1

Find out when a Specific Kernel Version was last booted

For those who manually install kernel versions the /boot can grow large over time. I'd like find which kernel versions haven't been booted in a long time as candidates for removal.

File last accessed time

To facilitate this project I would need to know when each kernel was last booted. I saw a Q&A for finding files older than a certain date using the atime. However this Q&A went searching for files older than x days. I'm looking for all files and wanting to know the last access time.

Via bash script how would one determine a given file's last access time?

Edit 1 - Must set Kernel Version's last access time during boot

When grub mounts the kernel it is in ro (read-only) mode and the last access time is not updated.

If you run update-initramfs -u -k all the file initrd.img the last access time is updated for all kernels even though they haven't been booted today.

When installing a new kernel the all previous kernel version files system.map-w.x.yy-zzz last access time is updated even though they haven't been booted today.

To correctly record when a kernel version was REALLY booted we need to touch the file vmlinuz-w.x.yy-zzz. Using sudo powers create a file like this in /etc/cron.d/:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@reboot   root    touch "/boot/vmlinuz-"`uname -r`

Now when listing files in /boot using muru's answer:

find /boot/vm* -printf "%Ac %p\n"

Thu 21 Jul 2016 05:02:48 AM MDT /boot/vmlinuz-3.13.0-92-generic
Wed 26 Oct 2016 05:10:08 PM MDT /boot/vmlinuz-3.2.0-113-generic
Sat 15 Oct 2016 10:45:41 AM MDT /boot/vmlinuz-4.4.0-43-generic
Thu 20 Oct 2016 06:09:00 PM MDT /boot/vmlinuz-4.4.0-45-generic
Sat 06 Aug 2016 09:32:02 PM MDT /boot/vmlinuz-4.6.3-040603-generic
Sun 21 Aug 2016 12:59:04 PM MDT /boot/vmlinuz-4.7.1-040701-generic
Fri 26 Aug 2016 04:51:04 AM MDT /boot/vmlinuz-4.7.2-040702-generic
Thu 08 Sep 2016 06:46:52 PM MDT /boot/vmlinuz-4.7.3-040703-generic
Sun 25 Sep 2016 07:25:46 PM MDT /boot/vmlinuz-4.7.5-040705-generic
Sat 08 Oct 2016 03:08:45 PM MDT /boot/vmlinuz-4.8.1-040801-generic
Sat 22 Oct 2016 08:16:44 AM MDT /boot/vmlinuz-4.8.4-040804-generic
Sun 30 Oct 2016 12:56:12 PM MDT /boot/vmlinuz-4.8.5-040805-generic

Check Free Space before installing new Kernel Version

Before installing a new kernel it's a good idea to check how much space is available in /boot and/or how much is already being used with these commands:

rick@dell:~$ df /boot
Filesystem     1K-blocks     Used Available Use% Mounted on
/dev/sdc3       30106300 20449376   8104556  72% /
────────────────────────────────────────────────────────────────
rick@dell:~$ du /boot --max-depth 0 -h
565M    /boot

To see how much space will be saved by deleting a specific previous kernel use this command:

rick@dell:~$ du /boot/*4.8.1* -h
1.4M    /boot/abi-4.8.1-040801-generic
204K    /boot/config-4.8.1-040801-generic
44M /boot/initrd.img-4.8.1-040801-generic
3.6M    /boot/System.map-4.8.1-040801-generic
4.8M    /boot/vmlinuz-4.8.1-040801-generic
2
  • Add a bootup script to get the kernel version currently running, log it to a file, and use that file for access time data? Oct 25, 2016 at 23:32
  • echo "$(date) $(uname -srv)" >> ~/.kernellog.txt Oct 25, 2016 at 23:32

2 Answers 2

2

Use the stat command:

   %x     time of last access, human-readable
   %X     time of last access, seconds since Epoch

So:

stat -c %X /some/file

Or with find:

find /some/path -printf "%A@ %p\n"

Since for find's -printf:

  %a     File's  last  access time in the format returned by the C
         `ctime' function.

  %Ak    File's last access time in the  format  specified  by  k,
         which  is  either `@' or a directive for the C `strftime'
         function.  The possible values for k  are  listed  below;
         some  of  them might not be available on all systems, due
         to differences in `strftime' between systems.

         @      seconds  since  Jan.  1,  1970,  00:00  GMT,  with
                fractional part.
12
  • Haha who knew?... well obviously muru the guru! Thank you very much :) Well except for the fact you're creeping up on me for points totals for week now :D Anyway just tried stat -c %x /boot/vmlinuz-4* and it works like a charm. However for programming I should use Epoch but what does that mean? Oct 26, 2016 at 2:11
  • @WinEunuuchs2Unix Epoch is the Unix Epoch. So you get a number of seconds since Jan 1, 1970. It's easier to compare when you have a plain number without any date formatting.
    – muru
    Oct 26, 2016 at 2:15
  • definitely easier for programming. How can I find out today's Epoch? Or should I just click your link? (Interesting only 1.4 GB of seconds since 1970 who knew???) Oct 26, 2016 at 2:20
  • @WinEunuuchs2Unix now would be date +%s
    – muru
    Oct 26, 2016 at 2:22
  • TYVM... I have my weekend project lined up now. Oct 26, 2016 at 2:22
0

I have accepted muru's answer as it correctly shows how to find a file's last access time. However when grub mounts the kernel it is in ro read-only mode so the last access time is not updated.

Furthermore when you run update-initramfs -u -k all the file initrd.img is updated with current time for all kernels even though it hasn't been booted today.

When installing a new kernel the all kernel files system.map-w.x.yy-zzz are accessed even though it hasn't been booted today.

To correctly record when a kernel was last booted using sudo powers create a file like this in /etc/cron.d/:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@reboot   root    touch "/boot/vmlinuz-"`uname -r`

Now when listing files in /boot using muru's answer vmlinuz-x.w.yy-zzz will display when that kernel was last booted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .