Drop Down MenusCSS Drop Down MenuPure CSS Dropdown Menu

Linux ctime,mtime,atime,cmin,amin,mmin

Unix and therefore Linux uses (at least) 3 different timestamps on modern file systems (see File systems Table for info) in order to date any files. You can use these information to search for files, check logs, manage your backup and more… that’s why it is a must  for any sysadmin to clearly understand this mechanism.
This page is aimed at exposing basics knowledge to understand and use files timestamps.

1) Definitions
Here are some time stamps related definitions.

1.1 atime

  • This is the Access time :
  • atime is updated whenever file’s data is accessed (a read, write or any other access); this could be done by a system process, interactively by CLI or by a script.

1.2 mtime
  • This is the Modification time :
  • mtime is updated whenever the file’s content changes. This time stamp is not updated by a change of files permissions (e.g : through a chown command). It is usually used for tracking the file content changes (see the Linux time related tools section below for more infos).
  • mtime changing implies a ctime change too.
  • So basically mtime represents the file’s data age.

1.3 ctime

  • This is the Change time :
  • ctime is updated when  file’s ownership, access permissions or file contents are modified. As stated in ls manual (man ls) : time of last modification of file status information. ctime is updated when the inode data changes.

2) File Systems and time stamping
The following table is a quick summary of commons file systems time stamping properties.
File Systems and Time stamping
FileSystemsatimectimemtimeCreation time
ext2yesyesyesno
ext3yesyesyesno
ext4yesyesyesyes
btrfsyesyesyesyes
reiserfsyesyesyesno
zfsyesyesyesyes
ntfsyesyesyesyes

3) Practical examples
This section propose some practical examples related to the Unix/Linux files timestamps. These examples are based on common Linux commands and show their effects on timestamps.

Which time stamp is updated when ….

3.1 Moving a file with mv
atime : not updated
mtime : not updated
ctime : UPDATED

Example
bash-3.2$ touch moved.txt      # Creating the test file
bash-3.2$ stat moved.txt       # Checking its stats
File: `moved.txt'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234806     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:09:02.000000000 +0200   # This is atime
Modify: 2012-08-16 17:09:02.000000000 +0200   # This is mtime
Change: 2012-08-16 17:09:02.000000000 +0200   # This is ctime
bash-3.2$ mv moved.txt moved.txt_moved        # moving the test file with mv command
bash-3.2$ stat moved.txt_moved                # Checking test file again to see the changes
File: `moved.txt_moved'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234806     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:09:02.000000000 +0200
Modify: 2012-08-16 17:09:02.000000000 +0200
Change: 2012-08-16 17:10:07.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with mv command
3.2 Copying a file with cp
atime : UPDATED
mtime : not updated
ctime : not updated
bash-3.2$ touch copied.txt   # Creating test file
bash-3.2$ stat copied.txt    # Checking test file stats
File: `copied.txt'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234808     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:38:09.000000000 +0200   # This is atime
Modify: 2012-08-16 17:38:09.000000000 +0200   # This is mtime
Change: 2012-08-16 17:38:09.000000000 +0200   # This is ctime
bash-3.2$ cp copied.txt copied.txt_copied     # copying test file using cp command
bash-3.2$ stat copied.txt                     # Checking new file stats
File: `copied.txt'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234808     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:39:03.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with cp command
Modify: 2012-08-16 17:38:09.000000000 +0200
Change: 2012-08-16 17:38:09.000000000 +0200

3.3 Updating a file timestamps with touch
atime : UPDATED
mtime : UPDATED
ctime : UPDATED
bash-3.2$ touch touch.txt   # Creating test file
bash-3.2$ stat touch.txt    # Checking test file stats
File: `touch.txt'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234810     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:38:09.000000000 +0200   # This is atime
Modify: 2012-08-16 17:38:09.000000000 +0200   # This is mtime
Change: 2012-08-16 17:38:09.000000000 +0200   # This is ctime
bash-3.2$ touch touch.txt                     # updating test file using touch command
bash-3.2$ stat touch.txt                     # Checking new file stats
File: `touch.txt'
Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234810     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command
Modify: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command
Change: 2012-08-16 17:49:09.000000000 +0200  # THEY ARE ALL UPDATED with touch command

