Just the other day we were auditing some of the packages on our production application servers and found a few that we were surprised about.  None of us remember installing them, so we set out to try and find out who might have done it, and when it might have happened.  The other two admins started grepping through the history files and looking at old, archived log data.  I used the information within the RPM database and simply asked the machine when it was installed:

<br /> [root@repo ~]# rpm -qi htop<br /> Name        : htop                         Relocations: (not relocatable)<br /> Version     : 0.7                               Vendor: Dag Apt Repository, http://dag.wieers.com/apt/<br /> Release     : 1.el5.rf                      Build Date: Sat 24 Nov 2007 07:24:19 AM MST<br /> Install Date: Tue 04 Nov 2008 04:02:40 PM MST      Build Host: lisse.leuven.wieers.com<br /> Group       : Applications/System           Source RPM: htop-0.7-1.el5.rf.src.rpm<br /> Size        : 148330                           License: GPL<br /> Signature   : DSA/SHA1, Sat 24 Nov 2007 07:29:40 AM MST, Key ID a20e52146b8d79e6<br /> Packager    : Dag Wieers <[email protected]><br /> URL         : http://htop.sourceforge.net/<br /> Summary     : Interactive process viewer<br /> Description :<br /> htop is an interactive process viewer for Linux.

As you can see in the example above, the RPM database provides information on “Install Date”, including the time. With this information I was able to report to the other admins that the htop package was installed on Tue 04 Nov 2008 at 4:02:40 PM MST. That is more specific than anything they’d find looking through old log data!