[clue] [SFS] When was this server "born"?

[Dan]

If it's a Redhat or Centos system there should be a /root/anaconda.ks file with the same timestamp.

On August 5, 2015 4:36:44 PM MDT, "David L. Willson" <DLWillson at TheGeek.NU> wrote:
>CLUE: What is your strategy for determining a server's "born on" date?
>
>---
>
>> WRT the keys idea: On my Fedora 21 box, there weren't any ssh keys
>> until I started the ssh daemon, so no dice.
>
>> ----- Original Message -----
>
>> From: "Mike Shoup" <mike at shouptech.com>
>
>> Near as I can tell, XFS doesn't store that information:
>
>> ~
>> [mike at voyager]$ sudo xfs_info /
>> meta-data=/dev/mapper/centos_voyager-root isize=256 agcount=4,
>> agsize=1147392 blks
>> = sectsz=512 attr=2, projid32bit=1
>> = crc=0 finobt=0
>> data = bsize=4096 blocks=4589568, imaxpct=25
>> = sunit=0 swidth=0 blks
>> naming =version 2 bsize=4096 ascii-ci=0 ftype=0
>> log =internal bsize=4096 blocks=2560, version=2
>> = sectsz=512 sunit=0 blks, lazy-count=1
>> realtime =none extsz=4096 blocks=0, rtextents=0
>
>> ___
>
>> You could probably look at the ctime of a unique file for each
>> machine, that gets created at install time. What about the host's
>> SSH key? I don't think most places change those very often.
>
>> ~
>> [mike at voyager]$ stat /etc/ssh/ssh_host_rsa_key
>> File: ‘/etc/ssh/ssh_host_rsa_key’
>> Size: 1675 Blocks: 8 IO Block: 4096 regular file
>> Device: fd00h/64768d Inode: 416880 Links: 1
>> Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 999/ssh_keys)
>> Access: 2015-08-05 12:48:27.021065883 -0600
>> Modify: 2015-04-26 20:05:46.378871265 -0600
>> Change: 2015-04-26 20:05:46.457871265 -0600
>> Birth: -
>
>> --
>
>> Mike
>
>> On Wed, Aug 5, 2015 at 2:13 PM, David L. Willson <
>> dlwillson at sofree.us > wrote:
>
>> > BCC: LPIC-1 Study Group
>> 
>
>> > "Born On Date"
>> 
>
>> > Sometimes it's useful to know when this server was "born", when it
>> > was built. Usually, you also want to know who built it, so you know
>> > who to question or kick, but that's a topic for another day.
>> 
>
>> > The root filesystem was usually created on the same day, so that is
>> > the date I use. To get that date, if your root filesystem is
>> > ext2/3/4, run dumpe2fs and look for 'created'.
>> 
>
>> > Here's an example:
>> 
>
>> > [dwills003c at wdv-logecoll nagios]$ sudo df -hT /
>> 
>> > Filesystem Type Size Used Avail Use% Mounted on
>> 
>> > /dev/sdi6 ext3 70G 32G 35G 48% /
>> 
>> > [dwills003c at wdv-logecoll nagios]$ sudo /sbin/dumpe2fs /dev/sdi6 |
>> > grep -iC 3 created
>> 
>> > dumpe2fs 1.39 (29-May-2006)
>> 
>> > Fragments per group: 32768
>> 
>> > Inodes per group: 32736
>> 
>> > Inode blocks per group: 1023
>> 
>> > Filesystem created: Tue Jan 25 06:44:25 2011
>> 
>> > Last mount time: Fri Jul 31 09:02:54 2015
>> 
>> > Last write time: Fri Jul 31 09:02:54 2015
>> 
>> > Mount count: 10
>> 
>
>> > Now, Fedora Server 22 and Enterprise Linux 7 have moved to xfs. How
>> > do you get the same information from it? I don't know... yet.
>> 
>> > _______________________________________________
>> 
>> > SFS mailing list
>> 
>> > SFS at thegeek.nu
>> 
>> > http://mailman.thegeek.nu/mailman/listinfo/sfs
>>
>_______________________________________________
>clue mailing list: clue at cluedenver.org
>For information, account preferences, or to unsubscribe see:
>http://cluedenver.org/mailman/listinfo/clue

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20150805/a63b9f80/attachment.html