diff --git a/x-pack/auditbeat/module/system/package/rpm_linux.go b/x-pack/auditbeat/module/system/package/rpm_linux.go
index fa6fc66f4cdc..6e5df7e0c6ec 100644
--- a/x-pack/auditbeat/module/system/package/rpm_linux.go
+++ b/x-pack/auditbeat/module/system/package/rpm_linux.go
@@ -10,9 +10,12 @@ import (
 	"errors"
 	"fmt"
 	"runtime"
+	"strings"
 	"time"
 	"unsafe"
 
+	"debug/elf"
+
 	"github.com/coreos/pkg/dlopen"
 )
 
@@ -204,29 +207,57 @@ func (lib *librpm) close() error {
 	return nil
 }
 
-func openLibrpm() (*librpm, error) {
-	var librpmNames = []string{
-		"librpm.so",   // with rpm-devel installed
-		"librpm.so.9", // Fedora 31/32
-		"librpm.so.8", // Fedora 29/30
-		"librpm.so.3", // CentOS 7
-		"librpm.so.1", // CentOS 6
-
-		// Following for completeness, but not explicitly tested
-		"librpm.so.10",
-		"librpm.so.7",
-		"librpm.so.6",
-		"librpm.so.5",
-		"librpm.so.4",
-		"librpm.so.2",
+// getLibrpmNames determines the versions of librpm.so that are
+// installed on a system.  rpm-devel rpm installs the librpm.so
+// symbolic link to the correct version of librpm, but that isn't a
+// required package.  rpm will install librpm.so.X, where X is the
+// version number.  getLibrpmNames looks at the elf header for the rpm
+// binary to determine what version of librpm.so it is linked against.
+func getLibrpmNames() []string {
+	var rpmPaths = []string{
+		"/usr/bin/rpm",
+		"/bin/rpm",
+	}
+	var libNames = []string{
+		"librpm.so",
 	}
+	var rpmElf *elf.File
+	var err error
+
+	for _, path := range rpmPaths {
+		rpmElf, err = elf.Open(path)
+		if err == nil {
+			break
+		}
+	}
+	if err != nil {
+		return libNames
+	}
+
+	impLibs, err := rpmElf.ImportedLibraries()
+	if err != nil {
+		return libNames
+	}
+
+	for _, lib := range impLibs {
+		if strings.Contains(lib, "librpm.so") {
+			libNames = append(libNames, lib)
+		}
+	}
+
+	return libNames
+}
+
+func openLibrpm() (*librpm, error) {
 
 	var librpm librpm
 	var err error
 
+	librpmNames := getLibrpmNames()
+
 	librpm.handle, err = dlopen.GetHandle(librpmNames)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("Couldn't open %v", librpmNames)
 	}
 
 	librpm.rpmtsCreate, err = librpm.handle.GetSymbolPointer("rpmtsCreate")