Find last time yum update was run

You almost answered your question. Here is a way you can find latest 5 updated packages:

grep Updated: /var/log/yum.log | tail -5

Output example:

Aug 05 13:28:34 Updated: virt-manager-common-1.1.0-9.git310f6527.fc21.noarch
Aug 05 13:28:34 Updated: glusterfs-libs-3.5.5-2.fc21.i686
Aug 05 13:28:35 Updated: virt-manager-1.1.0-9.git310f6527.fc21.noarch
Aug 05 13:28:36 Updated: virt-install-1.1.0-9.git310f6527.fc21.noarch
Aug 05 13:28:38 Updated: glusterfs-3.5.5-2.fc21.i686

First you need to define what "upgrade" means. Eg. upgrade with only a newer kernel will be an install (and likely an erase of an older one). If someone does "upgrade foo" does that count? What about "distro-sync" that ends up just doing upgrades (or if it doesn't)? Does it count if the transaction failed?

Then stop greping output, it will only lead to pain and suffering.

Using the API is pretty simple, eg (latest time a transaction was started to upgrade any package):

import yum
import time

yb = yum.YumBase()
for old in yb.history.old():
    if "Update" in (hpkg.state for hpkg in old.trans_data):
        print "Latest Update:", time.ctime(old.beg_timestamp)
        break

The following command lists recently installed or updated RPM packages:

rpm -qa --last  | head

It may includes packages installed outside YUM too. This command can also run without root privilege.

[EDIT] You can try my script https://github.com/seffparker/nagios-plugins/blob/master/check_pkg