How can it be explained that /proc/uptime does not match ctime of system files?

javanerd

3/22/24, 9:53 AM

I have a small webspace (PHP + MySQL). Nothing special.

I can read /proc/uptime using PHP and it returns:

51967189.77 1731371689.58

So the uptime is 601 days (51967189 / 60 / 60 / 24).

I have also listed the files in the /dev folder. On the left there is the creation time (d.m.Y).

17.03.2023 .
17.03.2023 ..
17.03.2023 full
28.07.2021 log
17.03.2023 null
17.03.2023 random
17.03.2023 tty
17.03.2023 urandom
17.03.2023 zero

Other folders like /bin /sbin /var /lib64 also have 17.03.2023 as creation time.

Because these files and folders are created on boot it means the uptime is only 5 days.

So I have 601 days vs. 5 days.

How can it be /proc/uptime does not match creation time of files like /dev/null?

1 + 0

uptime

Score:0

Server

user1686

3/22/24, 11:52 AM

Note how few devices your /dev actually has.

Your webspace is in a container – it has its own dedicated /dev (and its own /bin, etc.) and overall an isolated view of the filesystem, but still shares the actual "OS" (the running kernel) with all other webspaces on that system. The various customers' containers come and go, with each getting a brand new /dev, but the host OS remains running continuously and that's the uptime reported via /proc.

(It's the same kind of "container" as in Docker or LXC.)

/dev/log is the odd one, because it's a socket that gets mounted from the outside (i.e. from the /dev/log of the host OS) so that all containers' logs would be collected by the same syslog daemon.

Also, "ctime" is not creation time – it's inode change time, updated whenever any metadata is changed. The actual creation time field is "btime" (birth time), which is a relatively new addition to Linux (PHP's stat() does not support it yet).

+ 2

javanerd

3/22/24, 11:58 AM

Thanks. Does 601 days uptime mean they never update the kernel or do they use live patching? It's a big hoster I cannot imagine they never apply security patches.

user1686

3/22/24, 12:00 PM

You'll have to ask them specifically. (Or poke around e.g. in /proc/modules for signs of livepatch, or /proc/version for signs of Ksplice.)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How can it be explained that /proc/uptime does not match ctime of system files?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.