https://github.com/facebook/osquery/blob/master/osquery/tables/system/linux/rpm_packages.cpp#L31 particular reason for 2048 constant? this makes impossible to match any of the kernel package files since the kernel package has ~2700 files. rpm -q --filesbypkg kernel has no issues listing all the files.