Can I reliably use the value os.version to determine the Linux distro?

Question

I'm parsing customer logs, I need to want to figure out which distro they are running. I can't run commands on their systems, all I have is the logs.

The property os.name always returns, Linux, but the os.version returns what appears to be the kernel version? For instance, 2.6.9-42.0.3.ELsmp or 2.6.5-7.283-smp.

After some google is appears that the last characters of the os.version can be mapped to a distro.

Values ending in, ELsmp or el, map to Redhat, just plain smp maps to SUSE.

Is that true or I'm just engaging in wishfully thinking?

Answer 1

If the distro vendor applies their own patches to the kernel, they usually add a tag to the version number to indicate that it's a custom version of the kernel. If they just use the stock kernel as written by Linus and friends, then there often won't be a tag.

The tag may even be different between distros by the same vendor, that would otherwise be compatible. Or it may be the same for different distros. (Last i saw, Fedora kernels didn't have the "EL" or "el" tags. CentOS kernels, however, have the same tags as RHEL.) Or, for some distros, it may not be there at all.

Answer 2

You'll get info for the major distributions, true. But it won't be possible to guess it for 100% of your logs.

FYI: search generic or generic-pae for Ubuntu, but you'll miss some other. Debian don't have specific endings apart from -686 and -amd64, but it must be the case for many other distributions.

Answer 3

That's true as long as they use distro-specific kernels - vanilla kernels with distro-specific patches applied. But they might also use entirely different or custom kernels, maybe even a vanilla kernel. And I'm not sure what will happen if it is a virtual machine. Those kernels might end in -xen or -openvz or something similar. Different distros may also use the same kernel, so that makes it even harder again.