Atime, mtime and ctime: Explanation of Linux file timestamps

Atime, mtime and ctime: Explanation of Linux file timestamps

A laptop showing a terminal window with additional terminal windows filled with text in the background.
Fatmawati Achmad Zaenuri / Shutterstock

When does “changed” not mean “modified”? When we talk about timestamps of Linux. In this guide we will explain how the system updates them and how to change them yourself.

Each Linux file has three timestamps: the login timestamp (atime), the modified timestamp (mtime), and the modified timestamp (ctime).

The login timestamp is the last time a file was read. This means that someone used a program to view the contents of the file or read some values ​​from it. Nothing has been changed or added to the file. The data was referenced but unchanged.

A modified timestamp indicates the last time the content of a file was modified. A program or process has modified or manipulated the file. “Modified” means that something in the file has been changed or deleted or that new data has been added.

Modified timestamps do not refer to changes made to the contents of a file. Rather, it is the time when the metadata related to the file was changed. Changes to file permissions, for example, will update the modified timestamp.

The standard ext4 Linux file system also allocates space for a file creation timestamp in its internal file system structures, but this has not yet been implemented. Sometimes, this timestamp gets populated, but you can’t depend on the values ​​it contains.

The anatomy of a timestamp

Linux timestamps contain a number rather than a date and time. This number is the number of seconds since the Unix era, which was midnight (00:00:00) on January 1, 1970, in Coordinated Universal Time (UTC). Leap seconds are ignored in Linux timestamps, so they are not analogous to real time.

When Linux needs to display a timestamp, it translates the number of seconds into a date and time. This makes it easier for humans to understand. The location and time zone of the computer displaying the file guides the conversion of the number of seconds to date and time. It also ensures that the month is in the correct language.

So how many seconds can be stored in a timestamp? A lot — 2,147,483,647, to be exact. That’s a big number, but is it enough? If you add it to the Unix era and then translate it to a date and time, you get Tuesday, January 19, 2038, at 03:14:07. We will need a different scheme for timestamps before then.

Viewing timestamps

When you use the -loption (long list) with lsas shown below, you can see the modified timestamp:

ls -l dp.c

If you want to see the login timestamp, use the -luoption (access time) like this:

ls -lu dp.c

And finally, to see the date and time change, you can use the -lcoption (change now); type the following:

ls -lc dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

The timestamps above show that the contents of the file were last modified on April 21, 2019. The access and modified timestamps are identical because the file was copied from another computer to this one on January 20, 2020 and both timestamps are been updated at that time.

To see all timestamps at once, use the statcommand as follows:

stat dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

Time zones are listed at the bottom of the display. As you can see, they have a very accurate fractional second component. At the end of each timestamp, you also see a -0500or -0400 .

These are the time zone differences . The file system records timestamps in UTC and converts them to the local time zone when viewed from stat. The computer we used to search for this article is configured as if it were in the Eastern Standard Time (EST) area of ​​the United States

That time zone is five hours behind UTC when EST is in effect. However, it is four hours behind UTC when Eastern Daylight Time (EDT) is in effect. In April 2019, when the modified timestamp was changed, the EDT was in effect. That’s why two of the timestamps have a five hour offset, but the modified one has a four hour offset.

Offsets and time zones are not stored anywhere. There is neither an inode nor a file system space dedicated to holding these values. You have to calculate them on the fly using the timestamp (which is always in UTC time), the local time zone of the computer viewing the file, and whether daylight saving time was in effect.

You will also see a “Birth” timestamp, which is reserved for the date the file was created. This is not implemented and a dash is displayed ” -”Instead of a timestamp.

Changing timestamps

If you wish, you can change the timestamps on a file. You can use the touchcommand to modify access or modified timestamps or both:

touch -a dp.c

To set a new login timestamp, you will use the -aoption (access time). This command sets the login timestamp to the current computer time:

stat dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

The login timestamp has changed, as expected. However, the modified timestamp has also been updated; It’s normal.

To edit the edited timestamp, you can use the -moption (now changed):

touch -m dp.c
stat dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

This time, the edited and edited timestamps have been updated.

You can use the -d(date) option if you want to change both the access and the modified timestamps at the same time. You can also specify a time and date – you’re not limited to changing timestamps to the present.

