Dear all

I am working on a SIEM platform "ArcSight" and I need RPM packages installation/uninstallation logs in Linux CentOS. I searched for a directory/file containing related logs but I couldn't find a way. I just got that I can query these logs via command "rpm -qa".

ASSUMPTION:

#I use below command to get the log:
rpm -qa --qf '%{INSTALLTIME} (%{INSTALLTIME:date}): %{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -n

#output:
1532931951 (Mon 30 Jul 2018 10:55:51 AM IRDT): samba-client-4.7.1-6.el7.x86_64

PROBLEM:

I need to customize the time of installation in below format:
yyyy-MM-dd HH:mm:ss
e.g: 2018-08-04 11:16:22

I tried to edit the above query in order to get my customized output but I faced errors.

MY first edit:
rpm -qa --qf '%{INSTALLTIME} (%{INSTALLTIME:date yyyy-MM-dd HH:mm:ss}): %{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' | sort -n

Output: error: incorrect format: unknown tag

I don't know if you can mangle the date/time like that in the rpm command itself, but if you post-process it that date can be fed directly into the "date" command and reformatted. Very handy feature.
Use whatever "language" you are comfortable with that allows you to invoke a system command - awk, perl, python, ...

Reading the man page for the rpm command, it seems you can.

@yasharalimz,

Have you read the rpm man page?

If this is a script, please post it using CODE tags.