3.4 Updating a file content with a redirection
atime : not updated
mtime : UPDATED
ctime : UPDATED
bash-3.2$ touch redirection.txt
bash-3.2$ stat redirection.txt
  File: `redirection.txt'
  Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234811     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:58:55.000000000 +0200
Modify: 2012-08-16 17:58:55.000000000 +0200
Change: 2012-08-16 17:58:55.000000000 +0200
bash-3.2$ echo "redirection test" > redirection.txt   # First test : replacing test file content
bash-3.2$ stat redirection.txt
  File: `redirection.txt'
  Size: 17              Blocks: 8          IO Block: 4096   fichier régulier
Device: 806h/2054d      Inode: 4234811     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:58:55.000000000 +0200
Modify: 2012-08-16 17:59:18.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with a simple redirection
Change: 2012-08-16 17:59:18.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with a simple redirection
bash-3.2$ echo "redirection test APPEND" >> redirection.txt
bash-3.2$ stat redirection.txt
  File: `redirection.txt'
  Size: 41              Blocks: 8          IO Block: 4096   fichier régulier
Device: 806h/2054d      Inode: 4234811     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-16 17:58:55.000000000 +0200
Modify: 2012-08-16 18:00:01.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with an "APPENDED" redirection : exactly the same as for a simple redirect.
Change: 2012-08-16 18:00:01.000000000 +0200   # THESE ARE THE CHANGES THAT OCCURS with an "APPENDED" redirection : exactly the same as for a simple redirect.

3.5 Changing the file owner
atime : not updated
mtime : not updated
ctime : UPDATED
bash-3.2$ touch chown.txt
bash-3.2$ stat chown.txt
  File: `chown.txt'
  Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234946     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-17 14:09:22.000000000 +0200
Modify: 2012-08-17 14:09:22.000000000 +0200
Change: 2012-08-17 14:09:22.000000000 +0200
bash-3.2$ su -c "chown root:root chown.txt"   # chown-ing the test file
Mot de passe :
bash-3.2$ stat chown.txt
  File: `chown.txt'
  Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234946     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-08-17 14:09:22.000000000 +0200
Modify: 2012-08-17 14:09:22.000000000 +0200
Change: 2012-08-17 14:09:33.000000000 +0200    # THIS IS THE ONLY CHANGES THAT OCCURS with chown command
 
bash-3.2$ touch chmod.txt
bash-3.2$ stat chmod.txt
  File: `chmod.txt'
  Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234958     Links: 1
Access: (0644/-rw-r--r--)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-17 14:47:16.000000000 +0200
Modify: 2012-08-17 14:47:16.000000000 +0200
Change: 2012-08-17 14:47:16.000000000 +0200
bash-3.2$ su -c "chmod 777 chmod.txt"
Mot de passe :
bash-3.2$ stat chmod.txt
  File: `chmod.txt'
  Size: 0               Blocks: 0          IO Block: 4096   fichier régulier vide
Device: 806h/2054d      Inode: 4234958     Links: 1
Access: (0777/-rwxrwxrwx)  Uid: (10268/username)   Gid: ( 1850/  GROUP)
Access: 2012-08-17 14:47:16.000000000 +0200
Modify: 2012-08-17 14:47:16.000000000 +0200
Change: 2012-08-17 14:48:05.000000000 +0200   # THIS IS THE ONLY CHANGES THAT OCCURS with chmod command
4) Linux timestamps related tools
This chapter presents the most commons tools that can be used to check or update files timestamps.

4.1 ls
The ls command can be used to print and/or sort files by any of the three timestamps (atime, mtime, ctime).

4.1.1 Print and/or sort files by mtime
To print the mtime :

bash-3.2$ ls -l
Note : By default ls used with the “-l” option displays the mtime.

To print AND sort files by mtime, you just need to add the “-t” option as :

bash-3.2$ ls -lt


4.1.2 Print and/or sort files by ctime
To print the ctime :

bash-3.2$ ls -lc
To print AND sort files by ctime, you just need to add the “-t” option as :

bash-3.2$ ls -ltc


4.1.3 Print and/or sort files by atime
To print the atime :

bash-3.2$ ls -lu
To print AND sort files by atime, you just need to add the “-t” option as :

bash-3.2$ ls -ltu


4.2 find
Find is a powerful tool, i am sure you already know it (check this page for more examples), it can easily be used to found files according to timestamps parameters, here are some examples.

Find provides basically two different way for searching files according to their timestamps : it can search for files newer or older to another file and it can also search for files newer or older than a given date.



