Quick ways to discover when a filesystem became active, whether systemd managed it or stored a timestamp in the superblock. 13.02.2026 | reading time: 3 min You arrive at a server and must prove when a mount happened; is it a recent systemd action, or was the disk last mounted days ago? This short guide shows concrete commands to answer that question quickly and reliably. Hands-on: systemd timestamp and journal Use systemd to get the authoritative time for mounts it manages: first derive the unit name, then query its active timestamp and check the journal. Example: ```sh $ systemd-escape --path --suffix=mount /srv/data srv-data.mount $ systemctl show -p ActiveEnterTimestamp srv-data.mount ActiveEnterTimestamp=Thu 2026-02-12 10:05:23 CET $ journalctl -u srv-data.mount -b --no-pager | tail -n 3 Feb 12 10:05:23 host systemd[1]: Mounted /srv/data. Feb 12 10:05:23 host kernel: VFS: Mounted rootfs. ``` These three lines tell him when systemd activated the mount and show the journal event for verification. Looking inside the filesystem For local ext2/3/4 devices the superblock records mount metadata; inspect it with `tune2fs` or `dumpe2fs` to get the last mount time and count. Example: ```sh $ sudo tune2fs -l /dev/sdb1 | grep "Last mount" Last mount time: Thu Feb 12 10:05:23 2026 Last mounted on: /srv/data ``` That proves the kernel recorded a mount against the filesystem itself; note: network filesystems do not have this superblock. When one method is not enough Systemd timestamps are exact for mounts it handled; superblock entries tell when the filesystem structure was last mounted; journal entries add human-readable context and process IDs. Combine them: if `systemctl` reports a timestamp but the superblock is unchanged, it may be a bind mount or a remount; if neither shows a recent time, check `mount`, `findmnt` or `dmesg` for clues. Practical commands to remember Commands that help in live troubleshooting include `findmnt` to locate the mount, `mount`/`/proc/self/mountinfo` to inspect current mounts, `lsblk` to map devices to mount points, and `dmesg` for kernel messages; use the systemd and superblock methods when you need a timestamp rather than just presence. Final word Timestamps come from different layers: systemd, kernel, filesystem; pick the one that fits your story and corroborate with the journal or kernel log. Keep practicing: dive deeper into mounts and filesystems, then consider formalizing skills with a certificate like CompTIA Linux+ or LPIC-1 — bitsandbytes.academy offers intensive exam preparation to accelerate that path. Join Bits & Bytes Academy First class LINUX exam preparation. filesystem utilities boot-process troubleshooting storage
