Unix & Linux Stack Exchange
Q&A for users of Linux, FreeBSD and other Unix-like operating systems
Latest Questions
6
votes
2
answers
468
views
Can I use grep or strings to find the previous atime of a file still present on my btrfs?
The metadata of this file which resides on my HDD is written by CoW, therefore can I look for it just by using grep or strings, and the filename?
The metadata of this file which resides on my HDD is written by CoW, therefore can I look for it just by using grep or strings, and the filename?
user324831
(113 rep)
Jun 1, 2025, 10:00 AM
• Last activity: Jun 11, 2025, 08:04 PM
1
votes
2
answers
3608
views
rsync keep access time (atime), how?
I am using rsync-3.2.3 on Fedora 33 (GNOME). But how can I keep the access time (`atime`) for my files and folders? I can only keep the modified time (`mtime`) with this command: rsync -t
I am using rsync-3.2.3 on Fedora 33 (GNOME).
But how can I keep the access time (
atime) for my files and folders?
I can only keep the modified time (mtime) with this command:
rsync -t
Laradu9sna7al
(11 rep)
Jan 21, 2021, 12:39 PM
• Last activity: May 15, 2023, 06:36 PM
2
votes
1
answers
543
views
Why is atime updating when equal to mtime and ctime?
I'm trying to understand how inode access time is handled with the default "relatime" mount option in Linux, but the behavior documented in [mount(8)](https://linux.die.net/man/8/mount) doesn't quite match what I see. It says: > **relatime** > > Update inode access times relative to modify or change...
I'm trying to understand how inode access time is handled with the default "relatime" mount option in Linux, but the behavior documented in [mount(8)](https://linux.die.net/man/8/mount) doesn't quite match what I see. It says:
> **relatime**
>
> Update inode access times relative to modify or change time. Access time is only updated if the previous access time was earlier than the current modify or change time. (Similar to noatime, but doesn't break mutt or other applications that need to know if a file has been read since the last time it was modified.)
I can set up a test file with the same atime/mtime/ctime:
$ touch sometestfile
$ stat sometestfile
File: sometestfile
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: 259,2 Inode: 38318274 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ user) Gid: ( 1000/ user)
Context: unconfined_u:object_r:unlabeled_t:s0
Access: 2023-03-24 16:56:56.758033579 -0400
Modify: 2023-03-24 16:56:56.758033579 -0400
Change: 2023-03-24 16:56:56.758033579 -0400
Birth: 2023-03-24 16:56:56.758033579 -0400$ cat sometestfile
$ stat sometestfile
File: sometestfile
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: 259,2 Inode: 38318274 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ user) Gid: ( 1000/ user)
Context: unconfined_u:object_r:unlabeled_t:s0
Access: 2023-03-24 16:57:02.336950126 -0400
Modify: 2023-03-24 16:56:56.758033579 -0400
Change: 2023-03-24 16:56:56.758033579 -0400
Birth: 2023-03-24 16:56:56.758033579 -0400
epiii2
(23 rep)
Mar 24, 2023, 09:15 PM
• Last activity: Mar 24, 2023, 09:58 PM
2
votes
2
answers
1856
views
How useful is it to disable access time logging on SSD and are there disadvantages doing so?
As SSD drives have limited writes, I would like to know whether disabling access time logging still plays a significant role in 2021. Most websites I see on the subject are from 2015 and before, and SSD might be more robust nowadays. I don't really realise how SSD writes are managed on Linux systems...
As SSD drives have limited writes, I would like to know whether disabling access time logging still plays a significant role in 2021. Most websites I see on the subject are from 2015 and before, and SSD might be more robust nowadays.
I don't really realise how SSD writes are managed on Linux systems with respect to cacheing, nor do I know how many files are actually concerned by those logs or whether all or only some of the accessed files are updated to include access times.
My final question concern the disadvantages of disabling access time logging. What services use access times? Will something break? Is there something I should know?
Thanks in advance!
PS: I am using Ubuntu 21.04 for daily usage on a 300 GB partition on SSD. My computer model was released mid-2020.
Johannes Lemonde
(155 rep)
Apr 21, 2021, 07:00 PM
• Last activity: Apr 22, 2021, 04:21 AM
0
votes
1
answers
1427
views
`noatime` mount option's effect on `stat` access time
I have mounted ext4 partition in Ubuntu 20.04 with noatime mount option in my /etc/fstab From `stat`: Access time doesn't change when the file is opened on the editor or modified and saved, while modification time changes. Even when the file is repeatedly modified and saved, closed and saved the Acc...
