How do I find how long ago a Linux system was installed?
How can I find the time since a Linux system was first installed, provided that nobody has tried to hide it?
@Let: I was expecting an answer along the lines of «check the timestamp of /some/oscure/file, it is never modified». Please make that an answer.
When every part of a linux installation has been replaced over the years, is it still the same installation? (Same as the original analogy of a ship that had all of its parts slowly replaced) I ask because my root partition has changed disks and filesystems, and my home partition is older than that. Some appliances are prepared once as gold images, then get custom hostnames, ssh host keys and fs uuids on deployment. Gold images can be modified and frozen again, like the turnkey linux lineage.
17 Answers 17
sudo tune2fs -l /dev/sda1 **OR** /dev/sdb1* | grep 'Filesystem created:' This will tell you when the file system was created.
* = In the first column of df / you can find the exact partition to use.
Usually /dev/sda1 or something like that (whatever df / shows in the first column), but the principle is sound.
+1. However, i have to note that my current desktop was created around 1994. Absolutely everything about it has changed multiple times since then (including the disks, and the filesystem type i use) but it’s still the same system. This method will only, at best, tell me the date of the most recent move to a new filesystem.
This shouldn’t be the accepted answer because it works only with ext2 (maybe up to ext4?) which I don’t use.
Check the date of the root filesystem with dumpe2fs. I can’t really think of how that could be anything other than the date you’re looking for:
dumpe2fs $(mount | grep 'on \/ ' | awk '') | grep 'Filesystem created:' You’d get the wrong date on several of my machines, where I’ve upgraded hard drives, and just copied the install over.
@derobert, I still think my answer would be correct, given the OPs question. A new disk isn’t any different from new RAM — you still have the same ‘installation’ even though you popped a new disk in.
@pboin No, when I copy the install over, its a larger disk, so I repartition and mkfs (then use tar/cp to copy it, not dd). May even be a different filesystem (e.g., ext2 -> ext3 -> ext4) So you’d get the time I copied the install over. That’s how it could be other than the date OP is looking for.
There are a few dates lying around.
On Debian or Ubuntu and their derivatives, see /var/log/installer/syslog for the definitive answer if it exists it is part of the log of the instillation.
But beware this is not guaranteed. (see other answers/comments for some of the reasons it may not work.)
@Bill: Yes, I said specific to Debian/Ubuntu. Meaning the recipe would work for both Debian and Ubuntu, but possibly not for other (non-Debian-based) Linux distributions.
But not all files HAVE A CREATION DATE. AFAIK birth date was only introduced in ext4, and that is not POSIX anyway.
On Red Hat based distributions (e.g. CentOS, Scientific, Oracle etc) you can use:
rpm -qi basesystem Name : basesystem Version : 10.0 Release : 7.el7 Architecture: noarch Install Date: Mon 02 May 2016 19:20:58 BST Group : System Environment/Base Size : 0 License : Public Domain Signature : RSA/SHA256, Tue 01 Apr 2014 14:23:16 BST, Key ID 199e2f91fd431d51 Source RPM : basesystem-10.0-7.el7.src.rpm Build Date : Fri 27 Dec 2013 17:22:15 GMT Build Host : ppc-015.build.eng.bos.redhat.com Relocations : (not relocatable) Packager : Red Hat, Inc. Vendor : Red Hat, Inc. Summary : The skeleton package which defines a simple Red Hat Enterprise Linux system Description : Basesystem defines the components of a basic Red Hat Enterprise Linux system (for example, the package installation order to use during bootstrapping). Basesystem should be in every installation of a system, and it should never be removed. rpm -q basesystem --qf '%\n' Mon 02 May 2016 19:20:58 BST How come rpm -qi gives me Install Date: Mon 07 Jul 2014 03:20:44 PM UTC , while tune2fs says Filesystem created: Sat Dec 20 23:41:41 2014 ?
The solution most neutral to filesystem and distribution (that I can come up with) is to use the oldest file given by ls -lact /etc , which looks at each file’s metadata for the creation time. While this can be gamed, it is not affected by touch or files created by extracting archives (e.g. tar -p to preserve timestamps).
I think it’s best to look at files rather than directories since directories do change their creation time metadata when their contents change (perhaps somebody can shed light on why that is?)
ls -lact --full-time /etc |tail Systems that lack GNU Coreutils should remove the —full-time option (the sort order will still be correct and you’ll still get the day). You can get the creation time from a file’s metadata with stat FILE |grep Change (run that on the oldest file listed by ls -lact ).
On other non-Linux systems, stat likely has that information in a slightly different arrangement, possibly requiring different flags. Note that this still uses the file’s metadata and accuracy isn’t guaranteed.
Also note that stat from GNU Coreutils has a «Birth» time which tends to be wrong (Linux with ext4 yields 0 to indicate it’s unknown, FreeBSD with UFS showed a «Birth» time that is older than the system I queried). The correct value was listed as its «Change» time.
If you want to get fancy and get just the creation time of the oldest file in /etc :
ls -lact --full-time /etc |awk 'END ' This command worked for me on an old FreeBSD system (UFS, no GNU utils):
stat "/etc/$(ls -act /etc |tail -1)" |awk -F\" '' (Yes, this parses ls and that’s taboo, but there shouldn’t be mischievously named files in /etc .)
You can also use stat to get other time formats. For example, to get the creation time in Unix epoch: stat -c %Z FILE (with GNU, note that %Z is «time of last status change» but that’s the correct flag for my Linux and BSD systems, as noted above; %W is the «time of file birth») or stat -f %c FILE (with BSD).
