linux 中的 atime mtime ctime

linux 中的 atime mtime ctime

1. atime

记录的是文件被访问的时间，通常是读取，如cat命令，在centos7中more,less,head,tail是不会触发atime时间被修改的。

mtime

记录的是文件内容被修改的时间，

如果文件被修改则atime和ctime也会被修改。

2. ctime

记录的是文件属性被修改的时间，包括权限更改，用户或组以及文件大小,文件名，内容被修改时会更新时间。

3. 查看文件的atime,mtime,ctime时间

• 使用 stat命令可以同时查看atime,mtime,ctime时间

[root@master test]# stat 1.txt 
  File: ‘1.txt’
  Size: 6         	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 9006882     Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (   10/   wheel)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2021-06-02 13:23:58.552000000 +0800
Modify: 2021-06-02 13:22:02.386000000 +0800
Change: 2021-06-02 13:23:33.247000000 +0800
 Birth: - 

• 使用ls命令

  ls -l 默认显示文件的Mtime
  ls -lc 显示文件的Ctime
  ls -lu 显示文件的Atime

[root@master test]# ls -l 1.txt 
-rwxr-xr-x. 1 root wheel 6 Jun  2 13:22 1.txt
[root@master test]# ls -lc 1.txt 
-rwxr-xr-x. 1 root wheel 6 Jun  2 13:23 1.txt
[root@master test]# ls -lu 1.txt 
-rwxr-xr-x. 1 root wheel 6 Jun  2 13:23 1.txt

4. 可以手动创建或修改文件时间的命令

• touch

  touch有个-d 选项，可以手动指定文件时间属性，如果文件存在则修改相关时间，不存在则新建具有指定时间属性的文件。

[root@master test]# stat 2.txt 
  File: ‘2.txt’
  Size: 14        	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 9006883     Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2021-06-02 15:37:25.834000000 +0800
Modify: 2021-06-02 15:37:25.834000000 +0800
Change: 2021-06-02 15:37:25.834000000 +0800
 Birth: -

[root@master test]# ll
total 8
-rwxr-xr-x. 1 root wheel  9 Jun  2 14:06 1.txt
-rwxr-xr-x. 1 root root  14 Jun  2 15:37 2.txt
[root@master test]# touch -d "3 days ago" 2.txt 
[root@master test]# stat 2.txt 
  File: ‘2.txt’
  Size: 14        	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 9006883     Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2021-05-30 15:39:35.398907423 +0800
Modify: 2021-05-30 15:39:35.398907423 +0800
Change: 2021-06-02 15:39:35.398000000 +0800
 Birth: -

touch -a 只修改atime

touch -m 只修改mtime

[root@master test]# touch -a -d "4 days ago" 2.txt 
[root@master test]# stat 2.txt 
  File: ‘2.txt’
  Size: 14        	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 9006883     Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2021-05-29 15:43:46.228604489 +0800
Modify: 2021-05-30 15:39:35.398907423 +0800
Change: 2021-06-02 15:43:46.228000000 +0800
 Birth: -
[root@master test]# touch -m 2.txt 
[root@master test]# stat 2.txt 
  File: ‘2.txt’
  Size: 14        	Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d	Inode: 9006883     Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Context: unconfined_u:object_r:admin_home_t:s0
Access: 2021-05-29 15:43:46.228604489 +0800
Modify: 2021-06-02 15:44:33.786000000 +0800
Change: 2021-06-02 15:44:33.786000000 +0800
 Birth: -

• find

  find 后面接 -atime n,-mtime n,-ctime n即搜索到n*24小时之前的文件。

[root@master test]# find /root -atime 4
/root/test/2.txt

[root@master test]# find /root -mtime 11
/root/.bash_history

[root@master test]# find /root -ctime 11
/root/.bash_history
/root/.kube/cache/discovery/localhost_8080