118

Is there a way to show the history of packages that were changed by apt-get via command line?

133

All actions with apt (apt-get) are logged. These files are available in /var/log/apt/. To view the most recent history log, execute:

less /var/log/apt/history.log

These logs gets rotated (every month I guess), old files will be suffixed with a number and compressed. So to view the next history log, use:

zless /var/log/apt/history.log.1.gz

To view the logs available:

ls -la /var/log/apt/
  • 4
    This is excellent. The only thing missing is who ran the commands. – Limited Atonement Apr 3 '12 at 17:33
  • 3
    @LimitedAtonement Have a look at /var/log/auth.log, it may contain the user running the installation. (this won't help if the installation was invoked through a shell/program running as root) – Lekensteyn Apr 3 '12 at 17:41
  • 3
    Also useful: zgrep, zcat – ishmael Sep 1 '15 at 23:33
  • does this file also log the dependency packages installed as a result of original apt-get? – Maha May 23 '16 at 19:26
  • 2
    @LimitedAtonement the latest versions of APT offer a "Requested-By:" portion of the log to show who invoked the command as well as which command they invoked like "Commandline: packagekit role='update-packages' " or "Commandline: apt upgrade" – Michael Tunnell Dec 18 '16 at 23:13
22

You can also make a short command to display the interesting content.

  • Add this custom function to your ~/.bashrc:

    ### pars for fun: install | remove | rollback
    function apt-history(){
    
          case "$1" in
            install)
                  grep 'install ' /var/log/dpkg.log
                  ;;
            upgrade|remove)
                  grep $1 /var/log/dpkg.log
                  ;;
            rollback)
                  grep upgrade /var/log/dpkg.log | \
                      grep "$2" -A10000000 | \
                      grep "$3" -B10000000 | \
                      awk '{print $4"="$5}'
                  ;;
            *)
                  cat /var/log/dpkg.log
                  ;;
          esac
    }
    
  • And call it in a terminal like this:

    kreso@h17:~$ apt-history install
    2013-08-06 14:42:36 install gir1.2-nautilus-3.0:amd64 <none> 1:3.8.2-0ubuntu1~ubuntu13.04.1
    2013-08-06 14:42:36 install python-nautilus:amd64 <none> 1.1-3ubuntu1
    2013-08-06 14:42:37 install insync-nautilus:all <none> 1.0.20
    2013-08-07 14:41:37 install powertop:amd64 <none> 2.1-0ubuntu1
    2013-08-07 18:44:10 install libdiscid0:amd64 <none> 0.2.2-3build1
    2013-08-07 18:44:11 install sound-juicer:amd64 <none> 3.5.0-0ubuntu1
    

Taken from here

  • zgrep ... /var/log/dpkg.log*- outputs entries from archives too. – Ctrl-C Nov 25 '16 at 10:27
6

You can also use the following command to list recently installed packages

grep "\ install\ " /var/log/dpkg.log
  • 1
    even better: grep "\ install\ " /var/log/apt/history.log in case you need to copy and paste a list into apt-get – mchid Jul 27 '15 at 19:53
2

If you want those packages that were installed and not subsequently uninstalled, try this:

comm -23 <(grep "apt-get install" /var/log/apt/history.log | sed 's/.* //' | sort) \ 
<(grep "apt-get remove" /var/log/apt/history.log | sed 's/.* //' | sort) 

This is the installs minus any matching removes.

References:

  • +1: Nice one-liner but only valid for the last log rotation period. Also instead of sort, use sort -uin both cases to avoid duplicate lines to show up such as in package like oracle-java8-installer and many others. – Cbhihe Jul 24 '16 at 7:58
1

Here is how you actually do it, say package mutter:

_P=mutter &&
(cat /var/log/dpkg.log{,.1};zcat /var/log/dpkg.log.*.gz) |
egrep --text "^[^ ]* [^ ]* (configure|install|remove|status [^ ]*|trigproc|upgrade) $_P[: ]" |
sort --reverse | less

Using dpkg.log captures operations that apt-get does not see.

Output:

2016-12-20 09:47:35 status unpacked mutter:amd64 3.22.2-2ubuntu1~ubuntu16.10.1
2016-12-20 09:47:35 status installed mutter:amd64 3.22.2-2ubuntu1~ubuntu16.10.1
…
  • 1
    Please note triple backticks here don't work the way you think they do. – edwinksl Dec 20 '16 at 23:01
1

To get the update history of a specific package assuming it was installed/updated via apt here's a oneliner (bash and zgrep), example is for package skypeforlinux:

package='skypeforlinux'; pregex="(${package}[^\)]+\))"; while read -r line; do [[ "$line" =~ ^Start-Date:[[:space:]]([[:digit:]].+) ]] && curdate="${BASH_REMATCH[1]} "; [[ "$line" =~ $pregex ]] && echo "$curdate ${BASH_REMATCH[1]}"; done < <(for i in `ls -tr /var/log/apt/history*`; do zgrep -B3 "$package" $i; done)

This greps apt's history log files for skypeforlinux including the previous three lines to get the date. Then iterates over the result and echoes the relevant dates and versions.

Replace the package variable value with your package name, even works for multiple packages provided they begin with same string.

Example with output:

package='apache'; pregex="(${package}[^\)]+\))"; while read -r line; do [[ "$line" =~ ^Start-Date:[[:space:]]([[:digit:]].+) ]] && curdate="${BASH_REMATCH[1]} "; [[ "$line" =~ $pregex ]] && echo "$curdate ${BASH_REMATCH[1]}"; done < <(for i in `ls -tr /var/log/apt/history*`; do zgrep -B3 "$package" $i; done)
2017-10-19  15:00:09  apache2-utils:amd64 (2.4.18-2ubuntu3.5)
2017-11-24  14:24:45  apache-pom-java:amd64 (10-2build1, automatic)
2018-02-22  16:42:02  apache2-data:amd64 (2.4.18-2ubuntu3.5, automatic)
2018-02-26  15:34:34  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:36:32  apache2-data:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:40:50  apache2-data:amd64 (2.4.18-2ubuntu3.5, automatic)
2018-02-26  15:42:07  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-02-26  15:42:39  apache2:amd64 (2.4.18-2ubuntu3.5)
2018-03-15  10:08:50  apache-pom-java:amd64 (10-2build1)
2018-04-20  08:55:07  apache2-data:amd64 (2.4.18-2ubuntu3.5, 2.4.18-2ubuntu3.8)
2018-07-06  08:55:11  apache2-data:amd64 (2.4.18-2ubuntu3.8, 2.4.18-2ubuntu3.9)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.