日拱一卒

Linux 系统中文件的 atime, mtime 和 ctime

 
  • 2023年 06月13日
  • 0 阅读

先上结论：

  • Access time (atime): 最近一次读取文件内容的时间。
  • Modifty time, (mtime): 最近一次修改文件内容的时间。
  • Change time (ctime): 最近一次更改文件元数据的时间
  • 修改文件内容会同时修改 mtime 和 ctime，具体原因见下面对 struct stat 的分析。

What is the access time in Unix

stat structure

The stat(2) structure keeps track of all the file date/times:

struct stat {
    dev_t     st_dev;     /* ID of device containing file */
    ino_t     st_ino;     /* inode number */
    mode_t    st_mode;    /* protection */
    nlink_t   st_nlink;   /* number of hard links */
    uid_t     st_uid;     /* user ID of owner */
    gid_t     st_gid;     /* group ID of owner */
    dev_t     st_rdev;    /* device ID (if special file) */
    off_t     st_size;    /* total size, in bytes */
    blksize_t st_blksize; /* blocksize for file system I/O */
    blkcnt_t  st_blocks;  /* number of 512B blocks allocated */
    time_t    st_atime;   /* time of last access */
    time_t    st_mtime;   /* time of last modification */
    time_t    st_ctime;   /* time of last status change */
};

Last access time

  • st_atime is the access time
  • Changed by the mknod(2), utimes(2) and read(2) system calls.

Last modification time

  • st_mtime is the data modification time
  • Changed by the mknod(2), utimes(2) and write(2) system calls.

Last changed time

  • st_ctime is the metadata modification time
  • When any of the other data in the struct stat gets modified.
  • Changed by the chmod(2), chown(2), link(2), mknod(2), rename(2), unlink(2), utimes(2) and write(2) system calls.

通过 mv 命令移动或重命名文件，也会导致 ctime 改变，这是因为 mv 会改变 inode 的 link 计数，也就改变了文件的元数据。具体解释可以参考 Why does renaming a file with mv command alter an inode’s “change” date & time?

修改文件内容会同时修改 st_mtime 和 st_ctime，这是因为文件大小由 struct stat 中的 st_size 表示，也是文件的元数据之一，因此元数据改变会导致 st_ctime 更改。

Creation time

stat structure does not have create time. There is no create time in this structure, so it’s not possible to find out when a file was created directly from the system.

The statx(2) syscall introduced a new structure that can report the creation time of a file. Not all filesystems support this feature.

struct statx {
    __u32 stx_mask;        /* Mask of bits indicating
                              filled fields */
    __u32 stx_blksize;     /* Block size for filesystem I/O */
    __u64 stx_attributes;  /* Extra file attribute indicators */
    __u32 stx_nlink;       /* Number of hard links */
    __u32 stx_uid;         /* User ID of owner */
    __u32 stx_gid;         /* Group ID of owner */
    __u16 stx_mode;        /* File type and mode */
    __u64 stx_ino;         /* Inode number */
    __u64 stx_size;        /* Total size in bytes */
    __u64 stx_blocks;      /* Number of 512B blocks allocated */
    __u64 stx_attributes_mask;
                           /* Mask to show what's supported
                              in stx_attributes */

    /* The following fields are file timestamps */
    struct statx_timestamp stx_atime;  /* Last access */
    struct statx_timestamp stx_btime;  /* Creation */
    struct statx_timestamp stx_ctime;  /* Last status change */
    struct statx_timestamp stx_mtime;  /* Last modification */

    /* If this file represents a device, then the next two
       fields contain the ID of the device */
    __u32 stx_rdev_major;  /* Major ID */
    __u32 stx_rdev_minor;  /* Minor ID */

    /* The next two fields contain the ID of the device
       containing the filesystem where the file resides */
    __u32 stx_dev_major;   /* Major ID */
    __u32 stx_dev_minor;   /* Minor ID */
};

查看 atime, mtime 和 ctime 的命令

stat 命令

stat filename

ls 命令

# 几种时间显示格式
ll --time-style=long-iso
ll --time-style=full-iso
ll --time-style=+'%y-%m-%d %H:%M:%S'

# 查看 atime
ll --time-style=long-iso [-u|--time=atime]

# 查看 ctime
ll --time-style=long-iso [-c|--time=mtime]
搜索