I've been playing around with Splunk and got some questions:

  1. I have installed it using

    rpm -iv splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm

  2. I removed it next using

rpm -e splunk-7.2.3-06d57c595b80.x86_64

My question is, why didn't rpm remove the Splunk user from /etc/passwd ? Also I'm a bit puzzled why removing via splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm did not work (but the installation did) and I had to get the actual package name with rpm -qa | grep splunk first?

Is this related to the Splunk rpm package or rather standard?

  • 1
    It's a general policy issue (and likely a duplicate). Removing a user requires one to ensure that there are no leftover files belonging to the deleted user. Dec 27, 2018 at 18:52
  • @ThomasDickey Thank you. What do you mean "general policy issue"? Dec 27, 2018 at 18:54
  • 1
    Leaving files owned by an unspecified user (only a number) is considered by some a security problem. Reducing problems like that is a policy. See this Dec 27, 2018 at 19:02
  • To add to the second part of your question, you don't include the .rpm part of the package when removing it via rpm -e. Dec 27, 2018 at 20:07

2 Answers 2


rpm packages consist of a bunch of files and optionally a group of scripts (pre/postinstall pre/postremove pre/postupgrade verify)

You can use the --list option to show what files are part of the package. These will be removed when you --erase the package.

rpm -qipl package.rpm

You can also include --scripts to dump the contents of the scripts. There isn't a whole lot of standardized templates or enforcement on how install / remove scripts work, so it's really up to the package maintainer. But you can certainly dump the --scripts of a package to discover exactly what an RPM is doing to your system so you can better write your own cleanup scripts.

rpm -qi --scripts package.rpm

You might even consider installing with --noscripts if you just need some files from an rpm and don't want or don't trust the maintainer to dink with the configuration of your system.


Not removing a user together with a package is a standard.

Thomas already provided nice explanation in comments and linked this nice document https://ma.ttias.be/on-removing-users-with-postun-in-rpm-spec-files/

However, there is another reason. Many admins rely on LDAP or NIS to provide users to the system. And even before installing package which creates new user, they will first add that user to their LDAP. This is the reason why new users are created using:

getent passwd USERNAME >/dev/null || \
    useradd -r -g GROUPNAME -d HOMEDIR -s /sbin/nologin ...

i.e. before the user is created, the package should always check if the user already has been created.

And of course, you simply cannot remove LDAP user from a client system. So simple userdel may likely fail. So it is up to the admin to remove the user - using the tools he uses for user management.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.