linux 下mtime,ctime,atime分析

一、atime、ctime与mtime

atime是指access time，即文件被读取或者执行的时间，修改文件是不会改变access time的。网上很多资料都声称cat、more等读取文件的命令会改变atime，但是我试验时却发现使用cat、more时atime没有被修改。这个问题需要另外做研究探讨。

ctime即change time文件状态改变时间，指文件的i结点被修改的时间，如通过chmod修改文件属性，ctime就会被修改。

mtime即modify time，指文件内容被修改的时间。

使用stat可以查看文件的atime、ctime、mtime。

• atime：access time文件被访问的最后时间。
• mtime：modify time文件内容被修改的时间。
• ctime：change time文件的inode内容修改的时间。

这样还是不容易理解，如果从英文解释中的函数来理解就容易分清了。例如atime中有提到execve(2)和read(2)函数，其实就是表示文件执行和读取时该时间被修改；mtime中的write(2)就表示内容写入时该时间被修改；ctime中的owner和group表示修改文件所属用户和用户组时该时间被修改。

ls -l filename  看到时间的是mtime

ls -lu filename  看到时间是atime

ls -lc  filename 看到的时间是ctime

英文解释：

Unix filesystems store a number of timestamps for each file. This means that you can use these timestamps to find out when any file or directory was last accessed (read from or written to),  changed (file access permissions were changed) or modified (written to).

atime – File Access Time

Access time shows the last time the data from a file was accessed – read by one of the Unix processes directly or through commands and scripts.

ctime – File Change Time

ctime also changes when you change file's ownership or access permissions. It will also naturally highlight the last time file had its contents updated.

mtime – File Modify Time

Last modification time shows time of the  last change to file's contents. It does not change with owner or permission changes, and is therefore used for tracking the actual changes to data of the file itself.

Timestamps are shown when using the long-format output of ls command, ls -l:

ubuntu# ls -l /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:10 /tmp/file1

This is the default output of ls -l, which shows you the time of the last file modification – mtime. In our example, file /tmp/file1 was last changed around 7:10am.

If we want to see the last access time for this file, atime – you need to use -lu options for ls. The output will probably show some later time:

ubuntu# ls -lu /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:27 /tmp/file1

In the example, it's 7:27am.

Lastly, ls -lc will show you the last time our file was changed, ctime:

ubuntu# ls -lc /tmp/file1
-rw-r--r-- 1 greys root 9 2008-04-05 07:31 /tmp/file1

$ stat test.txt
File: `test.txt'
Size: 2648461 Blocks: 5176 IO Block: 4096 regular file
Device: fd00h/64768d Inode: 1050409 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 666/autosysadmin) Gid: ( 666/autosysadmin)
Access: 2017-06-15 14:23:42.761508546 +0800
Modify: 2017-06-15 14:17:26.737508925 +0800
Change: 2017-06-15 14:23:32.946508404 +0800

touch命令可以修改atime,mtime  具体使用可以man touch