Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 14 down vote favorite
6

How can I find the time since a Linux system was first installed, provided that nobody has tried to hide it?

share|improve this question
What do you mean by age? – Let_Me_Be Mar 23 '11 at 16:43
@Let: The time since it was set up. – Tim N Mar 23 '11 at 16:48
@Tim There is no way to determine that. You could estimate by searching for the oldest files. – Let_Me_Be Mar 23 '11 at 16:51
@Let: I was expecting an answer along the lines of "check the timestamp of /some/oscure/file, it is never modified". Please make that an answer. – Tim N Mar 23 '11 at 16:53
1  
When every part of a linux installation has been replaced over the years, is it still the same installation? (Same as the original analogy of a ship that had all of its parts slowly replaced) I ask because my root partition has changed disks and filesystems, and my home partition is older than that. Some appliances are prepared once as gold images, then get custom hostnames, ssh host keys and fs uuids on deployment. Gold images can be modified and frozen again, like the turnkey linux lineage. – Tobu May 10 '11 at 20:53
show 7 more comments

8 Answers

up vote 18 down vote accepted 
tune2fs -l /dev/sda1 or /dev/sdb1*  | grep cr

This will tell you when the file system was created.

* = In the first column of df / you can find the exact partition to use.

share|improve this answer
3  
Usually /dev/sda1 or something like that (whatever df / shows in the first column), but the principle is sound. – Gilles Mar 23 '11 at 21:34
Hey, that's handy to know, thanks. And this information survives copying the filesystem too. +1. – Faheem Mitha Mar 23 '11 at 22:04
up vote 5 down vote

Check the date of the root filesystem with dumpe2fs. I can't really think of how that could be anything other than the date you're looking for:

dumpe2fs $(mount | grep 'on \/ ' | awk '{print $1}') | grep 'Filesystem created:'
share|improve this answer
1  
... or tune2fs -l – forcefsck Mar 23 '11 at 20:24
You forgot to mention that this is only applicable to ext2/ext3/ext4 filesystem. – Let_Me_Be Mar 23 '11 at 21:18
You'd get the wrong date on several of my machines, where I've upgraded hard drives, and just copied the install over. – derobert Aug 30 '12 at 16:12
@derobert, I still think my answer would be correct, given the OPs question. A new disk isn't any different from new RAM -- you still have the same 'installation' even though you popped a new disk in... – pboin Oct 22 '12 at 20:26
@pboin No, when I copy the install over, its a larger disk, so I repartition and mkfs (then use tar/cp to copy it, not dd). May even be a different filesystem (e.g., ext2 -> ext3 -> ext4) So you'd get the time I copied the install over. That's how it could be other than the date OP is looking for. – derobert Oct 22 '12 at 21:54
up vote 4 down vote

As requested by OP.

If you are looking for the time, when the system was setup, there isn't a way to determine that. For one, the system might have been cloned (not installed) which would effectively fake the file creation time.

You can estimate the age by searching for oldest files.

share|improve this answer
mattdm is right; you can get access time, modification time, and change time; ctime is the last. See this SO post – Michael Mrozek♦ Mar 23 '11 at 17:48
up vote 2 down vote

There are a few dates lying around.

  • All files have dates.
  • Log files have dates in them.

see /var/log/installer/syslog for the definitive answer if it exists it is part of the log of the instillation.

But beware this is not guaranteed. (see other answers/comments for some of the reasons it may not work.)

share|improve this answer
This might be specific to Debian/Ubuntu though. – Faheem Mitha Mar 23 '11 at 17:26
@Faheem Mitha: Same file/directory is used for Ubuntu. – BillThor Mar 23 '11 at 21:13
@Bill: Yes, I said specific to Debian/Ubuntu. Meaning the recipe would work for both Debian and Ubuntu, but possibly not for other (non-Debian-based) Linux distributions. – Faheem Mitha Mar 23 '11 at 22:05
up vote 2 down vote

I look at the oldest file in /boot (top of "ls -ltr /boot". Often there is an original boot sector from the first install there. On my oldest system this gives the date of original installation, despite having replaced everything in the machine and copied the contents of the file system around a few times :)

share|improve this answer
up vote 2 down vote

In Fedora, anaconda installer stores the config details of your install in root's home folder, that can give you some idea.

On Debian (at least more recent ones), several logs from the install are stored in /var/log/installer/. Older versions stored them in /var/log/installer.*. That's at least back to 2003.

share|improve this answer
up vote 1 down vote 
ls -alct /|tail -1|awk '{print $6, $7, $8}'
share|improve this answer
up vote 0 down vote

ls -alct /root -> root home directory is created at install time

share|improve this answer
1  
But it might have changed afterwards. The time on / is slightly less likely to have changed if the kernel isn't kept in /, but it's still not a very good indicator. (Reminder: -c is not the creation time, it's the metadata change time. Most unix filesystems do not store a file's creation time.) – Gilles Mar 23 '11 at 21:36
show me any time which cannot be changed :) – jet Mar 24 '11 at 0:09
The question had the assumption “provided that nobody has tried to hide it”. The ctime of /root is likely to change naturally (e.g. every time someone creates a file there). – Gilles Mar 24 '11 at 0:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.