$ grep "install\|upgrade" /var/log/dpkg.log | grep "2021-01" > log.dat

示例输出：

2021-01-11 23:05:50 status installed mime-support:all 3.62
2021-01-11 23:05:50 status installed hicolor-icon-theme:all 0.17-2
2021-01-11 23:05:53 status installed shared-mime-info:amd64 1.10-1
2021-01-12 11:11:57 install python3-configobj:all <none> 5.0.6-3
2021-01-12 11:11:57 status half-installed python3-configobj:all 5.0.6-3
2021-01-12 11:11:57 install python3-psutil:amd64 <none> 5.5.1-1
2021-01-12 11:11:57 status half-installed python3-psutil:amd64 5.5.1-1

Awk是一个理想的解决方案（GNU awk利用了gensub函数）

awk -v tstamp="$(date -d "-30 days" +%s)" '/install/ || /upgrade/ {dconv=gensub("-"," ","g",$1);tconv=gensub(":"," ","g",$2);dstamp=mktime(dconv" "tconv);if (dstamp >= tstamp ) { print } }' /var/log/dpkg.log

说明：

awk -v tstamp="$(date -d "-30 days" +%s)" ' # Pass the date minus 30 days as variable to awk (tstamp)
    /install/ || /upgrade/ {                                  # Process where lines 
                                                                contain install or 
                                                                upgrade
                             dconv=gensub("-"," ","g",$1);    # Replace "-" for " " in 
                                                                the first space 
                                                                delimited field (date) 
                                                                and read result into 
                                                                dcon
                             tconv=gensub(":"," ","g",$2);    # Replace ":" for " " in 
                                                                the second space 
                                                                delimited field (time) 
                                                                and read the result 
                                                                into tconv
                             dstamp=mktime(dconv" "tconv);    # Create epoch format of 
                                                                date and time
                             if (dstamp >= tstamp ) {         # See whether date/time 
                                                                is within 30 days by 
                                                                comparing dstamp to 
                                                                tstamp
                                 print                        # Print line if 
                                                                condition is met
                             } 
                            }' /var/log/dpkg.log