0

I have a small webspace (PHP + MySQL). Nothing special.

I can read /proc/uptime using PHP and it returns:

51967189.77 1731371689.58

So the uptime is 601 days (51967189 / 60 / 60 / 24).

I have also listed the files in the /dev folder. On the left there is the creation time (d.m.Y).

17.03.2023 .
17.03.2023 ..
17.03.2023 full
28.07.2021 log
17.03.2023 null
17.03.2023 random
17.03.2023 tty
17.03.2023 urandom
17.03.2023 zero

Other folders like /bin /sbin /var /lib64 also have 17.03.2023 as creation time.

Because these files and folders are created on boot it means the uptime is only 5 days.

So I have 601 days vs. 5 days.

How can it be /proc/uptime does not match creation time of files like /dev/null?

javanerd
  • 101

1 Answers1

0

Note how few devices your /dev actually has.

Your webspace is in a container – it has its own dedicated /dev (and its own /bin, etc.) and overall an isolated view of the filesystem, but still shares the actual "OS" (the running kernel) with all other webspaces on that system. The various customers' containers come and go, with each getting a brand new /dev, but the host OS remains running continuously and that's the uptime reported via /proc.

(It's the same kind of "container" as in Docker or LXC.)

/dev/log is the odd one, because it's a socket that gets mounted from the outside (i.e. from the /dev/log of the host OS) so that all containers' logs would be collected by the same syslog daemon.

Also, "ctime" is not creation time – it's inode change time, updated whenever any metadata is changed. The actual creation time field is "btime" (birth time), which is a relatively new addition to Linux (PHP's stat() does not support it yet).

user1686
  • 10,162
  • 1
  • 26
  • 42
  • Thanks. Does 601 days uptime mean they never update the kernel or do they use live patching? It's a big hoster I cannot imagine they never apply security patches. – javanerd Mar 22 '23 at 11:58
  • You'll have to ask them specifically. (Or poke around e.g. in /proc/modules for signs of livepatch, or /proc/version for signs of Ksplice.) – user1686 Mar 22 '23 at 12:00