How does last modification of the inode get changed?

[David L Brewster]

We have incremental backups by our 3rd party software but they appear to be backing up the entire system rather than just those files that have changed.
Vendor insists that their logic is based on the last modification time of the file.
I have found that it is actually the last modification time of the inode.
I have to find some other process running on my machine that changes the last modification of the inode but not the file.
Any ideas on which utilities can change the inode time and not the file time?

[A. Clay Stephenson]

The ctime field (CHANGE TIME) is modified whenever a chmod, chown, or chgrp command is executed (or when the underlying system calls are used).

[James R. Ferguson]

Hi David:

The 'mtime' (modification timestamp) only changes when the file (or directory) is actually modified. The 'ctime' is the last change timestamp and is altered whenever the permissions, name, owner, or other inode data of a file or directory is altered.

Some backup utilities (like 'fbackup') reset the 'atime' of files that they back up. Resetting the last access time ('atime') changes the 'ctime' since the timestamps themselves are inode information and changing inode data changes the 'ctime'.

Regards!

...JRF...

[A. Clay Stephenson]

Oh, and I should also note that the touch command (or the underlying system calls (e.g. utime()) can alter all 3 of the timestamps.

[David L Brewster]

Thanks for the info!
I do have fbackup running on my machine.
I'll start there.