166

is there a command which will output the date that ubuntu (or any distribution) was installed?

Improve this question
0

11 Answers 11

Reset to default
149

You can check the installer logs and dates at:

/var/log/installer

A quick way to find the date through the command line would be by running:

ls -lt /var/log/installer

That lists in reverse chronological order so the oldest file is at the bottom of the list.

Improve this answer
12
  • 2
    This file isn't on my Lucid system.
    – richq
    Aug 7, 2010 at 20:31
  • On my system, I have 7 files under /var/log/installer/ . I installed from 9.10, and later updated to 10.04.
    – Stefan Lasiewski
    Aug 10, 2010 at 0:34
  • I do also have this folder on my (freshly installed) 10.04 system and the creation dates of those files give me the install date. The file /var/log/installer/media-info for example contains the information about the installation media that was used for the install.
    – Marcel Stimberg
    Aug 10, 2010 at 12:29
  • 1
    On my system that was installed originally with 7.10, /var/log/installer/version has a date of 2007-10-30, so this seems to be quite reliable...
    – JanC
    Oct 21, 2010 at 3:02
  • 13
    A pastable answer might be ls -ld /var/log/installer.
    – Justin Force
    May 29, 2012 at 21:45
95

If you use ext2/ext3/ext4 and formatted the disk when you installed you can do this nifty trick.

sudo dumpe2fs /dev/sda1 | grep 'Filesystem created:'

You might have to change the /dev/sda1 to reflect your setup.

Example output

Filesystem created: Fri Oct 14 22:40:09 2022

Relying on the date of files, even the "creation time" (mtime) can give errors since upgrading packages might have replaced the file and made a new "creation time".

Similar tools and info might be available on other file systems as well, but I don't know of them.

Improve this answer
8
  • When I do this I get the error dumpe2fs: Bad magic number in super-block while trying to open /dev/sda1
    – king_julien
    Apr 2, 2014 at 20:28
  • @king_julien Are you sure that your /dev/sda1 is your systems root partition? It may be different on your install, in fact the filesystem type may be an other than what is supported by dumpe2fs!
    – LassePoulsen
    Apr 2, 2014 at 21:36
  • Thanks, I got it now. It was /dev/sda2. On /dev/sda1 I have /boot/efi.
    – king_julien
    Apr 3, 2014 at 18:36
  • 5
    You can use a more general but a little complicated command: sudo dumpe2fs $(mount | grep 'on / ' | awk '{print $1}') | grep 'Filesystem created:'
    – Aram Paronikyan
    Jun 8, 2016 at 12:10
  • 2
    You could use the -h option so you at least only get the superblock info which should be more than enough.
    – Alexis Wilke
    Sep 25, 2016 at 21:43
20

the only command that worked for me is - 

sudo ls -alct /|tail -1|awk '{print $6, $7, $8}'
Improve this answer
5
  • 2
    In my system, and I believe in everyone's, this is the creation date of /lost+found
    – MestreLion
    May 12, 2022 at 9:39
  • Wow that's an smart workaround @MestreLion (for non-boot disks too).
    – Sridhar Sarnobat
    Nov 1, 2022 at 23:38
  • 1
    @SridharSarnobat, credit for the cleverness goes to the answer, not to myself: that command prints the creation date of the oldest file/dir entry in the root directory. I simply stated that this is most likely /lost+found. Just notice this is for EXT4 filesystems: non-boot/root disks might be FAT/NTFS and thus have something else as the oldest entry.
    – MestreLion
    Nov 4, 2022 at 21:53
  • ls -ldsr /media/*/*/lost+found for the impatient
    – Sridhar Sarnobat
    Nov 9, 2022 at 21:06
  • Unfortunately even this answer may be misleading, for cloud services. They may have an image they created beforehand.
    – j riv
    Nov 22, 2022 at 10:25
4

If the installation is recent, look at the oldest entries under /var/log, but after a few weeks the logs will have been rotated away.

