atime

Hi! If you're new here, you may want to subscribe to the Unix Tutorial RSS feed to get regular tips & tricks for all flavors of Unix. Thanks for visiting!

As you know, Unix filesystems store a number of timestamps for each file. This means that you can use these timestamps to find out when any file or directory was last accessed (read from or written to), changed (file access permissions were changed) or modified (written to).

File and directory timestamps in Unix

Three times tracked for each file in Unix are these:

access time - atime
change time - ctime
modify time - mtime

atime - File Access Time

Access time shows the last time the data from a file was accessed - read by one of the Unix processes directly or through commands and scripts.

ctime - File Change Time

ctime indicates the last time a file’s metadata (inode) was changed. It changes when you change file's ownership or access permissions. The Linux man page for stat summarizes ctime behavior nicely: “The field st_ctime is changed by writing or by setting inode information (i.e., owner, group, link count, mode, etc.).”

mtime - File Modify Time

Last modification time shows time of the last change to file's contents. It does not change with owner or permission changes, and is therefore used for tracking the actual changes to data of the file itself.

Find atime, ctime and mtime with ls

The simplest way to confirm the times associated with a file is to use ls command.

Timestamps are shown when using the long-format output of ls command, ls -l:

ubuntu# ls -l /tmp/file1
-rw-r–r– 1 greys root 9 2008-04-05 07:10 /tmp/file1

This is the default output of ls -l, which shows you the time of the last file modification - mtime. In our example, file /tmp/file1 was last changed around 7:10am.

If we want to see the last access time for this file, atime - you need to use -lu options for ls. The output will probably show some later time:

ubuntu# ls -lu /tmp/file1
-rw-r–r– 1 greys root 9 2008-04-05 07:27

In the example, it's 7:27am.

Lastly, ls -lc will show you the last time our file was changed, ctime:

ubuntu# ls -lc /tmp/file1
-rw-r–r– 1 greys root 9 2008-04-05 07:31

Show atime, ctime and mtime with stat command

In Linux distributions, you will probably find a stat command, which can be used to show all of the times in a more convenient way, and among plenty of other useful information about your file:

ubuntu# stat /tmp/file1
File: `/tmp/file1′
Size: 9             Blocks: 8          IO Block: 4096   regular file
Device: 811h/2065d    Inode: 179420      Links: 1
Access: (0644/-rw-r–r–)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2008-04-05 07:27:51.000000000 +0100
Modify: 2008-04-05 07:10:14.000000000 +0100
Change: 2008-04-05 07:35:22.000000000 +0100