---
title: System package dataset
description: This is the package dataset of the system module. It is implemented for Linux distributions using dpkg or rpm as their package manager, and for Homebrew...
url: https://www.elastic.co/elastic/docs-builder/docs/4075/reference/beats/auditbeat/auditbeat-dataset-system-package
products:
  - Auditbeat
  - Beats
applies_to:
  - Elastic Cloud Serverless: Beta
  - Elastic Stack: Beta
---

# System package dataset
This is the `package` dataset of the system module.
It is implemented for Linux distributions using dpkg or rpm as their package manager, and for Homebrew on macOS (Darwin).

## Required privileges

Privilege requirements depend on the package manager in use.
<definitions>
  <definition term="dpkg (Debian/Ubuntu)">
    No elevated privileges are required. The dpkg database at `/var/lib/dpkg` is world-readable.
  </definition>
  <definition term="RPM (RHEL/CentOS/SUSE)">
    The RPM library might attempt to write lock files to the RPM database, which typically requires root. To avoid this, configure `package.rpm_drop_to_uid` with a non-root UID. Auditbeat uses `setreuid` to switch to that UID before it queries the RPM database, which prevents unintended writes.
    ```yaml
    - module: system
      datasets: [package]
      package.rpm_drop_to_uid: 1000 
    ```
  </definition>
  <definition term="Homebrew (macOS)">
    No elevated privileges are required. Homebrew metadata is readable by the current user.
  </definition>
  <definition term="Docker">
    To report packages installed on the host rather than inside the container, mount the relevant package database paths from the host:
    ```sh
    # dpkg
    docker run -v /var/lib/dpkg:/var/lib/dpkg:ro ...
    # RPM
    docker run -v /var/lib/rpm:/var/lib/rpm:ro ...
    ```
  </definition>
</definitions>


### Example dashboard

The dataset comes with a sample dashboard:
![Auditbeat System Package Dashboard](https://www.elastic.co/elastic/docs-builder/docs/4075/reference/beats/auditbeat/images/auditbeat-system-package-dashboard.png)

## Fields

For a description of each field in the dataset, see the [exported fields](https://www.elastic.co/elastic/docs-builder/docs/4075/reference/beats/auditbeat/exported-fields-system) section.
Here is an example document generated by this dataset:
```json
{
    "@timestamp": "2017-10-12T08:05:34.853Z",
    "event": {
        "action": "existing_package",
        "category": [
            "package"
        ],
        "dataset": "package",
        "id": "6bed65c5-9797-4fb7-9ec7-2d1873c54371",
        "kind": "state",
        "module": "system",
        "type": [
            "info"
        ]
    },
    "message": "Package zstd (1.5.4) is already installed",
    "package": {
        "description": "Zstandard is a real-time compression algorithm",
        "installed": "2023-02-15T20:40:24.390086982-05:00",
        "name": "zstd",
        "reference": "https://facebook.github.io/zstd/",
        "type": "brew",
        "version": "1.5.4"
    },
    "service": {
        "type": "system"
    },
    "system": {
        "audit": {
            "package": {
                "entity_id": "SxYD3ZMh/Ym0lBIk",
                "installtime": "2023-02-15T20:40:24.390086982-05:00",
                "name": "zstd",
                "summary": "Zstandard is a real-time compression algorithm",
                "url": "https://facebook.github.io/zstd/",
                "version": "1.5.4"
            }
        }
    }
}
```