mtime, ctime, and atime


 
Thread Tools Search this Thread
Top Forums UNIX for Beginners Questions & Answers Answers to Frequently Asked Questions Tips and Tutorials mtime, ctime, and atime
# 1  
Old 07-31-2005
mtime, ctime, and atime

Unix keeps 3 timestamps for each file: mtime, ctime, and atime. Most people seem to understand atime (access time), it is when the file was last read. There does seem to be some confusion between mtime and ctime though. ctime is the inode change time while mtime is the file modification time. "Change" and "modification" are pretty much synonymous. There is no clue to be had by pondering those words. Instead you need to focus on what is being changed. mtime changes when you write to the file. It is the age of the data in the file. Whenever mtime changes, so does ctime. But ctime changes a few extra times. For example, it will change if you change the owner or the permissions on the file.

Let's look at a concrete example. We run a package called Samba that lets PC's access files. To change the Samba configuration, I just edit a file called smb.conf. (This changes mtime and ctime.) I don't need to take any other action to tell Samba that I changed that file. Every now and then Samba looks at the mtime on the file. If the mtime has changed, Samba rereads the file. Later that night our backup system runs. It uses ctime, which also changed so it backs up the file. But let's say that a couple of days later I notice that the permissions on smb.conf are 666. That's not good..anyone can edit the file. So I do a "chmod 644 smb.conf". This changes only ctime. Samba will not reread the file. But later that night, our backup program notices that ctime has changes, so it backs up the file. That way, if we lose the system and need to reload our backups, we get the new improved permission setting.

Here is a second example. Let's say that you have a data file called employees.txt which is a list of employees. And you have a program to print it out. The program not only prints the data, but it obtains the mtime and prints that too. Now someone has requested an employee list from the end of the year 2000 and you found a backup tape that has that file. Many restore programs will restore the mtime as well. When you run that program it will print an mtime from the end of the year 2000. But the ctime is today. So again, our backup program will see the file as needing to be backed up.

Suppose your restore program did not restore the mtime. You don't want your program to print today's date. Well no problem. mtime is under your control. You can set it to what ever you want. So just do:
Code:
$ touch -t 200012311800 employees.txt

This will set mtime back to the date you want and it sets ctime to now. You have complete control over mtime, but the system stays in control of ctime. So mtime is a little bit like the date on a letter while ctime is like the postmark on the envelope.
# 2  
Old 12-28-2006
find command -mtime -ctime -atime

The find command uses arguments like:
-mtime -2
-mtime +2
-mtime 2

There are -ctime and -atime options as well. Since we now understand the differences among mtime, ctime, and atime, by understanding how find uses the -mtime option, the other two become understood as well. So I will describe find's use of the -mtime option.

As you probably know, the find command can run for minutes or hours depending on the size of the filesystem being searched. The find command makes a note of its own start time. It then looks at a file's mtime and computes how many seconds ago the file was modified. By dividing the seconds by 86,400 (and discarding any remainder), it can calculate the file's age in days:
Code:
0 days in seconds:       0  -   86399
1 day in seconds:    86400  -  172799
2 days in seconds:  172800  -  259159

So now that we know how many days ago a file was modified, we can use stuff like "-mtime 2" which specifies files that are 172800 to 259159 seconds older than the instant that the find command was started.

"-mtime -2" means files that are less than 2 days old, such as a file that is 0 or 1 days old.

"-mtime +2" means files that are more than 2 days old... {3, 4, 5, ...}

It may seem odd, but +0 is supposed to work and would mean files more than 0 days old. It is very important to recognize that find's concept of a "day" has nothing to do with midnight.

Last edited by Perderabo; 08-05-2007 at 12:40 PM..
These 11 Users Gave Thanks to Perderabo For This Post:
# 3  
Old 08-30-2007
Using perl to display the file timestamps

The ls program will display mtime if you use "ls -l". And you can get atime or ctime with "ls -lu" or "ls -lc". But ls uses a strange format. It displays the month and day in all cases. If the timestamp is recent, it also displays hour and minute. If the timestamp is older than 6 months, it display the year instead of hour and minute. A clever script can reformat this to year, month, day, hour, and minute. But ls will not display the seconds. The gnu version of ls (which is usually the only version on linux) does have extended options like --fulltime. But these extended options are non-standard and won't be available on other versions of Unix.

The perl language is also non-standard, but perl tends to be available on most versions of unix. For example, a version of perl is supplied with HP-UX and Solaris. Perl can easily display the timestamps of files. Here are some perl one-liners to display atime, mtime, and ctime.


