[clue] [SFS] When was this server "born"?

[David L. Willson]

I think the problem can be solved with a high degree of confidence by checking multiple things, looking for a tight grouping in a majority of the things, and then taking the minimum or average of the group. 

* date of first entry in last: last | tail -n 1 
* root filesystem create date: tune2fs (root-dev) | grep -i create 
* mdate of system build config: stat /root/kickstart.ks 
* mdate of system ssh keys: stat /etc/sshd/(some-key) 
* mdate of mount entries directory: /etc/fstab.d/ 

Clones do screw it up, though. They screw up UUID's, too. What does "born on" or "unique" mean to a clone? 

-- 
David L. Willson 
Teacher, Engineer, Evangelist 
RHCE+Satellite CCAH Network+ A+ Linux+ LPIC-1 UbuntuCP NovellCLA 
Mobile 720-333-LANS(5267) 
http://sofree.us 

This is a good time for a r3VOLution. 

----- Original Message -----

> I agree with David that I've never really cared about that, but
> looking at the fielsystem itself seems like decent thing to check if
> you have to forensically figure it out for some reason. However!
> That information is useless if you are looking at VMs created from
> images. The creation time on the filesystem will be from when that
> image was created, not when the VM was instantiated.

> I did some poking around on my Ubuntu servers for similar thing, and
> the most reliable thing I've found so far is the creation date of
> "/etc/fstab.d". It's populated at installation (and then again at VM
> instnatiation) and is really unlikely to be touched after that in
> most cases, but even that isn't real reliable.

> QH

> On Thu, Aug 6, 2015 at 10:05 AM, David L. Anselmi <
> anselmi at anselmi.us > wrote:

> > David L. Willson wrote:
> 
> > > CLUE: What is your strategy for determining a server's "born on"
> > > date?
> 

> > Can't say I've ever cared about that. But the strategies so far
> > seem
> > susceptible to inadvertent
> 
> > changes. Seems like this is info you'd keep in your configuration
> > database. If you don't have one
> 
> > then I'd suggest putting a file on the server to record that info.
> 

> > Dave
> 

> > _______________________________________________
> 
> > clue mailing list: clue at cluedenver.org
> 
> > For information, account preferences, or to unsubscribe see:
> 
> > http://cluedenver.org/mailman/listinfo/clue
> 

> _______________________________________________
> clue mailing list: clue at cluedenver.org
> For information, account preferences, or to unsubscribe see:
> http://cluedenver.org/mailman/listinfo/clue
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://cluedenver.org/pipermail/clue/attachments/20150806/eea09fc8/attachment.html