I am running rkhunter as a cron job and thus receiving notification any time I’ve installed something. Ideally I should be checking the output immediately and updating its database if it is just reporting a change due to a software update I’ve performed. But very often I don’t have time to do it right away and end up forgetting for days. At some point in time, I do check the logs and see that some pieces of software have been changed. By that time I usually do not remember what packages I’ve updated since last rkhunter database update. So I needed a way to check the history of installation of packages.
The bad news is that there is no apt-history command which would easily display the history of installed, updated and removed packages. The good news is that there are some log files which contain the whole history and can be used as a basis to extract this information.
There are actually two location where you can find such log files:
- /var/log/apt/history.log* –> This contains the apt history logs
- /var/log/dpkg.log* –> This contains the dpkg logs
Note that older log files are compressed with gzip. For the apt history logs, only the latest file is uncompressed. For the dpkg logs, the two latest files are uncompressed. Luckily, you can use the -f option of zcat to output the contents of those log files, no matter whether they are compressed or not. And combining it with ls -tr you can basically decompress them and concatenate them on the fly in the proper order:
zcat -f $(ls -tr /var/log/apt/history.log*)
zcat -f $(ls -tr /var/log/dpkg.log*)Before we start, I wanted to mention that I do know that aptitude also writes a log file (/var/log/aptitude) but when I looked at it, it only contained information about what happened in the past 8 days. So it wasn’t really useful for my purpose. There is probably a way to configure aptitude to store more history in there but since I found another good solution, let’s stick to this… Also if you use Synaptic, there is also a “View History” function in the GUI. But it only shows changes made with Synaptic, not from the command line or automatically e.g. by Plesk auto-installer.
First I had a look at the contents of the apt history log files. It looks like this:
Start-Date: 2014-02-17 21:53:00 Install: libserf1:amd64 (1.3.4-1+WANdisco, automatic), php5-imagick:amd64 (3.1.0~rc1-1+b2, automatic), php5-pgsql:amd64 (5.4.4-14+deb7u7, automatic), php5-mcrypt:amd64 (5.4.4-14+deb7u7, automatic), php5-intl:amd64 (5.4.4-14+deb7u7, automatic) Upgrade: owncloud:amd64 (5.0.13-1, 6.0.1-1), subversion:amd64 (1.7.13-1+WANdisco, 1.7.14-1+WANdisco), libsvn1:amd64 (1.7.13-1+WANdisco, 1.7.14-1+WANdisco), libapache2-svn:amd64 (1.7.13-1+WANdisco, 1.7.14-1+WANdisco) End-Date: 2014-02-17 21:53:20
Processing it with Unix tools is possible but it is a pain because you have to consider groups of lines, between a Start-Date and an End-Date, and the number of lines inbetween is not always the same (potentially one line for installs, one line for upgrades and one line for removals). This can of course be procesed with some grep, awk, sed and other utilities. But this has two problems: first I’m lazy, second if the command is too complex I will never remember it even if I use it daily.
So I decided to have a look at the dpkg log files and see whether they were friendlier:
2014-02-17 21:53:00 startup archives unpack 2014-02-17 21:53:00 install libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:00 status half-installed libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:00 status unpacked libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:00 status unpacked libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:01 install php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:01 status triggers-pending libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:01 status not-installed php5-intl:amd64 2014-02-17 21:53:01 status half-installed php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:01 status unpacked php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:01 status unpacked php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 install php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 status not-installed php5-mcrypt:amd64 2014-02-17 21:53:02 status half-installed php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 status unpacked php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 status unpacked php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 install php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:02 status not-installed php5-pgsql:amd64 2014-02-17 21:53:02 status half-installed php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:03 status unpacked php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:03 status unpacked php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:03 upgrade subversion:amd64 1.7.13-1+WANdisco 1.7.14-1+WANdisco 2014-02-17 21:53:03 status half-configured subversion:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:03 status unpacked subversion:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:03 status half-installed subversion:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:03 status triggers-pending man-db:amd64 2.6.2-1 2014-02-17 21:53:04 status half-installed subversion:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:04 status half-installed subversion:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:04 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:04 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:04 upgrade libsvn1:amd64 1.7.13-1+WANdisco 1.7.14-1+WANdisco 2014-02-17 21:53:04 status half-configured libsvn1:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:04 status unpacked libsvn1:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:04 status half-installed libsvn1:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status half-installed libsvn1:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status unpacked libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:05 status unpacked libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:05 upgrade libapache2-svn:amd64 1.7.13-1+WANdisco 1.7.14-1+WANdisco 2014-02-17 21:53:05 status