[clue] [SFS] When was this server "born"?

[Christopher Cross]

/root/anaconda.ks would be my go to also. This is also good on Fedora.

Another option may be to check the file system creation date with tune2fs
if it is an ext fs.

tune2fs -l /dev/mapper/${filesystem} | grep created

On Wed, 5 Aug 2015 at 17:24 Dan <danduncan at gmail.com> wrote:

> If it's a Redhat or Centos system there should be a /root/anaconda.ks file
> with the same timestamp.
>
> On August 5, 2015 4:36:44 PM MDT, "David L. Willson" <DLWillson at TheGeek.NU>
> wrote:
>
>> CLUE: What is your strategy for determining a server's "born on" date?
>>
>> ---
>>
>>  WRT the keys idea: On my Fedora 21 box, there weren't any ssh keys
>>>  until I started the ssh daemon, so no dice.
>>>
>>
>>  ----- Original Message -----
>>>
>>
>>  From: "Mike Shoup" <mike at shouptech.com>
>>>
>>
>>  Near as I can tell, XFS doesn't store that information:
>>>
>>
>>  ~
>>>  [mike at voyager]$ sudo xfs_info /
>>>  meta-data=/dev/mapper/centos_voyager-root isize=256 agcount=4,
>>>  agsize=1147392 blks
>>>  = sectsz=512 attr=2, projid32bit=1
>>>  = crc=0 finobt=0
>>>  data = bsize=4096 blocks=4589568, imaxpct=25
>>>  = sunit=0 swidth=0 blks
>>>  naming =version 2 bsize=4096 ascii-ci=0 ftype=0
>>>  log =internal bsize=4096 blocks=2560, version=2
>>>  = sectsz=512 sunit=0 blks, lazy-count=1
>>>  realtime =none extsz=4096 blocks=0, rtextents=0
>>>
>>
>>  ___
>>>
>>
>>  You could probably look at the ctime of a unique file for each
>>>  machine, that gets created at install time. What about the host's
>>>  SSH key? I
>>>  don't
>>> think most places change those very often.
>>>
>>
>>  ~
>>>  [mike at voyager]$ stat /etc/ssh/ssh_host_rsa_key
>>>  File: ‘/etc/ssh/ssh_host_rsa_key’
>>>  Size: 1675 Blocks: 8 IO Block: 4096 regular file
>>>  Device: fd00h/64768d Inode: 416880 Links: 1
>>>  Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 999/ssh_keys)
>>>  Access: 2015-08-05 12:48:27.021065883 -0600
>>>  Modify: 2015-04-26 20:05:46.378871265 -0600
>>>  Change: 2015-04-26 20:05:46.457871265 -0600
>>>  Birth: -
>>>
>>
>>  --
>>>
>>
>>  Mike
>>>
>>
>>  On Wed, Aug 5, 2015 at 2:13 PM, David L. Willson <
>>>  dlwillson at sofree.us > wrote:
>>>
>>
>>  BCC: LPIC-1 Study Group
>>>>
>>>
>>>
>>  "Born On Date"
>>>>
>>>
>>>
>>  Sometimes it's useful to know when this server was "born", when it
>>>>  was built. Usually, you also want to know who built it, so you know
>>>>  who to question or kick, but that's a topic for another day.
>>>>
>>>
>>>
>>  The root filesystem was usually created on the same day, so that is
>>>>  the date I use. To get that date, if your root filesystem is
>>>>  ext2/3/4, run dumpe2fs and look for 'created'.
>>>>
>>>
>>>
>>  Here's an
>>>> example:
>>>>
>>>
>>>
>>  [dwills003c at wdv-logecoll nagios]$ sudo df -hT /
>>>>
>>>
>>>  Filesystem Type Size Used Avail Use% Mounted on
>>>>
>>>
>>>  /dev/sdi6 ext3 70G 32G 35G 48% /
>>>>
>>>
>>>  [dwills003c at wdv-logecoll nagios]$ sudo /sbin/dumpe2fs /dev/sdi6 |
>>>>  grep -iC 3 created
>>>>
>>>
>>>  dumpe2fs 1.39 (29-May-2006)
>>>>
>>>
>>>  Fragments per group: 32768
>>>>
>>>
>>>  Inodes per group: 32736
>>>>
>>>
>>>  Inode blocks per group: 1023
>>>>
>>>
>>>  Filesystem created: Tue Jan 25 06:44:25 2011
>>>>
>>>
>>>  Last mount
>>>>   time:
>>>> Fri Jul 31 09:02:54 2015
>>>>
>>>
>>>  Last write time: Fri Jul 31 09:02:54 2015
>>>>
>>>
>>>  Mount count: 10
>>>>
>>>
>>>
>>  Now, Fedora Server 22 and Enterprise Linux 7 have moved to xfs. How
>>>>  do you get the same information from it? I don't know... yet.
>>>>
>>>
>>> ------------------------------
>>>>
>>>>
>>>  SFS mailing list
>>>
>>>
>>>  SFS at thegeek.nu
>>>>
>>>
>>>  http://mailman.thegeek.nu/mailman/listinfo/sfs
>>>>
>>>
>>> ------------------------------
>>
>> clue mailing list: clue at cluedenver.org
>> For information, account preferences, or to unsubscribe see:
>> http://cluedenver.org/mailman/listinfo/clue
>>
>>
> --
> Sent from my Android device with K-9 Mail. Please excuse my brevity.
> _______________________________________________
> clue mailing list: clue at cluedenver.org
> For information, account preferences, or to unsubscribe see:
> http://cluedenver.org/mailman/listinfo/clue
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20150806/eb36398f/attachment-0001.html