When does "changed" does not mean "changed"? When we talk about time stamps for Linux files. In this guide we explain how the system updates them and how you can change them yourself.
The difference between atime, mtime and ctime
Each Linux file has three time stamps: the access time stamp (atime), the changed time stamp (mtime) and the changed time stamp (ctime).
The access time stamp is the last time a file was read. This means that someone has used a program to display the contents of the file or to read some values from it. Nothing has been edited or added to the file. The data has been referred to but these are unchanged.
A modified time stamp indicates the last time the content of a file was changed. A program or process has edited or manipulated the file. "Changed" means that something has been changed or deleted in the file, or that new data has been added.
Changed time stamps do not refer to changes in the contents of a file. Rather, it is when the metadata related to the file has changed. For example, changes to file permissions will update the changed time stamp.
The standard ext4 Linux file system also allocates space for a timestamp for creating files in the internal file system structures, but this has not yet been implemented. Sometimes this time stamp is filled in, but you cannot depend on the values in it.
The anatomy of a time stamp
Linux time stamps contain a number instead of a date and time. This number is the number of seconds since the Unix era, which was January 1
When Linux is to display a time stamp, this translates the number of seconds into a date and time. This makes it easier for people to understand. The location and time zone in which the computer views the file guides the conversion of the number of seconds to a date and time. It also ensures that the month is in the correct language.
So how many seconds can be stored in a time stamp? Lots – 2,147,483,647 to be exact. That is a large number, but is it enough? If you add that to the Unix period and then translate it to a date and time, you will get Tuesday, January 19, 2038 at 3:14:07 PM. However, we need a different schedule for time stamps before that time.  View time stamps
If you use the
-l (long list) with
ls as shown below, you will see the modified time stamp:
ls -l dp.c
If you want to see the access time stamp, use the
-lu (access time) option as follows:
ls -lu dp.c
And finally change the time stamp, you can use the option
-lc (change time); type the following:
ls -lc dp.c
The time stamps above show the contents of the file last modified on April 21, 2019. The access and changed time stamps are identical because the file was copied from another computer to this on January 20, 2020 and both timestamps were updated at that time.
stat command to view all time stamps simultaneously:
The time zones are displayed at the bottom of the screen. As you can see, they have a very accurate, fractional second component. At the end of each timestamp you will also see a
These are time zone offsets . The file system records the time stamps in UTC and converts them to the local time zone when displayed by
stat . The computer we used to examine this article is configured as if it were in the Eastern Standard Time (EST) zone of the US
That time zone is five hours behind UTC when EST is in effect. However, it is four hours behind UTC when Eastern Daylight Time (EDT) is in effect. In April 2019, when the changed time stamp was changed, EDT was in force. That is why two of the time stamps have an offset of five hours, but the modified one has an offset of four hours.
The offsets and time zones are not stored anywhere. There is neither an inode nor a file system space dedicated to storing these values. You must calculate it on the spot using the time stamp (which is always in UTC time), the local time zone of the computer on which the file is displayed, and whether DST was in effect.
You will also see a "Birth" time stamp reserved for the creation date of the file. This is not implemented and you will see a hyphen "
- " instead of a timestamp.
RELATED: Everything you ever wanted to know about inodes on Linux
Change time stamps
If you want, you can change the time stamps in a file. You can use the
touch command to change the access or custom time stamps, or both:
touch -a dp.c
If you want to set a new access time stamp, use the
- an (access time) option. This command sets the access time stamp to the current time of the computer:
The access time stamp has changed as expected. However, the changed time stamp has also been updated; this is normal.
To change the changed time stamp, you can use the
-m (changed time) option:
touch -m dp.c
This time the changed and changed time stamps have been updated.
You can use the
-d (date) option if you want to change both the access and the modified time stamps at the same time. You can also specify a time and date – you are not limited to changing the time stamps in the present.
We use the following command to set the access and custom time stamps at 10:30:45 on January 15, 2020:
touch -d "2020-01-15 10:30:45" dp.c  stat dp.c
We have now set access and adjusted time stamps to a date in the past. The changed time stamp has also been updated to the current time of the computer.
You can also use the
-r (reference) option, as shown below, if you want to set the time stamps of one file to the time stamp values of another:
hit dp.c -r dice_words.sl3
And then we are just about back where we started, with a mixture of
-0500 time stamps.
Let's do something that only affects the changed time stamp. We use the command
chmod to give an executable file permissions for all users:
chmod + x dp
De changed time stamp was the only one that was updated. This is because the file itself has not been changed – it has not been opened or changed. However, the metadata about the file was changed .
RELATED: How to use the chmod command on Linux
How the file system updates time stamps
When a file system is linked, there are options that you can use to indicate how that file system should work or be treated. These are stored in the file
/ etc / fstab that is read and processed during start-up. You can also set options to dictate the schedule they should use to update the access time stamp.
The following are some of the most common options:
- strictatime (strict atime) : This option updates the access time stamp of files each time they are opened. There is an overhead associated with this approach, but some servers can take advantage of this scheme. It has little merit on a desktop or laptop.
- noatime (no time): This option completely disables access time stamps for files and folders for updating. However, the modified time stamps are still being updated.
- nodiratime (no dir atime): With this option, time stamps for accessing files can be updated, but it is disabled for folders.
- relatime (relative time): This option only updates the access time stamp if it was more than 24 hours old or the previous one was older than the current changed or changed time stamps. This strikes a good balance between access time stamps that are updated too often or not updated at all.
Let's look at the file
/ etc / fstab for this computer and see which options are set:
less / etc / fstab
/ etc / fstab is displayed for us as shown below.
Here is the contents of the file without the wrap-around:
# / etc / fstab: static file system information. # # Use & # 39; blkid & # 39; to print the universally unique identification code for one # device; this can be used with UUID = as a more robust way to name devices # that works even if disks are added and removed. See fstab (5). # #
# / was on / dev / sda1 during the installation UUID = 4a143d08-8695-475b-8243-b13b56050fc2 / ext4 errors = remount-ro 0 1 / swapfile none swap sw 0 0
There are only two entries and one is a swap file that we can ignore. The other is mounted at the root of the file system (
/ ) and was at the time of installation on device
/ dev / sda1 . That is the first partition on the first hard drive and it happens to contain a file system
The only option passed to it is
errors = remount-ro indicating the operating system to re-read this file system as read-only if there are errors trying to link as a read and read write file system.
It is therefore not specified how the access time stamp will be treated. Let's go deeper and see what
/ proc / mounts can tell us. We send the output from
/ proc / mounts to
grep . Our search string is "sda", the hard disk identification.
We type the following:
cat / proc / mounts | grep "sda"
Now we see the following options:
- rw : The file system is linked as a read and write file system.
- relatime : The file system will use the "relative atime" scheme to update the access time stamps.
Where does that come from? Well, the relatime
scheme is used in the following situations:
- When the default value
/ etc / fstabis used.
- When the relatime is used
/ etc / fstaboption is used.
- When no access time stamp options are used in
/ etc / fstaband you use Linux kernel 2.6.30 or newer.  Us
/ etc / fstabfile system item
ext4did not specify access timestamp update options, so Linux made the wise choice and used
RELATED: How to write an fstab file on Linux
Time stamps are important
Time stamps give us an easy way to see when a file was opened, changed or changed. But more importantly, they offer a way to back up and synchronize software to determine which files to back up.
The ability to manipulate time stamps will be useful when you are forced to convince a program to record or ignore a file or a set of files.