Another thing to look at is the oldest ctime of a file on the root filesystem; but if the whole installation has been copied (e.g. rescued off a failing disk) at the directory tree level, this gives you the date of the copy.

If a heuristic is good enough, look at the date (mtime) of a file that was created during the installation and is unlikely to have been modified since. A good candidate is /etc/hostname; other candidates are /etc/hosts, /etc/papersize, /etc/popularity-contest.conf.

Improve this answer
3

I also don't know of a specific command or file. I'm using some heuristics to find the installation date:

for dir in {/etc,/usr,/lib}; do
  sudo find $dir -type f -exec stat -c %z {} \; | \
    sed -e 's,-,,g' -e 's, .*,,' | sort | uniq -c | sort -nr -k 2 | \ 
    grep -Ev " [0-9]?[0-9] "
done

This small script looks for files in /etc and /usr and prints out the last changed date. It does some reformatting and lists the occurrences sorted by date (newest first). Usually the oldest entry is the installation date.

This assumes that after an installation are left unchanged. This is in most cases (according to my observation) true, but in special cases it can also give wrong results.

Improve this answer
1
  • 1
    tried it on /etc only (faster), the date was the same as from the dumpe2fs solution, so for me it worked well!
    – eik3
    Feb 28, 2014 at 15:52
1

The command sudo grep ubiquity /var/log/installer/syslog | less worked for me very well.

Improve this answer
1

For my Linux Mint system the following worked:

    sudo grep 'RTC time' /var/log/installer/syslog

The problem was my syslog didn't show years in the time stamps.

Improve this answer
0

I don't think there is.

On Red Hat / CentOS there is the install.log files that is generated when you install the system, but this doesn't exist on Ubuntu.

Assuming your logs go back far enough ( mine do ) you can determine the date the base installation was done in /var/log/dpkg.log*

For example on my system the first two lines of my oldest dpkg.log file (dpkg.log.4.gz) are

2010-04-19 11:40:55 startup archives install
2010-04-19 11:40:55 install base-files <none> 5.0.0ubuntu18

So I installed this system on 19/04/2010 at 11:40:55. That is correct for this system.

There was also a brainstorm idea to add this born date.

Improve this answer
4
  • Thank-you andol, thank-you Richard. /var/log/dpkg.log.1 on a lucid desktop system gave a correct answer where as /var/log/dpkg.log was the only file on a lucid server setup I have, so a little detective work was needed. Some further understanding of the log files will be helpful.
    – lxtips
    Aug 6, 2010 at 7:05
  • The default setup of logrotate discards dpkg logs older than one year.
    – LassePoulsen
    Aug 10, 2010 at 12:13
  • @Source Lab : Yup. My answer is not foolproof. I did not know about the /var/log/installer directory but do now. That is a better solution.
    – Richard Holloway
    Aug 10, 2010 at 17:20
  • I still think that the filesystem creation time is the best pointer se here
    – LassePoulsen
    Aug 10, 2010 at 17:31
0

would it be simple (i may be wrong) just to check software centre, while in there click on 'history' and scroll down to the bottom of your installed updates. Mine shows april 23 2012 first installation. Which is about right when I started using ubuntu?

Improve this answer
0

You can type this :

$ \ls -lact --full-time / | awk 'END {print $6,substr($7,1,8)}'
2021-09-08 18:15:47

Or if you have ext2/3/4 filesystem on the / partition, you can type this :

$ sudo tune2fs -l $(findmnt -n -o source -T /) | awk '/created:/{$1=$2="";print substr($0,3)}'
Wed Sep 8 18:15:47 2021

Or if the directory /var/log/installer still exists :

$ \ls -lact --full-time /var/log/installer | awk 'END {print $6,substr($7,1,8)}'
2020-12-27 14:38:45
Improve this answer
0

Unfortunately most answers can be misleading for cloud services because they often have an image they created beforehand.

In that case the best bet might be delving inside /var/log files and finding evidence of your own earliest boots.

Logs themselves may be from the image so you might need logs or file/dir creation dates unique to you.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.