I have mounted ext4 partition in Ubuntu 20.04 with noatime mount option in my /etc/fstab
From
stat: Access time doesn't change when the file is opened on the editor or modified and saved, while modification time changes. Even when the file is repeatedly modified and saved, closed and saved the Access time doesn't change.
So, when does Access time change in noatime mounted partition? Does it ever change? Does it represent the creation time (in noatime) or when it was copied to the partition?
Porcupine
(2156 rep)
Mar 20, 2021, 07:21 PM
• Last activity: Mar 20, 2021, 11:34 PM
4
votes
2
answers
3316
views
File access time not updating in ubuntu 12.04
After using the `cat` command to read a file, I used the `stat` command to view it's changed access time, but it's not getting updated. I checked `/etc/fstab` file and there is no `noatime` on any of my drives, so why is the access time not getting updated? I'm using Ubuntu 12.04 Precise Pangolin.
After using the
cat command to read a file, I used the stat command to view it's changed access time, but it's not getting updated.
I checked /etc/fstab file and there is no noatime on any of my drives, so why is the access time not getting updated?
I'm using Ubuntu 12.04 Precise Pangolin.
Cody
(143 rep)
Dec 8, 2013, 11:09 AM
• Last activity: Jan 27, 2021, 03:51 PM
17
votes
2
answers
6368
views
Does using noatime on modern Linux make sense?
Starting from version 2.6.30 (which was released 5 years ago), Linux has the option `relatime` enabled by default. It means updates of file access time are very infrequent and prudent. But I still see [recommendations][1] to use `noatime` for databases or SSD discs. Are there any reason to change de...
Starting from version 2.6.30 (which was released 5 years ago), Linux has the option
relatime enabled by default. It means updates of file access time are very infrequent and prudent.
But I still see recommendations to use noatime for databases or SSD discs. Are there any reason to change default configuration and use it? Does it make any measurable difference compared to relatime?
valodzka
(405 rep)
Feb 3, 2014, 03:59 PM
• Last activity: Sep 28, 2020, 01:36 AM
0
votes
1
answers
413
views
Does GNU tar incremental backup save an entire file again, even if only atime or mtime is different?
``` mkdir test echo "hi" > test/file1 tar -c -f archive.0.tar -g test.snar test touch -a test/file1 # changes atime and ctime, doesn't change mtime tar -c -f archive.1.tar -g test.snar test tar -t -G -vv -f archive.1.tar # lists Y for file1 ``` So did GNU tar store the entire file again, even though...
mkdir test
echo "hi" > test/file1
tar -c -f archive.0.tar -g test.snar test
touch -a test/file1 # changes atime and ctime, doesn't change mtime
tar -c -f archive.1.tar -g test.snar test
tar -t -G -vv -f archive.1.tar # lists Y for file1
qwr
(798 rep)
Jul 10, 2020, 08:31 PM
• Last activity: Jul 12, 2020, 01:09 PM
1
votes
0
answers
460
views
Problem "atime in future"
I have a problem running Aide. After doing different tasks in the system, most notarius ones were to change user and home name and to change system's date to EST. Then I run Aide and it showed a huge list of files with flag: ```atime in future``` ``` aide# ./bin/aide --config=./aide.conf --init /bin...
I have a problem running Aide. After doing different tasks in the system, most notarius ones were to change user and home name and to change system's date to EST.
Then I run Aide and it showed a huge list of files with flag:
in futureaide# ./bin/aide --config=./aide.conf --init
/bin/sh atime in future
/etc/os-release atime in future
/etc/localtime atime in future
/etc/alternatives/python3 atime in future
/etc/alternatives/lzma atime in future
/etc/php/7.3/apache2/conf.d/20-ctype.ini atime in future
/etc/php/7.3/apache2/conf.d/20-posix.ini atime in future
/etc/php/7.3/apache2/conf.d/20-ftp.ini atime in future
/etc/php/7.3/apache2/conf.d/20-tokenizer.ini atime in future
/etc/php/7.3/apache2/conf.d/20-sysvsem.ini atime in future
/etc/php/7.3/apache2/conf.d/20-gettext.ini atime in future
/etc/php/7.3/apache2/conf.d/20-exif.ini atime in future
/etc/php/7.3/apache2/conf.d/20-sysvshm.ini atime in future
.
.
