Unix How-To: File Updates in Linux

While the average Unix user is generally satisfied by the date/time stamps that he sees when using the ls -l command, it is sometimes useful to remember that there are actually several time stamps associated with every Unix file. These time stamps represent the last modification time (i.e., the time stamp you see when you use the ls -l command), the last status change time and the last time that the file was accessed. For Linux users, all three of these time stamps can generally be displayed with the stat command.

The Linux stat command provides quite a bit more information about a file than you will see when you type ls -l. In the example below, for example, we look at the /etc/passwd file and can see that we get the file size in both bytes and blocks, the inode and number of links, a device address, etc. along with the file owner and group.

The three time stamps show us that the /etc/passwd file has not been changed since March, though it was last accessed today.

$ stat /etc/passwd
  File: `/etc/passwd'
  Size: 70980           Blocks: 152        IO Block: 4096   regular file
Device: 6802h/26626d    Inode: 3877639     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2010-04-12 22:22:55.000000000 -0400
Modify: 2010-03-16 11:14:43.000000000 -0400
Change: 2010-03-16 11:14:43.000000000 -0400

Tail the /etc/passwd file and run the stat command again and you're likely to see a small change in the access time:

$ stat /etc/passwd
  File: `/etc/passwd'
  Size: 70980           Blocks: 152        IO Block: 4096   regular file
Device: 6802h/26626d    Inode: 3877639     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2010-04-12 22:24:39.000000000 -0400	<==
Modify: 2010-03-16 11:14:43.000000000 -0400
Change: 2010-03-16 11:14:43.000000000 -0400
$ date
Mon Apr 12 22:25:17 EDT 2010

You can also elect to display this same type of information in a "terse" form. In this form, the information is displayed without labels and in a format that might not be easy to recognize as dates and times.

$ stat -t /etc/passwd
/etc/passwd 70980 152 81a4 0 0 6802 3877633 1 0 0 1271123694 1268752483 1268752483 4096

The fields in this terse format represent:

/etc/passwd 	file name (%n)
70980 		total size (%s)
152 		number of blocks (%b)
81a4 		raw mode in hex (%f)
0 		UID of owner (%u)
0 		GID of file (%g)
6802  		device number in hex (%D)
3877633 	inode number (%i)
1 		number of hard links (%h)
0 		major devide type in hex (%t)
0 		minor device type in hex (%T)
1271123694 	last access time as seconds since the Unix Epoch (%X)
1268752483 	last modification as seconds since the Unix Epoch (%Y)
1268752483 	last change as seconds since the Unix Epoch (%Z)
4096 		I/O block size (%o)

You might recognize the three "seconds since the Unix Epoch" time stamps simply from their size. Yes, Unix is more than 1.25 billion seconds old. You can run the non-terse (i.e., normal) form of the stat command to see these numbers transformed into familiar date strings or use an online Epoch converter such as this one to go between Unix time and human time:

http://www.epochconverter.com/

In order to improve file system performance, many Unix systems turn off atime updates -- at least for file systems in which files are frequently accessed while updating the access time for each access would not provide valuable information. For these file systems, you might access a file only to find that the access time reported by stat or similar commands (e.g., fstat) does not reflect your having accessed the file. Edit the file and you will see changes in the modification time. Chmod or rename it and you will see the change time updated.

Top 10 Hot Internet of Things Startups
Join the discussion
Be the first to comment on this article. Our Commenting Policies