Linux check file time

File Timestamps — mtime, ctime and atime in Linux

When you are working with directory and files, you may need to know about Linux file timestamps such as change time (ctime), access time (atime), and modification time (mtime). Linux files, directories, sockets have three different timestamps – mtime, ctime and atime.

Probably when working in Linux you have get answers to following questions:

When was the last date of file content modified? When was the file last opened/accessed ? When the properties of the file such as ownership, permissions last changed?

Here, we are going to explain each file timestamps in Linux in detail.

mtime – Last modification time

Mtime or modification time is the time of the last change to the file contents. ‘Modification’ means something inside the file was amended or deleted, or new data was added.

Use the -l (long listing) option with ls, you can see the modified timestamp.

ctime – last change time

Ctime is the changed timestamp referring to changes made to attribute of a file such as ownership, access permission. It’s the time at which the metadata related to the file changed.

To see the change timestamp, use the -lc option:-

atime – last access time

Atime or access timestamp is the last time a file was read, read by one of the processes directly or through commands and scripts.

Use the -lu (access time) option with command ls to see access time. You can see the modification time and access time for the same file are different.

Show mtime, atime and ctime with stat command

Most of the linux distribution come with stat command which can be used to show all of the time stamp in a more convenient way.

To see modification time, access time and change time of a particular file use as follow:-

The timestamp are first generated in number of seconds since the Unix epoch, it translates the number of seconds into a date and time from the system time zone.

Conclusion

Unfortunately, we won’t be able to find file creation time using ctime, atime or mtime orelse we have to use debugfs command.

In this article, we learned about Linux file timestamps and about access time, modification time, and change time. Your feedback is much welcome.

Источник

How to Get Last Modified Date of File in Linux

Sometimes, you may be required to check detailed information about a file (timestamp) such as its last modified date. This can come in handy when you want to check when the file was last edited. Additionally, it ensures that you have the latest version of the file.

In this article, you will learn 4 ways to get the last modified date of file in Linux.

1. Using stat command

The ls -l command is just okay in giving you basic information about a file such as file ownership and permissions, file size, and creation date. The stat command returns detailed information file attributes such as the last time the file was accessed and modified.

The syntax is quite simple. stat is followed by the file name or the full path to the file.

From the above output, we can clearly see when the file was last accessed ( Access date ), Modify date, Change date among other parameters.

If you wish to view the modified date only and leave out all the other information, run the following command:

The -c option is used to return the date in a custom format, while the ‘%y’ flag displays the last modification time. For directories, the syntax remains the same. Simply replace the file name with that of the directory.

2. Using date command

The date command in its basic syntax displays the current date. However, when used with the -r option, you can display the last modification date of a file as shown.

3. Using ls -l command

The ls -l command is usually used for long listing — display additional information about a file such as file ownership and permissions, size and creation date. To list and display the last modified times, use the lt option as shown.

4. Using httpie

Another way you can check the last modified date is by using the httpie HTTP command-line client tool. The tool is usually used for interacting with HTTP servers and APIs and can also check when a file residing on a web server was last modified.

But first, you need to install it using the command:

On Ubuntu / Debian / Mint, run the command:

To check when a file on a web server was last modified, use the syntax:

Output

Conclusion

This wraps up this article. In this guide, we have featured various ways that you can use to list the last modified date of a file on a Linux system, and even a file hosted on a web server using the httpie tool. Hopefully, you won’t have an issue viewing when files were last modified.

More Articles You May Like

1 thought on “How to Get Last Modified Date of File in Linux”. add one

I prefer using ‘ls’ over all the others because ls allows you to control precisely how the date and time are displayed. I believe stat only gives the choice between seconds-since-epoch and human-readable, with no control over the human-readable format.

