Determining the exact date when a Red Hat Enterprise Linux (RHEL) 10 system was installed or initially configured is not always straightforward. There is no single command that definitively states “this system was installed on X date.” However, RHEL leaves behind strong forensic indicators during installation that can be used to confidently determine the timeframe.

In this blog post, we will walk through two of the most reliable and audit-friendly methods to confirm when a RHEL 10 system was initially configured.

• Method 1: Reviewing Anaconda Installation Logs
• Method 2: Checking the RPM Database Initialization Date
• Recommended Approach
• Final Thoughts

Method 1: Reviewing Anaconda Installation Logs

RHEL systems are installed using the Anaconda installer, which generates logs and configuration artifacts during the installation process. These files are created at install time and rarely modified afterward, making them a strong indicator of the system’s initial configuration date.

Key files and directories to review include:

• /root/anaconda-ks.cfg – The Kickstart file generated at install time (even for manual installs)
• /var/log/anaconda/ – Directory containing detailed installer logs

To inspect the timestamps, run the following commands:

sudo ls -lah /root/anaconda-ks.cfg

sudo ls -lah /var/log/anaconda/

The creation or modification timestamps on these files typically align very closely with the date the operating system was installed. When documenting findings, the earliest timestamp in this set is usually the most meaningful.

Why this works well:

• These files are generated only during installation
• They are not touched during normal patching or upgrades
• They are commonly accepted as evidence in audits and change reviews

Method 2: Checking the RPM Database Initialization Date

Another highly reliable method is to examine the creation (birth) timestamp of the RPM database. The RPM database is initialized as part of the OS installation process and represents the moment package management was first set up on the system.

To retrieve this information, run:

sudo stat /var/lib/rpm

Look for the Birth timestamp in the output. For example:

Birth: 2025-11-02 14:25:03

This timestamp typically corresponds to the installation date of the operating system. It is a strong indicator unless the RPM database was manually rebuilt, which is uncommon in most environments.

Why this works well:

• The RPM database is created during initial OS installation
• It remains stable throughout the life of the system
• The birth timestamp is precise and easy to document

Recommended Approach

For the strongest and most defensible conclusion, it is best to correlate both methods together. When both the Anaconda logs and the RPM database show matching or closely aligned timestamps, you can confidently state the system’s installation window.

Final Thoughts

While RHEL 10 does not expose a single authoritative installation date, these two methods provide a practical and reliable solution. They are simple to execute, easy to verify, and widely accepted in enterprise Linux environments.

Keeping this technique in your operational toolkit can save time during audits, troubleshooting, and infrastructure reviews.