Find commands for common Linux commands find--elaborate-atime,-mtime,-ctime

　　We know that everything in Linux is file, so can we see when a file was created? The answer is in the negative. So can we get some information about the time? That will have to say three times the state of the file, they are-atime,-ctime and-mtime.

First let's look at a file under Linux:

We can see that there are three information about time: Recent access Time (-atime), last changed modify time (-mtime), and recent status change Time (-ctime), Of course, we also saw that the creation time is blank and confirms that the creation time of the file cannot be viewed under the Linux system.

The following specific explanations of these three times:

Atime: It represents the time of the most recent file visit, displaying the contents of a file, or running a shell script to update the file's atime. Use the Ls-lu command to view. One thing to note is that before kernel version 2.6.30, the core developers of Linux discussed the performance of the Ext3/ext4 file system, including Atime. Before kernel 2.6.30, the file system will be updated in a timely manner by default Atime, and in later versions, only one of the following three cases will be updated atime

1. 1. Specifies that a non-relatime mode is used when mounting a partition mount
   2. When the atime is less than ctime or less than mtime
   3. This time, access time and last atime more than 24 hours

Mtime: It represents the time when the last file content was modified. Use the Ls-l command to view.

CTime: It represents the time of the most recent file state change, which is the change in status change when writing to a file, changing the owner, permission, or link settings, changing the contents of the Inode, that is, the time the file state was last changed. Use the LS-LC command to view.

To demonstrate the results of the command operation:

Now let's see what happened to Atime after viewing the file.

　　　

As you can see, the atime of the file is updated after you perform the View command cat. What if the contents of the file are changed?

After changing the contents of the file, after reviewing the details of the file, we can see that mtine and CTime have changed, so does this mean that mtime and CTime are the same? As has been said before, CTime refers to the change of the inode. Now that we have changed the contents of the file, the Mtime has changed, so CTime will change. That is to say, as long as the mtime change, CTime will certainly change. How does that make ctime change and the rest of the same? We can do this by changing the permissions of the file, the user, the owning group, and so on. Here are some examples:

Of course, since we can view the current atime, Mtime, and CTime, it is also possible to view files that have been altered or accessed within a few days or days. Linux provides us with a simple way to query, that is, +n and-N. Here is an example of-mtime:

-mtime N: = = number, meaning a file that has been changed in "One Day" before N days

-mtime +n: Lists the file name of the content that was changed before n days (excluding n days itself)

-mtime-n: Lists the file name of the content that was changed within n days (including n days itself)

For example, a file that changes the contents of a system within 24 hours is listed.

Find/-mtime 0

So, find "file name changed within 5 days" is find /-mtime-5 , find "5 days ago the day of the changed file name" is find /-mtime 5 , find "5 days ago changed file name" is Find/-mtime +5. We can see that there is no "+,-" difference is very big. Here is a diagram to illustrate:

　　by this time axis we can know that the rightmost is the current time, + 5 Represents a file name that is greater than or equal to 6 days ago, 5 represents a file name that is less than or equal to 5 days, and5 is the file name that represents the 5-6 day.

Find commands for common Linux commands find--elaborate-atime,-mtime,-ctime