yum Logs and dnf Logs: File Locations and dnf history Output

Updated: 12 October 2026 · Applies to: dnf 4.20 on AlmaLinux 10.2 and dnf 4.14 on Rocky Linux 9.8 (same files on RHEL 8, 9 and 10), dnf5 5.4 on Fedora 44, yum 3.4.3 on CentOS 7 (end of life); apt on Ubuntu 24.04 for comparison

On AlmaLinux, Rocky Linux and RHEL 8 to 10, the yum log is /var/log/dnf.rpm.log: yum is the same program as dnf there, and every package it installs, upgrades or removes gets one line in that file. The full output of each run is in /var/log/dnf.log. Only CentOS 7 and older write /var/log/yum.log, and Fedora (dnf5) writes /var/log/dnf5.log. For a quick overview, dnf history (or yum history) lists every transaction.

tail -n 30 /var/log/dnf.rpm.log          # last package changes (RHEL 8 to 10 family)
grep -i nginx /var/log/dnf.rpm.log       # everything that happened to one package
dnf history list                         # one line per transaction
cat /var/log/yum.log                     # CentOS 7 and older only

The dnf log files and what each one holds

• /var/log/dnf.rpm.log: one line per package change. This is the file to read when you ask "what was installed or updated, and when".
• /var/log/dnf.log: everything dnf printed, including the command that was run (DDEBUG Command:), dependency resolution, download sizes and errors.
• /var/log/dnf.librepo.log: repository downloads and the mirrors used. Look here for mirror and download errors.
• /var/log/hawkey.log: messages from the libdnf library, such as dependency solver problems.
• /var/lib/dnf/history.sqlite: the history database behind dnf history. It is not a text file; read it with the commands below.

The files belong to root and are world-readable. dnf rotates them itself: according to the dnf configuration reference, a file is rotated when it grows past log_size (default 1 MB) and log_rotate (default 4) old copies are kept. You can change both in the [main] section of /etc/dnf/dnf.conf. hawkey.log is also rotated weekly by /etc/logrotate.d/dnf, which keeps 4 copies. So the text logs reach back only a limited time, while dnf history goes back to the installation of the server.

Read and search the logs

Real lines from /var/log/dnf.rpm.log on AlmaLinux 10.2 after an install, a removal and an upgrade (our test container ran in UTC, so the times end in +0000; a server shows its own time zone):

2026-10-10T03:06:22+0000 SUBDEBUG Installed: tree-2.1.0-8.el10.x86_64
2026-10-10T03:06:23+0000 SUBDEBUG Erase: tree-2.1.0-8.el10.x86_64
2026-10-10T03:20:16+0000 SUBDEBUG Upgrade: gnutls-3.8.10-5.el10_2.x86_64
2026-10-10T03:20:16+0000 SUBDEBUG Upgraded: gnutls-3.8.10-4.el10_2.x86_64

Upgrade is the new version and Upgraded the version it replaced. Useful searches:

grep -E 'Installed:|Erase:' /var/log/dnf.rpm.log   # installs and removals
grep '^2026-10-10' /var/log/dnf.rpm.log           # changes on one day
grep 'Command:' /var/log/dnf.log                  # which dnf commands were run
grep -i error /var/log/dnf.log                    # failed runs
zgrep -h kernel /var/log/dnf.rpm.log*             # include rotated copies

dnf history (yum history): the list

Output on AlmaLinux 10.2 after we installed tree, removed it with rpm -e (outside dnf), installed and removed nano, and installed two more packages:

ID     | Command line             | Date and time    | Action(s)      | Altered
-------------------------------------------------------------------------------
     6 | -y -q install which psmi | 2026-10-10 03:08 | Install        |    2
     5 | -y -q remove nano        | 2026-10-10 03:08 | Removed        |    1
     4 | -y -q install nano       | 2026-10-10 03:08 | Install        |    1  <
     3 | -y -q install tree       | 2026-10-10 03:07 | Install        |    1 >
     2 | reinstall -y --installro | 2026-10-02 09:04 | R              |    2
     1 | install -y --installroot | 2026-10-02 09:04 | Install        |  135 EE

• ID: the transaction number, used with dnf history info, undo and rollback.
• Command line: the dnf arguments, cut to fit. With the option history_list_view=users this column shows the login user instead.
• Date and time: when the transaction started, in local time.
• Action(s): a single kind of action is written out (Install, Upgrade, Removed, Downgrade, Reinstall, Obsoleted). Mixed transactions show short codes: I install, U upgrade, D downgrade, E erase (removed), R reinstall, O obsoleted, C reason change.
• Altered: the number of packages changed, then up to two marker characters.

The markers, as set in dnf's source code (historyListCmd) and seen in our test:

• EE: the transaction succeeded but printed messages, usually warnings from package scripts. Harmless in most cases.
• ##: the transaction finished with an error.
• **: the transaction never finished, for example because it was interrupted. See how to recover an interrupted dnf or apt transaction.
• > on the left: the package database was changed outside dnf after this transaction (our rpm -e tree after ID 3).
• < on the right: it was changed outside dnf before this transaction (ID 4). On Rocky Linux 9.8 we saw both at once as >E.

Details of one transaction

$ dnf history info 6
Transaction ID : 6
Begin time     : Sat Oct 10 03:08:18 2026
...
User           : Super User <root>
Return-Code    : Success
Releasever     : 10
Command Line   : -y -q install which psmisc
Persistence    : Persist
Comment        :
Packages Altered:
    Install psmisc-23.6-8.el10.x86_64   @baseos
    Install which-2.21-44.el10_0.x86_64 @baseos

(Output shortened.) dnf history info last shows the newest one. For a transaction marked EE, the messages are at the end under "Scriptlet output"; on Rocky Linux 9.8 it was warning: /etc/hosts created as /etc/hosts.rpmnew.

dnf history list nano        # only transactions that touched nano
dnf history list 20..30      # a range of IDs
dnf history userinstalled    # packages installed on purpose

To undo or roll back a transaction, see how to use dnf history to see installed and removed packages.

Fedora (dnf5) and CentOS 7 (yum 3)

• Fedora 44: yum and dnf are links to dnf5. It writes a single file, /var/log/dnf5.log, where each run starts with DNF5 launched with arguments:. There is no dnf.rpm.log; use dnf history info ID for the package list. The history database is /usr/lib/sysimage/libdnf5/transaction_history.sqlite, and dnf history list shows no markers.
• CentOS 7 (end of life): /etc/yum.conf sets logfile=/var/log/yum.log. That file is readable by root only (mode 0600) and is rotated yearly by /etc/logrotate.d/yum. yum history works like dnf history.

Ubuntu and Debian: the apt log

The equivalent files are /var/log/apt/history.log (each apt command and the packages it changed), /var/log/apt/term.log (the screen output) and /var/log/dpkg.log (every package step). From Ubuntu 24.04:

Start-Date: 2026-10-10  03:18:32
Commandline: apt-get install -y -qq tree
Install: tree:amd64 (2.1.1-2ubuntu3.24.04.2)
End-Date: 2026-10-10  03:18:33

More log locations are listed in common log file locations on Linux and cPanel servers.

Official documentation: DNF configuration reference (logging options) and DNF command reference (history command).