half-configured libapache2-svn:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status unpacked libapache2-svn:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status half-installed libapache2-svn:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status half-installed libapache2-svn:amd64 1.7.13-1+WANdisco 2014-02-17 21:53:05 status unpacked libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:05 status unpacked libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:06 upgrade owncloud:all 5.0.13-1 6.0.1-1 2014-02-17 21:53:06 status half-configured owncloud:all 5.0.13-1 2014-02-17 21:53:06 status unpacked owncloud:all 5.0.13-1 2014-02-17 21:53:06 status half-installed owncloud:all 5.0.13-1 2014-02-17 21:53:11 status half-installed owncloud:all 5.0.13-1 2014-02-17 21:53:11 status unpacked owncloud:all 6.0.1-1 2014-02-17 21:53:11 status unpacked owncloud:all 6.0.1-1 2014-02-17 21:53:12 install php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:12 status half-installed php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:12 status unpacked php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:12 status unpacked php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:12 trigproc libapache2-mod-php5:amd64 5.4.4-14+deb7u7 5.4.4-14+deb7u7 2014-02-17 21:53:12 status half-configured libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:12 status installed libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:13 trigproc man-db:amd64 2.6.2-1 2.6.2-1 2014-02-17 21:53:13 status half-configured man-db:amd64 2.6.2-1 2014-02-17 21:53:13 status installed man-db:amd64 2.6.2-1 2014-02-17 21:53:14 startup packages configure 2014-02-17 21:53:14 configure libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:14 status unpacked libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:14 status half-configured libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:14 status installed libserf1:amd64 1.3.4-1+WANdisco 2014-02-17 21:53:14 configure php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:14 status triggers-pending libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:14 status unpacked php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status unpacked php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status half-configured php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status triggers-awaited php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 configure php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status unpacked php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status unpacked php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:15 status half-configured php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:16 status triggers-awaited php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:16 configure php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:16 status unpacked php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:16 status unpacked php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:16 status half-configured php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:17 status triggers-awaited php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:17 configure php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:17 status unpacked php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:17 status half-configured php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:18 status installed php5-imagick:amd64 3.1.0~rc1-1+b2 2014-02-17 21:53:18 trigproc libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 status half-configured libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 status installed php5-pgsql:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 status installed php5-mcrypt:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 status installed php5-intl:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 status installed libapache2-mod-php5:amd64 5.4.4-14+deb7u7 2014-02-17 21:53:18 configure owncloud:all 6.0.1-1 2014-02-17 21:53:18 status unpacked owncloud:all 6.0.1-1 2014-02-17 21:53:19 status unpacked owncloud:all 6.0.1-1 2014-02-17 21:53:19 status unpacked owncloud:all 6.0.1-1 2014-02-17 21:53:19 status half-configured owncloud:all 6.0.1-1 2014-02-17 21:53:19 status installed owncloud:all 6.0.1-1 2014-02-17 21:53:19 configure subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status unpacked subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status half-configured subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status installed subversion:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 configure libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status unpacked libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status half-configured libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:19 status installed libsvn1:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 configure libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 status unpacked libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 status unpacked libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 status unpacked libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 status half-configured libapache2-svn:amd64 1.7.14-1+WANdisco 2014-02-17 21:53:20 status installed libapache2-svn:amd64 1.7.14-1+WANdisco
It’s much more verbose but each line contains both the date and time and what was performed. All you need to do is use a grep to extract the information you need. So depending what you’re after you’ll use one of these 3 commands:
zcat -f $(ls -tr /var/log/dpkg.log*) | grep " install "
zcat -f $(ls -tr /var/log/dpkg.log*) | grep " upgrade "
zcat -f $(ls -tr /var/log/dpkg.log*) | grep " remove "You will then see something like this:
# zcat -f $(ls -tr /var/log/dpkg.log*) | grep " remove "
2014-12-01 18:43:15 remove libneon27-gnutls:amd64 0.29.6-3 <keine>
2014-12-01 18:43:16 remove libnss3-1d:amd64 2:3.14.5-1+deb7u3 <keine>
2014-12-01 18:43:16 remove libtommath0:amd64 0.42.0-1 <keine>Note that keine means “none” in German, so removing a package is going from a certain version to none.
The post Debian / Ubuntu: viewing the apt change log appeared first on Benohead.
