Fixing RPM Database Desynchronization on RHEL

Recently, we encountered a case on a RHEL 9 machine where an RPM query did not show any information about installed package even though the package files were present in the filesystem.

[root@server ~]# rpm -q tcpdump
package tcpdump is not installed

[root@server ~]# tcpdump --version
tcpdump version 4.99.0
libpcap version 1.10.0 (with TPACKET_V3)
OpenSSL 3.5.5 27 Jan 2026

[root@server ~]# whereis tcpdump
tcpdump: /usr/sbin/tcpdump /usr/share/man/man8/tcpdump.8.gz

Although RPM reported that the package was not installed, I was still able to run tcpdumpcommand and use it without any issues. The binary was present there in the filesystem and I was able to run it successfully.

All of the commands above returned normal output and did not generate any errors.

This raises an interesting question: if the binary is present and functioning correctly, why does the RPM query command did not return any information about the package?

The reason is that the package metadata has been removed from the RPM database while the package files themselves remain intact on the system. As a result, the operating system can still execute the binary but RPM has no record that the package is installed.

There are several possible reasons why package files remain on disk but the RPM database no longer contains metadata for the package. Few of them are:

• RPM database corruption due to unexpected system crash.
• Interrupted dnf transaction can leave the RPM database in an inconsistent state.
• Manual removal of RPM database entry for the package. (rpm -e --justdb tcpdump)
• RPM database copied from another server (/var/lib/rpm).

To resolve this issue, there are two possible approaches:

1. Reinstall the same version of the package so that RPM can recreate the package metadata in the RPM database.
2. Download the corresponding RPM package (without installing it) and safely inject its metadata into the RPM database using the --justdb option. This restores the package information in the RPM database without modifying or replacing the existing binary files on the filesystem.

[root@server ~]# dnf download tcpdump

[root@server ~]# rpm -ivh --justdb --nodeps tcpdump-*.rpm
Verifying...
################################# [100%]
Preparing...
################################# [100%]
Updating / installing...
1:tcpdump-14:4.99.0-9.el9
################################# [100%]

RPM database was updated successfully without installing the actual package files.
--justdb only updates the RPM database, does NOT install binaries, libs, or files on disk.
--nodeps ignores dependency checks.
-ivh install with verbose + hash progress.

Now verify again.

[root@server ~]# rpm -q tcpdump
tcpdump-4.99.0-9.el9.x86_64