.# stat -c %x /bin/sh
2020-06-21 17:44:34.996267989 -0500# date
Mon 15 Jun 2020 06:13:28 PM EST# date +%s
1592262916
# touch -a 1592262916 /bin/sh
# stat -c %X /bin/sh
1592779474
# touch /bin/sh
# stat -c %x /bin/sh
2020-06-21 17:44:34.996267989 -0500
Ecofintech
(143 rep)
Jun 17, 2020, 04:49 PM
0
votes
1
answers
177
views
GNU tar man-page mysterious references to METHOD='replace' and METHOD='system'
My tar (GNU tar 1.28) man-page lists the --atime-preserve option, which applies to the time a file is added to the tarball. The full explanation reads thus: --atime-preserve preserve access times on dumped files, either by restoring the times after reading (METHOD='replace'; default) or by not setti...
My tar (GNU tar 1.28) man-page lists the --atime-preserve option, which applies to the time a file is added to the tarball.
The full explanation reads thus:
--atime-preserve
preserve access times on dumped files, either by restoring the times after reading (METHOD='replace'; default) or by not setting
the times in the first place (METHOD='system')
However, what is exactly meant by METHOD='replace' and METHOD='system' remains unexplained.
Can anyone shed a light on this?
Roadowl
(129 rep)
Jun 28, 2019, 04:14 PM
• Last activity: Jun 28, 2019, 04:18 PM
0
votes
1
answers
448
views
How to prevent `atime` in Linux from overwriting `Date created` in Windows on NTFS?
From Linux, if I alter files on an NTFS external HD so that I get some specific values for `mtime`, `atime` and `ctime` (readable with the `stat` command, and with `ctime = mtime` because one cannot change access permissions of files on NTFS from Linux - I think) and if I then connect the same exter...
From Linux, if I alter files on an NTFS external HD so that I get some specific values for
mtime, atime and ctime (readable with the stat command, and with ctime = mtime because one cannot change access permissions of files on NTFS from Linux - I think) and if I then connect the same external HD on a Windows 7 system, I see that Date modified = mtime (as expected) but I also get Date created = atime.
How comes atime takes the placeholder associated with the NTFS CTime timestamp, and is there a way to avoid this behavior, for example would using the noatime option on NTFS volumes be a proper solution? My goal is to be able to work from both Windows and Linux on this same external HD without mingling too much the timestamps.
**Edit**
After re-investigating the issue, it turns out that the problem is not present in the end. I must have been confused at the time I asked the question. I still leave the question as it has generated some comments and an answer.
The Quark
(402 rep)
May 17, 2019, 05:41 PM
• Last activity: May 31, 2019, 03:30 PM
4
votes
1
answers
940
views
List of applications that require atime
Without digging into the rationale behind access time tracking, its write-amplification effects in particular for SSDs, or the fact that it can be somewhat mitigated by the `relatime` and `lazytime` mount options: Can we produce a list of the (allegedly very few) applications that actually **require...
Without digging into the rationale behind access time tracking, its write-amplification effects in particular for SSDs, or the fact that it can be somewhat mitigated by the
relatime and lazytime mount options:
Can we produce a list of the (allegedly very few) applications that actually **require** atime support, and **how** (severely) they break if it's not used?
Naturally, a number of applications that **inspect** atime indirectly rely on it, in the sense that they report a wrong atime if it is not tracked (e.g., listing or forensic tools). This question should only concern applications that actually **exploit** this piece of information, rather than presenting it, and which **break** at least to some extent functionality-wise if they are used on data without atime support (e.g., the prime example of mails not shown as read).
akobel
(141 rep)
Apr 16, 2019, 10:53 AM
2
votes
1
answers
795
views
chmod without changing stat (atime) of file
i would like to be able to `chmod` a directory structure without changing the `atime` of those (files and) directories. if i start out with a file structure like $ tree test/ test/ ├── test1.txt └── text2.txt and list the `atime`s of the files and directories $ find test/ -exec stat --printf='name:...
i would like to be able to
chmod a directory structure without changing the atime of those (files and) directories.
