<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: times new roman,new york,times,serif; font-size: 12pt; color: #000000'>I think the problem can be solved with a high degree of confidence by checking multiple things, looking for a tight grouping in a majority of the things, and then taking the minimum or average of the group.<br><br> * date of first entry in last: last | tail -n 1<br> * root filesystem create date: tune2fs (root-dev) | grep -i create<br> * mdate of system build config: stat /root/kickstart.ks<br> * mdate of system ssh keys: stat /etc/sshd/(some-key)<br> * mdate of mount entries directory: /etc/fstab.d/<br><br>Clones do screw it up, though. They screw up UUID's, too. What does "born on" or "unique" mean to a clone?<br><br><div><span name="x"></span>--<br>David L. Willson<br>Teacher, Engineer, Evangelist<br>RHCE+Satellite CCAH Network+ A+ Linux+ LPIC-1 UbuntuCP NovellCLA<br>Mobile 720-333-LANS(5267)<br>http://sofree.us<br><br>This is a good time for a r3VOLution.<span name="x"></span><br></div><br><hr id="zwchr"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr">I agree with David that I've never really cared about that, but looking at the fielsystem itself seems like decent thing to check if you have to forensically figure it out for some reason. However! That information is useless if you are looking at VMs created from images. The creation time on the filesystem will be from when that image was created, not when the VM was instantiated.<div><br></div><div>I did some poking around on my Ubuntu servers for similar thing, and the most reliable thing I've found so far is the creation date of "/etc/fstab.d". It's populated at installation (and then again at VM instnatiation) and is really unlikely to be touched after that in most cases, but even that isn't real reliable.</div><div><br></div><div>QH</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 6, 2015 at 10:05 AM, David L. Anselmi <span dir="ltr"><<a href="mailto:anselmi@anselmi.us" target="_blank">anselmi@anselmi.us</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">David L. Willson wrote:<br>
> CLUE: What is your strategy for determining a server's "born on" date?<br>
<br>
</span>Can't say I've ever cared about that. But the strategies so far seem susceptible to inadvertent<br>
changes. Seems like this is info you'd keep in your configuration database. If you don't have one<br>
then I'd suggest putting a file on the server to record that info.<br>
<br>
Dave<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
clue mailing list: <a href="mailto:clue@cluedenver.org" target="_blank">clue@cluedenver.org</a><br>
For information, account preferences, or to unsubscribe see:<br>
<a href="http://cluedenver.org/mailman/listinfo/clue" rel="noreferrer" target="_blank">http://cluedenver.org/mailman/listinfo/clue</a><br>
</div></div></blockquote></div><br></div>
<br>_______________________________________________<br>clue mailing list: clue@cluedenver.org<br>For information, account preferences, or to unsubscribe see:<br>http://cluedenver.org/mailman/listinfo/clue</blockquote><br></div></body></html>