Determine when, by who, a centos 6 package was installed.

[Keith Smith]

Thanks,

I did look at the bash history which was informative.  Wish the stored 
more info though!!



On 2014-12-31 09:35, Matt Graham wrote:
> On 2014-12-31 06:13, Keith Smith wrote:
>> I am trying to determine who installed GIT and when GIT was installed
>> and what repository it came from.
>> The date stamp on /usr/share/git-core says Oct 31 16:55.  The server
>> did not exist until early November.
> 
> /root/install.log should contain the packages installed from the
> normal installer or the kickstart installer.  Things installed after
> that would be recorded in /var/log/yum.log .  However, this'll only
> tell you when the RPM was installed, not which non-root user was
> responsible or which repository it came from.  You could try "rpm -q
> -f /usr/share/git-core/templates/description --qf
> %{NAME}%{INSTALLTIME}%{VENDOR}" and convert the timestamp from
> seconds-since-epoch to a regular time as well.
> 
> If the log files and RPM database don't contain anything about a git
> RPM, then whoever installed it might've done "./configure
> --prefix=/usr && make && su -c 'make install' ".  At that point, you
> go trawling through users' .bash_history files....

-- 
Keith Smith