FreeBSD timestamps

balanga · Friday at 6:07 AM

Does a FreeBSD system retain any timestamps which would show when the system was installed, updated or booted?

CShell · Friday at 6:23 AM

Yes - for "when booted" you can use uptime(1):

Code:

shell$ uptime
10:00AM  up 27 mins, 2 users, load averages: 0.48, 0.48, 0.36
shell$

Edited: It's also built into the who(1) command as well:

Code:

shell$ who -b
                 system boot  Dec 12 10:00
shell$

balanga · Friday at 7:18 AM

I can get the time of booting using stat /var/run/dmesg.boot and somehow decipher the fourth parameter (birth time).

or better still sysctl kern.boottime, thanks to ChatGPT, although I'm not sure what the value provided is. ie is it epoch time, or how long the sytem has been running?

SirDice · Friday at 8:53 AM

Did you know you can use the -d parameter to get a description of a sysctl(8)?

Code:

       -d	    Print  the	description  of	 the  variable	instead	of its
		    value.

Code:

# sysctl -d kern.boottime
kern.boottime: Estimated system boottime

Code:

# sysctl kern.boottime
kern.boottime: { sec = 1765358752, usec = 167805 } Wed Dec 10 10:25:52 2025

I rebooted this system last Wednesday.

T-Daemon · Friday at 9:42 AM

balanga said:
Does a FreeBSD system retain any timestamps which would show when the system was installed

The install time can be viewed on ZFS inspecting zpool-history(8)

Rich (BB code):

# zpool history  | grep 'zpool create"
2022-01-18.16:44:19 zpool create -o altroot=/mnt -O compress=lz4 -O atime=off -m none -f zroot nvd0p3.eli

Or from /var/log/bsdinstall_log (ZFS and UFS) when installed menu-guided (not manually).

Rich (BB code):

% stat  bsdinstall_log
13020405558614810491 2 -rw-r--r-- 1 root wheel 0 88672 "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" 89088 25 0x800 bsdinstall_log

Highlighted is the files "st_birthtime" ( stat(1) )

Argentum · Friday at 12:13 PM

balanga said:
Does a FreeBSD system retain any timestamps which would show when the system was installed, updated or booted?

To see when the system was installed, you can just ls -l /boot/kernel/kernel.

sko · Friday at 12:40 PM

Argentum said:
To see when the system was installed, you can just ls -l /boot/kernel/kernel.

only if you never updated your system/kernel...

Same goes for the ZFS pool creation time - if you transferred the datasets to a new pool, restored it from backus or in any other way moved the installation to another pool, the creation time isn't the same as the initial installation date... This is rather unusual, but not entirely impossible: I have 2 systems I migrated from pools that were created back when the ashift defaulted to 9. When moving the OS to nvme drives I created a new pool (with ashift=12) and zfs send|recv'd all datasets over.

The more accurate date shoud therefore be the the 'creation' property of the zroot/ROOT dataset; but I guess one can come up with another scenario where this also no longer matches the initial installation date... (anyone here moved an existing installation from UFS to ZFS by hand?)

cracauer@ · Friday at 1:11 PM

I determine the age of a system by the oldest file in /etc

ls -ltr /etc

sko · Friday at 1:26 PM

cracauer@ said:
I determine the age of a system by the oldest file in /etc

ls -ltr /etc

There seems to be some deviation from the actual date:

Code:

% ls -ltr /etc | head
total 1033
drwxr-xr-x  2 root wheel        2 Oct 23  2020 rc.conf.d/
drwxr-xr-x  6 root wheel        6 Oct 23  2020 periodic/
-rw-rw-r--  1 root operator     0 Oct 23  2020 dumpdates
-rw-r--r--  1 root wheel      106 Oct 23  2020 mail.rc
lrwxr-xr-x  1 root wheel       14 Oct 23  2020 unbound@ -> ../var/unbound
lrwxr-xr-x  1 root wheel       23 Oct 23  2020 termcap@ -> /usr/share/misc/termcap
lrwxr-xr-x  1 root wheel       15 Oct 23  2020 rmt@ -> ../usr/sbin/rmt
lrwxr-xr-x  1 root wheel       21 Oct 23  2020 os-release@ -> ../var/run/os-release
lrwxr-xr-x  1 root wheel       12 Oct 23  2020 aliases@ -> mail/aliases
-r--r--r--  1 root wheel     2309 Jun 15  2021 localtime
drwxr-xr-x  2 root wheel        2 Jun 15  2021 authpf/
-rw-r--r--  1 root wheel       37 Jun 15  2021 hostid
-rw-r--r--  1 root wheel       46 Jun 15  2021 host.conf
-rw-------  1 root wheel        0 Jun 15  2021 opiekeys

This system was actually set up in 2021:

Code:

% zfs get -H creation zroot/ROOT
zroot/ROOT    creation    Tue Jun 15  2:07 2021    -

I guess some of those file dates are from when the installer image (or more precisely: the base.txz tarball) was built?
The 'hostid' file might be the best indicator; but this might have been re-generated at some point...

