Determine when, by who, a centos 6 package was installed.

[Todd Millecam]

If they used sudo, then you'd be able to see it in /var/log/secure.
Otherwise, if they logged in as root, you can see all root logins via:
last -da | grep root
The latter won't tell you what they did, only:
history | less
will show you recent commands, but on most systems that's limited to the
last session.

If you want to log all root-level activity in the future, I'd recommend
installing auditd and getting that setup--it'll watch file changes, and log
who changed what and when they did so.

On Sun, Jan 4, 2015 at 9:39 PM, James Mcphee <jmcphe at gmail.com> wrote:

> rpm -qid will give you the install date at least.
>
> On Sun, Jan 4, 2015 at 8:09 PM, George Toft <george at georgetoft.com> wrote:
>
>> ls -lc might give you better insight on package install time.  Also rpm
>> -qa | grep git, then rpm -qi <package name>
>>
>> Regards,
>>
>> George Toft
>>
>> On 12/31/2014 6:13 AM, Keith Smith wrote:
>>
>>>
>>> Hi,
>>>
>>> I am trying to determine who installed GIT and when GIT was installed
>>> and what repository it came from.
>>>
>>> The date stamp on /usr/share/git-core says Oct 31 16:55.  The server did
>>> not exist until early November.
>>>
>>> Thanks!!
>>>
>>> Keith
>>>
>>>
>>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>>
>
>
>
> --
> James McPhee
> jmcphe at gmail.com
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>



-- 
Todd Millecam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.phxlinux.org/pipermail/plug-discuss/attachments/20150105/048b4700/attachment.html>