Understanding atime mtime ctime

All files have three time information and are stored in the file system atime (access time)
Is the last read time of the file or the execution time of the file mtime (Modified Time)
Is the last time the file was written (it was changed as the file content was changed when the file was written) ctime (create time)
The last write time of the I-node information.
When a file is written, the owner, permission, or link settings are changed as inode Content Changes

When you use the ext3 file system, if the noatime parameter is used during mount, the atime information will not be updated.

These three time stamps are stored in inode. if you only read a file, it will only modify atime (the execution of an executable file will also change its atime). Generally, mtime is modified, inode will change (touch-m can only change the mtime instead of the ctime). Since inode is changed, the ctime will be changed. the reason why noatime is used in mount option is that you do not want to make too many modifications to file system to improve the efficiency of compaction. in the mount option, there is no noctime or nomtime conclusion: Changing the file content will change the mtime and ctime, atime may not be changed. For example, clearing a File> tempctime may be changed without any change in mtime-when the permission is changed, however, when the file content is not changed, ctime is used to change the file name. Generally, ctime is used to change the mtime without changing the mtime. However, only modified time is changed for touch-TM time file, instead of ctime.

Application:
1> using the Mount Option noatime can improve reading performance

2> Use ls to sort the file time attribute
Ls-LC: list the ctime of files, and sort LS-LTC.
Ls-lu lists the atime of files and sorts LS-LTU.
The time listed in LS-L is mtime.
List the mtime of a file and sort it by LS-lt

3> Find
Find the file that has been modified within one day, and use ctime because the operation that may change the attribute will change ctime without changing mtime.
Shell> find./-ctime-1If you want to find the file whose ctime was changed between the day before yesterday and yesterdayUse touch to find two files and use find, but touch cannot change the ctime of the file. Only mtime and atime can be changed.
The find parameter newer compares the mtime

Suppose it's 01122000, January 1, January 12 ,. Shell> touch-MT 01112000 filename Shell> touch-MT 01102000 filename [Root @ localhost test] # Find./-newer t3dayago! -Newer tempnow ./Tempnow ./Tyesterday ./T2dayago [Root @ localhost test] # Find./-newer t3dayago ./ ./Tempnow ./Tyesterday ./Note ./T2dayago