How to identify which RPM package is associated with a specific Pulp artifact file on Red Hat Satellite 6.x?

Environment

• Red Hat Satellite 6.10 and later

Issue

• How to identify which RPM package is associated with a specific Pulp artifact file when the artifact file no longer exists on Red Hat Satellite 6.x?

• Our antivirus detected and deleted the following suspicious file on the Satellite server:

  /var/lib/pulp/media/artifact/4b/1ecaa12c422418790352de50eb673fcf1fdc8918b98a4483e50589fb63a0a2
  

  How to identify the RPM package which is associated with this file?

Resolution

1. Run the following Postgres query on the Satellite server:

   # sudo su - postgres -c 'psql -U postgres pulpcore -c "select * from core_artifact where file ~ '\''1ecaa12c422418790352de50eb673fcf1fdc8918b98a4483e50589fb63a0a2'\'';"'
   

2. Note down the value in the first column of the output from the previous step (i.e. the pulp_id value), and use it in the following Postgres query in place of XXXXXX:

   # sudo su - postgres -c 'psql -U postgres pulpcore -c "select * from core_contentartifact where artifact_id='\''XXXXXX'\'';"'
   

Then run the Postgres query on the Satellite server. The output will look like this:

   # sudo su - postgres -c 'psql -U postgres pulpcore -c "select * from core_contentartifact where artifact_id='\''20b84122-f18f-47c7-b2b6-0bda5f0d4e5e'\'';"'
               pulp_id                |         pulp_created          |       pulp_last_updated       |        relative_path         |             artifact_id              |              content_id              
--------------------------------------+-------------------------------+-------------------------------+------------------------------+--------------------------------------+--------------------------------------
 02adb808-7bb9-4ed1-ac96-d06ac0d47e7e | 2025-02-07 07:04:04.089171-05 | 2025-02-07 07:20:43.589991-05 | ethtool-6.2-1.el9.x86_64.rpm | 20b84122-f18f-47c7-b2b6-0bda5f0d4e5e | 99b43fb9-d1be-4954-b74d-ad3f0f7a9c8a
(1 row)

The relative_path column in this output will tell you the name of the package associated with the deleted artifact.

For more KB articles/solutions related to Red Hat Satellite 6.x Pulp 3.0 Issues, please refer to the Consolidated Troubleshooting Article for Red Hat Satellite 6.x Pulp 3.0-related Issues

Root Cause

An antivirus software installed on the Satellite server identified a pulpcore artifact file as a suspicious file and automatically deleted it.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.