How do I find how long ago a Linux system was installed?

Question

How can I find the time since a Linux system was first installed, provided that nobody has tried to hide it?

@Tim There is no way to determine that. You could estimate by searching for the oldest files. — Šimon Tóth, Mar 23 '11 at 16:51
@Let: I was expecting an answer along the lines of "check the timestamp of /some/oscure/file, it is never modified". Please make that an answer. — , Mar 23 '11 at 16:53
I'd say look at the creation date of /etc or /sbin as a rough and not-totally-reliable estimate. — LawrenceC, Mar 23 '11 at 17:13
Ahh, after researching I found out linux doesn't store this information in its filesystems, but FreeBSD does. (http://www.linuxquestions.org/questions/general-10/file-creation-date-in-linux-473684/) Sorry to mislead you with bad advice. — LawrenceC, Mar 23 '11 at 17:45
Well, look in /etc and find a configuration file related to a program or service that's likely never to have been used. The mtime, visible with the stat command, should approximate the date of install. For example, if no one's ever bothered to change the inittab, that might provide a clue. — LawrenceC, Mar 23 '11 at 17:48
See the same question on Ask Ubuntu, which has both Ubuntu-specific and more generic answers. — Gilles 'SO- stop being evil', Mar 23 '11 at 20:40
Probable duplicate of http://unix.stackexchange.com/questions/7149/installation-date-of-ubuntu/7157#7157 — Dharmit, Mar 24 '11 at 04:34
When every part of a linux installation has been replaced over the years, is it still the same installation? (Same as the original analogy of a ship that had all of its parts slowly replaced) I ask because my root partition has changed disks and filesystems, and my home partition is older than that. Some appliances are prepared once as gold images, then get custom hostnames, ssh host keys and fs uuids on deployment. Gold images can be modified and frozen again, like the turnkey linux lineage. — Tobu, May 10 '11 at 20:53

score 127 · Accepted Answer · edited Dec 31 '20 at 10:49

127

sudo tune2fs -l /dev/sda1 **OR** /dev/sdb1*  | grep 'Filesystem created:'

This will tell you when the file system was created.

* = In the first column of df / you can find the exact partition to use.

edited Dec 31 '20 at 10:49

Julian Knight

148

answered Mar 23 '11 at 21:08

RailOcelot

1,412

6

Usually /dev/sda1 or something like that (whatever df / shows in the first column), but the principle is sound. – Gilles 'SO- stop being evil' Mar 23 '11 at 21:34
1

Hey, that's handy to know, thanks. And this information survives copying the filesystem too. +1. – Faheem Mitha Mar 23 '11 at 22:04
7

The solution is good, but filesystem dependent and requires root privileges. – golem Jun 24 '15 at 23:22
8

+1. However, i have to note that my current desktop was created around 1994. Absolutely everything about it has changed multiple times since then (including the disks, and the filesystem type i use) but it's still the same system. This method will only, at best, tell me the date of the most recent move to a new filesystem. – cas Nov 13 '15 at 04:20
4

This shouldn't be the accepted answer because it works only with ext2 (maybe up to ext4?) which I don't use. – soger Mar 09 '17 at 11:09
Cool solution. It worked even on a system where I used dump and restore to replace the system drive. But I guess it won't work if you use other methods, such as cp -a or rsync, to copy the data to the new drive. – gerlos Dec 07 '17 at 10:12
sudo tune2fs -l $(df / | tail -n 1 | awk -F' ' '{ print $1 }') | grep 'Filesystem created:' – user672009 Jun 19 '20 at 16:58
But this not support xfs filesystem? – Subfire Nov 03 '23 at 02:43

score 30 · Answer 2 · answered Mar 23 '11 at 19:54

30

Check the date of the root filesystem with dumpe2fs. I can't really think of how that could be anything other than the date you're looking for:

dumpe2fs $(mount | grep 'on \/ ' | awk '{print $1}') | grep 'Filesystem created:'

answered Mar 23 '11 at 19:54

pboin

1,500

1

... or tune2fs -l – forcefsck Mar 23 '11 at 20:24
3

You forgot to mention that this is only applicable to ext2/ext3/ext4 filesystem. – Šimon Tóth Mar 23 '11 at 21:18
1

You'd get the wrong date on several of my machines, where I've upgraded hard drives, and just copied the install over. – derobert Aug 30 '12 at 16:12
1

@derobert, I still think my answer would be correct, given the OPs question. A new disk isn't any different from new RAM -- you still have the same 'installation' even though you popped a new disk in... – pboin Oct 22 '12 at 20:26
1

@pboin No, when I copy the install over, its a larger disk, so I repartition and mkfs (then use tar/cp to copy it, not dd). May even be a different filesystem (e.g., ext2 -> ext3 -> ext4) So you'd get the time I copied the install over. That's how it could be other than the date OP is looking for. – derobert Oct 22 '12 at 21:54
It doesn't even have to be a new disk: a filesystem upgrade alone would change that date. – Dmitry Grigoryev Oct 01 '21 at 08:53

score 22 · Answer 3 · edited Apr 04 '14 at 18:07

22

There are a few dates lying around.

