I'm looking through the schema here (<https://osqu...
# general
I'm looking through the schema here (https://osquery.io/schema/4.0.2) and it doesn't appear that I am able to query when
yum update
was last run on a machine? Is that a correct assumption?
You would have to parse the package manager log to get that information. It is also possible to look for the command in the shell history table
(depending on how updates are performed)
on rhel/centos systems using
, not sure that'd be in shell history, I am surprised that there isn't anything for that
It is indeed a really useful feature, but sometimes things are hard to integrate
Indeed, thank you!
yum has to provide a library to access that information (usually, that library is private and subject to drastic changes at every update)
and osquery has to work on as many distro as possible (and can’t risk using a library version that only parses data specific to a distro/package manager release)
One thing that you can do, is write a Python extension that calls the yum command and parses the output
That makes sense, the yum api is...inscrutable at best. Looking at the source code, they explicitly tell you not to use the API. looks like we'll have to write our own extension.
and then publish it and share it! 😄
💯 1
maybe schedule a diff query on the atime/mtime fields of /var/log/yum.log as this gets updated when packages update?