How can I know:

  1. What packages were installed in the system?
  2. The user who installed them?

3 Answers 3


You can check your package selections (install packages) using:

dpkg-query -l

Read more: https://wiki.debian.org/ListInstalledPackages

@mook765 stated that "You could find out which user requested an install by checking in /var/log/apt/history.log and related archives /var/log/apt/history.log.#.gz"

  • 1
    You could find out which user requested an install by checking in var/log/apt/history.log and related archives /var/log/apt/history.log.#.gz, you may include that in the answer...
    – mook765
    Commented Oct 4, 2016 at 5:34
  • You should clean this answer up, it is a mess, what is with the crossed out lines? -1
    – Mark Kirby
    Commented Oct 5, 2016 at 9:10

how far back do you want to go?

check this log:

grep " install " /var/log/dpkg.log

the one before:

grep " install " /var/log/dpkg.log.1

or archive:

zgrep " install " /var/log/dpkg.log.2.gz

Now that you have timestamps, check against this list's timestamps:

grep sudo /var/log/auth.log

(you can actually just do it all from this last command)

But, if you have a lot to sort through...its easier to know what times you are looking for by checking dpkg logs.

  • 3
    hmmm... good thinking. A script could do this detective work maybe...
    – Zanna
    Commented Oct 4, 2016 at 6:06
  • Can you write it? :)
    – ultrajohn
    Commented Oct 4, 2016 at 6:09

Some commands to get this info from the logs suggested by others, to save sifting through the entire logs

zgrep -B1 Install /var/log/apt/history*

sample of output:

/var/log/apt/history.log.4.gz:Requested-By: zanna (1000)
/var/log/apt/history.log.4.gz:Install: powertop:amd64 (2.8-1build1)


zgrep 'sudo.*install ' /var/log/auth*

sample of output:

/var/log/auth.log.3.gz:Sep 18 07:09:28 monster sudo:    zanna : TTY=pts/1 ; PWD=/home/zanna/Downloads ; USER=root ; COMMAND=/usr/bin/apt install jq

tee or > out to a file for easier browsing, eg

zgrep -B1 Install /var/log/apt/history* > ~/install.log

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .