April 14, 2010, 6:42 AM — While the average Unix user is generally satisfied by the date/time stamps that he sees when using the ls -l command, it is sometimes useful to remember that there are actually several time stamps associated with every Unix file. These time stamps represent the last modification time (i.e., the time stamp you see when you use the ls -l command), the last status change time and the last time that the file was accessed. For Linux users, all three of these time stamps can generally be displayed with the stat command.
The Linux stat command provides quite a bit more information about a file than you will see when you type ls -l. In the example below, for example, we look at the /etc/passwd file and can see that we get the file size in both bytes and blocks, the inode and number of links, a device address, etc. along with the file owner and group.
The three time stamps show us that the /etc/passwd file has not been changed since March, though it was last accessed today.
$ stat /etc/passwd File: `/etc/passwd' Size: 70980 Blocks: 152 IO Block: 4096 regular file Device: 6802h/26626d Inode: 3877639 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2010-04-12 22:22:55.000000000 -0400 Modify: 2010-03-16 11:14:43.000000000 -0400 Change: 2010-03-16 11:14:43.000000000 -0400
Tail the /etc/passwd file and run the stat command again and you're likely to see a small change in the access time:
$ stat /etc/passwd File: `/etc/passwd' Size: 70980 Blocks: 152 IO Block: 4096 regular file Device: 6802h/26626d Inode: 3877639 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2010-04-12 22:24:39.000000000 -0400 <== Modify: 2010-03-16 11:14:43.000000000 -0400 Change: 2010-03-16 11:14:43.000000000 -0400 $ date Mon Apr 12 22:25:17 EDT 2010
You can also elect to display this same type of information in a "terse" form. In this form, the information is displayed without labels and in a format that might not be easy to recognize as dates and times.
$ stat -t /etc/passwd /etc/passwd 70980 152 81a4 0 0 6802 3877633 1 0 0 1271123694 1268752483 1268752483 4096
The fields in this terse format represent:
/etc/passwd file name (%n) 70980 total size (%s) 152 number of blocks (%b) 81a4 raw mode in hex (%f) 0 UID of owner (%u) 0 GID of file (%g) 6802 device number in hex (%D) 3877633 inode number (%i) 1 number of hard links (%h) 0 major devide type in hex (%t) 0 minor device type in hex (%T) 1271123694 last access time as seconds since the Unix Epoch (%X) 1268752483 last modification as seconds since the Unix Epoch (%Y) 1268752483 last change as seconds since the Unix Epoch (%Z) 4096 I/O block size (%o)
You might recognize the three "seconds since the Unix Epoch" time stamps simply from their size. Yes, Unix is more than 1.25 billion seconds old. You can run the non-terse (i.e., normal) form of the stat command to see these numbers transformed into familiar date strings or use an online Epoch converter such as this one to go between Unix time and human time:
http://www.epochconverter.com/
In order to improve file system performance, many Unix systems turn off atime updates -- at least for file systems in which files are frequently accessed while updating the access time for each access would not provide valuable information. For these file systems, you might access a file only to find that the access time reported by stat or similar commands (e.g., fstat) does not reflect your having accessed the file. Edit the file and you will see changes in the modification time. Chmod or rename it and you will see the change time updated.
