Neat, thanks for pointing out dumpe2fs(8). At least for ext2/3 file
systems it can be used to determine the install date.
Ed
On Jan 4, 2008 1:54 PM, Jan Macek <[EMAIL PROTECTED]> wrote:
> Hi,
>
> in some cases you can get an idea from dumpe2fs -h
> which includes:
>
> Filesystem created:
Hi,
in some cases you can get an idea from dumpe2fs -h
which includes:
Filesystem created: Fri Dec 7 14:19:28 2007
jan
On Tue, Dec 25, 2007 at 08:30:48AM +0800, Eduardo Tongson wrote:
> Not dismissing it. TCT is useful for forensic, for example a server
> compromise. Yes I used it before
Not dismissing it. TCT is useful for forensic, for example a server
compromise. Yes I used it before but took a better deeper look at
mactime this time. I thought it could get the created timestamp for
files.
I think an accurate way to get the install date is by getting the
creation timestamp of t
25Dec2007 (UTC +8)
On 12/24/07, Eduardo Tongson <[EMAIL PROTECTED]> wrote:
> Took a peek. TCT mactime can not be used to determine the install
> date. mactime uses lstat(2) which in turn relies on inode timestamps.
> Inode timestamps only has one field each for modified, accessed,
> changed so it
Took a peek. TCT mactime can not be used to determine the install
date. mactime uses lstat(2) which in turn relies on inode timestamps.
Inode timestamps only has one field each for modified, accessed,
changed so it can only record the last update.
I think the MAC letters are confusing. C can be mi
24Dec2007 (UTC +8)
On 12/10/07, Federico Sevilla III <[EMAIL PROTECTED]> wrote:
> On Mon, 2007-12-10 at 20:01 +0800, Drexx Laggui [personal] wrote:
> >
> > On 12/10/07, jan gestre <[EMAIL PROTECTED]> wrote:
> > > I'm just after the install date.
> >
> > 'cat /proc/version' will give you the same o
On Dec 15, 2007 7:31 PM, Kelsey Hartigan Go
<[EMAIL PROTECTED]> wrote:
> Centos is like RedHat therefore check the time stamp of /etc/issue or
> /etc/motd.
/etc/issues is provided by centos-release and it gets updated when
centos-release is updated while /etc/motd, just like any rpm files,
has wha
Centos is like RedHat therefore check the time stamp of /etc/issue or
/etc/motd.
However, you should know that the date may be inaccurate if the installer
did not set the time and date correctly when he/she installed the operating
system.
On 12/11/07, Winelfred G. Pasamba <[EMAIL PROTECTED]> wro
hehe, not everyone compiles his/her own kernel during install.
On Dec 10, 2007 8:16 PM, Federico Sevilla III <[EMAIL PROTECTED]> wrote:
> On Mon, 2007-12-10 at 20:01 +0800, Drexx Laggui [personal] wrote:
> > 10Dec2007 (UTC +8)
> >
> > On 12/10/07, jan gestre <[EMAIL PROTECTED]> wrote:
> > > I'm ju
you can try to check the kickstat.cfg file on your /root. Usually this file
is generated during install. unless the file was updated of course :)
On Dec 11, 2007 8:54 AM, jan gestre <[EMAIL PROTECTED]> wrote:
>
>
> On Dec 10, 2007 8:01 PM, Drexx Laggui [personal] <[EMAIL PROTECTED]> wrote:
>
> >
On Dec 10, 2007 8:01 PM, Drexx Laggui [personal] <[EMAIL PROTECTED]> wrote:
> 10Dec2007 (UTC +8)
>
>
> 'cat /proc/version' will give you the same output as "uname -a". The
> installation date is shown there.
>
>
> If I will base on this, all of the servers will have the same install date
> August
On CentOS 4.x, you can refer to the date of install.log that anaconda
writes in /root. But that is assuming that the files are still the
original ones.
On Dec 8, 2007 2:33 PM, jan gestre <[EMAIL PROTECTED]> wrote:
>
>
>
> On Dec 8, 2007 11:53 AM, Eduardo Tongson <[EMAIL PROTECTED]> wrote:
> >
> >
feb 22, 2005 is my guess.
'ls -lt' sorts by date&time.
i realized it is hard to guess the install dates from the directory
entries if you modify your installation excessively, hehe.
another way is to look at the warranty stickers, hehe
On Dec 10, 2007 6:38 PM, jan gestre <[EMAIL PROTECTED]> wro
Getting the oldest time stamp from directories/files is inaccurate.
You have to consider preserved time stamps.
And cat /proc/version or uname -a reflects the date/time when the
kernel was compiled which is of course can not be relied on to get the
install date.
On Dec 10, 2007 8:01 PM, Drexx Lag
On Mon, 2007-12-10 at 20:01 +0800, Drexx Laggui [personal] wrote:
> 10Dec2007 (UTC +8)
>
> On 12/10/07, jan gestre <[EMAIL PROTECTED]> wrote:
> > I'm just after the install date.
>
> 'cat /proc/version' will give you the same output as "uname -a". The
> installation date is shown there.
Caveat:
10Dec2007 (UTC +8)
On 12/10/07, jan gestre <[EMAIL PROTECTED]> wrote:
> I'm just after the install date.
'cat /proc/version' will give you the same output as "uname -a". The
installation date is shown there.
Drexx Laggui -- CISA, CISSP, CFE Associate, CCSI, CSA
http://www.laggui.com ( Singapo
On Dec 10, 2007 5:34 PM, Winelfred G. Pasamba <[EMAIL PROTECTED]>
wrote:
> what do you mean by "period of time server in deployment"? were there
> times the server wasn't in deployment?
>
> or is it just the install date that you're after? aren't the most
> popular dates in 'ls -l /' the install d
what do you mean by "period of time server in deployment"? were there
times the server wasn't in deployment?
or is it just the install date that you're after? aren't the most
popular dates in 'ls -l /' the install date?
On Dec 7, 2007 11:01 PM, jan gestre <[EMAIL PROTECTED]> wrote:
> Hi All,
>
>
On Dec 8, 2007 11:53 AM, Eduardo Tongson <[EMAIL PROTECTED]> wrote:
> Hello Jan,
>
> Getting this information is probably bound to be distribution
> specific. For example, in one of my Gentoo Linux installs I can
> accurately get the installation data and time from the top line of
> /var/log/emerg
Hello Jan,
Getting this information is probably bound to be distribution
specific. For example, in one of my Gentoo Linux installs I can
accurately get the installation data and time from the top line of
/var/log/emerge.log <1194875898: Started emerge on: Nov 12, 2007
13:58:18>. Of course that is
Hi All,
Just want to know how to determine the period of time a Linux server has
been in deployment from the installation date to current date. The install
log is not accurate because it says July 26, 2007. or it's changing every
time a new a application is installed? I can't find any info from go
21 matches
Mail list logo
