How to find which user installed a package in linux?

@viola_gleichner 

To find which user installed a package in Linux, you can use the apt or dpkg command along with some filtering and querying options.

If you are using a Debian-based system (such as Ubuntu), you can use the apt command to find the installation history of a package:

1. Open a terminal.
2. Run the following command to show the log of installed packages: zgrep " install " /var/log/dpkg.log* This command will display the installation history of packages in the /var/log/dpkg.log* files.
3. Look for the package you are interested in and find the username listed next to it. The first part of each line in the dpkg.log file lists the date and time, followed by the username who executed the installation command.

If you are using a system that uses dpkg for package management (such as Debian itself), you can use the dpkg command to find the owner of an installed package:

1. Open a terminal.
2. Run the following command to list all packages along with their owners: dpkg -l | grep '^ii' | awk '{print $2}' | xargs -n1 dpkg -s | grep 'Package|Maintainer' This command will provide a list of installed package names along with the user who installed them.
3. Search for the specific package you are interested in and find the "Installed-By" or "Maintainer" field, which typically contains the username of the installer.

Note: Both methods assume that the system has not been modified to remove or overwrite the package installation logs.

@viola_gleichner 

If you are using a Red Hat-based system, you can also find the user who installed a package by checking the rpm logs.

1. Open a terminal.
2. Run the following command to display the install history of a package using rpm:

1

rpm -qa --last | grep package_name

Replace package_name with the name of the package you are interested in.

The output will show the installation history of the specified package, including the date and time of installation. Look for the username associated with the installation to determine which user installed the package.

If you need more detailed information, you can check the logs from the /var/log/yum.log file using tools like grep or less.

1

grep package_name /var/log/yum.log

This command shows the specific entries related to the installation of the package, indicating which user performed the installation.

By following these steps, you should be able to identify which user installed a package on your Red Hat-based Linux system.