Someone updated modules in my Drupal install 5 days ago, and I would like to find out who.
I looked in Reports > Recent log messages, but this is filled up with so many php warnings that it only goes back 1 day.
I also tried searching for "update" in the watchdog table, but couldn't find any entries for the date I was interested in.
I think you'll find details in the Watchdog if the updates were performed using the UI.
If the modules were updated using a different method, e.g. Drush or manually, then you'll need to turn to your server logs, assuming that you keep logs for such actions. Drupal won't hold any data about those actions, as it wouldn't even necessarily know they had occurred.
Just to clear things up, the "Recent log messages" report gets its data from the watchdog table, so you're looking in the same place for both.
One of the challenges with recent log messages (watchdog), is that there might be quite a few PHP notices, warnings, and errors that are filling up your logs. So a good practice is to identify / address these problems in your site (which will reduce the required resources for your site also and will result in a faster site).
However digesting these messages is quite a challenge. That's why I've come up with my own "custom" reports, as illustrated also.
Within the "Report Execution Parameters" (collapsed in the screenprint above), I specify the search criteria of the log messages to be retrieved (like severity, User name, etc). And the red numbers are hyperlinks to get a drill down report of the specific messages for which I want more details (= to display the actual watchdog entries). I wonder if it is worth publishing these kind of reports in a contributed module (something like a Watchdog Dashboard)?
Refer to my answer to "How to gets analyts and generate visual reports from sessions?" for more details about reports as in the above screenprint.
Some other modules that I've been looking at recently, in the context of Watchdog processing (one of them suggested also in Clive's comment):
