How to Get the Yum Log on Red Hat or CentOS

Overview

The package manager logs on Enterprise Linux distributions record critical software lifecycle events, including installations, updates, and removals. Monitoring these logs is vital for auditing system updates, tracking configuration drift, and troubleshooting software deployment or Automox patching failures.

Depending on your distribution's major version, the system relies on either the legacy YUM (Yellowdog Updater, Modified) or modern DNF (Dandified YUM) package manager.

Log Locations by OS Version

⚠️ Prerequisite: Accessing system log files requires root or sudo administrative privileges.

Viewing Package Manager Logs

1. Viewing Recent Log Entries

To view the most recent package management actions, run the tail command against the appropriate log path:

• For RHEL/CentOS 7 and older (YUM):

  Bash

   

  sudo tail -n 10 /var/log/yum.log

• For RHEL/Rocky/AlmaLinux 8 and 9 (DNF):

  Bash

   

  sudo tail -n 10 /var/log/dnf.rpm.log

2. Monitoring Logs in Real-Time

To stream live log entries during an active Automox patching job or manual update, append the -f flag:

sudo tail -f /var/log/dnf.rpm.log

Understanding Log Terminology

Package transaction entries include timestamps and action keywords. Note the slight variation in terminology between YUM and DNF:

YUM Terms (RHEL 7 & Older)

• Installed: A new package was added to the system.

• Updated: An existing package was upgraded to a newer version.

• Erased: A package was completely removed.

DNF Terms (RHEL 8 & 9)

• Installed: A new package was successfully provisioned.

• Upgrade / Upgraded: A package was successfully updated to a higher version.

• Erase: A package was uninstalled.

Advanced Administration Tips

Searching for Specific Transactions

Filter for specific events (such as all updates or removals) by piping log output to grep:

# Find updated packages on YUM systems
sudo grep "Updated" /var/log/yum.log

# Find uninstalled packages on DNF systems
sudo grep "Erase" /var/log/dnf.rpm.log

Using Built-In Transaction History

Enterprise Linux distributions maintain an internal transaction database. Instead of parsing plain text log files, you can use built-in history commands to view a structured, numbered index of all package actions:

1. View the overall transaction history:

   Bash

    

   sudo dnf history
   # Note: Use 'sudo yum history' on RHEL 7

2. Inspect a specific transaction ID (e.g., Transaction ID 14):

   Bash

    

   sudo dnf history info 14