How to determine the "age" of a linux system since installation?

I thought that I could easily check the timestamp of particular files. Then I realized that it wouldn't be so easy when I saw timestamps like 1991.

Solution 1:

The simplest way would probably be (presuming sda1 is your /root/):

tune2fs -l /dev/sda1 | grep created

This should show you the date on which the file system was created. Confirmed to work on ext2 to ext4, not sure about other file systems!

Solution 2:

One mechanism I often use is to check the change time (ctime) on files within the root home directory. Since the /root home directory is created at install time, and is often seldom used, this can provide a relatively good approximation. As clarified by Kyle in the comments, since ctime refers to the inode, and not the data, modifying the file contents will not change the ctime.

By default, the ls command prints the modification time (mtime) of the file. So if substitute in the ctime option like so,

ls -alct /root

This will print all files, display the create time, and sort by time.

As an example, here is a sample of the 3 oldest files in the /root directory from one of my systems.

ls -alt install.log.syslog .cshrc .tcshrc
-rw-r--r--. 1 root 10238 Feb 18  2010 install.log.syslog
-rw-r--r--. 1 root   129 Dec  3  2004 .tcshrc
-rw-r--r--. 1 root   100 Sep 22  2004 .cshrc

And then by checking the change time

ls -alct install.log.syslog .cshrc .tcshrc
-rw-r--r--. 1 root   100 Feb 18  2010 .cshrc
-rw-r--r--. 1 root 10238 Feb 18  2010 install.log.syslog
-rw-r--r--. 1 root   129 Feb 18  2010 .tcshrc

The date Feb 18th of 2010 certainly tracks with the approximate time I would have first installed that system.

Solution 3:

try

ls -alp /etc/ssh/ssh_host_dsa_key.pub | cut -d " " -f6

the keys are generated when you install the os.

Solution 4:

Checking the hardware would be a good bet, if you have access to it. You could inspect the system and/or hardware components to get a good idea of when it was assembled.

Alternately, if you can gain access to the BIOS screen there's often date info there that can be used to determine how old a machine is.

If you can gain access to the SMART info on the hard drive (smartctl -a /dev/sda) there might be something there to go on. I don't see a specific timestamp in SMART but there is at least an hours of usage counter. That would provide a lower bound on how old the machine is (since if the hard drive has been running for 100 hours, the system can't be younger than 100 hours).

As for filesystem checks, you could look at the date info for /lost+found - that directory was created when the filesystem was created. The date on it should agree with the tunefs info from the previous answer.