April 14, 2010, 6:42 AM — While the average Unix user is generally satisfied by the date/time stamps that he sees when using the ls -l command, it is sometimes useful to remember that there are actually several time stamps associated with every Unix file. These time stamps represent the last modification time (i.e., the time stamp you see when you use the ls -l command), the last status change time and the last time that the file was accessed. For Linux users, all three of these time stamps can generally be displayed with the stat command.
The Linux stat command provides quite a bit more information about a file than you will see when you type ls -l. In the example below, for example, we look at the /etc/passwd file and can see that we get the file size in both bytes and blocks, the inode and number of links, a device address, etc. along with the file owner and group.
The three time stamps show us that the /etc/passwd file has not been changed since March, though it was last accessed today.
$ stat /etc/passwd File: `/etc/passwd' Size: 70980 Blocks: 152 IO Block: 4096 regular file Device: 6802h/26626d Inode: 3877639 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2010-04-12 22:22:55.000000000 -0400 Modify: 2010-03-16 11:14:43.000000000 -0400 Change: 2010-03-16 11:14:43.000000000 -0400
Tail the /etc/passwd file and run the stat command again and you're likely to see a small change in the access time:
$ stat /etc/passwd File: `/etc/passwd' Size: 70980 Blocks: 152 IO Block: 4096 regular file Device: 6802h/26626d Inode: 3877639 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2010-04-12 22:24:39.000000000 -0400 <== Modify: 2010-03-16 11:14:43.000000000 -0400 Change: 2010-03-16 11:14:43.000000000 -0400 $ date Mon Apr 12 22:25:17 EDT 2010
You can also elect to display this same type of information in a "terse" form. In this form, the information is displayed without labels and in a format that might not be easy to recognize as dates and times.
$ stat -t /etc/passwd /etc/passwd 70980 152 81a4 0 0 6802 3877633 1 0 0 1271123694 1268752483 1268752483 4096
The fields in this terse format represent:
/etc/passwd file name (%n) 70980 total size (%s) 152 number of blocks (%b) 81a4 raw mode in hex (%f) 0 UID of owner (%u) 0 GID of file (%g) 6802 device number in hex (%D) 3877633 inode number (%i) 1 number of hard links (%h) 0 major devide type in hex (%t) 0 minor device type in hex (%T) 1271123694 last access time as seconds since the Unix Epoch (%X) 1268752483 last modification as seconds since the Unix Epoch (%Y) 1268752483 last change as seconds since the Unix Epoch (%Z) 4096 I/O block size (%o)
You might recognize the three "seconds since the Unix Epoch" time stamps simply from their size.