1. Introduction
Knowing how long a Linux system has been around can help with different diagnostics. For example, there is often a direct link between age and the number of risk factors, much like in humans. Separately, it’s a sort of identifier for the machine.
In this article, we look at ways to define the age of a Linux system. We start by defining what a Linux system is. After that, we discover methods to check how old a hardware component is. Next, we focus on storage, exploring partition and filesystem age. Finally, file dates are discussed as a means to date a Linux system.
We tested the code in this tutorial on Debian 11 (Bullseye) with GNU Bash 5.1.4. It should work in most POSIX-compliant environments.
2. Linux System
To understand the age of something, we must be able to define it. Basically, our definition of a Linux system is any hardware and software combination, which runs a Linux distribution.
Note that we do include the hardware, as it can be a decisive factor for performance and faults. For example, if we have an old hard disk, no amount of reinstalling can prevent data issues due to bad blocks.
Furthermore, software isn’t limited to the operating system. Just installing it and leaving the system alone wouldn’t result in “aging”. It’s more akin to freezing food instead of cooking and eating it.
Finally, all components mentioned can have different ages. Considering that, we’ll uncover how to separately check how old each one is. Combinations of these methods may produce better results than each one alone.
3. Hardware Age
Hardware components often have production dates or serial numbers physically attached to them, including:
- assembly sticker on the hull of the computer
- manufacturer sticker on the component itself
- printed or punched timestamps
- date codes on electronic components
Importantly, serial numbers can directly contain a manufacture date. They sometimes also lead to one via an online reference.
Of course, we can try to get a serial number from a component’s controller with a tool like lsblk (List Block Devices):
$ lsblk --nodeps --output name,serial
NAME SERIAL
sda 6a8430a1006660002099d400666f71fa
sdb
In this example, we use storage components. Notice that the second drive doesn’t seem to have a serial number. In fact, it does, but consumer-grade storage controllers often omit it for simplicity. This omission is less likely for a motherboard, which we can list via dmidecode as root:
# dmidecode --type 2
# dmidecode 3.2
Getting SMBIOS data from sysfs.
SMBIOS 2.7 present.
Handle 0x0200, DMI type 2, 9 bytes
Base Board Information
Manufacturer: Dell Inc.
Product Name: 01W066
Version: A02
Serial Number: ..QQ06660430D1D0.
Asset Tag: Not Specified
Using the –type (-t) flag with an argument of 2, only motherboards are listed, but there are many other component types available.
Any component is useless without a command mechanism. For instance, storage has controllers, while operating systems have users. What links them are drivers, which allow us to use and format our system.
4. Partitions and Filesystems
Let’s look at the top-level organization of storage and explore ways to extract dates from that.
4.1. Partitions
Basically, partition tables split mediums into separate containers. Since we must have at least one partition in Linux, creating and formatting it are the first storage actions when installing.
Although at one point MBR did, neither MBR nor GPT contain a timestamp in current systems.
We still have options, though.
4.2. Filesystems
To use a partition, we often need to format it with a filesystem. Formatting leaves a trace, which we can follow via tune2fs:
$ df --output=source / | tail --lines=1
/dev/sda1
$ tune2fs -l /dev/sda1 | perl -nwe 'print if /Filesystem created/;'
Filesystem created: Mon Jun 06 00:06:56 2022
Note that we’re only interested in the active partition of our current operating system. To locate it, we use df on /. After that, we extract information from its block device.
Due to restrictions in tune2fs, this method works only for native Linux ext* filesystems. Importantly, we can:
- apply a new filesystem to an old partition
- install Linux on an old filesystem, without formatting
Because of these possible discrepancies, we can turn to other methods of age identification. While not directly linked, we can often infer how old a system is based on files.
5. File Dates
Data is the main delta between “then” and “now” during a system’s life. Considering this, we can use the date information of the oldest file on a medium:
$ find -type f -printf '%C+ %p\n' | sort | head --lines=1
2006-06-06+00:06:56.0000000000 ./host.conf
First, we use find to print all file paths in the current and below directories. The -printf flag allows us to prefix with a modification date, but not creation date. After this, we sort the list and get the first entry in the result.
Of course, there are multiple issues with this approach. Let’s discuss some of them and provide workarounds.
5.1. Old System File
Even the Linux kernel alone contains thousands of files. Indeed, many of them have not been touched for a long time. Libraries and other system files can have timestamps dating years before a given installation was created.
To avoid old files, we could use a path that gets created during the install process:
# stat /var/log/installer/syslog
File: /var/log/installer/syslog
Size: 401666 Blocks: 791 IO Block: 4096 regular file
Device: 801h/2049d Inode: 6660 Links: 1
Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2022-01-01 00:06:56.000666137 +0200
Modify: 2013-12-01 10:47:05.168579010 +0200
Change: 2013-12-01 10:47:05.176579010 +0200
In this example, we use stat to check the Debian installer log’s last modification date. Since the file is a log, accessible only by root, we can be fairly certain that it wasn’t changed for any other reason.
This may not be the case for all files.
5.2. Tampered Files
Even if we decide to check an “active” path like /etc, we should be careful. For example, configurations are often long and complex, which prompts copying and templating.
This can lead to time anomalies in certain scenarios:
# scp -p user@remote:/etc/hosts /etc/hosts
[...]
In fact, the -p (preserve) flag of scp (Secure Copy) remote transfer tool preserves all original file timestamps. This makes them useless in terms of our needs.
6. Summary
In this article, we explored many ways of checking how old a Linux system is. From hardware, through partitions and filesystems, all the way to single files.
In conclusion, if we are careful with our method and file choice, we can lower the chance of false dates coming up for a given system’s birthday.