On this page

OSSEC / HIDS Rule 2933

OSSEC / HIDS rule catalog

  • Rule family: OSSEC / HIDS
  • Rule ID: 2933
  • Definition status: Present in current source
  • Alert message / subject: Yum/DNF package updated.
  • Rule level: 7
  • Definition checked: 2026-10-21

Interpretation and response

This event is recorded as “Yum/DNF package updated.” Review the originating log and the affected host or service to determine whether the activity was expected.

An OSSEC/HIDS event records or correlates activity. Blocking depends on the originating application and any separately configured Active Response policy; an alert alone does not prove that an attack was blocked.

Documentation

The following guidance was migrated from the historical wiki and reviewed against the rule definition. Legacy ASL product names and interface instructions refer to the versions documented then. Use the current metadata above and your installed configuration when interpreting thresholds, notification settings and response behavior.

Rule ID

2933

Status

The wiki marked this rule Active at the source revision. Current definition status is shown above.

Description

This rule detects when the operating system has reported that the operating systems software management tool, yum, has updated a piece of software. This may be an authorized change, or an unauthorized change and these changes should be investigated further.

Guidance

By default ASL (historical reference) and aum (historical reference) will automatically update themselves, and certain parts of the system. They will update:

aum

  • aum
  • mod_security
  • supporting libraries used by mod_security

ASL

  • asl
  • aum
  • asl-php
  • mod_security
  • supporting libraries used by mod_security
  • kernel
  • clamav
  • ossec
  • proftp (Plesk systems only)
  • rkhunter

If other software was changed, and you did not update or upgrade this software, then this may be an indication that a malicious use has changed these on your system. You should always investigate file changes to verify that they were only conducted by authorized parties.

False Positives

A legitimate event may still trigger this rule. Review the surrounding activity before deciding whether it is malicious. This rule detects when the operating system has reported that the operating systems software management tool, yum, has updated a piece of software, therefore, it is not recommended that you disable this rule.

Source and revision

Migrated from HIDS_2933, wiki page 637, revision 5513 (20150811). Documentation review: 2026-10-21. An archived wiki status of Active is not a current deployment status.

For assistance, provide the rule ID, installed product and rule version, and a sanitized event to Atomicorp support .