List packages on an apt based system by installation date
How can I list installed packages by installation date? I need to do this on debian/ubuntu. Answers for other distributions would be nice as well. I installed a lot of stuff to compile a certain piece of code, and I want to get a list of the packages that I had to install.
12 Answers 12
RPM-based distributions like Red Hat are easy:
On Debian and other dpkg-based distributions, your specific problem is easy too:
grep install /var/log/dpkg.log Unless the log file has been rotated, in which case you should try:
grep install /var/log/dpkg.log /var/log/dpkg.log.1 In general, dpkg and apt don’t seem to track the installation date, going by the lack of any such field in the dpkg-query man page.
And eventually old /var/log/dpkg.log.* files will be deleted by log rotation, so that way isn’t guaranteed to give you the entire history of your system.
One suggestion that appears a few times (e.g. this thread) is to look at the /var/lib/dpkg/info directory. The files there suggest you might try something like:
ls -t /var/lib/dpkg/info/*.list | sed -e 's/\.list$//' | head -n 50 To answer your question about selections, here’s a first pass.
build list of packages by dates
$ find /var/lib/dpkg/info -name "*.list" -exec stat -c $'%n\t%y' <> \; | \ sed -e 's,/var/lib/dpkg/info/,,' -e 's,\.list\t,\t,' | \ sort > ~/dpkglist.dates build list of installed packages
$ dpkg --get-selections | sed -ne '/\tinstall$/' | \ sort > ~/dpkglist.selections $ join -1 1 -2 1 -t $'\t' ~/dpkglist.selections ~/dpkglist.dates \ > ~/dpkglist.selectiondates For some reason it’s not printing very many differences for me, so there might be a bug or an invalid assumption about what —get-selections means.
You can obviously limit the packages either by using find . -mtime — or head -n , and change the output format as you like, e.g.
$ find /var/lib/dpkg/info -name "*.list" -mtime -4 | \ sed -e 's,/var/lib/dpkg/info/,,' -e 's,\.list$,,' | \ sort > ~/dpkglist.recent $ join -1 1 -2 1 -t $'\t' ~/dpkglist.selections ~/dpkglist.recent \ > ~/dpkglist.recentselections to list only the selections that were installed (changed?) in the past 4 days.
You could probably also remove the sort commands after verifying the sort order used by dpkg —get-selections and make the find command more efficient.
I usually like apt-get more than rpm , but now debian gets -1 for not saving the installation date in the database. The debian trick includes all the installed packages, not just the selected packages, but it’s a good start.
For Debian you get less cruft (removes half-installed entries) if u do: grep install\ /var/log/dpkg.log
@Mikel — Great answer. I expanded upon the ‘gather /var/lib/dpkg/info/*.list file info’ and added code to filter out all but the «top level packages» (atp packages upon which no other atp packages depend). That post answers the question «How can I view the history of apt-get install commands that I have manually executed?«.
Debian/Ubuntu: grep » install » /var/log/dpkg.log lists only the “install” lines rather than showing the “status” ones as well.
If neither apt nor dpkg store install/modified datetime, that seems pretty unacceptable to me in 2019. We have rely on grepping log files which may or not be still on the machine? How is this the case?
Mikel has shown how to do this at the dpkg level. In particular, /var/lib/dpkg/info/$packagename.list is created when the package is installed (and not modified afterwards).
If you used the APT tools (which you presumably did since you’re concerned about automatically vs manually installed packages), there’s a history in /var/log/apt/history.log . As long as it hasn’t rotated away, it keeps track of all APT installations, upgrades and removals, with an annotation for packages marked as automatically installed. This is a fairly recent feature, introduced in APT 0.7.26, so in Debian it appeared in squeeze. In Ubuntu, 10.04 has history.log but the automatically-installed annotation is not present until 10.10.
As Mikel pointed out: «And eventually old /var/log/dpkg.log.* files will be deleted by log rotation, so that way isn’t guaranteed to give you the entire history of your system.». See this answer for how to detect the current top level packages (meaning the ones on which no other package depends)
Here is the one-liner everyone wants and needs:
for x in $(ls -1t /var/log/dpkg.log*); do zcat -f $x |tac |grep -e " install " -e " upgrade "; done |awk -F ":a" '' |column -t The result will show all (newly) installed and upgraded packages in chronological order.
The line explanation:
- ls -1t — get all dpkg.log* file names in chronological order
- zcat -f — IF file is of gzip type then decompress it, ELSE just pass on the content.
- tac — Reverse output of cat, line-by-line to makes sure we get the correct chronological order.
- grep — Only check for installed or upgrade packages.
- awk -F ‘:a’ — Separate the architecture field from the package name
- column -t — pretty print the columns separated by space
One would of course like to make an alias for this, but unfortunately it is not possible as awk depends on both single and double quotes. In that regard this is best put into a bash script and where the : separator is handled better for other architectures in the field column.
2018-03-06 18:09:47 upgrade libgomp1 :armhf 6.3.0-18+rpi1 6.3.0-18+rpi1+deb9u1 2018-03-05 15:56:23 install mpg123 :armhf 1.23.8-1 2018-03-05 15:56:23 install libout123-0 :armhf 1.23.8-1 2018-01-22 17:09:45 install libmailtools-perl :all 2.18-1 2018-01-22 17:09:44 install libnet-smtp-ssl-perl :all 1.04-1 - As shown above, it only works on ARM architecture and need slight modification for the architecture field separator
- Need to be put into a script for easy alias
- Has not been tested across other *nix systems
for fillo in `ls -tr /var/lib/dpkg/info/*.list` ; do basename $ | sed 's/.list$//g' ; done > forens.txt ls -ltr /var/lib/dpkg/info/*.list > forentime.txt for lint in `cat forens.txt` ; do echo -n "[ $ Installed ] : " ; echo -n "`grep /$.list forentime.txt | awk '< print $6, $7, $8 >'` : " ; ( ( grep -A3 " $$" /var/lib/apt/extended_states | \ grep '^Auto' > /dev/null ) && echo "Auto" ) || echo "Manual" ; done > pkgdatetime.txt Boo, hiss for parsing output from ls . See mywiki.wooledge.org/ParsingLs for notes on why this is dangerous / inherently buggy — the safer option is to use either find -printf or stat —format to generate a stream that can be unambiguously parsed.
@CharlesDuffy Nice link, but for the purpose of simplicity, using ls -al —time-style=long-iso should be helpful. In addition, it is probably unheard of that someone would name an APT package with \n\t\r\v in its name.
The /var/log/apt/history.log file has an awkward format IMHO.
I would have preferred a more log-file formatted record
or some XML showing not only a but any .
As currently implemented, you can discover the information you seek but it requires some forensic processing to extract the details.
This works for me on a Debian system, I’m guessing the file format has changed since 2011. This system is pretty fresh so I wouldn’t expect this to work on an older system, although that might just require unzipping the logs and using a glob to refer to all of them.
grep 'install ' /var/log/dpkg.log.1 | sort | cut -f1,2,4 -d' ' The first two fields in each line of the file /var/log/dpkg.log are the date and time. Note the trailing space with install in the grep part, this is because upgrades can trigger installs but if I understood correctly you wanted to know what was installed by users.
Exactly what I do. Easy. But you can use zgrep and your all your .gz logs will get searched like zgrep ‘ install’ /var/log/dpkg.log*. Place the space before the word «install» to prevent those pesky «half-installs». I had to use cut -f1,5 to get the package name field. Of course eventually the old logs rotate out.
GNU/Linux Debian has no built-in tools for this problem, but all information about programs installed in the standard way is saved in files with program-name.list in the location /var/lib/dpkg/info/. But there is no information about manually installed programs there.
A long single-line solution:
for file_list in `ls -rt /var/lib/dpkg/info/*.list`; do \ stat_result=$(stat --format=%y "$file_list"); \ printf "%-50s %s\n" $(basename $file_list .list) "$stat_result"; \ done Explanation:
- ls -rt outputs files sorted by date modification in the reverse order, i.e. with the newest files at the end of the list.
- stat prints the file’s date in human readable form.
- printf displays the package name and the date of its last modification.
- The for loop as a whole prints package names and dates from oldest to newest.
