Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've been asked to find out when a specific version of software was installed. The only thing I have to go on are the modification times of the directories in question. I'm having a hard time deciphering when we installed it:

/opt/pkg/totalview:
drwxr-xr-x. 3 root root 4 Jan 23  2013 8.11.0-0

/opt/pkg/totalview/8.11.0-0:
lrwxrwxrwx. 1 root root 32 Jan 23  2013 bin -> toolworks/totalview.8.11.0-0/bin
drwxrwxr-x. 5 root root  5 Dec 11  2012 toolworks

/opt/pkg/totalview/8.11.0-0/bin:
-r-xr-xr-x. 1 root root  3391 Oct 25  2012 htmlhelp.sh
lrwxrwxrwx. 1 root root    38 Dec 11  2012 memscape -> ../../memoryscape.3.3.0-0/bin/memscape
lrwxrwxrwx. 1 root root    39 Dec 11  2012 memscript -> ../../memoryscape.3.3.0-0/bin/memscript
-r-xr-xr-x. 1 root root  9161 Oct 25  2012 mrnet_commnode
lrwxrwxrwx. 1 root root     3 Dec 11  2012 sctotalview -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 sctotalviewcli -> tv8cli
lrwxrwxrwx. 1 root root     3 Dec 11  2012 sctv8 -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 sctv8cli -> tv8cli
lrwxrwxrwx. 1 root root     3 Dec 11  2012 totalview -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 totalviewcli -> tv8cli
-r-xr-xr-x. 3 root root 21970 Oct 25  2012 tv8
-r-xr-xr-x. 3 root root 21970 Oct 25  2012 tv8cli
-r-xr-xr-x. 2 root root 19093 Oct 25  2012 tvdbootstrap
-r-xr-xr-x. 2 root root 19093 Oct 25  2012 tvdsvr
-r-xr-xr-x. 3 root root 21970 Oct 25  2012 tvscript
-r-xr-xr-x. 1 root root  6968 Oct 25  2012 visualize

/opt/pkg/totalview/8.11.0-0/toolworks:
drwxrwxr-x.  5 root root  9 Dec 11  2012 flexlm-10.8.0-3
drwxrwxr-x.  5 root root 19 Oct 25  2012 memoryscape.3.3.0-0
drwxrwxr-x. 17 root root 17 Dec 11  2012 totalview.8.11.0-0

I see three primary dates:

  • January 23, 2013
  • December 11, 2012
  • October 25, 2012

What can I look at to try and determine when this software was actually installed? This software was installed from source, and is not part of an rpm or yum install. I understand that I can do stat to get some more information, but I'm not able to confidently determine which one of these three dates was when it was installed.

EDIT: the results of ls -lc

/opt/pkg/totalview:
drwxr-xr-x. 3 root root 4 Jan 23  2013 8.11.0-0

/opt/pkg/totalview/8.11.0-0:
lrwxrwxrwx. 1 root root 32 Jan 23  2013 bin -> toolworks/totalview.8.11.0-0/bin
drwxrwxr-x. 5 root root  5 Dec 11  2012 toolworks

/opt/pkg/totalview/8.11.0-0/bin:
-r-xr-xr-x. 1 root root  3391 Nov  5 03:34 htmlhelp.sh
lrwxrwxrwx. 1 root root    38 Dec 11  2012 memscape -> ../../memoryscape.3.3.0-0/bin/memscape
lrwxrwxrwx. 1 root root    39 Dec 11  2012 memscript -> ../../memoryscape.3.3.0-0/bin/memscript
-r-xr-xr-x. 1 root root  9161 Nov  5 03:34 mrnet_commnode
lrwxrwxrwx. 1 root root     3 Dec 11  2012 sctotalview -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 sctotalviewcli -> tv8cli
lrwxrwxrwx. 1 root root     3 Dec 11  2012 sctv8 -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 sctv8cli -> tv8cli
lrwxrwxrwx. 1 root root     3 Dec 11  2012 totalview -> tv8
lrwxrwxrwx. 1 root root     6 Dec 11  2012 totalviewcli -> tv8cli
-r-xr-xr-x. 3 root root 21970 Nov  5 03:34 tv8
-r-xr-xr-x. 3 root root 21970 Nov  5 03:34 tv8cli
-r-xr-xr-x. 2 root root 19093 Nov  5 03:34 tvdbootstrap
-r-xr-xr-x. 2 root root 19093 Nov  5 03:34 tvdsvr
-r-xr-xr-x. 3 root root 21970 Nov  5 03:34 tvscript
-r-xr-xr-x. 1 root root  6968 Nov  5 03:34 visualize

/opt/pkg/totalview/8.11.0-0/toolworks:
drwxrwxr-x.  5 root root  9 Dec 11  2012 flexlm-10.8.0-3
drwxrwxr-x.  5 root root 19 Dec 11  2012 memoryscape.3.3.0-0
drwxrwxr-x. 17 root root 17 Dec 11  2012 totalview.8.11.0-0
share|improve this question
    
What is the ctime of the directories. –  Zoredache Nov 5 '13 at 16:33
    
@Zoredache Thanks, edited question with results of ls -lc. –  CptSupermrkt Nov 5 '13 at 16:52

1 Answer 1

up vote 5 down vote accepted

The ctime is a firm indication of the latest date at which the software might have been installed: it was installed no later than 2013-01-23. However, it is entirely possible (and likely here) that the software was installed before; the ctime may have changed due to permission changes or restoring from a backup or copying files around.

In all likelihood, the program was compiled on or before 2012-10-25, the mtime of the compiled executables. Unless someone deliberately changed the file times, the dates on the executable indicate when the executables were compiled, or when they were later copied (without -p).

There is a good chance that the software was compiled on 2012-10-25 and installed on this machine on 2012-12-11, the mtime of the symlinks. However, it is also possible that the program was compiled on 2012-10-25, then installed to a temporary location (which involved creating the symlinks) on 2012-12-11, then packed into a tarball or other archive format, and untarred at some point between 2012-12-11 and 2013-01-23.

share|improve this answer
    
Thanks for the analysis. Sounds good to me! –  CptSupermrkt Nov 6 '13 at 14:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.