File times on Linux system.

cropped-tux.jpegOn Linux system, files have three different times. Very first thing before going forward, every thing in Linux is file. There are some exceptions to that but I will not be talking about that. Meta-data about the file that describes the file is stored separately besides contents of file. The place where this meta-data is stored is called inode. For each file, there is inode, associated with it, which points to contents of file.

If you want to know what is inode of a file then,

$ ls -i /bin/ls
786515 /bin/ls

First field is inode and second one is name of file associated with it.

Now, about file times, there are three times as follows,

  1. modification time (mtime)
  2. access time (atime)
  3. changed status time (ctime)

Modification time of file is a time when contents of file are modified. For example, when contents of file are changed or new data is written to it, modification time will change. Now you may guess what are those functions which could change this time of file.

Access time of file is a time when contents or file is accessed. For example, when file is opened for reading, it’s access time set to current time. Now you may guess read function changes the access time of file.

Changed status time is also called as status changed time, So I will use both the words interchangeably. Status changed time of file is time when inode is updated. It happens when contents of inode changes. Not that Linux doesn’t record access time of inode. This means that when you do stat on file, it’s changed status or any of the time will not be changed. So what are those changes which may affect changed status time of file. For example, changing permissions of file, owner of file, etc.

I will show you some examples so that these concepts will get clear. If you understood, then you may skip this.

I need a tool which shows all of these times. You have got ls. It does that for you.

$ ls postponed -l
-rw——- 1 rahul rahul 1244 Dec 31 21:44 postponed

with -l option ls shows last modification time of file. So Dec 31 21:44 is a last time when I have modified this file. (BTW I haven’t modified this, but there is a application who was doing that it’s mutt 😉 )

Have you noticed there is no year in time ? Why is that happened ? Doesn’t Linux stored year for a time ? That’s the beauty here. I will talk about it some other day, some other time.

To get a access time of a file use,

$ ls -lu postponed
-rw——- 1 rahul rahul 1244 Mar  6 21:54 postponed

with -u option you will get a access time of file.

To get a status changed time,

$ ls -lc postponed
-rw——- 1 rahul rahul 1244 Dec 31 21:44 postponed

with -c option you will changed status time of a file.

Now let us change a permissions of a file

$ chmod u+x postponed

Now lets us check if status changed time is changed or not.
$ ls -lc postponed
-rwx—— 1 rahul rahul 1244 Mar 13 19:46 postponed

Yep, it’s changed. 🙂

Knowing all about file times is very important for a all type of a users on Linux systems.

System admin can check what are files that hasn’t been accessed since 2 year, delete them. How you will do it ? Yes, check for access time.

There are different ways to change a mtime and atime of file, one of the ways to it utime function. But note that there is interface to change a ctime of a file. But there is one but quite tricky. Can you find that ?


Post a Comment

You must be logged in to post a comment.
%d bloggers like this: