146

Is there a way to show the history of packages that were changed by apt-get via command line?

1

6 Answers 6

172

All actions with apt (apt-get) are logged. These files are available in /var/log/apt/. To view the most recent history log, execute:

less /var/log/apt/history.log

These logs gets rotated (every month I guess), old files will be suffixed with a number and compressed. So to view the next history log, use:

zless /var/log/apt/history.log.1.gz

To view the logs available:

ls -la /var/log/apt/
7
  • 5
    This is excellent. The only thing missing is who ran the commands. Apr 3, 2012 at 17:33
  • 4
    @LimitedAtonement Have a look at /var/log/auth.log, it may contain the user running the installation. (this won't help if the installation was invoked through a shell/program running as root)
    – Lekensteyn
    Apr 3, 2012 at 17:41
  • 3
    Also useful: zgrep, zcat
    – ishmael
    Sep 1, 2015 at 23:33
  • does this file also log the dependency packages installed as a result of original apt-get?
    – Mahesha999
    May 23, 2016 at 19:26
  • 3
    @LimitedAtonement the latest versions of APT offer a "Requested-By:" portion of the log to show who invoked the command as well as which command they invoked like "Commandline: packagekit role='update-packages' " or "Commandline: apt upgrade" Dec 18, 2016 at 23:13
30

You can also make a short command to display the interesting content.

  • Add this custom function to your ~/.bashrc:

    ### pars for fun: install | remove | rollback
    function apt-history(){
    
          case "$1" in
            install)
                  grep 'install ' /var/log/dpkg.log
                  ;;
            upgrade|remove)
                  grep $1 /var/log/dpkg.log
                  ;;
            rollback)
                  grep upgrade /var/log/dpkg.log | \
                      grep "$2" -A10000000 | \
                      grep "$3" -B10000000 | \
                      awk '{print $4"="$5}'
                  ;;
            *)
                  cat /var/log/dpkg.log
                  ;;
          esac
    }
    
  • And call it in a terminal like this:

    kreso@h17:~$ apt-history install
    2013-08-06 14:42:36 install gir1.2-nautilus-3.0:amd64 <none> 1:3.8.2-0ubuntu1~ubuntu13.04.1
    2013-08-06 14:42:36 install python-nautilus:amd64 <none> 1.1-3ubuntu1
    2013-08-06 14:42:37 install insync-nautilus:all <none> 1.0.20
    2013-08-07 14:41:37 install powertop:amd64 <none> 2.1-0ubuntu1
    2013-08-07 18:44:10 install libdiscid0:amd64 <none> 0.2.2-3build1
    2013-08-07 18:44:11 install sound-juicer:amd64 <none> 3.5.0-0ubuntu1
    

Taken from here

1
  • 1
    zgrep ... /var/log/dpkg.log*- outputs entries from archives too.
    – Ctrl-C
    Nov 25, 2016 at 10:27
9

You can also use the following command to list recently installed packages

grep "\ install\ " /var/log/dpkg.log
1
  • 2
    even better: grep "\ install\ " /var/log/apt/history.log in case you need to copy and paste a list into apt-get
    – mchid
    Jul 27, 2015 at 19:53
2

If you want those packages that were installed and not subsequently uninstalled, try this:

comm -23 <(grep "apt-get install" /var/log/apt/history.log | sed 's/.* //' | sort) \ 
<(grep "apt-get remove" /var/log/apt/history.log | sed 's/.* //' | sort) 

This is the installs minus any matching removes.

References:

1
  • +1: Nice one-liner but only valid for the last log rotation period. Also instead of sort, use sort -uin both cases to avoid duplicate lines to show up such as in package like oracle-java8-installer and many others.
    – Cbhihe
    Jul 24, 2016 at 7:58
2

To get the update history of a specific package assuming it was installed/updated via apt here's a oneliner (bash and zgrep), example is for package skypeforlinux:

package='skypeforlinux'; pregex="(${package}[^\)]+\))"; while read -r line; do [[ "$line" =~ ^Start-Date:[[:space:]]([[:digit:]].+) ]] && curdate="${BASH_REMATCH[1]} "; [[ "$line" =~ $pregex ]] && echo "$curdate ${BASH_REMATCH[1]}"; done < <(for i in `ls -tr /var/log/apt/history*`; do zgrep -B3 "$package" $i; done)

This greps apt's history log files for skypeforlinux including the previous three lines to get the date. Then iterates over the result and echoes the relevant dates and versions.

Replace the package variable value with your package name, even works for multiple packages provided they begin with same string.

Example with output:

package='apache'; pregex="(${package}[^\)]+\))"; while read -r line; do [[ "$line" =~ ^Start-Date:[[:space:]]([[:digit:]].+) ]] && curdate="${BASH_REMATCH[1]} "; [[ "$line" =~ $pregex ]] && echo "$curdate ${BASH_REMATCH[1]}"; done < <(for i in `ls -tr /var/log/apt/history*`; do zgrep -B3 "$package" $i; done)
2017-10-19  15:00:09  apache2-utils:amd64 (2.4.18-2ubuntu3.5)
2017-11-24  14:24:45  apache-pom-java:amd64 (10-2build1, automatic)
2018-02-22  16:42:02  apache2-data:amd64 (2.4.18-2ubuntu3.5, automatic)
2018-02-26  15:34:34  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:36:32  apache2-data:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:40:50  apache2-data:amd64 (2.4.18-2ubuntu3.5, automatic)
2018-02-26  15:42:07  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:42:39  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-03-15  10:08:50  apache-pom-java:amd64 (10-2build1)
2018-04-20  08:55:07  apache2-data:amd64 (2.4.18-2ubuntu3.5, 2.4.18-2ubuntu3.8)
2018-07-06  08:55:11  apache2-data:amd64 (2.4.18-2ubuntu3.8, 2.4.18-2ubuntu3.9)
1

Here is how you actually do it, say package mutter:

_P=mutter &&
(cat /var/log/dpkg.log{,.1};zcat /var/log/dpkg.log.*.gz) |
egrep --text "^[^ ]* [^ ]* (configure|install|remove|status [^ ]*|trigproc|upgrade) $_P[: ]" |
sort --reverse | less

Using dpkg.log captures operations that apt-get does not see.

Output:

2016-12-20 09:47:35 status unpacked mutter:amd64 3.22.2-2ubuntu1~ubuntu16.10.1
2016-12-20 09:47:35 status installed mutter:amd64 3.22.2-2ubuntu1~ubuntu16.10.1
…
1
  • 1
    Please note triple backticks here don't work the way you think they do.
    – edwinksl
    Dec 20, 2016 at 23:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .