Find out exact installation time of CentOS

tune2fs

You can use the command tune2fs to find out when the filesystem was created.

$ tune2fs -l /dev/main/partition |grep  'Filesystem created'

Example

$ sudo tune2fs -l /dev/dm-1 |grep  'Filesystem created'
Filesystem created:       Sat Dec  7 20:42:03 2013

which disk to use?

If you don't have /dev/dm-1 you can use the command blkid to determine your HDD topology.

$ blkid
/dev/sda1: UUID="XXXX" TYPE="ext4" 
/dev/sda2: UUID="XXXX" TYPE="LVM2_member" 
/dev/mapper/fedora_greeneggs-swap: UUID="XXXX" TYPE="swap" 
/dev/mapper/fedora_greeneggs-root: UUID="XXXX" TYPE="ext4" 
/dev/mapper/fedora_greeneggs-home: UUID="XXXX" TYPE="ext4" 

You can also find out what filesystem a directory is coming from using the df -h . command.

$ df -h .
Filesystem                         Size  Used Avail Use% Mounted on
/dev/mapper/fedora_greeneggs-root   50G  9.3G   38G  20% /

From kickstart .cfg file

You can also look at the date this file was created, assuming it wasn't deleted.

$ sudo  ls -lah ~root/anaconda-ks.cfg
-rw-------. 1 root root 1.3K Dec  7 21:10 /root/anaconda-ks.cfg

From RPM

Another method would be to find out when the package setup was installed. This package is rarely updated, only from version of version of distro, so it should be fairly safe to query it in this manner.

Example

$  rpm -qi setup | grep Install
Install Date: Sat 07 Dec 2013 08:46:32 PM EST

Another package that has similar qualities to setup is basesystem.

$ rpm -qi basesystem | grep Install
Install Date: Sat 07 Dec 2013 08:46:47 PM EST

Lastly you could just take the full list of installed packages and get the last few to see what their install dates were.

$ rpm -qa --last | tail 
nhn-nanum-fonts-common-3.020-8.fc19.noarch    Sat 07 Dec 2013 08:46:47 PM EST
basesystem-10.0-8.fc19.noarch                 Sat 07 Dec 2013 08:46:47 PM EST
m17n-db-1.6.4-2.fc19.noarch                   Sat 07 Dec 2013 08:46:46 PM EST
gnome-user-docs-3.8.2-1.fc19.noarch           Sat 07 Dec 2013 08:46:45 PM EST
foomatic-db-filesystem-4.0-38.20130604.fc19.noarch Sat 07 Dec 2013 08:46:45 PM EST
mozilla-filesystem-1.9-9.fc19.x86_64          Sat 07 Dec 2013 08:46:35 PM EST
dejavu-fonts-common-2.33-5.fc19.noarch        Sat 07 Dec 2013 08:46:34 PM EST
telepathy-filesystem-0.0.2-5.fc19.noarch      Sat 07 Dec 2013 08:46:33 PM EST
setup-2.8.71-1.fc19.noarch                    Sat 07 Dec 2013 08:46:32 PM EST
fontpackages-filesystem-1.44-7.fc19.noarch    Sat 07 Dec 2013 08:46:31 PM EST

I assume during the installation you have formatted your file system?

If that's the case you can use the tune2fs utility to see the creation date that's stored in the super block of your root file system.

Assumed your root file system is /dev/sda3 you could do do this:

tune2fs -l /dev/sda3

In the output there should be a field called Filesystem created like here:

Filesystem created:       Wed Oct 31 15:30:21 2012

Method

RPM

via command rpm -qi basesystem, in CentOS 6.10, its output is

#rpm -qi basesystem
Name        : basesystem                   Relocations: (not relocatable)
Version     : 10.0                              Vendor: CentOS
Release     : 4.el6                         Build Date: Wed 10 Nov 2010 05:12:57 PM PST
Install Date: Fri 01 Jun 2018 05:06:56 PM PDT      Build Host: c5b2.bsys.dev.centos.org
Group       : System Environment/Base       Source RPM: basesystem-10.0-4.el6.src.rpm
Size        : 0                                License: Public Domain
Signature   : RSA/8, Sat 02 Jul 2011 09:00:48 PM PDT, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
Summary     : The skeleton package which defines a simple Red Hat Enterprise Linux system
Description :
Basesystem defines the components of a basic Red Hat Enterprise Linux
system (for example, the package installation order to use during
bootstrapping). Basesystem should be in every installation of a system,
and it should never be removed.

extraction command

rpm -qi basesystem 2> /dev/null | sed -r -n '/^Install Date[[:space:]]*:/{s@[[:space:]]{2,}.*$@@g;s@^[^:]+:[[:space:]]*(.*)$@\1@g;p}'

output

Fri 01 Jun 2018 05:06:56 PM PDT

/etc/

via file create time under dir /etc/

extraction command

ls -lact --full-time /etc/ | awk 'END {print $6,$7,$8}'

• -l use a long listing format
• -a, --all do not ignore entries starting with .
• -c with -lt: sort by, and show, ctime (time of last modification of file status information) with -l: show ctime and sort by name otherwise: sort by ctime
• -t sort by modification time
• --full-time like -l --time-style=full-iso

output

2018-06-01 17:06:54.101999993 -0700

Addition

If you wanna format date, you may consider use command date

#echo 'Fri 01 Jun 2018 05:06:56 PM PDT' | date +'%F %T %z %Z' -f -
2018-06-01 17:06:56 -0700 PDT

#echo '2018-06-01 17:06:54.101999993 -0700' | date +'%F %T %z %Z' -f -
2018-06-01 17:06:54 -0700 PDT