All files have dates.
Log files have dates in them.

On Debian or Ubuntu and their derivatives, see /var/log/installer/syslog for the definitive answer if it exists it is part of the log of the instillation.

But beware this is not guaranteed. (see other answers/comments for some of the reasons it may not work.)

edited Apr 04 '14 at 18:07

Stefan Lasiewski

19,754
24
70
85

answered Mar 23 '11 at 17:02

ctrl-alt-delor

27,993

This might be specific to Debian/Ubuntu though. – Faheem Mitha Mar 23 '11 at 17:26
@Faheem Mitha: Same file/directory is used for Ubuntu. – BillThor Mar 23 '11 at 21:13
1

@Bill: Yes, I said specific to Debian/Ubuntu. Meaning the recipe would work for both Debian and Ubuntu, but possibly not for other (non-Debian-based) Linux distributions. – Faheem Mitha Mar 23 '11 at 22:05
1

But not all files HAVE A CREATION DATE. AFAIK birth date was only introduced in ext4, and that is not POSIX anyway. – Konrad Gajewski Dec 06 '15 at 01:49
@KonradGajewski But nether this answer, or any of its comments mention file creation date. – ctrl-alt-delor Dec 07 '15 at 21:48
This did not work on my Debian Testing system (installed as Linux Mint Debian Edition –and later transitioned to the more sane Debian Testing– in Mar 2014 according to the dumpe2fs answers). Instead, try ls -ltc --full-time /etc to list the contents of /etc by order of creation time as noted in my answer below. – Adam Katz Sep 16 '16 at 17:14
@gerlos your edit (not approved), could be a new answer. Add it as an answer and I will up vote it (if I notice, may be add a comment here, we should delete both comment afterward). – ctrl-alt-delor Dec 08 '17 at 17:43

score 20 · Answer 4 · edited May 07 '16 at 21:43

On Red Hat based distributions (e.g. CentOS, Scientific, Oracle etc) you can use:

rpm -qi basesystem
Name        : basesystem
Version     : 10.0
Release     : 7.el7
Architecture: noarch
Install Date: Mon 02 May 2016 19:20:58 BST
Group       : System Environment/Base
Size        : 0
License     : Public Domain
Signature   : RSA/SHA256, Tue 01 Apr 2014 14:23:16 BST, Key ID     199e2f91fd431d51
Source RPM  : basesystem-10.0-7.el7.src.rpm
Build Date  : Fri 27 Dec 2013 17:22:15 GMT
Build Host  : ppc-015.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
Summary     : The skeleton package which defines a simple Red Hat Enterprise Linux system
Description :
Basesystem defines the components of a basic Red Hat Enterprise Linux
system (for example, the package installation order to use during
bootstrapping). Basesystem should be in every installation of a system,
and it should never be removed.

or

rpm -q basesystem --qf '%{installtime:date}\n'
Mon 02 May 2016 19:20:58 BST

How come rpm -qi gives me Install Date: Mon 07 Jul 2014 03:20:44 PM UTC, while tune2fs says Filesystem created: Sat Dec 20 23:41:41 2014? — BenMorel, Feb 28 '17 at 00:33
On my Azure's VM all have the same time, so rpm is not reliable at all — Chris, Sep 17 '19 at 06:59

score 13 · Answer 5 · answered Sep 16 '16 at 17:11

The solution most neutral to filesystem and distribution (that I can come up with) is to use the oldest file given by ls -lact /etc, which looks at each file's metadata for the creation time. While this can be gamed, it is not affected by touch or files created by extracting archives (e.g. tar -p to preserve timestamps).

I think it's best to look at files rather than directories since directories do change their creation time metadata when their contents change (perhaps somebody can shed light on why that is?)

ls -lact --full-time /etc |tail

Systems that lack GNU Coreutils should remove the --full-time option (the sort order will still be correct and you'll still get the day). You can get the creation time from a file's metadata with stat FILE |grep Change (run that on the oldest file listed by ls -lact).