if i start out with a file structure like
$ tree test/
test/
├── test1.txt
└── text2.txt
and list the atimes of the files and directories
$ find test/ -exec stat --printf='name: %n atime: %x\n' {} \;
name: test/ atime: 2019-02-28 11:28:24.418369586 +0100
name: test/text2.txt atime: 2019-02-28 11:28:03.609919183 +0100
name: test/test1.txt atime: 2019-02-28 11:27:58.101799544 +0100
and then chmod those with
$ chmod -R 'u=Xrw,g=Xrw,o=Xr' test
this changes the atimes of the directories (and yes, for good reasons); the mtimes remain unaffected:
$ find test/ -exec stat --printf='name: %n atime: %x\n' {} \;
name: test/ atime: 2019-02-28 11:38:30.590740343 +0100
name: test/text2.txt atime: 2019-02-28 11:28:03.609919183 +0100
name: test/test1.txt atime: 2019-02-28 11:27:58.101799544 +0100
is there a simple way to avoid that? i could of course write a script, that stores the atime before the modification and then resets it afterwards. but is there a simpler way?
hiro protagonist
(258 rep)
Feb 28, 2019, 10:45 AM
• Last activity: Feb 28, 2019, 01:01 PM
2
votes
1
answers
522
views
Why is find(ing) by -atime not printing expected files?
I'm trying to recursively find files that have not been accessed for over 365 days. I can use stat and verify that the file has not been accessed for over 365 days. It is odd that the file shows that it has been changed about 6 months ago, but again stat shows last access was over a year ago. Then I...
I'm trying to recursively find files that have not been accessed for over 365 days. I can use stat and verify that the file has not been accessed for over 365 days. It is odd that the file shows that it has been changed about 6 months ago, but again stat shows last access was over a year ago.
Then I try using the find command and searching for files that have not been accessed for over a year, but the file I verified is not listed:
skunkbad:/var/www/htdocs/newera$ stat ./index.html
File: './index.html'
Size: 31 Blocks: 8 IO Block: 4096 regular file
Device: 802h/2050d Inode: 3279283 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 1000/skunkbad) Gid: ( 1001/ webdevs)
Access: 2018-01-08 16:22:58.271143975 -0800
Modify: 2017-09-21 14:01:36.950307771 -0700
Change: 2018-06-04 09:00:36.801632639 -0700
Birth: -
skunkbad:/var/www/htdocs/newera$ find . -atime +365 -type f -print
skunkbad:/var/www/htdocs/newera$
So, in this case, why isn't this index.html file listed by find? How can I recursively find files that haven't been accessed in over 365 days?
I'm asking because I intend to issue a command that touches these files, but I need to know that it's going to work. Example for 90 days:
find -type f -atime +90 -exec touch -a {} +
Brian Gottier
(123 rep)
Jan 7, 2019, 11:02 PM
• Last activity: Jan 8, 2019, 07:49 AM
1
votes
2
answers
476
views
Does Duplicity modify atime when backing up?
My data resides on a SSD and — thanks to re-writes and [Write Amplification][1] — any modification of an atime will result in not only the inode being modified, but the whole block that it resides on being erased and rewritten. That is, obviously, undesirable as it would cause a large amount of unne...
My data resides on a SSD and — thanks to re-writes and Write Amplification — any modification of an atime will result in not only the inode being modified, but the whole block that it resides on being erased and rewritten. That is, obviously, undesirable as it would cause a large amount of unnecessary wear on the drive.
When Duplicity backs up files, does it modify the **atime** attribute of the **source files** in the process?
If it *does* modify the atime, does it do so on the initial (full) backup, the incremental backups, or both?
Tim
(782 rep)
Apr 29, 2018, 10:05 PM
• Last activity: Oct 30, 2018, 09:35 PM
6
votes
1
answers
679
views
Does a typical single-user desktop Linux system have apps requiring atime?
I've just: https://unix.stackexchange.com/questions/112319/does-using-noatime-on-modern-linux-make-sense and I'm interpreting the answer there as follows: "If you don't have applications that depend on atime's being valid, you don't need them." Thinking about my home Linux system, which doesn't serv...
I've just:
https://unix.stackexchange.com/questions/112319/does-using-noatime-on-modern-linux-make-sense
and I'm interpreting the answer there as follows: "If you don't have applications that depend on atime's being valid, you don't need them."
