up vote 1 down vote favorite
1
share [g+] share [fb]

Any way to find out who installs the package and when the package was installed in debian?

link|improve this question
50% accept rate
feedback

2 Answers

up vote 0 down vote accepted

Who, I think it should be root, but when, check /var/log/dpkg.log. You will have the dates of install, update, delete of all the packages.

link|improve this answer
"who" is effectively root, yes, but that is only half of the answer since the chances of one of your users being named "root smith" are pretty remote. Depending on your configuration you may be able to leverage your sudo log to see which user(s) are elevating their privileges and, again depending on configuration, which package(s) they have installed. Obviously with physical access and the root password there is very little forensic data that can be recovered to trace actions back to a single human. – Tok Nov 26 '10 at 17:31
feedback
up vote 0 down vote

Take a look in: /var/log/apt/history.log for when. As for who, you need to be root to install packages, so it'll always be root. (If you use sudo, you might want to configure sudo to log when someone uses any of the relevant commands (dpkg/aptitude/apt-get etc...)

link|improve this answer
/var/log/apt/history.log don't exists on my Lenny, but it is available on Squeeze. – Dom Nov 26 '10 at 17:02
I found it in /var/log/apt/term.log instead. thanks! – henry Nov 26 '10 at 17:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.