[clue] [SFS] When was this server "born"?

Wed Aug 5 21:39:08 MDT 2015

We started at tune2fs. I was saying that one doesn't work in Fedora 22 or Enterprise Linux 7 because they're defaulting to xfs and Mike and I can't figure out how to get the create date on it.

thatSent from my Verizon Wireless 4G LTE smartphone

-------- Original message --------
From: Christopher Cross <g1ccross at gmail.com> 
Date: 08/05/2015  8:23 PM  (GMT-07:00) 
To: CLUE's mailing list <clue at cluedenver.org>, "David L. Willson" <DLWillson at thegeek.nu> 
Cc: "David L. Willson" <dlwillson at sofree.us> 
Subject: Re: [clue] [SFS] When was this server "born"? 

/root/anaconda.ks would be my go to also. This is also good on Fedora. 

Another option may be to check the file system creation date with tune2fs if it is an ext fs. 
tune2fs -l /dev/mapper/${filesystem} | grep created
On Wed, 5 Aug 2015 at 17:24 Dan <danduncan at gmail.com> wrote:
If it's a Redhat or Centos system there should be a /root/anaconda.ks file with the same timestamp.

On August 5, 2015 4:36:44 PM MDT, "David L. Willson" <DLWillson at TheGeek.NU> wrote:CLUE: What is your strategy for determining a server's "born on" date?

---

 WRT the keys idea: On my Fedora 21 box, there weren't any ssh keys
 until I started the ssh daemon, so no dice.

 ----- Original Message -----

 From: "Mike Shoup" <mike at shouptech.com>

 Near as I can tell, XFS doesn't store that information:

 ~
 [mike at voyager]$ sudo xfs_info /
 meta-data=/dev/mapper/centos_voyager-root isize=256 agcount=4,
 agsize=1147392 blks
 = sectsz=512 attr=2, projid32bit=1
 = crc=0 finobt=0
 data = bsize=4096 blocks=4589568, imaxpct=25
 = sunit=0 swidth=0 blks
 naming =version 2 bsize=4096 ascii-ci=0 ftype=0
 log =internal bsize=4096 blocks=2560, version=2
 = sectsz=512 sunit=0 blks, lazy-count=1
 realtime =none extsz=4096 blocks=0, rtextents=0

 ___

 You could probably look at the ctime of a unique file for each
 machine, that gets created at install time. What about the host's
 SSH key? I 
 don't
think most places change those very often.

 ~
 [mike at voyager]$ stat /etc/ssh/ssh_host_rsa_key
 File: ‘/etc/ssh/ssh_host_rsa_key’
 Size: 1675 Blocks: 8 IO Block: 4096 regular file
 Device: fd00h/64768d Inode: 416880 Links: 1
 Access: (0640/-rw-r-----) Uid: ( 0/ root) Gid: ( 999/ssh_keys)
 Access: 2015-08-05 12:48:27.021065883 -0600
 Modify: 2015-04-26 20:05:46.378871265 -0600
 Change: 2015-04-26 20:05:46.457871265 -0600
 Birth: -

 --

 Mike

 On Wed, Aug 5, 2015 at 2:13 PM, David L. Willson <
 dlwillson at sofree.us > wrote:

 BCC: LPIC-1 Study Group

 "Born On Date"

 Sometimes it's useful to know when this server was "born", when it
 was built. Usually, you also want to know who built it, so you know
 who to question or kick, but that's a topic for another day.

 The root filesystem was usually created on the same day, so that is
 the date I use. To get that date, if your root filesystem is
 ext2/3/4, run dumpe2fs and look for 'created'.

 Here's an
example:

 [dwills003c at wdv-logecoll nagios]$ sudo df -hT /

 Filesystem Type Size Used Avail Use% Mounted on

 /dev/sdi6 ext3 70G 32G 35G 48% /

 [dwills003c at wdv-logecoll nagios]$ sudo /sbin/dumpe2fs /dev/sdi6 |
 grep -iC 3 created

 dumpe2fs 1.39 (29-May-2006)

 Fragments per group: 32768

 Inodes per group: 32736

 Inode blocks per group: 1023

 Filesystem created: Tue Jan 25 06:44:25 2011

 Last mount
  time:
Fri Jul 31 09:02:54 2015

 Last write time: Fri Jul 31 09:02:54 2015

 Mount count: 10

 Now, Fedora Server 22 and Enterprise Linux 7 have moved to xfs. How
 do you get the same information from it? I don't know... yet.

 SFS mailing list

 SFS at thegeek.nu

 http://mailman.thegeek.nu/mailman/listinfo/sfs

clue mailing list: clue at cluedenver.org
For information, account preferences, or to unsubscribe see:
http://cluedenver.org/mailman/listinfo/clue

-- 

Sent from my Android device with K-9 Mail. Please excuse my brevity._______________________________________________

clue mailing list: clue at cluedenver.org

For information, account preferences, or to unsubscribe see:

http://cluedenver.org/mailman/listinfo/clue
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20150805/01541e42/attachment.html 