For Debian-based systems, there are several reliable methods to determine when packages were last updated:

The primary location for tracking package management activities is:

/var/log/apt/history.log

To view the last update timestamp:

grep "upgrade" /var/log/apt/history.log | tail -1
# or for more detailed info
grep -A 10 "Start-Date" /var/log/apt/history.log | tail -11

DPKG maintains its own logs which can be queried:

ls -lt /var/log/dpkg.log*
# View the most recent entries
zcat /var/log/dpkg.log.*.gz | head -20
# or for uncompressed logs
tail -20 /var/log/dpkg.log

The package lists modification time can indicate last refresh:

stat -c %y /var/lib/apt/periodic/update-success-stamp
# Alternative
stat -c %y /var/lib/apt/lists/

For regular checks, create a monitoring script:

#!/bin/bash
LAST_UPDATE=$(stat -c %y /var/lib/apt/periodic/update-success-stamp)
LOG_ENTRY=$(grep -A 1 "Start-Date" /var/log/apt/history.log | tail -2)
echo "Last package update: $LAST_UPDATE"
echo "Last upgrade operation:"
echo "$LOG_ENTRY"

If using automatic updates via systemd:

systemctl list-timers --all | grep apt
journalctl -u apt-daily.service -u apt-daily-upgrade.service --since "1 week ago"

• Logs rotate periodically (typically weekly)
• Consider setting up logrotate for extended retention
• For security audits, combine with auth.log checks

Debian maintains detailed logs of package management activities in /var/log/apt/. The most relevant files are:

# List relevant log files
ls -lh /var/log/apt/history.log*

The primary method is examining the timestamp in the history log:

# Display last update timestamp
grep "Start-Date" /var/log/apt/history.log | tail -1

For systems using automatic updates, check the cron logs:

# Check unattended-upgrades log
cat /var/log/unattended-upgrades/unattended-upgrades.log | grep "Packages will be installed"

To get full details of the last update session:

# Show complete last update session
awk '/Start-Date/{flag=1;print;next} /End-Date/{flag=0} flag' /var/log/apt/history.log | tail -n +2

For regular monitoring, consider this bash script:

#!/bin/bash
LAST_UPDATE=$(grep "Start-Date" /var/log/apt/history.log | tail -1 | cut -d ' ' -f 2-)
DAYS_SINCE=$(( ( $(date +%s) - $(date -d "$LAST_UPDATE" +%s) ) / 86400 ))

if [ $DAYS_SINCE -gt 7 ]; then
    echo "Warning: Last update was $DAYS_SINCE days ago on $LAST_UPDATE"
else
    echo "System updated $DAYS_SINCE days ago ($LAST_UPDATE)"
fi