1

Find out when a Specific Kernel Version was last booted

For those who manually install kernel versions the /boot can grow large over time. I'd like find which kernel versions haven't been booted in a long time as candidates for removal.

File last accessed time

To facilitate this project I would need to know when each kernel was last booted. I saw a Q&A for finding files older than a certain date using the atime. However this Q&A went searching for files older than x days. I'm looking for all files and wanting to know the last access time.

Via bash script how would one determine a given file's last access time?

Edit 1 - Must set Kernel Version's last access time during boot

When grub mounts the kernel it is in ro (read-only) mode and the last access time is not updated.

If you run update-initramfs -u -k all the file initrd.img the last access time is updated for all kernels even though they haven't been booted today.

When installing a new kernel the all previous kernel version files system.map-w.x.yy-zzz last access time is updated even though they haven't been booted today.

To correctly record when a kernel version was REALLY booted we need to touch the file vmlinuz-w.x.yy-zzz. Using sudo powers create a file like this in /etc/cron.d/:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@reboot   root    touch "/boot/vmlinuz-"`uname -r`

Now when listing files in /boot using muru's answer:

find /boot/vm* -printf "%Ac %p\n"

Thu 21 Jul 2016 05:02:48 AM MDT /boot/vmlinuz-3.13.0-92-generic
Wed 26 Oct 2016 05:10:08 PM MDT /boot/vmlinuz-3.2.0-113-generic
Sat 15 Oct 2016 10:45:41 AM MDT /boot/vmlinuz-4.4.0-43-generic
Thu 20 Oct 2016 06:09:00 PM MDT /boot/vmlinuz-4.4.0-45-generic
Sat 06 Aug 2016 09:32:02 PM MDT /boot/vmlinuz-4.6.3-040603-generic
Sun 21 Aug 2016 12:59:04 PM MDT /boot/vmlinuz-4.7.1-040701-generic
Fri 26 Aug 2016 04:51:04 AM MDT /boot/vmlinuz-4.7.2-040702-generic
Thu 08 Sep 2016 06:46:52 PM MDT /boot/vmlinuz-4.7.3-040703-generic
Sun 25 Sep 2016 07:25:46 PM MDT /boot/vmlinuz-4.7.5-040705-generic
Sat 08 Oct 2016 03:08:45 PM MDT /boot/vmlinuz-4.8.1-040801-generic
Sat 22 Oct 2016 08:16:44 AM MDT /boot/vmlinuz-4.8.4-040804-generic
Sun 30 Oct 2016 12:56:12 PM MDT /boot/vmlinuz-4.8.5-040805-generic

Check Free Space before installing new Kernel Version

Before installing a new kernel it's a good idea to check how much space is available in /boot and/or how much is already being used with these commands:

rick@dell:~$ df /boot
Filesystem     1K-blocks     Used Available Use% Mounted on
/dev/sdc3       30106300 20449376   8104556  72% /
────────────────────────────────────────────────────────────────
rick@dell:~$ du /boot --max-depth 0 -h
565M    /boot

To see how much space will be saved by deleting a specific previous kernel use this command:

rick@dell:~$ du /boot/*4.8.1* -h
1.4M    /boot/abi-4.8.1-040801-generic
204K    /boot/config-4.8.1-040801-generic
44M /boot/initrd.img-4.8.1-040801-generic
3.6M    /boot/System.map-4.8.1-040801-generic
4.8M    /boot/vmlinuz-4.8.1-040801-generic
WinEunuuchs2Unix
  • 102,282

2 Answers2

2

Use the stat command:

   %x     time of last access, human-readable
   %X     time of last access, seconds since Epoch

So:

stat -c %X /some/file

Or with find:

find /some/path -printf "%A@ %p\n"

Since for find's -printf:

  %a     File's  last  access time in the format returned by the C
         `ctime' function.

  %Ak    File's last access time in the  format  specified  by  k,
         which  is  either `@' or a directive for the C `strftime'
         function.  The possible values for k  are  listed  below;
         some  of  them might not be available on all systems, due
         to differences in `strftime' between systems.

         @      seconds  since  Jan.  1,  1970,  00:00  GMT,  with
                fractional part.
muru
  • 197,895
  • 55
  • 485
  • 740
  • Haha who knew?... well obviously muru the guru! Thank you very much :) Well except for the fact you're creeping up on me for points totals for week now :D Anyway just tried stat -c %x /boot/vmlinuz-4* and it works like a charm. However for programming I should use Epoch but what does that mean? – WinEunuuchs2Unix Oct 26 '16 at 02:11
  • @WinEunuuchs2Unix Epoch is the Unix Epoch. So you get a number of seconds since Jan 1, 1970. It's easier to compare when you have a plain number without any date formatting. – muru Oct 26 '16 at 02:15
  • definitely easier for programming. How can I find out today's Epoch? Or should I just click your link? (Interesting only 1.4 GB of seconds since 1970 who knew???) – WinEunuuchs2Unix Oct 26 '16 at 02:20
  • @WinEunuuchs2Unix now would be date +%s – muru Oct 26 '16 at 02:22
  • TYVM... I have my weekend project lined up now. – WinEunuuchs2Unix Oct 26 '16 at 02:22
  • The find method in the answer generates a wall of text as each file from printf isn't separated by new line/carriage return. – WinEunuuchs2Unix Oct 29 '16 at 13:57
  • @WinEunuuchs2Unix fixed – muru Oct 29 '16 at 13:58
  • Looks great thanks. I need to explore it some more because besides /boot it's listing recursively and including /boot/grub and then /boot/grub/i386-pc. Also it isn't sorting by name. I don't want you to waste time though, I'll learn about the find command on my own time. Learning something everyday and loving the power of Linux. – WinEunuuchs2Unix Oct 29 '16 at 14:07
  • @WinEunuuchs2Unix find never sorts by name. Your best bet is to pass it to sort and use / as sort's field separator – muru Oct 29 '16 at 14:18
  • I was wrong about the sorting it seems just fine as show in: http://askubuntu.com/questions/843197/what-are-kernel-version-number-components-w-x-yy-zzz-called because 3.2 kernel was added last but shows up sorted ok. Also using /boot/vm* solves the /boot/grub... recurssive listing problem. So all is good - thanks again. – WinEunuuchs2Unix Oct 29 '16 at 14:56
  • @WinEunuuchs2Unix don't rely on find's sorting – muru Oct 29 '16 at 15:02
  • Let us continue this discussion in chat. – WinEunuuchs2Unix Oct 29 '16 at 15:11
0

I have accepted muru's answer as it correctly shows how to find a file's last access time. However when grub mounts the kernel it is in ro read-only mode so the last access time is not updated.

Furthermore when you run update-initramfs -u -k all the file initrd.img is updated with current time for all kernels even though it hasn't been booted today.

When installing a new kernel the all kernel files system.map-w.x.yy-zzz are accessed even though it hasn't been booted today.

To correctly record when a kernel was last booted using sudo powers create a file like this in /etc/cron.d/:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@reboot   root    touch "/boot/vmlinuz-"`uname -r`

Now when listing files in /boot using muru's answer vmlinuz-x.w.yy-zzz will display when that kernel was last booted.

WinEunuuchs2Unix
  • 102,282