Linux Find command-atime,-ctime,-mtime the real meaning

The meaning of-atime,-ctime,-mtime under Linux
We are often asked in forums or groups, how to view the creation date of a file under Linux or Unix?
It's often said that with the Find command plus option-ctime, the-ctime here is not the create time, but the change time.
Operating systems such as Linux or Unix do not save the creation date of the file for us.

[@[email protected]]

The meaning of-atime,-ctime,-mtime under Linux
We are often asked in forums or groups, how to view the creation date of a file under Linux or Unix?
It's often said that with the Find command plus option-ctime, the-ctime here is not the create time, but the change time.
Operating systems such as Linux or Unix do not save the creation date of the file for us.
We can take a look at the status information of the files in the Linux system, the following file I created a week ago:
[[Email protected] ~]# Stat 3
File: "3"
Size:15 blocks:8 IO block:4096 general file
device:fd00h/64768d inode:489602 links:1
Access: (0644/-rw-r--r--) Uid: (0/root) Gid: (0/root)
ACCESS:2012-07-17 22:14:55.000000000 +0800
MODIFY:2012-07-17 15:22:45.000000000 +0800
CHANGE:2012-07-17 15:22:45.000000000 +0800
As you can see, there are three times in the state of the file, respectively, Access,modify,change.
Let's look at these options under the Find command:
[[email protected] admin]$ man find
-atime N
File was last accessed n*24 hours ago. When find figures off how many 24-hour periods ago the file is last accessed, any fractional
Part was ignored, so to Match-atime +1, a file had to had been accessed at least both days ago.
-mtime N
File ' s data was last modified n*24 hours ago. See the comments For-atime to understand how rounding affects the interpretation of file
Modification times.
-ctime N
File ' s status is last changed n*24 hours ago. See the comments For-atime to understand how rounding affects the interpretation of file
Status change times.

It is found that three times is exactly the same as the three time state of the file, and the help has clearly told us its specific meaning:
Atime means access time, which is the most recent visit to a file, +n means to find files that are N days old,-N to find files within n days
For example, there is a file data4.txt that looks at its status:
[Email protected] ~]$ stat data4.txt
File: ' Data4.txt '
size:49 blocks:8 IO block:4096 Regular file
device:fd00h/64768d inode:458037 links:1
Access: (0644/-rw-r--r--) Uid: (500/oracle) Gid: (500/oinstall)
access:2012-07-10 11:46:05.000000000 +0800Modify:2012-07-10 11:44:37.000000000 +0800
Change:2012-07-10 11:44:37.000000000 +0800
Let's take a look at its contents:
[Email protected] ~]$ more Data4.txt 
"SCOTT", "F444"
"Brentt", "54GSS"
"SYS", 4566
Then look at the status of the file:
[[email protected] ~]$ stat data4.txt 
Files: ' Data4.txt '
size:49 blocks:8 IO block:4096 Regular file
device:fd00h/64768d inode:458037 links:1
Access: (06 44/-rw-r--r--) Uid: (500/oracle) Gid: (500/oinstall)
access:2012-07-22 23:21:10.000000000 +0800 modify:2012-07-10 11:44:37.000000000 +0800
change:2012-07-10 11:44:37.000000000 +0800
can be found, as long as you view the contents of the file, Either More,cat,vi, the file's access time will be updated.

Mtime better understand, for modify time, that is, the latest modification of the file data, refers to the latest modification time of the file content.
[[email protected] ~]$ stat ctl1.txt
File: ' ctl1.txt '
size:288 blocks:8 IO block:4096 regular file
De vice:fd00h/64768d inode:458031 links:1
Access: (0644/-rw-r--r--) Uid: (500/oracle) Gid: (500/oinstall)
Access: 2012-07-22 23:46:05.000000000 +0800
modify:2012-07-10 11:44:05.000000000 +0800 Change: 2012-07-10 11:44:05.000000000 +0800
Edit the file:
[[email protected] ~]$ echo "" >>ctl1.txt
[email  protected] ~]$ stat ctl1.txt 
File: ' ctl1.txt '
size:291 Blocks : 8 IO block:4096 Regular file
device:fd00h/64768d inode:458070 links:1
Access: (0644/-rw-r--r--) Uid: (500/or Acle) Gid: (500/oinstall)
access:2012-07-22 23:46:05.000000000 +0800
modify:2012-07-22 23:46:31.000000000 +0800
change:2012-07-22 23:46:31.000000000 +0800 The Modify and change time of the found file changed, Time is discussed below.

The CTime means the change time, the state of the file is updated. Is the status of the file change time, what is the status of the file?
We all know that the file has some basic properties, permissions, user, group, size, modification time, etc., as long as the information changes, then the CTime will change,
So the above changes in the contents of the file why CTime will change, because its mtime has changed, Mtime is also a file status.
The file status can be viewed through ls-l:
[Email protected] ~]# Ls-l 3
-rw-r--r--1 root root 15 07-17 15:22 3
The change time for the following file is 2012-07-17:
[[Email protected] ~]# Stat 3
File: "3"
Size:15 blocks:8 IO block:4096 general file
device:fd00h/64768d inode:489602 links:1
Access: (0644/-rw-r--r--) Uid: (0/root) Gid: (0/root)
ACCESS:2012-07-17 22:14:55.000000000 +0800
MODIFY:2012-07-17 15:22:45.000000000 +0800
change:2012-07-17 15:22:45.000000000 +0800Let's change its permissions:
[Email protected] ~]# chmod 755 3
Let's take a look at its change time:
[[Email protected] ~]# Stat 3
File: "3"
Size:15 blocks:8 IO block:4096 general file
device:fd00h/64768d inode:489602 links:1
Access: (0755/-rwxr-xr-x) Uid: (0/root) Gid: (0/root)
ACCESS:2012-07-17 22:14:55.000000000 +0800
MODIFY:2012-07-17 15:22:45.000000000 +0800
change:2012-07-22 23:17:40.000000000 +0800To change its users:
[Email protected] ~]# Chown oracle.root 3
[[Email protected] ~]# Stat 3
File: "3"
Size:15 blocks:8 IO block:4096 general file
device:fd00h/64768d inode:489602 links:1
Access: (0755/-rwxr-xr-x) Uid: (500/oracle) Gid: (0/root)
ACCESS:2012-07-17 22:14:55.000000000 +0800
MODIFY:2012-07-17 15:22:45.000000000 +0800
change:2012-07-22 23:33:59.000000000 +0800and change the group it belongs to:
[Email protected] ~]# CHGRP Oinstall 3
[email protected] ~]# LL
Total 4
-rwxr-xr-x 1 Oracle Oinstall 15 07-17 15:22 3
[[Email protected] ~]# Stat 3
File: "3"
Size:15 blocks:8 IO block:4096 general file
device:fd00h/64768d inode:489602 links:1
Access: (0755/-rwxr-xr-x) Uid: (500/oracle) Gid: (500/oinstall)
ACCESS:2012-07-17 22:14:55.000000000 +0800
MODIFY:2012-07-17 15:22:45.000000000 +0800
change:2012-07-22 23:36:14.000000000 +0800It is found that change time changes whenever any information in the Ls-l is modified.

Summary: The CTime in the Find command is not the creation time, but the file state change time. The time of the file is three attributes for access time,modify times and change.

http://blog.itpub.net/26675752/viewspace-1058878/

Linux Find command-atime,-ctime,-mtime the real meaning