One of my favorite distribution-agnostic tricks is to check the inode change time of files or directories which are extremely unlikely to ever have been altered over the life of the server. These are generally directories in the root directory, such as /lost+found
.
For example, this Ubuntu 10.04 LTS system was indeed installed around 9:40 pm on February 1, 2011.
# ls -lctr / | head -n 5
total 88
drwxr-xr-x 2 root root 4096 2011-02-01 21:40 selinux
drwxr-xr-x 2 root root 4096 2011-02-01 21:40 opt
drwxr-xr-x 2 root root 4096 2011-02-01 21:40 mnt
drwxr-xr-x 2 root root 4096 2011-02-01 21:40 media
And finally, a sure fire answer which is reasonably sure to be accurate, if you have an ext* root filesystem. Look at the filesystem metadata, which contains the time the filesystem was created. For instance, this command shows the creation time for the filesystem mounted at /
.
tune2fs -l $(grep " / " /proc/mounts | grep -v rootfs | cut -f 1 -d " ") | grep created