We utilize LVM snapshots for some periodic maintenance. They're manually created and, usually, manually destroyed.
But not always.
So there's now a nightly script monitoring for open snapshots.
Which raises the question of when a given snapshot was created.
Absent good practices of, say, using sudo to create snapshots (leaving a /var/log/secure message), is there any reasonably reliable way to determine when an LVM was created?
There's a timestamp on the /dev/mapper/<snapshot> file. I'm presuming that's somewhat useful for this purpose?
Ah: just found /var/log/messages also indicates:
lvm[2314]: Monitoring snapshot <name> lvm[2314]: No longer monitoring snapshot <name>
... which I think answers my own question. Posting here for Google's sake and/or discussion.