---
name: "rpm-plugin-audit"
section: "8"
platform: "linux"
package: "rpm-tools"
version: "6.0.1-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rpm-plugin-audit"
---

# rpm-plugin-audit(8)

Audit plugin for the RPM Package Manager

## NAME

rpm-plugin-audit - Audit plugin for the RPM Package Manager

## DESCRIPTION

The plugin writes basic information about rpm transactions to the audit log - like packages installed or removed. The entries can be viewed with

**ausearch -m SOFTWARE\_UPDATE**

### Data fields

The entries in the audit log have the following fields:

| | | |
| --- | --- | --- |
| **Field** | **Description** | **Possible values** |
| **op** | Package operation | install/update/remove |
| **sw** | Package identifier | name-version-release.arch |
| **key\_enforce** | Are signatures being enforced (no/yes) | 0/1 |
| **gpg\_res** | Signature check result (fail/success) | 0/1 |
| **root\_dir** | Root directory of the operation (normally "/") | \<path\> |
| **sw\_type** | Package format | rpm |

## CONFIGURATION

There are currently no options for this plugin in particular. See [**rpm-plugins**(8)](/rpm-plugins/8.md) on how to control plugins in general.

## SEE ALSO

[**ausearch**(8)](/ausearch/8.md), [**rpm-plugins**(8)](/rpm-plugins/8.md)