3

I have been using tune2fs to determine the age of my Linux distribution installations but without knowing the time zone the date in it is less useful. The exact command I am using is from here, here it is just for the sake of clarity:

sudo tune2fs -l /dev/sda3 | grep created | sed 's/.*created\:\s*//g'

but the output is of the form:

Fri Jun 23 23:59:22 2017

Note how there is no time zone mentioned. But date returns output of the form:

Sun Jul 23 17:58:18 AEST 2017

Notice how the time zone AEST is mentioned. I have read the man page of tune2fs. I have searched for "date", "created", "time" in it using my Web browser's find utility and I haven't found a single mention of the time zone of the date format, or if there is a way to manually set it. I have run DuckDuckGo searches for "tune2fs date" and "tune2fs timezone" and I looked at the top five results and couldn't find anything relevant in them.

Josh Pinto
  • 3,483
  • 15
  • 52
  • 87

2 Answers2

4

The time is stored as a Unix epoch time (see s_mkfs_time in the superblock), not as a calendar date, so it's timezone independent.

When displaying it, tune2fs converts it to a calendar/human date to give you a representation meaningful to you, in your time zone.

To get the time in UTC, run it with:

TZ=UTC0 LC_ALL=C tune2fs -l /dev/sda3 |
  sed -n 's/^Filesystem created: *//p'

That is telling tune2fs that your timezone is UTC (with 0 offset from UTC).

I've added LC_ALL=C to make sure the Filesystem created is returned in English and the date is still displayed in the US-English style regardless of the locale of the user (in case e2fsprogs are internationalised in the future).

Since the S_mkfs_time is at offset 0x108 in the superblock and the superblock starts at offset 0x400 within the block device, you can also retrieve that epoch time by hand:

od -vAn -j 0x508 -N4 < /dev/sda3

And convert it in the format you like:

$ date --iso-8601=s -d "@$(od -An -j0x508 -N4 -tu4 < /some/device)"
2017-07-23T12:20:22+01:00
$ date -u --iso-8601=s -d "@$(od -An -j0x508 -N4 -tu4 < /some/device)"
2017-07-23T11:20:22+00:00
Stéphane Chazelas
  • 522,931
  • 91
  • 1,010
  • 1,501
2

The date seems to be displayed in the local system time zone at the time it was created.

e.g. my /boot partition is ext4 on raid-1 (/dev/md0), created when I replaced my boot drives with 4 SSDs and converted to root on ZFS last year. I kept a /boot ext4 partition in case of emergency.

# tune2fs -l /dev/md0 | sed -n -e 's/.*created\:\s*//gp'
Sat Oct  8 16:38:45 2016

# TZ=UTC tune2fs -l /dev/md0 | sed -n -e 's/.*created\:\s*//gp'
Sat Oct  8 05:38:45 2016

I'm also on the east coast of Australia (Melbourne), and the difference between 16:38 and 05:38 is 11 hours, which is correct for AEDT (daylight savings starts in October for those states which observe it)

BTW, it's almost never necessary to pipe the output of grep into either sed or awk. both can already do regexp pattern matches. an awk example might look like this:

# tune2fs -l /dev/md0 | awk -F': +' '/created/ {print $2}'
Sat Oct  8 16:38:45 2016
cas
  • 1
  • 7
  • 119
  • 185