) On Thu, 30 Dec 2004 01:57:29 -0400, Jorge Fábregas <fabregasj(a)prtc.net&gt; wrote: >On Thursday 30 December 2004 1:49 am, mnikhil m wrote: > >>Now I am looking at other alternative >>http://www.tripwire.org/ as someone informed me that the rpm database >>can be spoofed. > >I use rkhunter. Take a look at: > >http://www.rootkit.nl/projects/rootkit_hunter.html >