[Techtalk] find ctime after mtime

[R. Daneel Olivaw]

Hi there,

[...]

> I found this:
> To see what the values of mtime, atime, ctime are use:
> ls -lt   (mtime)
> ls -lu   (atime)
> ls -lc   (ctime)
> 
> and ctime was AFTER mtime.  Has anyone seen anything like this before
> or should I suspect this might be a deeper (hardware?) issue?

atime, ctime and mtime are different things.

atime tells when the file has last been accessed (by the 'find' command
for instance) this does not mean the file has changed, just that it's
entry in the directory has been accessed.

mtime is modification time, it tells when the file content has
last changed.

ctime works almost like mtime, but also includes inode modifications to
the file, like ownership changes, file permissions, ...

Therefore, mtime is the most useful if you want to backup files when
their content changes, while ctime catches more file changes.


'find /home/webservice/backups/ -mtime +5 -exec rm -f {} \;'

will delete any file with content that had not changed for 5 days from
now.


'find /home/webservice/backups/ -ctime +5 -exec rm -f {} \;'

will delete any file that has been untouched for 5 days.

An easy example of what could breake the 'ctime +5' match would be a
daily maintenance script that does something like this:
'chown -R somuser:somegroup /home/webservice/backups/'
hereby forcing the files permissions and doing so forcing an inode
change. Same would be done by a chmod. 'ctime +5' would never catch the
files.

Hope this helps,

R. Daneel Olivaw,
The Human Robot Inside.