How to Check Recently Installed and Upgraded Packages in Ubuntu

When troubleshooting unexpected server misconfigurations, kernel module incompatibilities, or security incidents on an Ubuntu system, determining which software packages were recently altered is crucial. System administrators frequently need to answer: “What packages were updated during yesterday’s maintenance window?” or “Which libraries were installed before the web server began crashing?”

Ubuntu maintains detailed, timestamped historical logs of every package transition managed by APT and DPKG. You can inspect these logs directly from the terminal without installing supplementary audit utilities.

Method 1: Auditing High-Level Transactions via APT History Logs

The APT log provides human-readable transaction summaries documenting exact command invocations, start times, and modified packages:

1. View the most recent package transactions:

   cat /var/log/apt/history.log

2. The log records transactions in structured blocks:

   Start-Date: 2026-10-26  14:22:15
   Commandline: apt install nginx certbot
   Install: python3-certbot:amd64 (2.1.0-1), certbot:amd64 (2.1.0-1), nginx:amd64 (1.24.0-2ubuntu7)
   End-Date: 2026-10-26  14:22:28

3. To review older archived history from previous weeks:

   zcat /var/log/apt/history.log.*.gz | less

Method 2: Querying Low-Level DPKG Installation Logs

While APT records user-facing commands, /var/log/dpkg.log records the exact installation, configuration, and removal of every individual binary package at the system level:

To filter exclusively for newly installed software:

grep " install " /var/log/dpkg.log

To inspect software that was upgraded to a newer release version:

grep " upgrade " /var/log/dpkg.log

To view packages that were removed or purged:

grep -E "(remove|purge)" /var/log/dpkg.log

Filtering Package History by Date

To audit changes applied on a specific calendar day (for example, 26 October 2026), combine grep with timestamp anchors:

grep "2026-10-26" /var/log/dpkg.log | grep -E "(install|upgrade)"

This outputs an instant, chronological ledger of all modified libraries, helping you isolate package regressions rapidly.