Multi-user system.

Fedora 12 x86_64.

All users are sudoers.

  • 2
    If you have a date when the package was installed, you might want to check /var/log/auth.log for a sudo incident on that date. – 111--- Jul 2 '15 at 12:33
  • Is auditing enabled? – Andrew Henle Jul 2 '15 at 12:43
  • Do you need to know for security reasons or for convenience? – mattdm Jul 2 '15 at 20:41

Fedora 12 is a bit old but I think you can still do the following:

Look in /var/log/secure which has lines for each use of sudo. For example, you might find:

Aug 11 15:16:37 home sudo: user : TTY=pts/2 ; PWD=/home/user ; \
 USER=root ; COMMAND=/bin/rpm -i /home/user/mypackage.rpm

List all the installation times of the rpms with:

rpm -qa --qf '%{name} %{version}-%{release} %{installtime:date}\n'

Match the time or the package name, eg:

mypackage Mon Aug 11 15:16:14 2014
| improve this answer | |
  • To say F12 is 'a bit old' is an understatement. It went out of support at the end of 2010. – jsbillings Jul 5 '15 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.