In short: From all the (rpm) packages installed I would like to identify the ones unused (for example since the last 6 months).

In long: I have number of machines with a respectable service record. Every time I upgrade from one release to another I'm surprised how well the upgrade procedure goes.

However over the years many packages were installed (via yum), a number of which I know are no longer used. I want to get rid of these as they have a negative impact on resource usage and the overall security of the system.

I'm looking for the best method to find unused packages.

One way would be to manually sift through the installed packages? The method works and I learn a lot, but its extremely time consuming.

So I'm looking for an automated way to identify unused packages so I can clean them manually.

I guess one way forward would be to monitor all used files on a server, link them to packages and see what's leftover. Is there anything available for this purpose?

Are there more inventive ways to accomplish this?

  • What problem would you solve by doing this?
    – ewwhite
    Dec 27, 2014 at 10:17
  • As mentioned: reduce resource usage and increase security
    – Zabuzzman
    Dec 27, 2014 at 10:18
  • 1
    Then just do a minimum install, and install your service after. For the security concern, if no user have bash access then how does this will exploit it? As ewwhite told, you need to secure what is open.
    – yagmoth555
    Dec 27, 2014 at 12:17
  • 2
    No, @yagmoth555's advice is perfectly applicable to desktops as well, only "minimum" in that case is a "Desktop" installation and "service" is the applications that the users need. In both cases, you should have clear documentation somewhere of what packages any given type of system needs. Your puppet roles/profiles that you have defined for them is a great place for it. Dec 30, 2014 at 13:09
  • 2
    I think for anyone to be able to answer this appropriately you will need to come up with a concrete definition of what you determine as 'used' and 'unused'. Dec 30, 2014 at 15:40

2 Answers 2


Given the nature of RPM's and shared libraries common to multiple packages, I would take the approach of building a list of packages that I actually use and diff that against a list of installed packages. There are benefits to removing unused packages, such as freeing up disk space, reducing packages that would facilitate privilege escalation, reducing the size of a checksum database i.e. OSSEC, aide, tripwire.


  • atime is enabled. If you are using a mount option of noatime, then the access times of files will not be updated and could not be used to determine what files are accessed. It is common for noatime to be set on a filesystem to avoid the write penalty.

Disclaimer: This method has some risk you will need to consider. For example, if your server has been up for a couple of years there could be daemons running that use old files you have not accessed since the server/daemon start time. There are plenty of other risks to factor in, but you asked so here is one method I might start with. This still requires a human to determine what could safely be removed. You should not automate removal of packages using this method. This is for educational use only.

Build a list of all RPM's installed.

rpm -qa | sort -n > /dev/shm/all.txt

Build a list of recently accessed files and save a count. We are approaching the new year, so you might want to look at last year.

YEAR=`date -d "one year ago" '+%Y'`
# YEAR=2014
OFS="$IFS";IFS=$'\n';stat --printf="%y %n\n" $(ls -tr $(find /bin /boot /etc /lib /lib64 /sbin /usr /var -type f ! -name "*~" ! -name "*.gz" ! -name "*.tar")) | grep ^${YEAR} | awk {'print $NF'} > /dev/shm/recent.txt;IFS="$OFS";
FILECOUNT=`egrep -c ^.+ /dev/shm/recent.txt`

Copy our RPM database to the ram disk so we don't abuse the server. Ensure you have at least 100 MB free or so. e.g. df -Ph /dev/shm

mkdir --mode=0700 /dev/shm/rpmdb
rsync -a /var/lib/rpm/. /dev/shm/rpmdb/.

Find the RPM's associated with our recent.txt list. This will take a while. I bet someone could find more efficient, faster and clever ways to do this step. I would do this in a screen session.

renice 19 -p $$ > /dev/null 2>&1
printf "${FILECOUNT} files to iterate through."
> /dev/shm/recent_packages.txt
for file in `cat /dev/shm/recent.txt`
rpm --dbpath /dev/shm/rpmdb -q --whatprovides ${file} >> /dev/shm/recent_packages.txt 2>/dev/null
# optional status indicator.
printf "."

Remove from our list the files not owned by an RPM package from the findings.

grep -v "not owned by" /dev/shm/recent_packages.txt | sort -n | uniq > /dev/shm/recent_sorted.txt

Diff the output. Again, this is not completely useful by itself. You will need to determine why the files from these packages have not been accessed.

diff -u /dev/shm/recent_sorted.txt /dev/shm/all.txt | grep '^+'

You can list the contents of an RPM with rpm -ql package. Here is the output on one of my VM's. As you can see, this is not entirely useful in my case.

+++ /dev/shm/all.txt    2014-12-31 20:50:06.521227281 +0000

I need to keep filesystem and basesystem around, despite the fact those files have not been accessed in a while. Note: At some point I enabled noatime

I removed dhcp-common and its associated dhclient package, since I will never need DHCP in my specific use case. I realize this method is not entirely efficient, but it should give you a starting point on each unique role of your servers. Happy new year!

  • Note this is probably going to miss libraries that are read/executed by other dependant programs. I thought about 'fixing' this using access times instead but this is generally updated by prelink. Dec 31, 2014 at 22:06
  • Prelinking is a factor as well. I suppose that would have to be factored case-by-case if prelink is installed. I don't see a good way to further address all of Zabuzzman's needs using historical data. Any other solution would likely require putting something in place and waiting to get a baseline.
    – Aaron
    Jan 3, 2015 at 2:25
  • @Aaron is there any way to contact you please?
    – seoppc
    Jan 17, 2016 at 4:30

I don't know that there's a proper answer to this...

It's important to note that extraneous packages are often installed in many general-purpose Linux deployments.

Most engineers don't hand-select the individual software packages that get installed, but rather choose by logical groups of applications (web server, mail server, NFS server) or system roles (server, workstation, minimal).

There are also dependencies that get installed as part of the above selections. The notion of determining which packages are "unused" is fraught because of this.

Security doesn't hinge solely on what's installed... It's more of a function of what's actually running on the system; namely daemons, network services, exposed ports, processes, etc.

In terms of resource utilization, you're only losing disk space by having unused software installed. A process won't consume CPU or RAM resources until it's executed. So, the consequences are low. If I were an employer/manager, I'd suggest that other things receive your attention. Not this.

If you want to improve the system builds, the right way is to start with a base set of packages and add whatever's necessary to provide the requisite system functionality. Document the additional package lists and add them to a kickstart (example below). Don't go the wrong direction by removing software from a running system.

snippet from one of my kickstart package lists, with package groups and several extra packages...


@ base
@ core
@ cifs-file-server
@ compat-libraries
@ console-internet
@ development
@ mail-server
@ nfs-file-server
@ network-server
@ network-tools
@ system-management
@ system-admin-tools
@ web-server


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .