[clue] [SFS] When was this server "born"?

[Quentin Hartman]

I agree with David that I've never really cared about that, but looking at
the fielsystem itself seems like decent thing to check if you have to
forensically figure it out for some reason. However! That information is
useless if you are looking at VMs created from images. The creation time on
the filesystem will be from when that image was created, not when the VM
was instantiated.

I did some poking around on my Ubuntu servers for similar thing, and the
most reliable thing I've found so far is the creation date of
"/etc/fstab.d". It's populated at installation (and then again at VM
instnatiation) and is really unlikely to be touched after that in most
cases, but even that isn't real reliable.

QH

On Thu, Aug 6, 2015 at 10:05 AM, David L. Anselmi <anselmi at anselmi.us>
wrote:

> David L. Willson wrote:
> > CLUE: What is your strategy for determining a server's "born on" date?
>
> Can't say I've ever cared about that.  But the strategies so far seem
> susceptible to inadvertent
> changes.  Seems like this is info you'd keep in your configuration
> database.  If you don't have one
> then I'd suggest putting a file on the server to record that info.
>
> Dave
> _______________________________________________
> clue mailing list: clue at cluedenver.org
> For information, account preferences, or to unsubscribe see:
> http://cluedenver.org/mailman/listinfo/clue
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20150806/63df95c3/attachment-0001.html