Output example (truncated):
. gnome-system-log 2016-09-17 16:31:58.000000000 +0300 libyelp0 2016-09-17 16:32:00.000000000 +0300 gnome-system-monitor 2016-09-17 16:32:00.000000000 +0300 yelp-xsl 2016-09-17 16:32:01.000000000 +0300 yelp 2016-09-17 16:32:03.000000000 +0300 gnome-user-guide 2016-09-17 16:32:18.000000000 +0300 libapache2-mod-dnssd 2016-09-17 16:32:19.000000000 +0300 . linux-compiler-gcc-4.8-x86 2017-02-26 20:11:02.800756429 +0200 linux-headers-3.16.0-4-amd64 2017-02-26 20:11:10.463446327 +0200 linux-headers-3.16.0-4-common 2017-02-26 20:11:17.414555037 +0200 linux-libc-dev:amd64 2017-02-26 20:11:21.126184016 +0200 openssl 2017-02-26 20:11:22.094098618 +0200 unzip 2017-02-26 20:11:23.118013331 +0200 wireless-regdb 2017-02-26 20:11:23.929949143 +0200 nodejs 2017-02-26 20:11:33.321424052 +0200 nasm 2017-02-28 16:41:17.013509727 +0200 librecode0:amd64 2017-03-01 10:38:49.817962640 +0200 libuchardet0 2017-03-01 10:41:10.860098788 +0200 tree 2017-03-04 14:32:12.251787763 +0200 libtar0 2017-03-07 09:51:46.609746789 +0200 libtar-dev 2017-03-07 09:51:47.129753987 +0200 The main defect of this solution.is that it’s not well-tested in production.
Как найти дату и время установки пакета rpm
В этом посту мы узнаем такую команду linux, чтобы найти дату и время установки пакета rpm.
Являясь системным администратором Linux, мы принимаем участие в деятельности по аудиту ИТ.
Иногда для кросс-проверки требуется точная дата и время файла rpm, установленного в операционной системе на базе Red Hat (RHEL / CentOS / Scientific Linux).
Следовательно, для целей аудита важно знать об этой команде.
RPM означает Red Hat Packet Manager.
Это система управления пакетами во всей операционной системе на базе Red Hat (RHEL / CentOS / Scientific Linux).
RPM также переносится на другую операционную систему, такую как IBM AIX и Novell’s Netware.
В RPM используется известный формат файла .rpm.
Сообщество rpm.org участвует в обслуживании и развитии RPM
Найти дату и время установки пакета rpm
Мы будем использовать команду rpm с некоторыми параметрами, чтобы найти информацию о дате установленного пакета.
(1) Список всех пакетов rpm с информацией о дате и времени
Используйте приведенную ниже команду, чтобы отобразить все пакеты rpm с информацией о дате
(2) Показать установленные дату и время одного пакета
Чтобы получить установленные данные даты и времени одного пакета – у нас есть две команды
Команда 1:
Приведенная ниже команда будет показывать только дату, время и часовой пояс установке пакета rpm.
[root@localhost ~]# rpm -q --last basesystem-10.0-4.el6.noarch basesystem-10.0-4.el6.noarch Friday 21 February 2014 07:09:30 PM IST [root@localhost ~]#
С приведенной ниже командой система покажет еще более полезное описание.
[root@localhost ~]# rpm -qi rsyslog-7.6.0-1.el6.x86_64 Name : rsyslog Relocations: (not relocatable) Version : 7.6.0 Vendor: (none) Release : 1.el6 Build Date: Thursday 13 February 2014 01:40:23 PM IST Install Date: Saturday 01 March 2014 06:54:57 AM IST Build Host: vmrpm.adiscon.com Group : System Environment/Daemons Source RPM: rsyslog-7.6.0-1.el6.src.rpm Size : 2403604 License: (GPLv3+ and ASL 2.0) Signature : RSA/SHA1, Thursday 13 February 2014 01:40:34 PM IST, Key ID e0f233b3e00b8985 URL : http://www.rsyslog.com/ Summary : a rocket-fast system for log processing Description : Rsyslog is an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine grain output format control. It is compatible with stock sysklogd and can be used as a drop-in replacement. Rsyslog is simple to set up, with advanced features suitable for enterprise-class, encryption-protected syslog relay chains. [root@localhost ~]#
Мы видим параметр “Install Date”