Package managers on Debian and Ubuntu systems maintain detailed logs of all installations, upgrades, and removals. These logs are essential for auditing system changes, troubleshooting dependency issues, or understanding what was installed and when.
Log File Locations
The main log files you’ll work with are:
/var/log/dpkg.log— Low-level package management operations logged by dpkg/var/log/apt/history.log— High-level apt operations (installs, upgrades, removals)/var/log/aptitude— Operations performed through aptitude (if used)
Note that /var/log/apt/history.log is rotated regularly, so older entries move to compressed files like /var/log/apt/history.log.1.gz. For historical records beyond what’s in the uncompressed file, you’ll need to decompress and search those.
Finding Recently Installed Packages
To see packages installed via apt:
grep " install " /var/log/apt/history.logFor dpkg-level operations:
grep " install " /var/log/dpkg.logFor aptitude users:
grep "\[INSTALL\]" /var/log/aptitudeMore Useful Queries
Show only the package names and timestamps for recent installs:
grep " install " /var/log/apt/history.log | cut -d' ' -f1-3Find all package removals:
grep " remove " /var/log/apt/history.logCheck upgrades:
grep " upgrade " /var/log/apt/history.logSee everything that happened in the last 24 hours:
grep "$(date -d '1 day ago' '+%Y-%m-%d')" /var/log/apt/history.logView compressed history files:
zgrep " install " /var/log/apt/history.log.1.gzReading dpkg.log in Detail
The dpkg.log format is more verbose and structured. A typical entry looks like:
2025-11-15 14:32:15 install vim:amd64 2:9.0.1144-1ubuntu1 2:9.0.1144-1ubuntu1
2025-11-15 14:32:16 status installed vim:amd64 2:9.0.1144-1ubuntu1To parse this more cleanly:
awk '/install/ {print $1, $2, $4, $5, $6}' /var/log/dpkg.logUsing journalctl for Recent Activity
Modern systems also log package manager operations to systemd’s journal. You can query it directly:
journalctl -u apt -u unattended-upgrades --no-pagerThis is particularly useful on systems where log rotation has cleared the traditional log files.
Finding a Specific Package’s History
To trace when a particular package was installed or modified:
grep "vim" /var/log/apt/history.logOr across all dpkg history:
grep "vim" /var/log/dpkg.log*Permissions Caveat
The apt history log is readable only by root or users in the sudo group. If you need non-root access, you’ll need to adjust permissions or have a privileged user run the grep command with sudo.