On other non-Linux systems, stat likely has that information in a slightly different arrangement, possibly requiring different flags. Note that this still uses the file's metadata and accuracy isn't guaranteed.

Also note that stat from GNU Coreutils has a "Birth" time which tends to be wrong (Linux with ext4 yields 0 to indicate it's unknown, FreeBSD with UFS showed a "Birth" time that is older than the system I queried). The correct value was listed as its "Change" time.

If you want to get fancy and get just the creation time of the oldest file in/etc:

ls -lact --full-time /etc |awk 'END {print $6,$7,$8}'

This command worked for me on an old FreeBSD system (UFS, no GNU utils):

stat "/etc/$(ls -act /etc |tail -1)" |awk -F\" '{print $6}'

^{(Yes, this parses ls and that's taboo, but there shouldn't be mischievously named files in /etc.)}

You can also use stat to get other time formats. For example, to get the creation time in Unix epoch: stat -c %Z FILE (with GNU, note that %Z is "time of last status change" but that's the correct flag for my Linux and BSD systems, as noted above; %W is the "time of file birth") or stat -f %c FILE (with BSD).

This didn't work for me (a few files were much older than the installation date). But looking only at symbolic links in /var and /etc seems to work: ls -lact --full-time /var | grep ' ->' | tail -4; echo; ls -lact --full-time /etc | grep ' ->' | tail -4 — ndemou, Jan 10 '20 at 16:24
@ndemou – What version of ls are you using? On what filesystem? I wonder about the validity of the creation times you're seeing; ls may be ignoring/misinterpreting -c and/or the filesystem may not be storing it correctly. Interesting idea on the symlinks. You could do your trick more simply with find /etc /var -maxdepth 1 -type l -print0 |xargs -0 ls -lactd |tail -n4 — Adam Katz, Jan 14 '20 at 14:56
ls is ver.8.2 and filesystem is xfs. stat also shows Change and Modify times that match ls output (FWIW it's a CentOS 7 server) — ndemou, Jan 19 '20 at 22:55

score 8 · Answer 6 · edited Aug 30 '12 at 16:47

8

In Fedora, anaconda installer stores the config details of your install in root's home folder, that can give you some idea.

On Debian (at least more recent ones), several logs from the install are stored in /var/log/installer/. Older versions stored them in /var/log/installer.*. That's at least back to 2003.

edited Aug 30 '12 at 16:47

derobert

109,670

answered Mar 23 '11 at 17:11

rajaganesh87

1,057

score 6 · Answer 7 · answered Aug 30 '12 at 15:29

6

ls -alct /|tail -1|awk '{print $6, $7, $8}'

answered Aug 30 '12 at 15:29

Jorge V.

419

score 5 · Answer 8 · answered May 29 '13 at 20:57

I have been looking for similar tool, and the best I could come up with was ls -lAhF /etc/hostname, simply the age of the hostname file. I think, generaly, the hostname of a system is set at the beginning, and left unchanged during the life of the system. The date of the creation of the filesystem is certailny helpful, but can be misleading. I, for example, often use virtual machines image, which I have installed some time ago, copy it, change the hostname and make a new server from it. Therefore, in my case /etc/hostname is better indication than tune2fs -l /dev/sda1

score 4 · Answer 9 · answered Mar 23 '11 at 16:59

4

As requested by OP.

If you are looking for the time, when the system was setup, there isn't a way to determine that. For one, the system might have been cloned (not installed) which would effectively fake the file creation time.

You can estimate the age by searching for oldest files.

answered Mar 23 '11 at 16:59

Šimon Tóth

8,238

mattdm is right; you can get access time, modification time, and change time; ctime is the last. See this SO post – Michael Mrozek Mar 23 '11 at 17:48

score 3 · Answer 10 · answered Mar 24 '11 at 14:54

I look at the oldest file in /boot (top of "ls -ltr /boot". Often there is an original boot sector from the first install there. On my oldest system this gives the date of original installation, despite having replaced everything in the machine and copied the contents of the file system around a few times :)

score 1 · Answer 11 · answered Dec 19 '17 at 10:52

Since a time ago, I usually install at the sime time that the linux distribution a package called Tuptime, which keeps useful statistics about the running time, startups, shutdowns...