For ls, the relevant option is ‘—time-style’ and its format specifiers are fairly straightforward, using the same specifiers used by /bin/date. See ‘man date’ for all the available specifiers. My personal favorite is —time-style=»+%Y-%m-%d %H:%M:%S». I use this alias for my day-to-day ls needs.

alias l=»/bin/ls —time-style=\»+%Y-%m-%d %H:%M:%S\» —group-directories-first -lLFAGv»

Источник

How to display modification time of a file?

I’d like a method to find and print the modified time of a file, for use within a bash script.

I have come up with:

Though I’d like to avoid parsing ls , also it’d be useful to have the year in there.

Ideally I’d like to see an output similar to the default output of the date command.

What other useful methods are available?

2 Answers 2

Don’t use ls , this is a job for stat :

-c lets us to get specific output, here %y will get us the last modified time of the file in human readable format. To get time in seconds since Epoch use %Y :

If you want the file name too, use %n :

Set the format specifiers to suit your need. Check man stat .

Example:

If you want the output like Tue Jul 26 15:20:59 BST 2016 , use the Epoch time as input to date :

Check date ‘s format specifiers to meet your need. See man date too.

but if the date is less than 10 it misses the time. This because of the extra space before the date if less than 10. Try this:

The awk command prints the fields separated by all spaces (-F ‘ ‘). Hope it works. I know this doesn’t answer the original question but just a clarification on the ls command for just date and time. When you Google «ubuntu get date and time of file» it lists this question at the top, which is what I was looking for, since I don’t need the year also. For year, date and time, you could try one of the commands below. %m prints month number. %b prints month abbreviation: Drop the %H:%M if you don’t need the hour and minute. %-d doesn’t print leading zero for the day of the month.

Источник

File Timestamps in Linux: atime, mtime, ctime Explained

In Linux, every file has some timestamps that provide some crucial analytics about when the file or its attributes were modified or changed. Let’s see these timestamps in detail.

What are Linux timestamps?

Any file in Linux has typically these three timestamps:

• atime – access time
• mtime – modify time
• ctime – change time

atime

atime stands for access time. This timestamp tells you when was the last time the file was accessed. By access, it means if you used cat, vim, less or some other tool to read or display the content of the file.

mtime

mtime stands for modify time. This timestamp tells you when was the last time the file was modified. By modify, it means if the contents of a file were changed by editing the file.

ctime

ctime stands for status change time. This timestamp tells you when was the last time the property and metadata of the file were changed. The metadata includes file permissions, ownership, name and location of the file.

How to see the timestamps of a file?

You can use the stat command to see all the timestamps of a file. Using stat command is very simple. You just need to provide the filename with it.

The output will be like this:

You can see all three timestamps (access, modify and change) time in the above output. All three timestamps are the same here because I just created this empty file with touch command.

Now let’s modify these timestamps.

If I use the less command to read the file, it will change only the access time because the content and metadata of the file remain the same.

Now let’s change the modify time. I’ll use cat command to add new text to this file. This will prevent the change in access time.

Did you notice something weird? You modified the file and expected the mtime to be changed but it also changed the ctime.

Remember, ctime is always changed with mtime. It’s because while mtime is under the control of user, ctime is controlled by the system. It represents when the last time the data blocks or metadata of a file was changed. If you modify the file, the data blocks change and thus ctime is changed.

You can change ctime alone by modifying file permissions using chmod or chgrp commands but you cannot modify mtime without modifying ctime.

You can also not change ctime in the past by normal means. It is a kind of security feature because it tells you the last time the file was changed. Even if someone modifies mtime and set it in the past for malicious purposes, ctime will indicate the actual time when the mtime was changed.

Remember: ctime will always be modified by mtime change.

What are the usage of file timestamps?

It helps a lot in analyzing. There could be a number of situations where you need to refer to the timestamps of a file. For example, you can see if a file was modified recently or not when it was supposed to be modified.

One of my favorite use was to locate log files of an application with mtime. Run the application and just go into the parent directory of the application and search for the files that have been modified in last few minutes.

