I know that dpkg and dpkg-query are good tools to find out about packages currently installed on a Debian system. Besides the information logged to the files /var/log/dpkg.log.* is there any other place that would allow me to know when a change took place (i.e. the time and date of an installation of a package)?

Assuming that this question here says that Debian's package system does not care about storing information about the origin of a deb file (and well how should it do so?) I am beginning to think that /var/log/dpkg.log.* is the only place where information about when something dpkg related happened is stored at all.

Maybe somebody can confirm this. Or else tell me if the time information regarding package installs is stored (indeed that would be great!) where to find them (which file?).


/var/log/dpkg.log is the only log file that is left by dpkg itself. It logs which packages are installed, uninstalled, upgraded, etc. It only indicates the package name, the version and the action: dpkg doesn't know the origin of the packages. It does indicate the date of each action.

If dpkg was invoked by a tool in the APT suite (apt-get, aptitude, Synaptic, …), the actions of APT are logged in /var/log/apt/history.log and /var/log/apt/term.log. The file apt/history.log contains the same kind of information as dpkg.log. The file apt/term.log contains a transcript of the dpkg run (pre- and post-install and -remove scripts, dpkg run, triggers).

Aptitude also writes a similar log in /var/log/aptitude. This log contains the actions that aptitude attempted, whether or not they succeeded.

You can also usually determine when the current version a package was installed by checking the ctime of /var/lib/dpkg/info/$package.*. These files may have a more recent ctime if they were modified later for some reason (e.g. restored from backup). The current version may have been an upgrade from another version, this method won't tell you anything about prior versions.

If you install and enable etckeeper, then every time you run APT and something in /etc changes, the change is committed to version control. When APT makes a commit automatically after an action, it indicates the action taken (e.g. which packages were installed) in the log message.

There is no tool that logs the origin of the packages. Usually, with APT, a given package always comes from the same source, unless the sources or their priorities have changed. In the rare cases where sources or priorities did change, there is no general way of retrieving historical information about where a package that was installed in the past was obtained from.

  • The ctime of the /var/lib/dpkg/info/ files even changes during normal apt-get upgrade operation. After such an upgrade e.g. the dpkg.lst ctime == mtime == current-time - and dpkg.md5sums ctime > mtime. Thus, unfortunately, looking at the ctime doesn't provide more information than just looking at the mtime. One can't distinguish package upgrade/install times with them. – maxschlepzig Jan 22 '17 at 20:59
  • @maxschlepzig Yes, I meant when the current version of the package was installed, not when some version was first installed. I'll edit that. – Gilles Jan 22 '17 at 21:48

See the files in /var/log/apt. The files history.log and term.log are written to by both apt-get and aptitude, at least. When apt-get runs, the command line is also given. You probably want to look at history.log. Among another things this logs the time of the action.

So, for example, a log section corresponding to a package installation using apt-get looks like:

Start-Date: 2013-09-02  00:27:25
Commandline: apt-get install unrar
Install: unrar:amd64 (4.1.4-1)
End-Date: 2013-09-02  00:27:29

A log section corresponding to an installation using aptitude looks like:

Start-Date: 2013-09-02  16:39:11
Install: hello:amd64 (2.8-2)
End-Date: 2013-09-02  16:39:15

These examples are from a Debian amd64 wheezy system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.