Determine when, by who, a centos 6 package was installed.

[Matt Graham]

On 2014-12-31 06:13, Keith Smith wrote:
> I am trying to determine who installed GIT and when GIT was installed
> and what repository it came from.
> The date stamp on /usr/share/git-core says Oct 31 16:55.  The server
> did not exist until early November.

/root/install.log should contain the packages installed from the normal 
installer or the kickstart installer.  Things installed after that would 
be recorded in /var/log/yum.log .  However, this'll only tell you when 
the RPM was installed, not which non-root user was responsible or which 
repository it came from.  You could try "rpm -q -f 
/usr/share/git-core/templates/description --qf 
%{NAME}%{INSTALLTIME}%{VENDOR}" and convert the timestamp from 
seconds-since-epoch to a regular time as well.

If the log files and RPM database don't contain anything about a git 
RPM, then whoever installed it might've done "./configure --prefix=/usr 
&& make && su -c 'make install' ".  At that point, you go trawling 
through users' .bash_history files....

-- 
Crow202 Blog: http://crow202.org/wordpress
There is no Darkness in Eternity
But only Light too dim for us to see.