Code:
$ echo hello > testfile ; date
Thu Aug 30 08:31:57 EDT 2007
$ chmod 700 testfile ; date
Thu Aug 30 08:32:48 EDT 2007
$ cat testfile ; date
hello
Thu Aug 30 08:33:30 EDT 2007
$
$
$
$
$ perl -e '@d=localtime ((stat(shift))[8]); printf "%4d%02d%02d%02d%02d%02d\n", $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]' testfile
20070830083330
$ perl -e '@d=localtime ((stat(shift))[9]); printf "%4d%02d%02d%02d%02d%02d\n", $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]' testfile
20070830083157
$ perl -e '@d=localtime ((stat(shift))[10]); printf "%4d%02d%02d%02d%02d%02d\n", $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]' testfile
20070830083248
$

These 4 Users Gave Thanks to Perderabo For This Post:
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Zfs - what does atime update?

It is widely documented that on zfs atime updates the access time on zfs. Where is the access time updated on Solaris 11.2? If I create file atimetest.txt under rpool/export/home: # zfs list rpool/export/home NAME USED AVAIL REFER MOUNTPOINT rpool/export/home 13.3G ... (5 Replies)
Discussion started by: jabberwocky
5 Replies

2. UNIX for Dummies Questions & Answers

Ls -l displays ctime or mtime?

commands ls -l or just l displays ctime (changed time) or mtime (modified time)? (10 Replies)
Discussion started by: rupeshkp728
10 Replies

3. UNIX for Advanced & Expert Users

Why updating atime doesn't update ctime?

Hi, ctime is the inode change time. If reading a file, its atime will be updated, which should cause inode member i_atime changed, which is an inode change. So ctime should also be updated. But if I try to ls a directory on redhat, only the directory atime gets updated, not ctime. Why? THANKS! (2 Replies)
Discussion started by: password636
2 Replies

4. UNIX for Dummies Questions & Answers

-atime not working as expected

I need to sort through a volume that contains video files by access time and delete files that have not been accessed over x days. I have to use the access time as video files are originals that do not get modified, just read Testing commands on a local test folder... $ date Wed Sep 28... (10 Replies)
Discussion started by: canon273
10 Replies

5. UNIX for Advanced & Expert Users

mtime VS atime VS ctime

hi, in trying to maintain your directories, one needs to do some housekeeping like removing old files. the tool "find" comes in handy. but how would you decide which option to use when it comes to, say, deleting files that are older than 5 days? mtime - last modified atime - last accessed... (4 Replies)
Discussion started by: pinoy43v3r
4 Replies

6. UNIX for Dummies Questions & Answers

(find) mtime vs. (unix) mtime

Hi I've made some test with perl script to learn more about mtime... So, my question is : Why the mtime from findfind /usr/local/sbin -ctime -1 -mtime -1 \( -name "*.log" -o -name "*.gz" \) -print are not the same as mtime from unix/linux in ls -ltr or in stat() function in perl : stat -... (2 Replies)
Discussion started by: hiddenshadow
2 Replies

7. Shell Programming and Scripting

how to find ot ctime , mtime ,atime

Can any one tell me how to find out ctime , mtime ,atime for a file/directory on unix. Cheers, Nilesh (5 Replies)
Discussion started by: nilesrex
5 Replies

8. Programming

read() without changing atime ?

Hey, First of all I want to know How do I see the atime of a file ?? Whats the command ?? I think ls -l shows the last modified time right ? Because when I use cat to read a file, the timestamp shown by ls -l does not change. Its not ls -lu ! man ls did not help ! How do I see the last... (8 Replies)
Discussion started by: tantric
8 Replies

9. UNIX for Dummies Questions & Answers

atime, ctime, mtime somewhere along csize..

i have used all forms of the unix find command.. and right now this is the only command i can think of that might have this option..: if i use mtime i am looking at a time interval.. but if i wanted to find out intervals of access, change and modification according to when a file changed size... (4 Replies)
Discussion started by: moxxx68
4 Replies

10. UNIX for Dummies Questions & Answers

mtime vs ctime

:D i have a slight problem and would appreciate if someone could clarify the confusion.. i use find alot and so far i have done ok.. but it just struck me a couple of days ago that I am not quite sure what the difference between the modification time and the change time as in ctime and mtime and... (3 Replies)
Discussion started by: moxxx68
3 Replies
Login or Register to Ask a Question