For your questions, the line "System life" have that information. As example:

System startups:    110   since   10:15:27 08/08/15
System shutdowns:   107 ok   -   2 bad
System uptime:      4.04 %   -   1 days, 22 hours, 4 minutes and 44 seconds
System downtime:    95.96 %   -   45 days, 13 hours, 57 minutes and 30 seconds
System life:        47 days, 12 hours, 2 minutes and 15 seconds

Largest uptime:     2 hours, 10 minutes and 44 seconds   from   20:49:17 09/08/15
Shortest uptime:    9 seconds   from   10:23:36 08/08/15
Average uptime:     25 minutes and 8 seconds

Largest downtime:   7 days, 10 hours, 17 minutes and 26 seconds   from   06:09:45 10/08/15
Shortest downtime:  15 seconds   from   19:27:24 19/09/15
Average downtime:   9 hours, 56 minutes and 42 seconds

Current uptime:     23 minutes and 33 seconds   since   21:54:09 24/09/15

More info: https://github.com/rfrail3/tuptime/

score 1 · Answer 12 · answered Oct 17 '20 at 23:37

1

Here is a nice script which attempts to provide the OS installation date for various operating systems using various techniques: https://github.com/dmbaturin/scripts/blob/master/installdate.sh

answered Oct 17 '20 at 23:37

Kenyon

238

score 1 · Answer 13 · edited Dec 13 '23 at 21:06

For a simpler solution, you could just do:

stat --format=%w /

This will tell you when the root of your filesystem was created.

You also could do just this:

stat /

Advantages:

Extremely easy to remember.
No need for root privileges, or sudo.

Example of the unfiltered result.

$ stat /
  File: /
  Size: 4096        Blocks: 8          IO Block: 4096   directory
Device: 10302h/66306d   Inode: 2           Links: 21
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-12-13 21:08:27.833202790 +0100
Modify: 2023-11-27 11:19:52.611063992 +0100
Change: 2023-11-27 11:19:52.611063992 +0100
 Birth: 2018-06-16 11:26:24.000000000 +0200

where the last line is relevant.

Thank you for the direct result method. I knew about stat /, but anyway. Cheers — Vlastimil Burián, Dec 13 '23 at 21:23

score 0 · Answer 14 · answered Mar 07 '19 at 18:06

If you used LVM during the installation, you can check the creation date of a Logical Volume done on the installation day, example :

$ sudo lvdisplay /dev/mapper/KUbuntu_VG-rootFS | grep Creation
  LV Creation host, time kubuntu, 2014-12-28 20:52:15 +0100

score 0 · Answer 15 · edited Jul 11 '19 at 12:24

0

This is another way

# rpm -q -last basesystem
basesystem-10.0-7.el7.noarch                  Tue 11 Jul 2017 03:57:52 PM UTC

edited Jul 11 '19 at 12:24

Jeff Schaller

67,283
35
116
255

answered Jul 11 '19 at 12:05

Shirish Shukla

109

score 0 · Answer 16 · edited Nov 02 '19 at 12:42

Dealing with virtual machines, some of the file system etc were created when the image was created, can be long before the instance was created.

The time stamp on /etc/locale.conf seems modified when the instance is boot up during instance creation. This might be a good time to use unless the locale is modified later on.

The /etc/hostname is similar, except that we do modify it in certain situations.

Any idea as to other files that are modified when a instance is created but not modified thereafter?

score 0 · Answer 17 · answered Mar 23 '11 at 21:25

0

ls -alct /root -> root home directory is created at install time

answered Mar 23 '11 at 21:25

jet

894

2

But it might have changed afterwards. The time on / is slightly less likely to have changed if the kernel isn't kept in /, but it's still not a very good indicator. (Reminder: -c is not the creation time, it's the metadata change time. Most unix filesystems do not store a file's creation time.) – Gilles 'SO- stop being evil' Mar 23 '11 at 21:36
show me any time which cannot be changed :) – jet Mar 24 '11 at 00:09
The question had the assumption “provided that nobody has tried to hide it”. The ctime of /root is likely to change naturally (e.g. every time someone creates a file there). – Gilles 'SO- stop being evil' Mar 24 '11 at 00:13

score -5 · Answer 18 · answered Mar 29 '17 at 09:59

-5

I found a simple file. name "1". Maybe is the first file.

▶ ls -lact --full-time /1
-rw-r--r--. 1 root root 0 2017-03-23 12:02:46.880994133 +0800 /1

answered Mar 29 '17 at 09:59

eexpress

381

why downvote. This time is really point out the last system installed time. – eexpress Apr 06 '17 at 02:28
2

I don't have this file on my Linux. – Kevin Lemaire Oct 04 '18 at 10:31

How do I find how long ago a Linux system was installed?

18 Answers18

Linked