Linux basic knowledge file Timestamp and touch usage

Linux basic knowledge file Timestamp and touch usage

 

The timestamp of a file is contained in its metadata and belongs to its own property information.
The file timestamp contains three types of time:
Acess time access time
Modify time modification time (more specifically, the time when data is modified)
Change time (the time when metadata is modified)

 

Modify time is abbreviated as mtime. mtime is different from ctime. When the file attribute information changes, for example, the file name, file path, and file owner, it changes ctime; when the file content is changed, mtime changes.

 

Popular Science:
Metadata concept:
Metadata (Metadata), also known as intermediary data and relay data, is the data about data, which mainly describes the property information, it is used to support functions such as storage locations, historical data, resource searches, and file records. Metadata is an electronic directory. In order to compile a directory, you must describe and add the content or characteristics of the data to it, so as to facilitate data retrieval. Dublin Core Metadata Initiative (DCMI) is an application of Metadata. It was developed by the international library computer center (OCLC) in February 1995) the Seminar, jointly sponsored by the National Center for Supercomputing Applications, NCSA, invited 52 librarians and computer experts to jointly develop specifications, create a set of features that describe electronic files on the network. Metadata is information about data organization, data domains, and their relationships. In short, metadata is data about data.

Understanding the concept of the file timestamp helps you locate the problem quickly when a fault occurs.
How to view the file Timestamp
Command: stat. It is used to view the file system status.
Modify the file Timestamp
Command: touch
To get a more detailed understanding of touch, the main usage of touch in man is as follows (Omitted, only common function items are listed)
NAME
Touch-change file timestamps
SYNOPSIS
Touch [OPTION]... FILE...
DESCRIPTION
Update the access and modification times of each FILE to the current
Time.
A file argument that does not exist is created empty, unless-c or-h
Is supplied.
A file argument string of-is handled specially and causes touch
Change the times of the file associated with standard output.
Mandatory arguments to long options are mandatory for short options
Too.
-A change only the access time to modify atime
-D, -- date = STRING
Parse STRING and use it instead of current time
-H, -- no-dereference only modifies the timestamp of the linked file and has no effect on the source file of the link.
Affect each symbolic link instead of any referenced file (useful
Only on systems that can change the timestamps of a symlink)
-M change only the modification time modify mtime
-R, -- reference = FILE: The timestamp of this FILE is consistent with the timestamp of the specified FILE.
Use this file's times instead of current time
-T STAMP
Use [[CC] YY] MMDDhhmm [. ss] instead of current time

 

Of course, a major function of touch is to create a new file in the format:
Touch filename is created if the file does not exist.

 

How to modify the file Timestamp and view the actual functions of the above options through experiments
The following lab environments are in CentOS6.8,
Preparations before the experiment:
/Test directory/test/file1 File
[Root @ centos6 test] # pwd
/Test
[Root @ centos6 test] # ll
Total usage 0
-Rw-r --. 1 root 0 July 28 21:43 file1

 

Prerequisites.
First, check the file attributes of file file1, especially the timestamp.
[Root @ centos6 test] # stat file1
File: "file1"
Size: 0 Blocks: 0 IO Block: 4096 common Empty files
Device: 803 h/2051d Inode: 266584 Links: 1
Access: (0644/-rw-r --) Uid: (0/root) Gid: (0/root)
Access: 21:43:53. 554651380 + 0800
Modify: 21:43:53. 554651380 + 0800
Change: 21:43:53. 554651380 + 0800

 

Modify atime first

 

123456789 [root @ centos6 test] # touch-a-t 201009200930 file1
[Root @ centos6 test] # stat file1
File: "file1"
Size: 0 Blocks: 0 IO Block: 4096 common Empty files
Device: 803 h/2051d Inode: 266584 Links: 1
Access: (0644/-rw-r --) Uid: (0/root) Gid: (0/root)
Access: 09:30:00. 000000000 + 0800
Modify: 21:43:53. 554651380 + 0800
Change: 21:48:15. 589652240 + 0800

 

-If a is specified as atime-t, it specifies the specific time for modification to modify atime. The two must be used together.
The result shows that atime is changed and ctime is also changed. Because the attribute information of file1 in the file is changed, as long as the information about the timestamp is modified, ctime is changed, the time when the system changes is the current time of the modification.
Modify mtime below
[Root @ centos6 test] # touch-m-t 201607180830 file1
[Root @ centos6 test] # stat file1
File: "file1"
Size: 0 Blocks: 0 IO Block: 4096 common Empty files
Device: 803 h/2051d Inode: 266584 Links: 1
Access: (0644/-rw-r --) Uid: (0/root) Gid: (0/root)
Access: 09:30:00. 000000000 + 0800
Modify: 08:30:00. 000000000 + 0800
Change: 21:51:21. 598641893 + 0800

 

The mtime is changed, and the ctime is also changed.
Run cat to view the file1 file.
123456789 [root @ centos6 test] # cat file1
[Root @ centos6 test] # stat file1
File: "file1"
Size: 0 Blocks: 0 IO Block: 4096 common Empty files
Device: 803 h/2051d Inode: 266584 Links: 1
Access: (0644/-rw-r --) Uid: (0/root) Gid: (0/root)
Access: 21:53:00. 418655120 + 0800
Modify: 08:30:00. 000000000 + 0800
Change: 21:51:21. 598641893 + 0800

 

Because the file1 file is empty, nothing is displayed, but we find that atime has changed, and its change time is the current system time.
Atime time changes because the read attribute of the file is triggered.
Next we will add the write content in the file1 file.
[Root @ centos6 test] # echo www> file1
[Root @ centos6 test] # stat file1
File: "file1"
Size: 4 Blocks: 8 IO Block: 4096 common file
Device: 803 h/2051d Inode: 266584 Links: 1
Access: (0644/-rw-r --) Uid: (0/root) Gid: (0/root)
Access: 21:53:00. 418655120 + 0800
Modify: 21:55:22. 358651684 + 0800
Change: 21:55:22. 358651684 + 0800

 

The results show that both mtime and ctime are changed because the file data is modified and the data content and metadata are changed.

 

Actual Effect of Timestamp
There are not many timestamps in the actual production environment, but sometimes atime time is earlier than the system time due to system exceptions, that is, atime is the future time in the system, in this case, the file cannot be read normally. At this time, you need to manually refresh the atime of the file.
Refresh atime command
Touche-a file

 

Refresh mtime command
Touche-m file

 

The file time after refresh is automatically updated to the current time of the system.

 

Although the role of the timestamp is irrelevant to the general administrator, hackers pay great attention to it. How to successfully intrude into the system and do not find any signs of intrusion after success or failure, it is critical to modify the timestamp reasonably.

This article permanently updates the link address: