Unix How-To: File Updates in Linux

By  

While the average Unix user is generally satisfied by the date/time stamps that he sees when using the ls -l command, it is sometimes useful to remember that there are actually several time stamps associated with every Unix file. These time stamps represent the last modification time (i.e., the time stamp you see when you use the ls -l command), the last status change time and the last time that the file was accessed. For Linux users, all three of these time stamps can generally be displayed with the stat command.

The Linux stat command provides quite a bit more information about a file than you will see when you type ls -l. In the example below, for example, we look at the /etc/passwd file and can see that we get the file size in both bytes and blocks, the inode and number of links, a device address, etc. along with the file owner and group.

The three time stamps show us that the /etc/passwd file has not been changed since March, though it was last accessed today.

$ stat /etc/passwd
  File: `/etc/passwd'
  Size: 70980           Blocks: 152        IO Block: 4096   regular file
Device: 6802h/26626d    Inode: 3877639     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2010-04-12 22:22:55.000000000 -0400
Modify: 2010-03-16 11:14:43.000000000 -0400
Change: 2010-03-16 11:14:43.000000000 -0400

Tail the /etc/passwd file and run the stat command again and you're likely to see a small change in the access time:

$ stat /etc/passwd
  File: `/etc/passwd'
  Size: 70980           Blocks: 152        IO Block: 4096   regular file
Device: 6802h/26626d    Inode: 3877639     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2010-04-12 22:24:39.000000000 -0400	<==
Modify: 2010-03-16 11:14:43.000000000 -0400
Change: 2010-03-16 11:14:43.000000000 -0400
$ date
Mon Apr 12 22:25:17 EDT 2010

You can also elect to display this same type of information in a "terse" form. In this form, the information is displayed without labels and in a format that might not be easy to recognize as dates and times.

$ stat -t /etc/passwd
/etc/passwd 70980 152 81a4 0 0 6802 3877633 1 0 0 1271123694 1268752483 1268752483 4096

The fields in this terse format represent:

/etc/passwd 	file name (%n)
70980 		total size (%s)
152 		number of blocks (%b)
81a4 		raw mode in hex (%f)
0 		UID of owner (%u)
0 		GID of file (%g)
6802  		device number in hex (%D)
3877633 	inode number (%i)
1 		number of hard links (%h)
0 		major devide type in hex (%t)
0 		minor device type in hex (%T)
1271123694 	last access time as seconds since the Unix Epoch (%X)
1268752483 	last modification as seconds since the Unix Epoch (%Y)
1268752483 	last change as seconds since the Unix Epoch (%Z)
4096 		I/O block size (%o)

You might recognize the three "seconds since the Unix Epoch" time stamps simply from their size.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Ask a Question