I already showed you above that it can also help in analyzing if someone accessed the files or modified it maliciously. Timestamps play an important role in such situations.

How to know when a file was originally created?

Did you notice the last line of stat command output? It says ‘Birth’. You may guess that this represents the timestmap when the file was ‘born’ (or created to be more precise).

Actually, there is one more timestamp called creation time (cr). Not all filesystems support this timestamp. Ext4 is one of the popular Linux filesystems and though it supports the creation timestamp, the stat command at present is not able to show it. Maybe the future versions of stat command will show the creation timestamp in the Birth section.

Источник

Get Last Modified Date of File in Linux

I’m new to Linux. I’m using the command-line. I’m trying to view the last modified date of a file. How do I do that in Linux from the Command Line?

7 Answers 7

As mentioned by @edvinas.me, stat tells you various information about the file including the last modified date.

At first, I was confused with Modify and Change, just to clarify, stat output lists:

• Access shows the time of last data access (e.g. read).
• Modify shows the time of last data modification.
• Change shows the time the file status last changed.

Use stat command for that:

Another way that is more flexible is using date -r . From man date :

This has the advantage of allowing you to specify the output format, e.g.

ls -l should do the work.

Building off of @Adam Taylor ‘s comment in @phoops ‘s answer and @Sparhawk ‘s answer.

To specifically just get the date (using October 3, 2019 for examples because it was my last birthday, here’s my venmo if you feel led to bless me financially: @levi_uzodike)

• stat -c %y file | cut -d’ ‘ -f1 will give you 2019-10-03
• date +%F -r file will also give you 2019-10-03
• date +%D -r file will give you 10/03/19
• date +%x -r file will probably give either 10/03/2019 , or 10/03/19 if you’re in the U.S. and either 03/10/2019 , or 03/10/19 if you’re in the U.K., just to name a couple examples (of course there are more possibilities)

These date format options are, to my understanding, combinations of other format options. Here are some explanations from the man page:

%b locale’s abbreviated month name (e.g., Jan)
%B locale’s full month name (e.g., January)
.
%d day of month (e.g, 01)
%D date; same as %m/%d/%y
%e day of month, space padded; same as %_d
%F full date; same as %Y-%m-%d
.
%m month (01..12)
.
%x locale’s date representation (e.g., 12/31/99)
.
%y last two digits of year (00..99)
%Y year
.
By default, date pads numeric fields with zeroes.
The following optional flags may follow `%’:

— (hyphen) do not pad the field
_ (underscore) pad with spaces
0 (zero) pad with zeros
^ use upper case if possible
# use opposite case if possible

N.B.: These flags don’t work on the «combo formats» like %F , %D and %x . They are for the «singular field formats«.

Apparently this last flag (#) does not work as I’d expect (e.g., if date +%b gives Oct , date +%#b gives OCT as opposed to oCT ) I guess this would be useless, but I’d think a lower case option would be more useful. date +%#p does turn date +%p which might give PM or AM into pm or am , respectively. So I guess it’s not a ‘per-character’ case switch but sets the case of all the characters in the string to the opposite case of the majority of the characters? Also date +%P gives pm or am , but neither date +%^P nor date +%#P change its output. My guess for this case is that %P is just an alias for %#p , and it seems that whenever you add more than one flag, the behavior is undefined/unpredictable ( e.g., date +%0-e gives the same as date +%-e : 3 and date +%-0e gives the same as date +%0e : 03 , which makes you think that only the flag next to the letter works or that it goes left to right, but both date +%#^p and date +%^#p give pm or am , [depending on the time of course] ) unless there’s some hidden order of operations? Sorry for digressing.

Also, if you run the command locale -k LC_TIME | grep ^d_fmt , you can see the combo for the specific locale of your system (e.g., d_fmt=»%m/%d/%Y» ).

And you can make your own combo. For example,

• date +%^b\ %-e\ %Y -r file will give you OCT 3 2019

Источник