Hi, there is no event type associated with rpm or yum. But using -F exe= filters for yum/rpm binaries is really the best option. -- Ondrej
On Mon, Jul 3, 2017 at 5:08 AM, warron.french <[email protected]> wrote: > Is there an audit system call associated with the use of rpm or yum? > > Or is it best to setup a watch rule for both executables? > > > -------------------------- > Warron French > > > -- > Linux-audit mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/linux-audit -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
