I think there ought to be two logs. One is an action log which succinctly logs upgrades, removals, etc. The other is a full log of stdout and stderr. You could reuse code from run-parts --report for this. Guy