4.2.1 find files newer or older than another file
When find is searching for files (let’s call it the “evaluated file“) newer or older than a given file (let’s call this later file the “reference file“) it compares the evaluated file atime or ctime to the reference file mtime.

You can perform this kind of search using this form :

find -xnewer file
Where x can be :

“a” : to compare the “evaluated file” access time to the “reference file” mtime
Example :
find /etc -anewer reference_file.txt
“c” : to compare the “evaluated file” change time to the “reference file” mtime
Example :
find /etc -cnewer reference_file.txt


4.2.2 find files newer or older than a given date
When find is searching for files (the “evaluated file“) newer or older than a given date, it compares the evaluated file atime or ctime to the given date.

You can perform this kind of search using one of these forms :

find -xtime n    # Where n is a number of days
find -xmin n     # Where n is a number of minutes
Note : You can specify an operator to the “n” number as : “+” or “-“. A “+” sign means greater than “n“, “-” sign means lesser than “n“. When no operator is given this means exactly “n“.

Where x can be :

“a” : to compare the “evaluated file” access time to “n” (where “n” can be a number of days or minutes)
find /etc -atime -30    # This would search for files with a last access time (atime) newer than 30 days (that occurs within the last 30 days)
find /etc -atime +30    # This would search for files with a last access time (atime) older than 30 days
find /etc -amin -60     # This would search for files with a last access time (atime) newer than 60 minutes (that occurs within the last 60 minutes)
find /etc -amin +60     # This would search for files with a last access time (atime) older than 60 minutes
“c” : to compare the “evaluated file” change time to “n” (where “n” can be a number of days or minutes)

Examples :
find /etc -ctime -40    # This would search for files with a last change time (ctime) newer than 40 days (that occurs within the last 40 days)
find /etc -ctime +40    # This would search for files with a last change time (ctime) older than 40 days
find /etc -cmin -50     # This would search for files with a last change time (ctime) newer than 50 minutes (that occurs within the last 50 minutes)
find /etc -cmin +50     # This would search for files with a last change time (ctime) older than 50 minutes
Note : When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1,  a file has to have been accessed at least two days ago.

The -daystart option can be used to change this behaviour (see man find for more info)

4.2.3 Find files according to their mtime
TODO

4.2.4 Find files according to their ctime
TODO

4.2.5 Find files according to their atime
TODO



4.3 touch
The touch command allow you to modify the mtime, ctime and the atime stamps.

4.3.1 Change the three timestamps to the current timestamps
To change all three timestamps at once you should use the touch command with no options, as :

touch file
bash-3.2$ stat new.txt
  File: « new.txt »
  Size: 0               Blocks: 0          IO Block: 4096   fichier vide
Device: 811h/2065d      Inode: 12716711    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-08-17 20:15:50.364731820 +0200
Modify: 2012-08-17 20:15:50.364731820 +0200
Change: 2012-08-17 20:15:50.364731820 +0200
bash-3.2$ touch new.txt
bash-3.2$ stat new.txt
  File: « new.txt »
  Size: 0               Blocks: 0          IO Block: 4096   fichier vide
Device: 811h/2065d      Inode: 12716711    Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-08-17 20:38:16.810732399 +0200
Modify: 2012-08-17 20:38:16.810732399 +0200
Change: 2012-08-17 20:38:16.810732399 +0200

4.3.2 Change the mtime timestamp to a given date
To do that change the mtime use this syntax :

touch -m [[CC]YY]MMDDhhmm[.ss]
Where :

CC : is the century (!?)
YY : is the year (e.g 89 for year 1989)
MM : is the month (e.g 09 for September)
DD : is the day (e.g
hh :
mm :
ss :


Example
$ touch -m 200012311800 employees.txt


4.3.3 Change the atime timestamp to a given date
To do that change the atime use this syntax :

touch -a [[CC]YY]MMDDhhmm[.ss]
Where :

CC : is the century (!?)
YY : is the year (e.g 89 for year 1989)
MM : is the month (e.g 09 for September)
DD : is the day (e.g
hh :
mm :
ss :


Example
$ touch -t 200012311800 employees.txt
In this example touch will set mtime back to the date you want and it sets ctime to now. You have complete control over mtime, but the system stays in control of ctime. So mtime is a little bit like the date on a letter while ctime is like the postmark on the envelope.

4.4 stat
stat displays informations (statistics) of a file.

Example
See the section 3.Practical examples for some examples.

No comments:

Post a Comment