mtime, ctime and atime in Linux: What’s the Difference
Use the correct one for a certain scenario
Many Linux operations are based on timestamps of files. For example, when you need to delete some old log files of a Linux server, you must pick the files based on correct timestamps to avoid deleting something unexpectedly. To be honest, I really deleted files mistakenly because of checking them by wrong timestamps when I was a junior developer. 😳
As an old saying goes, greatness is in the details. It’s very easy to understand the different types of timestamps in Linux, but you may pay a high price (like myself 😄) if you ignore it.
Basically, there are 3 different timestamps in a Linux system:
- Access timestamp (atime)
- Modified timestamp (mtime)
- Change timestamp (ctime)
This article will explain all the above 3 types and their common usages.
Access Timestamps — atime
The atime indicates the last time when a file was read, including reading by users directly or through commands or scripts.
To check the atime of files, we can use the following command:
ls -lu
