I am on a CrunchBang machine and trying to write a script that needs to have the OS install date as a reference.

I searched and found this command:

ls -lct /etc | tail -1 | awk '{print $6, $7, $8}'

It prints

Mar 31 21:24

I did not understand the tail -1 part, but was able figure out that $6 $7 $8 are the 6th 7th 8th occurrences of the last line that the command is referencing.

However, I realized that the year cannot be included as the year was not displayed in the ls -ltc command.

Some people suggested finding the date /etc was created and some checking the /var/log/syslog etc. I thought these might be a little specific to the distro.

What is your recommendation for a truly distro-agnostic way to find the OS install date?

  • 1
    Why do you think checking /etc's creation date is distro-specific? – Kevin Apr 2 '12 at 19:14
  • I recently read that there are some distros that have a different file system hierarchy like gobolinux and was under the impression that there might be more distros similar to gobolinux. – Animesh Apr 2 '12 at 19:40
  • 1
    I think checking /etc is more portable than assuming an ext filesystem. Or just check for the oldest directory in /. – Kevin Apr 3 '12 at 14:21
  • 1
    Just for completeness, I'll note that the output of ls shows the time when it is less than six months old, and the year when it is more than six months. – Random832 Apr 3 '12 at 17:56
  • @Kevin if you unpack an archive while preserving permissions, the oldest directory/file can be way older than the system install date. – scai Jul 30 '12 at 13:19

If the assumption is that you have an ext{2,3,4} filesystem, and you formatted the root filesystem when you installed the OS (and didn't do upgrades from another OS without a wipe), you can use dumpe2fs:

% dumpe2fs -h /dev/mapper/vg_desktop-lv_root 2>&1 |grep 'Filesystem created'
Filesystem created:       Sat Jul 23 04:28:07 2011
  • Was the output being redirected to somewhere or a file, because nothing happened when I run the command. – Animesh Apr 2 '12 at 21:23
  • You'll have to supply the device for your root filesystem, instead of /dev/mapper/vg_desktop-lv_root. Check the output of df / to get it. I'm sure you could automate it. – jsbillings Apr 2 '12 at 21:28
  • I realized I had a _ instead of - when typing the command. I get the date now. Thanks. – Animesh Apr 2 '12 at 21:39
  • Or that you didn't backup, reformat, and restore. – psusi Apr 3 '12 at 0:58
  • 3
    My filesystem is reiserfs. Imho, looking for /etc is a better approach. – user unknown Apr 3 '12 at 13:39

I don't know of any formal method for this.

What I have always done is:

touch /install-`date +"%F"` && chattr +i /install-20*

That creates a file named 'install-' followed by the current date (if ran today it would be install-2012-04-03) and sets it as immutable, so it can't be deleted by accident.

Then is it just a matter of looking at that file to see when the OS was installed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.