How to List Installed Packages by Date on Linux

Sometimes you want to know when a package was installed on your operating system, maybe for auditing purposes mostly if you're a Linux System Administrator.

In this blog post, I'll show you how to list installed packages by date on Linux - Ubuntu, Debian, CentOS and Arch Linux distributions.

List installed packages by date on Ubuntu/Debian

If you're running Ubuntu, Debian or any other Debian derivative like Kubuntu, Xubuntu e.t.c, commands used will be similar. To list installed packages sorted by date, run:

$ grep -i "install" /var/log/dpkg.log

Note that above command will work only if the package installed was logged to the file /var/log/dpkg.log. Since Linux system by default has some sort of log rotation, this will not work for rotated logs that have been compressed. To get all installed date for packages including those whose logs have been rotated, use the command:

$ zcat /var/log/dpkg.log.* | grep -i "installed"

Sample output is:

.....

2017-05-23 07:49:41 status installed libxaw7:amd64 2:1.0.13-1
2017-05-23 07:49:41 status installed libxcb-shape0:amd64 1.11.1-1ubuntu1
2017-05-23 07:49:41 status installed x11proto-xext-dev:all 7.3.0-1
2017-05-23 07:49:41 status installed libxext-dev:amd64 2:1.3.3-1
2017-05-23 07:49:41 status installed x11proto-render-dev:all 2:0.11.1-2
2017-05-23 07:49:41 status installed libxrender-dev:amd64 1:0.9.9-0ubuntu1
2017-05-23 07:49:41 status installed libxft-dev:amd64 2.3.2-1
2017-05-23 07:49:41 status installed libxrandr2:amd64 2:1.5.0-1
2017-05-23 07:49:41 status installed x11proto-scrnsaver-dev:all 1.2.2-1

zcat command reads compressed files, then we pipe the output to grep for filtering.

If you want to grep for a specific package which you know some part of its name, you can pipe the output again to grep command. See example below which searches for installation date of the apt-mirror package.

#  zcat /var/log/dpkg.log.* | grep -i "installed" | grep apt-mirror

2017-06-26 09:47:52 status installed apt-mirror:all 0.5.1-1ubuntu1

An alternative to zcat is the zgrep command which works similar to zcat. Just think of it as grep command for compressed files:

# zgrep "installed" /var/log/dpkg.log*
# zgrep "installed" /var/log/dpkg.log* | grep apt-mirror
/var/log/dpkg.log.7.gz:2017-06-26 09:47:52 status installed apt-mirror:all 0.5.1-1ubuntu1

The advantage of zgrep is that it will show you the log file from which that data was fetched. As you can see from above, data was pulled from the file /var/log/dpkg.log.7.gz.

List installed packages by date in CentOS

For RPM-based systems like Hat, CentOS, Scientific Linux, Fedora, SUSE, rpm command is used to list installed packages by date. The exact commands to run is:

# rpm -qa --last

This commands list package(s) by install time, most recent first. The output from this command will look like this:

libxml2-2.9.1-6.el7_2.3.x86_64 Sat 09 Dec 2017 10:15:00 AM EAT
findutils-4.5.11-5.el7.x86_64 Sat 09 Dec 2017 10:15:00 AM EAT
libgpg-error-1.12-3.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
libffi-3.0.13-18.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
libcap-ng-0.7.5-4.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
libattr-2.4.46-12.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
libacl-2.2.51-12.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
dbus-libs-1.6.12-17.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT
sed-4.2.2-5.el7.x86_64 Sat 09 Dec 2017 10:14:58 AM EAT

To search installation date for a specific package, append package name at the end of above command.

# rpm -qa --last postfix3
postfix3-3.2.0-1.gf.el7.x86_64 Thu 25 May 2017 01:04:35 AM EAT

From the example. the postfix3 package was installed on Thu 25 May 2017 01:04:35 AM EAT.

List installed packages by date on Arch

For Arch Linux and its derivatives such as Antergos, Manjaro, Apricity, Ninja OS e.t.c, alpm database data extraction utility called expac is used. Invoking expac consists of supplying a format string. Further formatting of the output can be done using supported command options and parameters.

$ expac --timefmt='%F %T' '%l %n'

To compare the output according to string numerical value, pipe the output to sort -n command.

$ expac --timefmt='%F %T' '%l %n' | sort -n

The most recent will be at the bottom, you can pipe the output to get most recent installations.

$ expac --timefmt='%F %T' '%l %n' | sort -n | tail -n 7
2018-01-15 14:41:15 webkitgtk
2018-01-16 09:18:26 babl
2018-01-16 09:18:26 gegl02
2018-01-16 09:18:26 lcms
2018-01-16 09:18:26 libspiro
2018-01-16 09:18:26 libwmf
2018-01-16 09:18:27 gimp

This example lists 7 recently installed packages.

Wrapping up

To this point, we have covered all the steps needed to check the date of package installation on CentOS, Ubuntu, Debian and Arch Linux. For any OS with same parent derivative, the commands should be same. Since some distributions have more than one command that does the same job, just stick to the one you prefer.