How do I find how long ago a Linux system was installed?

Question

How can I find the time since a Linux system was first installed, provided that nobody has tried to hide it?

Answer 1

tune2fs -l /dev/sda1 **OR** /dev/sdb1*  | grep 'Filesystem created:'

This will tell you when the file system was created.

* = In the first column of df / you can find the exact partition to use.

Answer 2

Check the date of the root filesystem with dumpe2fs. I can't really think of how that could be anything other than the date you're looking for:

dumpe2fs $(mount | grep 'on \/ ' | awk '{print $1}') | grep 'Filesystem created:'

Answer 3

There are a few dates lying around.

• All files have dates.
• Log files have dates in them.

On Debian or Ubuntu and their derivatives, see /var/log/installer/syslog for the definitive answer if it exists it is part of the log of the instillation.

But beware this is not guaranteed. (see other answers/comments for some of the reasons it may not work.)

Answer 4

In Fedora, anaconda installer stores the config details of your install in root's home folder, that can give you some idea.

On Debian (at least more recent ones), several logs from the install are stored in /var/log/installer/. Older versions stored them in /var/log/installer.*. That's at least back to 2003.

Answer 5

As requested by OP.

If you are looking for the time, when the system was setup, there isn't a way to determine that. For one, the system might have been cloned (not installed) which would effectively fake the file creation time.

You can estimate the age by searching for oldest files.

Answer 6

On Red Hat based distributions (e.g. CentOS, Scientific, Oracle etc) you can use:

rpm -qi basesystem
Name        : basesystem
Version     : 10.0
Release     : 7.el7
Architecture: noarch
Install Date: Mon 02 May 2016 19:20:58 BST
Group       : System Environment/Base
Size        : 0
License     : Public Domain
Signature   : RSA/SHA256, Tue 01 Apr 2014 14:23:16 BST, Key ID     199e2f91fd431d51
Source RPM  : basesystem-10.0-7.el7.src.rpm
Build Date  : Fri 27 Dec 2013 17:22:15 GMT
Build Host  : ppc-015.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
Summary     : The skeleton package which defines a simple Red Hat Enterprise Linux system
Description :
Basesystem defines the components of a basic Red Hat Enterprise Linux
system (for example, the package installation order to use during
bootstrapping). Basesystem should be in every installation of a system,
and it should never be removed.

or

rpm -q basesystem --qf '%{installtime:date}\n'
Mon 02 May 2016 19:20:58 BST

Answer 7

The solution most neutral to filesystem and distribution (that I can come up with) is to use the oldest file given by ls -lact /etc, which looks at each file's metadata for the creation time. While this can be gamed, it is not affected by touch or files created by extracting archives (e.g. tar -p to preserve timestamps).

I think it's best to look at files rather than directories since directories do change their creation time metadata when their contents change (perhaps somebody can shed light on why that is?)

ls -lact --full-time /etc |tail

Systems that lack GNU Coreutils should remove the --full-time option (the sort order will still be correct and you'll still get the day). You can get the creation time from a file's metadata with stat FILE |grep Change (run that on the oldest file listed by ls -lact).

On other non-Linux systems, stat likely has that information in a slightly different arrangement, possibly requiring different flags. Note that this still uses the file's metadata and accuracy isn't guaranteed.

Also note that stat from GNU Coreutils has a "Birth" time which tends to be wrong (Linux with ext4 yields 0 to indicate it's unknown, FreeBSD with UFS showed a "Birth" time that is older than the system I queried). The correct value was listed as its "Change" time.

If you want to get fancy and get just the creation time of the oldest file in/etc:

ls -lact --full-time /etc |awk 'END {print $6,$7,$8}'

This command worked for me on an old FreeBSD system (UFS, no GNU utils):

stat "/etc/$(ls -act /etc |tail -1)" |awk -F\" '{print $6}'

^{(Yes, this parses ls and that's taboo, but there shouldn't be mischievously named files in /etc.)}

You can also use stat to get other time formats. For example, to get the creation time in Unix epoch: stat -c %Z FILE (with GNU, note that %Z is "time of last status change" but that's the correct flag for my Linux and BSD systems, as noted above; %W is the "time of file birth") or stat -f %c FILE (with BSD).

Answer 8

ls -alct /|tail -1|awk '{print $6, $7, $8}'

Answer 9

I have been looking for similar tool, and the best I could come up with was ls -lAhF /etc/hostname, simply the age of the hostname file. I think, generaly, the hostname of a system is set at the beginning, and left unchanged during the life of the system. The date of the creation of the filesystem is certailny helpful, but can be misleading. I, for example, often use virtual machines image, which I have installed some time ago, copy it, change the hostname and make a new server from it. Therefore, in my case /etc/hostname is better indication than tune2fs -l /dev/sda1

Answer 10

I look at the oldest file in /boot (top of "ls -ltr /boot". Often there is an original boot sector from the first install there. On my oldest system this gives the date of original installation, despite having replaced everything in the machine and copied the contents of the file system around a few times :)

Answer 11

ls -alct /root -> root home directory is created at install time

Answer 12

Please run as follows:

1. rpm -qa|grep basesystem

And then use the below command.

2. rpm -qi (result of the first command)

Answer 13

Since a time ago, I usually install at the sime time that the linux distribution a package called Tuptime, which keeps useful statistics about the running time, startups, shutdowns...

For your questions, the line "System life" have that information. As example:

System startups:    110   since   10:15:27 08/08/15
System shutdowns:   107 ok   -   2 bad
System uptime:      4.04 %   -   1 days, 22 hours, 4 minutes and 44 seconds
System downtime:    95.96 %   -   45 days, 13 hours, 57 minutes and 30 seconds
System life:        47 days, 12 hours, 2 minutes and 15 seconds

Largest uptime:     2 hours, 10 minutes and 44 seconds   from   20:49:17 09/08/15
Shortest uptime:    9 seconds   from   10:23:36 08/08/15
Average uptime:     25 minutes and 8 seconds

Largest downtime:   7 days, 10 hours, 17 minutes and 26 seconds   from   06:09:45 10/08/15
Shortest downtime:  15 seconds   from   19:27:24 19/09/15
Average downtime:   9 hours, 56 minutes and 42 seconds

Current uptime:     23 minutes and 33 seconds   since   21:54:09 24/09/15

More info: https://github.com/rfrail3/tuptime/

Answer 14

I found a simple file. name "1". Maybe is the first file.

▶ ls -lact --full-time /1
-rw-r--r--. 1 root root 0 2017-03-23 12:02:46.880994133 +0800 /1