Raw Evidence Type = Uninstall on RHEL device

goody612 · ‎Nov 08, 2022

We are seeing Installer evidence on a RHEL system that is listed as Uninstall within Raw Evidence Type. It is getting mapped to a product and are curious what this means in reference to RHEL. Where is it picking this type of evidence up from on a RHEL system?

bfaller · ‎Nov 09, 2022

Uninstall raw evidence type is on the dark side, few or not documented. In principle, trace on uncomplete unsinstall action.

On windows, often remaining key in registry.

On Unix, not clear but uncommon. I suggest to have to a look on all raw file evidences, on the device via UI. If nothing, you have to have a look on the device it-self.

ChrisG · ‎Nov 24, 2022

Most installer evidence on an RHEL system is likely to come from the RPM (RedHat Package Manager) database.

The specific evidence you're looking at here is related to IBM DB2, so it is possible in this instance that it has been gathered based on output from running the db2licm license management tool.

(Did my reply solve the question? Click "ACCEPT AS SOLUTION" to help others find answers faster. Liked something? Click "KUDO". Anything expressed here is my own view and not necessarily that of my employer, Flexera.)