Hello, On Wednesday, August 29, 2018 9:53:05 AM EDT Maupertuis Philippe wrote: > I have tried to get the SOFTWARE_UPDATE events on a new RHEL 7.6 beta 1 > with audit rebased on 2.8.4 When installing a new rpm I get the > corresponding event. > The text format is very easily readable :) > Unfortunately when I remove the package I get nothing. > Is it the intending behavior ?
Yes. That is the intended behavior. If package removal events are desired, a bug report may be filed. OSPP v4.2 requirements are concerned about software being installed and upgraded. It is silent on software removal. > If updates are pushed through Redhat satellite or Spacewalk would I get > the event ? The patch is in librpm, so it should be recorded by anything that uses it. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
