Ubuntu 8.04 (Hardy Heron) released!
For all of you who were waiting for the next release of Ubuntu, it’s finally here! I’ve been using the beta of Ubuntu 8.04 (Hardy Heron) for the past month or so, and found it an excellent release to work with.
atime, ctime and mtime in Unix filesystems
As you know, Unix filesystems store a number of timestamps for each file. This means that you can use these timestamps to find out when any file or directory was last accessed (read from or written to), changed (file access permissions were changed) or modified (written to).
File and directory timestamps in Unix
Three times tracked for each file in Unix are these:
- access time atime
- change time – ctime
- modify time – mtime
INTERESTING: there’s no file creation timestamp kept in most filesystems – meaning you can’t run a command like “show me all files created on certain date”. This said, it’s usually possible to deduce the same from ctime and mtime (if they match – this probably means that’s when the file was created).
atime – Last Access Time
Access time shows the last time the data from a file or directory was accessed – read by one of the Unix processes directly or through commands and scripts.
Due to its definition, atime attribute must be updated – meaning written to a disk – every time a Unix file is accessed, even if it was just a read operation. Under extreme loads, atime requirement could severely impact the filesystem performance, especfially with hard disks (HDDs) compared to Solid State Disks (SSDs).
Modern Unix and Unix like operating systems have special mount options to optimise atime usage (or disable it completely).
For instance, in Linux kernel the following atime optimisations are supported when mounting filesystem:
- strictatime – always update atime (no longer the default!)
- relatime (“relative atime”) – selective atime updates, usually if previous atime is an older timestamp than ctime and mtime (see below)
- nodiratime – no access time updates for directories (files still get atime updates)
- noatime – no access time updates for anything
ctime – Last Change Time
ctime shows when your file or directory got metadata changes – typically that’s file ownership (username and/or group) and access permissions. ctime will also get updated if the file contents got changed.
mtime – Last Modification Time
Last modification time shows time of the last change to file’s contents. It does not change with owner or permission changes, and is therefore used for tracking the actual changes to data of the file itself.
INTERESTING: When a new file or directory is created, usually all three times – atime, ctime and mtime – are configured to capture the current time.
How to Use atime, ctime and mtime
Lots of common system administration tasks can be helped, if not completed, using knowledge of atime, ctime and mtime attributed:
- find files updated on a certain date
- confirm when was the last time a configuration file was changed
- find files modified in the last hour or day – very useful for finding most recently updated log files
- verify if a certain file was accessed and when – useful when debugging a script
- quickly get the list of really old files (not updated for longer than 30 days or something like that)
- confirm when the directory was updated – can suggest that temporary files were created and quickly deleted, so you don’t see the files but recognise evidence when they were still in the directory
- review a list of files to confirm when they had ownership (user/group) data updated and if this time is different from file modifications – could be useful when reviewing security breach on your Unix system
Find atime, ctime and mtime with ls
The simplest way to confirm the times associated with a file is to use ls command. Timestamps are shown when using the long-format output of ls command, ls -l:
ubuntu# ls -l /tmp/file1 -rw-r--r-- 1 greys root 9 2008-04-05 07:10 /tmp/file1
This is the default output of
** ls -l**, which shows you the time of the last file modification – mtime. In our example, file /tmp/file1 was last changed around 7:10am. If we want to see the last access time for this file, atime – you need to use -lu options for ls. The output will probably show some later time:
ubuntu# ls -lu /tmp/file1 -rw-r--r-- 1 greys root 9 2008-04-05 07:27 /tmp/file1
In the example, it’s 7:27am. Lastly,
ls -lc will show you the last time our file was changed, ctime:
ubuntu# ls -lc /tmp/file1 -rw-r--r-- 1 greys root 9 2008-04-05 07:31 /tmp/file1
To show you how this works, I’ll change the ownership of the file and then run the same 3 ls commands to show you that only the
ctime had been updated. I run the date command just before doing anything else so that you can compare the times:
ubuntu# date Sat Apr 5 07:35:16 IST 2008 ubuntu# chown root /tmp/file1 ubuntu# ls -lc /tmp/file1 -rw-r--r-- 1 root root 9 2008-04-05 07:35 /tmp/file1 ubuntu# ls -lu /tmp/file1 -rw-r--r-- 1 root root 9 2008-04-05 07:27 /tmp/file1 ubuntu# ls -l /tmp/file1 -rw-r--r-- 1 root root 9 2008-04-05 07:10 /tmp/file1
Show atime, ctime and mtime with stat command
In Linux distributions, you will probably find a stat command, which can be used to show all of the times in a more convenient way, and among plenty of other useful information about your file:
ubuntu# stat /tmp/file1 File: `/tmp/file1' Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 811h/2065d Inode: 179420 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2008-04-05 07:27:51.000000000 +0100 Modify: 2008-04-05 07:10:14.000000000 +0100 Change: 2008-04-05 07:35:22.000000000 +0100
More information on atime, ctime and mtime
How To List Directories in a Directory in Unix
Another quick answer to the question I see a lot in search queries on this blog: listing directories in a directory. I take it that this question means showing a list of only the directories and not other files under a certain location of your Unix filesystem.
