We utilize LVM snapshots for some periodic maintenance. They're manually created and, usually, manually destroyed. But not always. So there's now a nightly script monitoring for open snapshots. Which raises the question of when a given snapshot was created. Absent good practices of, say, using sudo to create snapshots (leaving a /var/log/secure message), is there any reasonably reliable way to determine when an LVM was created? There's a timestamp on the /dev/mapper/<snapshot> file. I'm presuming that's somewhat useful for this purpose? Ah: just found /var/log/messages also indicates: lvm[2314]: Monitoring snapshot <name> lvm[2314]: No longer monitoring snapshot <name> ... which I think answers my own question. Posting here for Google's sake and/or discussion. -- Dr. Ed Morbius, Chief Scientist / | Robot Wrangler / Staff Psychologist | When you seek unlimited power Krell Power Systems Unlimited | Go to Krell!