Monitor Installed Packages on Debian/Ubuntu with dpkg

Updated: 2025-11-17

Monitor Installed Packages on Debian/Ubuntu with dpkg

Quick guide to monitor installed packages on your Debian or Ubuntu server? Need to track software installations and detect unauthorized package changes autom...

Ready-made task for Zuzia

Get a warning when security updates are waiting

Create a free account and connect your server. The Free plan includes 1 monitored task.
In Tasks, create a task, paste the command below, pick the server and run it every 1 day.
Turn on “Monitor the result”. You get OK, warning or critical, and an alert when it changes.

z(){ printf '%s - %s' "$1" "$2"; [ -n "$3" ] && printf ' | %s' "$3"; printf '\n'; case $1 in OK|SKIP) exit 0;; WARNING) exit 1;; CRITICAL) exit 2;; *) exit 3;; esac; }; lv(){ if [ "$1" -ge "$3" ]; then echo CRITICAL; elif [ "$1" -ge "$2" ]; then echo WARNING; else echo OK; fi; }; num(){ case $1 in ''|*[!0-9]*) return 1;; esac; }; wr(){ case $1 in CRITICAL) s=CRITICAL;; WARNING) [ "$s" = OK ] && s=WARNING;; esac; }; if [ -x /usr/lib/update-notifier/apt-check ]; then s=$(/usr/lib/update-notifier/apt-check 2>&1 | cut -d';' -f2); elif command -v apt-get >/dev/null 2>&1; then o=$(apt-get -s dist-upgrade 2>/dev/null) || z UNKNOWN "apt-get simulation failed"; s=$(printf '%s\n' "$o" | grep '^Inst' | grep -ci security); elif command -v dnf >/dev/null 2>&1; then o=$(timeout 45 dnf -q updateinfo list security 2>/dev/null) || z UNKNOWN "dnf updateinfo failed or timed out"; s=$(printf '%s\n' "$o" | grep -c '/Sec\.'); else z SKIP "no supported package manager"; fi; num "$s" || z UNKNOWN "cannot count security updates"; z "$(lv $s 1 10)" "$s security updates pending" "security_updates=$s;1;10"

The same command is in the panel's public commands as “Check: Pending security updates”, so you can also add it from there.

Set up this check free Free plan · no credit card

Why Monitoring Installed Packages Matters

Monitoring installed packages on your Debian or Ubuntu server is crucial for security, compliance, and system management. Unauthorized package installations can indicate security breaches, while tracking package changes helps maintain system integrity and plan updates. Regular monitoring allows you to detect suspicious software installations, maintain accurate software inventories, and ensure compliance with security policies.

Method 1: List All Installed Packages with dpkg

The most straightforward way to monitor installed packages on Debian or Ubuntu is using the dpkg -l command. This command shows all packages installed on your system with their versions and status.

Basic Package List

To see all installed packages:

# List all installed packages
dpkg -l

# Count installed packages
dpkg -l | wc -l

This command displays:

Package status (installed, configured, etc.)
Package name
Version number
Architecture
Description

Filter Packages by Name

To find specific packages:

# List packages by name pattern
dpkg -l | grep nginx

# Search for multiple packages
dpkg -l | grep -E "nginx|mysql|redis"

# Case-insensitive search
dpkg -l | grep -i "web"

Get Detailed Package Information

For more detailed information about a specific package:

# Show detailed package information
dpkg -l | grep "^ii" | grep nginx

# List only installed packages (status "ii")
dpkg -l | grep "^ii"

Method 2: Monitor Package Changes Over Time

To detect unauthorized package installations, you need to compare package lists over time. This helps identify when new packages were installed.

Save Current Package List

# Save current package list to file
dpkg -l > /tmp/packages-$(date +%Y%m%d).txt

# Save only package names
dpkg -l | awk '{print $2}' > /tmp/packages-names.txt

Compare Package Lists

# Compare two package lists
diff /tmp/packages-old.txt /tmp/packages-new.txt

# Find packages in new list but not in old
comm -13 <(sort /tmp/packages-old.txt) <(sort /tmp/packages-new.txt)

Method 3: Automated Package Monitoring with Zuzia.app

Manual checks work while you are looking. To keep running them without you, Zuzia uses its agent and scheduled tasks.

How it works in Zuzia

Install the Zuzia agent on the server with one command. CPU, RAM, disk, load and network metrics start reporting on their own, with alerts on a threshold, on drift from the server's normal, or on a disk fill-up forecast.
Save the commands from this guide as a scheduled task and choose how often it runs, from every minute to once a year. The agent runs it on every host you pick.
If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account).
The output of every run is kept, so you can look back at what changed. On paid plans, AI can read the output and alert you only when it spots a problem.