And it gets completely nonsensical for /boot thanks to shitty msdosfs timestamps

Code:

% ls -ltr /boot | head
total 12519
drwxr-xr-x  1 root wheel  16384 Jan  1  1980 efi/
drwxr-xr-x  2 root wheel      3 Jun 15  2021 zfs/
drwxr-xr-x  2 root wheel      2 Jun 15  2021 loader.conf.d/
drwxr-xr-x  2 root wheel      2 Jun 15  2021 uboot/
-r--r--r--  1 root wheel    512 Sep 20  2022 boot1
-r--r--r--  1 root wheel    512 Sep 20  2022 mbr
-r--r--r--  1 root wheel   1185 Apr 11  2023 cdboot
-r--r--r--  1 root wheel  13653 Apr 11  2023 loader.help.bios
-r--r--r--  1 root wheel  13653 Apr 11  2023 loader.help.efi

but the directory dates on /boot/ seem to all match the install date... (again: unless you moved them around at some point)

Argentum · Friday at 1:36 PM

cracauer@ said:
I determine the age of a system by the oldest file in /etc

ls -ltr /etc

I think we should first define the meaning of the "age of the system". In my case, I do not know how old my desktop system actually is. Have cloned it several times from previous ZFS pools and upgraded many times from source. So - how old this system actually is? My storage pool is much younger than the oldest file in /etc, but kernel is latest 14.3.

Kai Burghardt · Friday at 1:37 PM

balanga said:
Does a FreeBSD system retain any timestamps which would show when the system was installed […]?

Thread 17849 asked for “Original Install Date”, but there is no answer to that.

Thread 87266, “Date of a FreeBSD installation”, received answers and explains some details.

Of course for machines dedicated to a certain purpose (e. g. “file server”) you keep a written document recording details about its hardware, configuration, and installation date among other things.

It’s easier to record information when it’s available rather than asking the question “how do I find out XYZ” afterwards.

balanga said:
Does a FreeBSD system retain any timestamps which would show when the system was […] updated […]?

You mean freebsd-update(8), right? Not pkg-update(8), hardware (driver) updates (the BIOS) or something else.

T-Daemon said:
The install time can be viewed on ZFS inspecting zpool-history(8)

Or simply refer to the root data set’s creation property, no grep(1)ping necessary (shouldn’t head(1) be sufficient anyway?).

If you use boot environments, how about:

Bash:

bectl list # On a running system.

balanga said:
Does a FreeBSD system retain any timestamps which would show when the system was […] booted?

Thread 72291, “How can I know the boot date/time of my FreeBSD system?”
Thread 89484, “List of dates when FreeBSD was started/shut down”
For remote machines you can set up rwhod(8) for ruptime(1)

cracauer@ · Friday at 1:42 PM

Yeah, if the install was cloned or made from an elderly install medium then /etc won't work well.

fmc000 · Friday at 1:43 PM

T-Daemon said:
The install time can be viewed on ZFS inspecting zpool-history(8)

Rich (BB code):

# zpool history | grep 'zpool create" 2022-01-18.16:44:19 zpool create -o altroot=/mnt -O compress=lz4 -O atime=off -m none -f zroot nvd0p3.eli

Or from /var/log/bsdinstall_log (ZFS and UFS) when installed menu-guided (not manually).

Rich (BB code):

% stat bsdinstall_log 13020405558614810491 2 -rw-r--r-- 1 root wheel 0 88672 "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" "Jan 18 16:46:08 2022" 89088 25 0x800 bsdinstall_log

Highlighted is the files "st_birthtime" ( stat(1) )

These two methods in my case give different results than cracauer@ method, which agrees with what fastfetch gives.

Code:

[14:24][fmc000@dabrafenib ~]$ doas zpool history  | grep 'zpool create'
2024-06-24.14:57:32 zpool create -o altroot=/mnt -O compress=lz4 -O atime=off -m none -f zroot nda0p4.eli
[14:24][fmc000@dabrafenib ~]$

[14:24][fmc000@dabrafenib ~]$ stat /var/log/bsdinstall_log
4604768845265284562 128 -rw-r--r-- 1 root wheel 0 140899 "Jun 24 15:06:47 2024" "Jun 24 15:06:47 2024" "Jun 24 15:06:47 2024" "Jun 24 15:06:47 2024" 131072 57 0x800 /var/log/bsdinstall_log
[14:25][fmc000@dabrafenib ~]$

[14:37][root@dabrafenib ~]$ zfs get creation zroot
NAME   PROPERTY  VALUE                  SOURCE
zroot  creation  Mon Jun 24 14:57 2024  -
[14:37][root@dabrafenib ~]$

==========================================================================

[14:25][fmc000@dabrafenib ~]$ ls -ltd /etc/*|tail -3
drwxr-xr-x  2 root wheel        2 May 31  2024 /etc/profile.d
drwxr-xr-x  2 root wheel        2 May 31  2024 /etc/rc.conf.d
drwxr-xr-x  2 root wheel        2 May 31  2024 /etc/sysctl.kld.d
[14:25][fmc000@dabrafenib ~]$

[14:25][fmc000@dabrafenib ~]$ fastfetch|grep -i installed
                                    Installed Date: 2024-05-31 11:39:59
[14:26][fmc000@dabrafenib ~]$

fastfetch seems to get its information from the zpool:

Code:

        {
            "type": "disk",
            "folders": "/",
            "format": "{create-time}",
            "key": "Installed Date",
        },

but I cannot see where it gets this information.

Edit: please disregard the /etc part of this post, the answer came in when I was writing it, sorry about that.

FreeBSD timestamps

Administrator