Find out when a package was last installed or updated

If you administer a Linux computer, you may occasionally ask when a software package was last installed or updated on your system.

For a Red-Hat-based operating system - Centos, Fedora, RHEL, etc - getting the answer is a simple task of querying the RPM database. The RPM database stores, among other things, the last install date of rpm packages.

To query information about the curl package:

$ rpm -qi curl
Name        : curl
Version     : 7.29.0
Release     : 7.fc19
Architecture: i686
Install Date: Sun 11 Aug 2013 03:55:52 PM PDT
Group       : Applications/Internet
Size        : 529869
License     : MIT
Signature   : RSA/SHA256, Sun 23 Jun 2013 09:26:17 AM PDT, Key ID 07477e65fb4b18e6
Source RPM  : curl-7.29.0-7.fc19.src.rpm
Build Date  : Sat 22 Jun 2013 02:46:47 PM PDT
Build Host  : buildvm-11.phx2.fedoraproject.org
Relocations : (not relocatable)
Packager    : Fedora Project
Vendor      : Fedora Project
URL         : http://curl.haxx.se/
Summary     : A utility for getting files from remote servers (FTP, HTTP, and others)
Description :
...

Note the Install Date for curl is Sun 11 Aug 2013 03:55:52 PM PDT. If curl was installed and subsequently updated, the stored Install Date is the update date, not the first install date.

If you run a Debian-based OS - Debian, Ubuntu, Mint, etc - you have to work harder to get the answer. The Debian package manager (dpkg) does not actually store the install date of packages in its database. However, you can still find it out using either of the following procedures.

• Search the dpkg log files

  The following example reveals the last update time for the curl package (2014-02-04 11:40:55).

  $ grep 'status installed curl:' /var/log/dpkg.log* 
  /var/log/dpkg.log:2014-02-04 11:40:55 status installed curl:amd64 7.26.0-1+wheezy8
  /var/log/dpkg.log.1:2014-01-08 10:06:50 status installed curl:amd64 7.26.0-1+wheezy7
  

  There is a catch with this approach. You cannot search merely the current dpkg log. Depending on when the package was installed or last updated, the dpkg log may already be rotated out. Hence, the asterisk in dpkg.log*. It matches dpkg.log, dpkg.log.1, dpkg.log.2, etc. However, if the package was installed a long time ago, the log file you are looking for may be already auto-deleted from the system.

• Look for the last modified timestamp of the package's file list.

  When a package is installed or updated, its corresponding file list in /var/lib/dpkg/info/ is overwritten with the latest information. For instance, /var/lib/dpkg/info/curl.list contains a list of file names that are installed by the curl package.

  The last modified timestamp of curl.list gives you a fairly accurate time of when curl was last installed/updated.

  $ ls -l /var/lib/dpkg/info/curl.list
  -rw-r--r-- 1 root root    584 Feb  4 11:40 /var/lib/dpkg/info/curl.list
  

  Again, if curl was updated after the initial install, the timestamp reflects the last update time.