How to find ctime, mtime, etc. of files

[Mark Landin]

I have a script to go clean up some files based on their name and ctime. A simple thing, really, except that it fails to find some files that I know it should. I think the ctime of the files is incorrect.

Is there as ls mode, or other utility, that can show me the atime and ctime of a file (the same one used by the find command?)

[Jeff Schussele]

Hi Mark,

mtime -> ls -t
atime -> ls -u
ctime -> ls -c

Rgds,
Jeff

[Mark Landin]

That only SORTS by those times; it doesn't actually DISPLAY them.

[James R. Ferguson]

Hi Mark:

Remember that 'find's 'mtime', 'atime' and 'ctime' are based on a 24-hour clock. That is, specifying '-ctime +1' assumes *exactly* 24-hours. If you need to fidn files with greater precision, touch a reference file and use the '-newer' option. For example:

# touch -amt 06030001 /tmp/ref

# find /tmp -newerc /tmp/ref

Regards!

...JRF...

[S.K. Chan · Accepted solution]

Echoing Jeff's reply ..
$ ls -l filename
$ ls -lt filename
$ ls -lu filename
$ ls -lc filename

[Mark Landin]

Actually, what I am wanting to do it find files that have not been changed within the last X days. My understanding is that this command should find those files:

find . -ctime +X

It's not finding a lot of files I think it should, and the ctime seems like the culprit. I want to see the actual ctimes of some of these files so I can determine what the problem is.

[James R. Ferguson]

Hi (again) Mark:

Also, don't confuse the 'ctime' and 'mtime' attributes. The 'ctime' represents the timestamp of the last inode change (permissions, ownership, etc.). The 'mtime' is the last modification time. There is no creation time. 'atime', of course, is the last access timestamp. Utilities like 'fbackup' will change the 'ctime' since they copy a file and then reset the lastaccess timestamp ('atime') to what it was before the copy began.

Regards!

...JRF...

[Ravi_8]

Hi,

files will be having last modified date and time (ls -l), but you can't see the creation time. whereas if u have tool to operate inode which will contain creation/modified time you can

[Bill Douglass]

ls -lc will display the ctime for a file; ls -lu the time of last access.

perl -e '@a=stat("/path/to/file"); print $a[8];'

will return atime in seconds;

perl -e '@a=stat("/path/to/file"); print $a[8];'

will return ctime.

[Jeff Schussele]

Hi (again) Mark,

JRF's reply is probably what you need, but again it is not going to show you those times.
The only way I know to show you those times is to obtain the file's inode #

ls -i

Then go into fsdb, go to that inode & query

at -> access time
mt -> mod time
ct -> inode change time

Problem here is I don't think this can be done from the command prompt. You have to go into fsdb & do this interactiely. And I would *strongly* caution you to be VERY careful with fsdb - it's one of THE most destructive commands out there.

HTH,
Jeff

[Mark Landin]

Ah! It was the -l that was throwing me. And now seeing those dates, I know what's happening ... my backup utility is updating the inode of each of these files so their ctime is older than the last backup!

Jeff, sorry I should have given you more points!

So, ctime is out ... guess I'll use mtime instead.

[James R. Ferguson]

Hi:

As Jeff indicated, 'ls' will allow you to see the modification timestamp ('mtime'); the last access timestamp ('atime') or the 'change' ('ctime') timestamp. See the man pages for 'ls'. For modifiction, lastaccess and inode changed, respectively, do

# ls -l filename
# ls -ul filename
# ls -cl filename

A useful additional flag to 'ls' is '-r' to reverse the sort order.

Regards!

...JRF...

[Zeev Schultz]

ok,there is a st_ctime as appears after
reading man fstat - which is defined there as
"last file status change time".to test one
can write simple c code,sth like open() on file
and fstat() on its file descriptor.theoretical
though...

[curt larson_1]

just a quick perl script:

#!/opt/perl/bin/perl

$filename = "$ARGV[0]";

#($dev, $ino, $mode, $nlink, $uid, $gid, $rdev, $size, $atime, $mtime, $ctime, $blocksize, $blocks) = stat($filename);

@s = stat($filename);

$atime = localtime($s[8]);
$mtime = localtime($s[9]);
$ctime = localtime($s[10);

print "Time of the last access (atime) = $atime\n";
print "Time of last inode change (ctime) = $ctime\n";
print "Time of the last modification (mtime) = $mtime\n";
exit;