Setting it up

Add the server in the Zuzia dashboard and install the agent.
Create a scheduled task with the check commands below, then choose the hosts and how often it runs.
Choose your notification channels. Turn on maintenance mode during planned work so it doesn't trigger alerts.

Method 4: Advanced Package Monitoring Techniques

Track Package Installation Dates

To see when packages were installed:

# Check package installation logs
grep " install " /var/log/dpkg.log | tail -20

# Find recently installed packages
grep " install " /var/log/dpkg.log | grep "$(date +%Y-%m-%d)"

Monitor Package Versions

Track specific package versions to detect updates:

# Check version of specific package
dpkg -l | grep nginx | awk '{print $3}'

# List all package versions
dpkg -l | awk '{print $2, $3}' > /tmp/package-versions.txt

Detect Unauthorized Package Installations

Set up monitoring to detect unexpected packages:

# Compare current packages with baseline
comm -23 <(dpkg -l | awk '{print $2}' | sort) <(sort /path/to/baseline-packages.txt)

Real-World Use Cases for Package Monitoring

Security Audit

For security audits, monitor all installed packages:

On paid plans, AI can also read task output and alert you only when it spots a problem.
dpkg -l > /tmp/security-audit-$(date +%Y%m%d).txt

# Check for suspicious packages
dpkg -l | grep -E "backdoor|trojan|malware"

Compliance Monitoring

For compliance requirements, track software installations:

# Generate compliance report
dpkg -l | grep "^ii" | wc -l > /tmp/package-count.txt

# List all installed software
dpkg -l | grep "^ii" > /tmp/installed-software.txt

Update Planning

Before planning updates, check current package versions:

# List packages that might need updates
dpkg -l | grep -v "^ii" | grep -v "^un"

# Check for outdated packages
apt list --upgradable

Best Practices for Package Monitoring

1. Monitor Packages Regularly

Check installed packages daily or weekly. Package installations are typically infrequent, so daily checks are usually sufficient for most servers.

2. Maintain Baseline Package Lists

Keep baseline package lists for comparison. Update baselines after authorized installations to reduce false positives.

3. Set Up Automated Alerts

Configure Zuzia.app to alert you immediately when packages change. This ensures you're aware of unauthorized installations quickly.

4. Review Package Changes Regularly

Regularly review package change reports to identify patterns and verify that all changes are authorized.

5. Document Authorized Installations

Document all authorized package installations to help distinguish between legitimate and suspicious changes.

Troubleshooting Common Package Monitoring Issues

Packages Not Showing in dpkg -l

If packages aren't showing in dpkg -l:

# Refresh package database
sudo apt update

# Reinstall package database
sudo dpkg --configure -a

Package Count Changes Unexpectedly

If package count changes unexpectedly:

Check installation logs: grep " install " /var/log/dpkg.log
Review recent system changes
Verify with system administrators
Check for automated updates or installations

FAQ: Common Questions About Monitoring Installed Packages

How often should I check installed packages?

We recommend checking installed packages once daily or weekly. Package installations are typically infrequent, so daily checks are usually sufficient for most servers. For high-security environments, consider checking more frequently.

What if packages change unexpectedly?

You'll receive notifications when package lists change through Zuzia.app. You can then verify whether changes are authorized or indicate a security concern. Review installation logs and check with system administrators to confirm the changes are legitimate.

Can I monitor specific packages?

Yes, you can modify the command to check specific packages. For example: dpkg -l | grep -E "nginx|mysql|redis". This allows you to focus monitoring on critical packages that are most important for your server's security and functionality.

How do I detect unauthorized package installations?

Set up automated monitoring in Zuzia.app that compares current package lists with baseline lists. Any packages in the current list that aren't in the baseline indicate new installations that should be investigated.

Can I track when packages were installed?

Yes, you can check installation logs: grep " install " /var/log/dpkg.log. This shows when packages were installed, helping you identify the timing of unauthorized installations.

How can I monitor packages across multiple servers?

Zuzia.app allows you to add multiple servers and monitor installed packages across all of them simultaneously. Each server executes commands independently, and all results are stored in Zuzia.app's database for centralized monitoring and analysis.

Does Zuzia.app use AI to analyze package installation patterns?

On paid plans, AI can read the output of your scheduled tasks and commands, explain it in plain language and alert you only when it spots a problem. Metric alerts work without AI: Zuzia alerts when CPU, RAM or load drifts from the server's normal and forecasts when a disk will fill up.

Monitor Installed Packages on Debian/Ubuntu with dpkg