How to Use APT History to Track Package Changes in Ubuntu

When managing an Ubuntu system, it is common to install, upgrade, or remove packages using the Advanced Package Tool (APT). However, if an update breaks a system component or you need to audit what software was recently installed, you need a way to review APT’s transaction history.

Unlike some package managers that have a dedicated “rollback” command, APT relies on detailed log files to track changes. By reviewing these logs, you can see exactly what was installed, upgraded, or removed, when the action occurred, and which user initiated it.

Where APT Stores History

APT maintains its transaction history in standard text log files located at /var/log/apt/. The two most important files are:

• /var/log/apt/history.log — Contains a high-level summary of APT commands executed, the packages affected, and the start/end times.
• /var/log/apt/term.log — Contains the exact terminal output generated during the APT transaction, useful for troubleshooting installation errors.

Because these logs grow over time, Ubuntu uses the logrotate utility to archive older logs. The current log is history.log, the previous one is compressed as history.log.1.gz, the one before that as history.log.2.gz, and so on.

How to View the Current APT History

To view recent package installations, upgrades, and removals, you can use the cat, less, or tail commands on the active history log.

To view the entire current log file:

cat /var/log/apt/history.log

For easier reading (allowing you to scroll up and down), use less:

less /var/log/apt/history.log

To see only the most recent transactions (the last 20 lines):

tail -n 20 /var/log/apt/history.log

Understanding the Log Format

An entry in history.log looks like this:

Start-Date: 2023-10-25  14:30:05
Commandline: apt install nginx
Requested-By: john (1000)
Install: nginx-core:amd64 (1.18.0-0ubuntu1.4, automatic), nginx:amd64 (1.18.0-0ubuntu1.4)
End-Date: 2023-10-25  14:30:12

• Start-Date / End-Date: When the transaction began and finished.
• Commandline: The exact APT command that was executed.
• Requested-By: The user account that ran the command with sudo privileges.
• Install / Upgrade / Remove: The specific packages affected, including their architecture (e.g., amd64) and the version numbers involved.

How to Search for Specific Package Changes

If you are looking for information about a specific package (for example, finding out when Docker was installed), you can use the grep command to filter the log.

grep -A 3 -B 1 "docker" /var/log/apt/history.log

The -A 3 and -B 1 flags tell grep to show 3 lines after the match and 1 line before the match, which ensures you see the date and command context alongside the package name.

Viewing Older, Compressed APT Logs

If the event you are looking for happened weeks or months ago, it has likely been archived by logrotate. You do not need to extract the files manually; you can use the zcat or zgrep utilities to read them directly.

To view the contents of the most recently archived log:

zcat /var/log/apt/history.log.1.gz | less

To search for a specific package across all archived logs in the directory:

zgrep -A 3 -B 1 "nginx" /var/log/apt/history.log.*.gz

How to Roll Back an Unwanted Upgrade

APT does not have an automatic “undo” command. If you discover via the history log that an upgrade broke your system, you must manually downgrade the package to the previous version listed in the log.

First, identify the exact version you want to revert to from the history.log.

Then, check if that specific version is still available in the Ubuntu repositories:

apt-cache policy package_name

If the older version is listed, you can force APT to install it by appending =version to the package name:

sudo apt install package_name=version_number

For example:

sudo apt install curl=7.68.0-1ubuntu2.7

After downgrading, you may want to prevent APT from upgrading that package again during the next apt upgrade. You can do this by placing a “hold” on the package:

sudo apt-mark hold package_name

Reviewing APT history is an essential troubleshooting skill for Ubuntu administrators. By understanding how to query /var/log/apt/history.log and search through compressed archives, you can track down exactly when a system change occurred and take the necessary steps to resolve package conflicts.