[clue] [SFS] When was this server "born"?

[David L. Willson]

CLUE: What is your strategy for determining a server's "born on" date?

---

> WRT the keys idea: On my Fedora 21 box, there weren't any ssh keys
> until I started the ssh daemon, so no dice.

> ----- Original Message -----

> From: "Mike Shoup" <mike at shouptech.com>

> Near as I can tell, XFS doesn't store that information:

> ~
> [mike at voyager]$ sudo xfs_info /
> meta-data=/dev/mapper/centos_voyager-root isize=256 agcount=4,
> agsize=1147392 blks
> = sectsz=512 attr=2, projid32bit=1
> = crc=0 finobt=0
> data = bsize=4096 blocks=4589568, imaxpct=25
> = sunit=0 swidth=0 blks
> naming =version 2 bsize=4096 ascii-ci=0 ftype=0
> log =internal bsize=4096 blocks=2560, version=2
> = sectsz=512 sunit=0 blks, lazy-count=1
> realtime =none extsz=4096 blocks=0, rtextents=0

> ___

> You could probably look at the ctime of a unique file for each
> machine, that gets created at install time. What about the host's
> SSH key? I don't think most places change those very often.

> ~
> [mike at voyager]$ stat /etc/ssh/ssh_host_rsa_key
> File: ‘/etc/ssh/ssh_host_rsa_key’
> Size: 1675 Blocks: 8 IO Block: 4096 regular file
> Device: fd00h/64768d Inode: 416880 Links: 1
> Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 999/ssh_keys)
> Access: 2015-08-05 12:48:27.021065883 -0600
> Modify: 2015-04-26 20:05:46.378871265 -0600
> Change: 2015-04-26 20:05:46.457871265 -0600
> Birth: -

> --

> Mike

> On Wed, Aug 5, 2015 at 2:13 PM, David L. Willson <
> dlwillson at sofree.us > wrote:

> > BCC: LPIC-1 Study Group
> 

> > "Born On Date"
> 

> > Sometimes it's useful to know when this server was "born", when it
> > was built. Usually, you also want to know who built it, so you know
> > who to question or kick, but that's a topic for another day.
> 

> > The root filesystem was usually created on the same day, so that is
> > the date I use. To get that date, if your root filesystem is
> > ext2/3/4, run dumpe2fs and look for 'created'.
> 

> > Here's an example:
> 

> > [dwills003c at wdv-logecoll nagios]$ sudo df -hT /
> 
> > Filesystem Type Size Used Avail Use% Mounted on
> 
> > /dev/sdi6 ext3 70G 32G 35G 48% /
> 
> > [dwills003c at wdv-logecoll nagios]$ sudo /sbin/dumpe2fs /dev/sdi6 |
> > grep -iC 3 created
> 
> > dumpe2fs 1.39 (29-May-2006)
> 
> > Fragments per group: 32768
> 
> > Inodes per group: 32736
> 
> > Inode blocks per group: 1023
> 
> > Filesystem created: Tue Jan 25 06:44:25 2011
> 
> > Last mount time: Fri Jul 31 09:02:54 2015
> 
> > Last write time: Fri Jul 31 09:02:54 2015
> 
> > Mount count: 10
> 

> > Now, Fedora Server 22 and Enterprise Linux 7 have moved to xfs. How
> > do you get the same information from it? I don't know... yet.
> 
> > _______________________________________________
> 
> > SFS mailing list
> 
> > SFS at thegeek.nu
> 
> > http://mailman.thegeek.nu/mailman/listinfo/sfs
>