Installation date of Ubuntu
How can I determine when Ubuntu was installed in my computer? There was a different question posted here.
@Mikel. The reason is that they show different dates. For instance, dumpe2fs and /var/log/installer show creation date as 05.11.2010 while /boot shows as 29.01.2011. That is why I wanted to find out precise method to get this information without any doubts.
@Bakhtiyor Then most probably something happened to /boot . When dumpe2fs and /var/log/installer point to the same answer I won’t keep any doubt.
@Bakhtiyor If you still think something is wrong and you need help with it please edit your question to include that information. Or if you question has already been answered on the other site you can close this one.
4 Answers 4
As I found here sudo grep ubiquity /var/log/installer/syslog | less should work for Ubuntu.
sudo dumpe2fs $(mount | awk '/on \/ /') | grep 'created:' Use this command for check when was the OS installed.
This should be an accepted answer as it relies on filesystem creation date rather than log file that can be modified.
Use last | tail -1 . It helped me find the installation date on Fedora 14. The last line stating
wtmp begins Tue Nov 9 22:35:12 2010 wtmp begins Wed Feb 2 16:24:52 2011. This is what I get with last command in Ubuntu. Approximately my OS had been installed on November 2010.
I wouldn’t rely on that. For example, FreeBSD rotates /var/log/wtmp by default, so when I run last on one of my FreeBSD boxes I get «wtmp begins Thu Feb 3 09:50:42 EST 2011». My Slackware box does the same thing, I installed the OS on it years ago but last reports that wtmp began last week. I don’t have an Ubuntu box handy to check.
@Dharmit. sudo grep ubiquity /var/log/installer/syslog | less worked for me. Could you please post it as an answer, so that I could select your answer as an accepted one.
How can I tell what date Ubuntu was installed?
A quick way to find the date through the command line would be by running:
That lists in reverse chronological order so the oldest file is at the bottom of the list.
On my system, I have 7 files under /var/log/installer/ . I installed from 9.10, and later updated to 10.04.
I do also have this folder on my (freshly installed) 10.04 system and the creation dates of those files give me the install date. The file /var/log/installer/media-info for example contains the information about the installation media that was used for the install.
On my system that was installed originally with 7.10, /var/log/installer/version has a date of 2007-10-30, so this seems to be quite reliable.
If you use ext2/ext3/ext4 and formatted the disk when you installed you can do this nifty trick.
sudo dumpe2fs /dev/sda1 | grep 'Filesystem created:' You might have to change the /dev/sda1 to reflect your setup.
Filesystem created: Fri Oct 14 22:40:09 2022 Relying on the date of files, even the «creation time» (mtime) can give errors since upgrading packages might have replaced the file and made a new «creation time».
Similar tools and info might be available on other file systems as well, but I don’t know of them.
When I do this I get the error dumpe2fs: Bad magic number in super-block while trying to open /dev/sda1
@king_julien Are you sure that your /dev/sda1 is your systems root partition? It may be different on your install, in fact the filesystem type may be an other than what is supported by dumpe2fs!
You can use a more general but a little complicated command: sudo dumpe2fs $(mount | grep ‘on / ‘ | awk ‘
You could use the -h option so you at least only get the superblock info which should be more than enough.
the only command that worked for me is —
@SridharSarnobat, credit for the cleverness goes to the answer, not to myself: that command prints the creation date of the oldest file/dir entry in the root directory. I simply stated that this is most likely /lost+found . Just notice this is for EXT4 filesystems: non-boot/root disks might be FAT/NTFS and thus have something else as the oldest entry.
Unfortunately even this answer may be misleading, for cloud services. They may have an image they created beforehand.
If the installation is recent, look at the oldest entries under /var/log , but after a few weeks the logs will have been rotated away.
Another thing to look at is the oldest ctime of a file on the root filesystem; but if the whole installation has been copied (e.g. rescued off a failing disk) at the directory tree level, this gives you the date of the copy.
If a heuristic is good enough, look at the date (mtime) of a file that was created during the installation and is unlikely to have been modified since. A good candidate is /etc/hostname ; other candidates are /etc/hosts , /etc/papersize , /etc/popularity-contest.conf .
How To Find Installation Date and Time of Linux OS
Hi guys, In this tutorial, We will illustrate a few ways to find Linux OS’s installation date and time.
Find Installation Date and Time
Here are some methods below to get the OS’s installation date and time
stat / | grep "Birth" | sed 's/Birth: //g' | cut -b 2-11
stat command will display file status in Linux with some manipulation tools such as sed editor and cut as shown above.
- Also you can use awk with stat to display Linux installation date as shown below
The installation date and time of my Linux OS is Jul 26, 2021.
- Also you can use stat command without sed, cut and awk as per stat command has a flag to check Linux installation date and time, just run the below command
- On Debian based systems, search in the syslog to get Linux OS installation date and time as shown below
sudo head -n1 /var/log/installer/syslog- If these logs were deleted or you couldn’t find them, you can find the installation date with another way like below, just run the command:
fs=$(df / | tail -1 | cut -f1 -d' ') && tune2fs -l $fs | grep created
- You can get Installation date with the Basesystem which defines the components of a basic Linux system such as the package installation, to use the Basesystem to find the Installation date and time, run the command below:
rpm -qi basesystem | grep -i date
- Also you can download this script and run it then you will get the Installation date, So download it with the command belwo
wget -O installdate.sh https://raw.githubusercontent.com/alicela1n/install-date/main/install-date
Conclusion
We showed you how to find Linux OS’s installation date and time with some ways, you can choose one of them to do that.