Thinking about my home Linux system, which doesn't serve much of anything to anyone (and I don't use a local MUA, not that I'm aware of anyway), it seems to me like I can safely set
noatime (and nodiratime). But maybe I'm wrong? Do some typically-installed apps use it still? I'm having doubts about this since I don't see why anyone would expect the OS to maintain atimes for everything just so that it can know the atime for a few files of its own.
einpoklum
(10753 rep)
Dec 25, 2017, 10:16 AM
• Last activity: Dec 25, 2017, 11:40 AM
8
votes
1
answers
10604
views
Why is EXT4 filesystem mounted with both relatime and lazytime
I'm running Debian/Testing, with kernel 4.4: # uname -a Linux shaula 4.4.0-1-amd64 #1 SMP Debian 4.4.6-1 (2016-03-17) x86_64 GNU/Linux So I want to use the `lazytime` mount option, which is why I put the following in my `/etc/fstab`: # grep vg_crypt-root /etc/fstab /dev/mapper/vg_crypt-root / ext4 l...
I'm running Debian/Testing, with kernel 4.4:
# uname -a
Linux shaula 4.4.0-1-amd64 #1 SMP Debian 4.4.6-1 (2016-03-17) x86_64 GNU/Linux
So I want to use the
lazytime mount option, which is why I put the following in my /etc/fstab:
# grep vg_crypt-root /etc/fstab
/dev/mapper/vg_crypt-root / ext4 lazytime,errors=remount-ro 0 1
However, now the filesystem seems to be mounted with *both* relatime and lazytime:
# grep vg_crypt-root /etc/mtab
/dev/mapper/vg_crypt-root / ext4 rw,lazytime,relatime,errors=remount-ro,data=ordered 0 0
How can this be?
andreas-h
(669 rep)
Apr 16, 2016, 08:36 AM
• Last activity: Aug 12, 2017, 09:30 PM
1
votes
1
answers
776
views
Changing file modification time to access time in bulk
I have a bunch of files in a directory where the modification time was changed (incorrectly) with `touch -m` The access time of these files is still close enough to what the modification time was, so I'd like to change them back. Is there a way of doing a `touch` where it sets the mtime = atime? I d...
I have a bunch of files in a directory where the modification time was changed (incorrectly) with
touch -m
The access time of these files is still close enough to what the modification time was, so I'd like to change them back.
Is there a way of doing a touch where it sets the mtime = atime? I don't want to set them all to the same timestamp, but I want to go file-by-file setting mtime = atime.
Joe
(113 rep)
Jul 16, 2017, 04:07 PM
• Last activity: Jul 16, 2017, 04:34 PM
0
votes
1
answers
250
views
List (and then delete) files that has last read-access older than 6 months
**How to list files that has last read-access older than 6 months?** Then, how to delete them? My filesystem seems to be mounted with: /dev/sda3 on /home type ext4 (rw,relatime,data=ordered)
**How to list files that has last read-access older than 6 months?** Then, how to delete them?
My filesystem seems to be mounted with:
/dev/sda3 on /home type ext4 (rw,relatime,data=ordered)
Basj
(2579 rep)
Sep 14, 2016, 10:55 PM
• Last activity: Sep 15, 2016, 12:57 PM
6
votes
1
answers
761
views
Why does my file have multiple crtime entries?
Using `ext4` filesystem I was able to read out the creation time of a file using the [approach here][1]. As a result I am indeed provided with a table featuring the `crtime` (creation time) of the inode(respective file) in question. What confuses me and to which I could not find an answer in the `ma...
Using
ext4 filesystem I was able to read out the creation time of a file using the approach here . As a result I am indeed provided with a table featuring the crtime (creation time) of the inode(respective file) in question.
What confuses me and to which I could not find an answer in the man debugfs is why it shows me 2 lines with crtime, moreover not even being the same time.
This is the output I get
[user ~] $ sudo debugfs -R "stat " /dev/sda2
debugfs 1.43.1 (08-Jun-2016)
Inode: 274742 Type: regular Mode: 0644 Flags: 0x80000
Generation: 3666549610 Version: 0x00000000:00000001
User: 1000 Group: 1000 Project: 0 Size: 0
File ACL: 0 Directory ACL: 0
Links: 0 Blockcount: 0
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
atime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
mtime: 0x57b4c632:1e30ee34 -- Wed Aug 17 22:16:50 2016
crtime: 0x57b4c4c0:afa082b0 -- Wed Aug 17 22:10:40 2016
crtime: 0x57b4c632:(1e30ee34) -- Wed Aug 17 22:16:50 2016
Size of extra inode fields: 32
Also note that the second (and not realy correct) crtime is in brackets and equals the mtime, since I saved to the file obviously twice.
humanityANDpeace
(15072 rep)
Aug 17, 2016, 08:33 PM
• Last activity: Aug 18, 2016, 04:22 PM
Showing page 1 of 20 total questions