We utilize LVM snapshots for some periodic maintenance. They're manually created and, usually, manually destroyed.

But not always.

So there's now a nightly script monitoring for open snapshots.

Which raises the question of when a given snapshot was created.

Absent good practices of, say, using sudo to create snapshots (leaving a /var/log/secure message), is there any reasonably reliable way to determine when an LVM was created?

There's a timestamp on the /dev/mapper/<snapshot> file. I'm presuming that's somewhat useful for this purpose?

Ah: just found /var/log/messages also indicates:

lvm[2314]: Monitoring snapshot <name> lvm[2314]: No longer monitoring snapshot <name>

... which I think answers my own question. Posting here for Google's sake and/or discussion.