Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Any way to find out who installs the package and when the package was installed in debian?

share|improve this question
up vote 1 down vote accepted

Who, I think it should be root, but when, check /var/log/dpkg.log. You will have the dates of install, update, delete of all the packages.

share|improve this answer
"who" is effectively root, yes, but that is only half of the answer since the chances of one of your users being named "root smith" are pretty remote. Depending on your configuration you may be able to leverage your sudo log to see which user(s) are elevating their privileges and, again depending on configuration, which package(s) they have installed. Obviously with physical access and the root password there is very little forensic data that can be recovered to trace actions back to a single human. – Tok Nov 26 '10 at 17:31

Take a look in: /var/log/apt/history.log for when. As for who, you need to be root to install packages, so it'll always be root. (If you use sudo, you might want to configure sudo to log when someone uses any of the relevant commands (dpkg/aptitude/apt-get etc...)

share|improve this answer
/var/log/apt/history.log don't exists on my Lenny, but it is available on Squeeze. – Dom Nov 26 '10 at 17:02
I found it in /var/log/apt/term.log instead. thanks! – henry Nov 26 '10 at 17:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.