Using find to show only directories
find command helps you show only the directories by using a -type d parameter.
Compare the default find output of finding files and directories under /etc/mysql:
ubuntu# find /etc/mysql /etc/mysql /etc/mysql/debian.cnf /etc/mysql/conf.d /etc/mysql/my.cnf /etc/mysql/debian-start
To the one which only shows you the directories:
ubuntu# find /etc/mysql -type d /etc/mysql /etc/mysql/conf.d
And if you’re in doubt, you can always use ls -ld command to confirm that returned entries are really standard Unix directories:
ubuntu# ls -ld /etc/mysql /etc/mysql/conf.d drwxr-xr-x 3 root root 4096 2008-03-28 07:56 /etc/mysql drwxr-xr-x 2 root root 4096 2008-03-25 21:06 /etc/mysql/conf.d
That’s it! Have fun with Unix!
See also:
How To Find a Location of a Directory in Unix
Very quick tip for you today, I just see that many of visitors of this block are curious how they can find a directory in Unix – and so here’s a command to help you do just that.
Finding directories in Unix
There’s nothing better than to employ the find command. As you might remember, among many things, this wonderful tool allows you to search files by their type. Since nearly everything in Unix is a file, this means you can find directories.
Let’s take an example: if you wand to find out everything about your MySQL installation, you can have a search across your filesystems to find all the directories called mysql:
Here is how you would find a directory called mysql under /etc directory:
ubuntu# find / -name mysql -type d /var/log/mysql /var/lib/mysql /var/lib/mysql/mysql /etc/mysql /usr/lib/perl5/DBD/mysql /usr/lib/perl5/auto/DBD/mysql /usr/share/mysql
As you can see, there are quite a few directories which belong to MySQL, and you can see from the list that MySQL configuration is most likely to be in /etc/mysql directory.
Narrowing down directory search in Unix
If you search across all your filesystems, it may take too much time. That’s why it makes sense to narrow your search using common sense.
For example, if you’re looking for a configuration file of some standard package of software, most likely it will be under /etc directory, so you can specify it and greatly reduce the searching time.
In this example, we’re narrowing directory search to only those directories that are part of /etc:
ubuntu# find /etc -name mysql -type d /etc/mysql
See also:
How To Find the Default Block Size in Unix
The questions about default block sizes used in your Unix system are always popular. Today I’d like to show you a few ways to answer them.
Default block size in Linux
If you ever want to confirm the block size of any filesystem of Ubuntu or any other Linux OS, tune2fs command is here to help:
ubuntu# tune2fs -l /dev/sda1 | grep Block Block count: 4980736 Block size: 4096 Blocks per group: 32768
From this example, you can see that the default block size for the filesystem on /dev/sda1 partition is 4096 bytes, or 4k. That’s the default block size for ext3 filesystem.
Default block size in Solaris
The default block size in Solaris is 8192 bytes, or 8k. However, some architectures allow you to use 4k size as well, by specifying it as a command line option for the newfs command.
To be absolutely sure, you can use one of the commands: df -g (takes a filesystem mount point name as the parameter – / or /usr for example) or use fstyp -v command (needs a character device of the filesystem you’re interested in).
Using df -g to confirm the filesystem block size
This command can be used as any user, so to confirm a block size for any of the filesystems you don’t have to be root. However, it works only for mounted filesystems.
bash-3.00$ df -g / / (/dev/dsk/c1t0d0s0 ): 8192 block size 1024 frag size 12405898 total blocks 4399080 free blocks 4275022 available 751296 total files 603544 free files 30932992 filesys id ufs fstype 0x00000004 flag 255 filename length
Using fstyp -v to confirm the filesystem block size
Because this command accesses the character device of a particular filesystem, you have to be root to run it. But as a bonus compared to df -g, you can use fstyp -v on an unmounted filesystem:
bash-3.00# fstyp -v /dev/dsk/c1t0d0s0 | grep ^bsize bsize 8192 shift 13 mask 0xffffe000