Sometimes you want to know when a package was installed on your operating system, maybe for auditing purposes mostly if you're a Linux System Administrator.
In this blog post, I'll show you how to list installed packages by date on Linux - Ubuntu, Debian, CentOS and Arch Linux distributions.
List installed packages by date on Ubuntu/Debian
If you're running Ubuntu, Debian or any other Debian derivative like Kubuntu, Xubuntu e.t.c, commands used will be similar. To list installed packages sorted by date, run:
$ grep -i "install" /var/log/dpkg.log
Note that above command will work only if the package installed was logged to the file /var/log/dpkg.log. Since Linux system by default has some sort of log rotation, this will not work for rotated logs that have been compressed. To get all installed date for packages including those whose logs have been rotated, use the command:
$ zcat /var/log/dpkg.log.* | grep -i "installed"
Sample output is:
..... 2017-05-23 07:49:41 status installed libxaw7:amd64 2:1.0.13-1 2017-05-23 07:49:41 status installed libxcb-shape0:amd64 1.11.1-1ubuntu1 2017-05-23 07:49:41 status installed x11proto-xext-dev:all 7.3.0-1 2017-05-23 07:49:41 status installed libxext-dev:amd64 2:1.3.3-1 2017-05-23 07:49:41 status installed x11proto-render-dev:all 2:0.11.1-2 2017-05-23 07:49:41 status installed libxrender-dev:amd64 1:0.9.9-0ubuntu1 2017-05-23 07:49:41 status installed libxft-dev:amd64 2.3.2-1 2017-05-23 07:49:41 status installed libxrandr2:amd64 2:1.5.0-1 2017-05-23 07:49:41 status installed x11proto-scrnsaver-dev:all 1.2.2-1
zcat command reads compressed files, then we pipe the output to grep for filtering.
If you want to grep for a specific package which you know some part of its name, you can pipe the output again to grep command. See example below which searches for installation date of the apt-mirror package.
# zcat /var/log/dpkg.log.* | grep -i "installed" | grep apt-mirror 2017-06-26 09:47:52 status installed apt-mirror:all 0.5.1-1ubuntu1
An alternative to zcat is the zgrep command which works similar to zcat. Just think of it as grep command for compressed files:
# zgrep "installed" /var/log/dpkg.log* # zgrep "installed" /var/log/dpkg.log* | grep apt-mirror /var/log/dpkg.log.7.gz:2017-06-26 09:47:52 status installed apt-mirror:all 0.5.1-1ubuntu1
The advantage of zgrep is that it will show you the log file from which that data was fetched. As you can see from above, data was pulled from the file /var/log/dpkg.log.7.gz.
List installed packages by date in CentOS
For RPM-based systems like Hat, CentOS, Scientific Linux, Fedora, SUSE, rpm command is used to list installed packages by date. The exact commands to run is:
# rpm -qa --last
This commands list package(s) by install time, most recent first. The output from this command will look like this:
libxml2-2.9.1-6.el7_2.3.x86_64 Sat 09 Dec 2017 10:15:00 AM EAT findutils-4.5.11-5.el7.x86_64 Sat 09 Dec 2017 10:15:00 AM EAT libgpg-error-1.12-3.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT libffi-3.0.13-18.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT libcap-ng-0.7.5-4.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT libattr-2.4.46-12.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT libacl-2.2.51-12.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT dbus-libs-1.6.12-17.el7.x86_64 Sat 09 Dec 2017 10:14:59 AM EAT sed-4.2.2-5.el7.x86_64 Sat 09 Dec 2017 10:14:58 AM EAT
To search installation date for a specific package, append package name at the end of above command.
# rpm -qa --last postfix3 postfix3-3.2.0-1.gf.el7.x86_64 Thu 25 May 2017 01:04:35 AM EAT
From the example. the postfix3 package was installed on Thu 25 May 2017 01:04:35 AM EAT.
List installed packages by date on Arch
For Arch Linux and its derivatives such as Antergos, Manjaro, Apricity, Ninja OS e.t.c, alpm database data extraction utility called expac is used. Invoking expac consists of supplying a format string. Further formatting of the output can be done using supported command options and parameters.
$ expac --timefmt='%F %T' '%l %n'
To compare the output according to string numerical value, pipe the output to sort -n command.
$ expac --timefmt='%F %T' '%l %n' | sort -n
The most recent will be at the bottom, you can pipe the output to get most recent installations.
$ expac --timefmt='%F %T' '%l %n' | sort -n | tail -n 7 2018-01-15 14:41:15 webkitgtk 2018-01-16 09:18:26 babl 2018-01-16 09:18:26 gegl02 2018-01-16 09:18:26 lcms 2018-01-16 09:18:26 libspiro 2018-01-16 09:18:26 libwmf 2018-01-16 09:18:27 gimp
This example lists 7 recently installed packages.
Wrapping up
To this point, we have covered all the steps needed to check the date of package installation on CentOS, Ubuntu, Debian and Arch Linux. For any OS with same parent derivative, the commands should be same. Since some distributions have more than one command that does the same job, just stick to the one you prefer.
Comments