when does rpm update the "last installed/updated" time?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


when a rpm package is being installed or updated, at what point does RPM
update the database "last installed/updated" timestamp that one can
query with "rpm -q --last" ?

in a forensic analysis of a system, does it make sense to correlate the
last ctime of a file with the rpm -q --last time of the package that
owns that file? At least, can it make sense to say if the two are within
some small threshold, then that file was last modified by rpm doing an
install or update? Or, is possible that a file may be installed or
updated and the install process takes a long time so that "rpm -q
--last" timestamp can be several seconds or even minutes different from
when the installed files are updated?

thanks for any insights...

Rpm-list mailing list

[Index of Archives]     [RPM Ecosystem]     [Linux Kernel]     [Red Hat Install]     [PAM]     [Red Hat Watch]     [Red Hat Development]     [Red Hat]     [Gimp]     [Yosemite News]     [IETF Discussion]

  Powered by Linux