Find last time update was performed with apt-get

I need to find the last time that the

apt-get update

command was run on my server. How can I determine this information?

Solution 1:

At least in Ubuntu systems there is a file /etc/apt/apt.conf.d/15update-stamp containing:

APT::Update::Post-Invoke-Success {"touch /var/lib/apt/periodic/update-success-stamp 2>/dev/null || true";};

So see if you have /var/lib/apt/periodic/update-success-stamp and if you have it, you can use

stat -c %y /var/lib/apt/periodic/update-success-stamp

command to get the the time of the last "apt-get update" invocation.

And if your system does not have that apt configuration file, you can always add it.

Solution 2:

An apt-get update may not create or update files, it does update the cache directory so we can use that to get the timestamp when the last apt-get update was run :

stat -c %Y /var/cache/apt/

Solution 3:

You could check the Access times on the files in /var/lib/apt/lists which is updated when you run apt-get update. If apt-get update was run with sudo you should have a line logged in /var/log/auth.log when it was done..

Solution 4:

Don't go from the lock files. Lock files aren't reliable, they tend to move around over time with new Linux releases, and many programs cleanup (remove) lock files when they're done with them.

The following command will get you what you're looking for.

ls -lt --time-style="long-iso" /var/log/apt | grep -o '\([0-9]\{2,4\}[- ]\)\{3\}[0-9]\{2\}:[0-9]\{2\}' -m 1

This is two commands in one. The results of the first command filter into the second through the pipe (|) symbol.

In the first command, I'm using "ls" to list the file contents of the /var/log/apt directory, which is the directory that stores the access history logs for apt-get. The "-lt" part is actually two switches. The first "l" switch tells "ls" to list one file per line with detail. The second "t" switch tells "ls" to sort by date and time. "--time-style" forces the date time to display in the format "YYYY-MM-DD HH:MM".

In the "grep" portion of the command, the "-o" switch tells grep to only show the portions of each line that match the regular expression exactly. The regular expression I've used here detects date times that are in the format specified in the "ls" command. You'll also notice the true little piece of magic on the very end of the "grep" command that there's a "-m" switch with the number "1" immediately following. This tells "grep" to stop looking for matches after it finds the first one.

So, in summary, we're listing the apt log file details so we can see the last modified date, we then sort by date and tell grep to pull the first date off the top, which it then returns. That's the last date that apt-get ran.

To play devil's advocate for a moment, however, it's common for Debian platforms like Ubuntu to schedule apt-get as a job that runs regularly. If you're looking for the person at the other end of the apt-get execution, you may actually find a machine. You could always match up access logs with the apt logs to see if any time stamps coincide. It's also possible to look at a user's command history to an extent.

Hope this helps!

Solution 5:

I suspect you can check the last modified times on files /var/cache/apt to figure out when the last updates were applied to the package lists.

I just tested this, and ran "sudo apt-get update" twice in a row, and the dates did not change from their current value, but I suspect this is because there were no new updates to apply, and that the caches are up to date.