when a rpm package is being installed or updated, at what point does RPM update the database "last installed/updated" timestamp that one can query with "rpm -q --last" ? in a forensic analysis of a system, does it make sense to correlate the last ctime of a file with the rpm -q --last time of the package that owns that file? At least, can it make sense to say if the two are within some small threshold, then that file was last modified by rpm doing an install or update? Or, is possible that a file may be installed or updated and the install process takes a long time so that "rpm -q --last" timestamp can be several seconds or even minutes different from when the installed files are updated? thanks for any insights... Bond _______________________________________________ Rpm-list mailing list Rpm-list@xxxxxxxxxxxxx http://lists.rpm.org/mailman/listinfo/rpm-list