We will use the following command to set the access and modified timestamps at 10:30:45 am on January 15, 2020:

touch -d "2020-01-15 10:30:45" dp.c
stat dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

We have now set the access and modified timestamps to a date in the past. The modified timestamp was also updated to the current computer time.

You can also use the -roption (reference), as shown below, if you want to set the timestamps of one file to the timestamp values ​​of another:

touch dp.c -r dice_words.sl3
stat dp.c

Atime, mtime and ctime: Explanation of Linux file timestamps

And then, we’re pretty much back to square one, with a mix of -0400And -0500timestamp.

Let’s do something that only affects the modified timestamp. We will use the chmodcommand to give an executable file execute permissions for all users:

chmod +x dp
dp statistica

Atime, mtime and ctime: Explanation of Linux file timestamps

The modified timestamp was the only one that was updated. This is because the file itself has not been modified, has not been consulted or modified. However, the metadata related to the file is States modified.

How the file system updates timestamps

When a file system is mounted, there are options you can use to specify how that file system should function or be treated. These are stored in the /etc/fstabfile, which is read and processed at boot time. You can also set options to dictate the pattern to be used to update the logon timestamp.

Here are some of the more common options:

  • strictatime (strict atime) : This option updates the file access timestamp every time you log in. There is an overhead associated with this approach, but some servers can take advantage of this scheme. It has little merit on a desktop or laptop computer.
  • noatime (no atime): this option completely disables access timestamps for files and directories from the update. However, the modified timestamps will still be updated.
  • nodiratime (no dir atime): this option enables logon timestamps for files to be updated, but disables it for directories.
  • relatime (relative atime): this option updates the login timestamp only if it was older than 24 hours or if the previous one was older than the modified or modified timestamps. This strikes a good balance between login timestamps updating too frequently or not updating at all.

Let’s take a look at the /etc/fstabfile for this computer and let’s see what options are set:

less /etc/fstab

Atime, mtime and ctime: Explanation of Linux file timestamps

The /etc/fstabfile is displayed for us as shown below.

Atime, mtime and ctime: Explanation of Linux file timestamps

Here is the contents of the file without the wrap-around:

# /etc/fstab: informazioni sul file system statico.
#
# Usa 'blkid' per stampare l'identificatore univoco universale per a
# dispositivo; questo può essere usato con UUID= come un modo più robusto per nominare i dispositivi
# che funziona anche se i dischi vengono aggiunti e rimossi. Vedere fstab(5).
#
# <file system> <punto di montaggio> <tipo> <opzioni> <dump> <pass>
# / era su /dev/sda1 durante l'installazione
UUID=4a143d08-8695-475b-8243-b13b56050fc2 / errori ext4=remount-ro 0 1
/swapfile nessuno swap sw 0 0

There are only two entries and one of them is a swap file, which we can ignore. The other is mounted at the root of the filesystem ( /) and was on the device /dev/sda1at the time of installation. This is the first partition on the first hard drive and appears to contain a ext4file system.

The only past option is errors=remount-rowhich tells the operating system to remount this file system as read only if there are any errors when trying to mount it as a read and write file system.

Hence, there is no mention of how the login timestamp will be handled. Let’s dig deeper and /proc/mountslet’s see what it can tell us. We will send the output from /proc/mountsattraverso grep. Our search string will be “sda”, the hard drive identifier.

We type the following:

cat /proc/mounts | grep "sda"

Atime, mtime and ctime: Explanation of Linux file timestamps

Now let’s see the following options:

  • rw : The file system will be mounted as a read and write file system.
  • relatime : the file system will use the “relative atime” scheme to update the access timestamps.

Where is he from? Well, it is relatimescheme is used in the following situations:

  • When the option is used default /etc/fstab .
  • When the relatime /etc/fstab the option is used.
  • When no login timestamp options are used in /etc/fstaband you are running Linux kernel 2.6.30 or later.

Our /etc/fstabheading for the ext4file system did not specify any login timestamp update options, so Linux made the sensible choice and used relatime.

Timestamps are important

Timestamps give us an easy way to see when a file was accessed, edited or modified. But more importantly, they provide a way to backup and synchronize software to determine which files need to be backed up.

The ability to manipulate timestamps will come in handy whenever you need to forcibly convince a program to include or ignore a file or set of files.

Similar Posts

Leave a Reply

Your email address will not be published.