One mechanism I often use is to check the change time (ctime) on files within the root home directory. Since the /root home directory is created at install time, and is often seldom used, this can provide a relatively good approximation. As clarified by Kyle in the comments, since ctime refers to the inode, and not the data, modifying the file contents will not change the ctime.
By default, the ls command prints the modification time (mtime) of the file. So if substitute in the ctime option like so,
ls -alct /root
This will print all files, display the create time, and sort by time.
As an example, here is a sample of the 3 oldest files in the /root directory from one of my systems.
ls -alt install.log.syslog .cshrc .tcshrc
-rw-r--r--. 1 root 10238 Feb 18 2010 install.log.syslog
-rw-r--r--. 1 root 129 Dec 3 2004 .tcshrc
-rw-r--r--. 1 root 100 Sep 22 2004 .cshrc
And then by checking the change time
ls -alct install.log.syslog .cshrc .tcshrc
-rw-r--r--. 1 root 100 Feb 18 2010 .cshrc
-rw-r--r--. 1 root 10238 Feb 18 2010 install.log.syslog
-rw-r--r--. 1 root 129 Feb 18 2010 .tcshrc
The date Feb 18th of 2010 certainly tracks with the approximate time I would have first installed that system.
Checking the hardware would be a good bet, if you have access to it. You could inspect the system and/or hardware components to get a good idea of when it was assembled.
Alternately, if you can gain access to the BIOS screen there's often date info there that can be used to determine how old a machine is.
If you can gain access to the SMART info on the hard drive (smartctl -a /dev/sda) there might be something there to go on. I don't see a specific timestamp in SMART but there is at least an hours of usage counter. That would provide a lower bound on how old the machine is (since if the hard drive has been running for 100 hours, the system can't be younger than 100 hours).
As for filesystem checks, you could look at the date info for /lost+found - that directory was created when the filesystem was created. The date on it should agree with the tunefs info from the previous answer.
With RedHat and derivatives, it's pretty easy to get a general idea of the OS version/vintage through a combination of file age and other system files. I'll usually check the /root/anaconda-ks.cfg file, as it contains the initial server setup and package parameters. Sometimes uname -a will have good information about the kernel build date. There would also be a cluster of files with the same date in /etc; typically the rcx.d links, rc scripts, inittab, etc.
On an openSUSE system I checked the creation (aka birth) date of /var/log/wtmp will not be reset on rotation. It gets created on the first boot after installation. Thus it is likely to to show a time from shortly after the first boot started:
Not all file systems support creation date, see https://unix.stackexchange.com/a/91200 . It is not the same as ctime (here c for change) from GNU ls. Even if this information exists and can be read, there might have been reasons the date was reset, e.g. human intervention.
The simplest way would probably be (presuming sda1 is your /root/):
This should show you the date on which the file system was created. Confirmed to work on ext2 to ext4, not sure about other file systems!
One mechanism I often use is to check the change time (ctime) on files within the root home directory. Since the
/root
home directory is created at install time, and is often seldom used, this can provide a relatively good approximation. As clarified by Kyle in the comments, since ctime refers to the inode, and not the data, modifying the file contents will not change the ctime.By default, the
ls
command prints the modification time (mtime) of the file. So if substitute in the ctime option like so,This will print all files, display the create time, and sort by time.
As an example, here is a sample of the 3 oldest files in the
/root
directory from one of my systems.And then by checking the change time
The date Feb 18th of 2010 certainly tracks with the approximate time I would have first installed that system.
try
the keys are generated when you install the os.
Checking the hardware would be a good bet, if you have access to it. You could inspect the system and/or hardware components to get a good idea of when it was assembled.
Alternately, if you can gain access to the BIOS screen there's often date info there that can be used to determine how old a machine is.
If you can gain access to the SMART info on the hard drive (
smartctl -a /dev/sda
) there might be something there to go on. I don't see a specific timestamp in SMART but there is at least an hours of usage counter. That would provide a lower bound on how old the machine is (since if the hard drive has been running for 100 hours, the system can't be younger than 100 hours).As for filesystem checks, you could look at the date info for
/lost+found
- that directory was created when the filesystem was created. The date on it should agree with the tunefs info from the previous answer.With RedHat and derivatives, it's pretty easy to get a general idea of the OS version/vintage through a combination of file age and other system files. I'll usually check the
/root/anaconda-ks.cfg
file, as it contains the initial server setup and package parameters. Sometimesuname -a
will have good information about the kernel build date. There would also be a cluster of files with the same date in/etc
; typically the rcx.d links, rc scripts, inittab, etc.This also works for Red Hat systems:
On an openSUSE system I checked the creation (aka birth) date of /var/log/wtmp will not be reset on rotation. It gets created on the first boot after installation. Thus it is likely to to show a time from shortly after the first boot started:
Not all file systems support creation date, see https://unix.stackexchange.com/a/91200 . It is not the same as ctime (here c for change) from GNU ls. Even if this information exists and can be read, there might have been reasons the date was reset, e.g. human intervention.