this post was submitted on 16 Dec 2023
20 points (95.5% liked)

Linux

48183 readers
1375 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
20
Stat command shows birth after modify time? (lemmy.nz)
submitted 11 months ago by luthis@lemmy.nz to c/linux@lemmy.ml
6 comments fedilink hide all child comments
 

Any explanation on how this happens?

Access: 2023-12-14 07:57:28.376736001 +1300 Modify: 2023-12-14 07:50:20.783207177 +1300 Change: 2023-12-14 07:51:57.413989824 +1300 Birth: 2023-12-14 07:51:57.413989824 +1300

Just as a matter of curiosity

you are viewing a single comment's thread
view the rest of the comments
[–] cbarrick@lemmy.world 14 points 11 months ago* (last edited 11 months ago) (2 children)

FWIW, the stat structure in Linux does not include birth time [1]. It only gives you:

  1. atime: The time of last access.
  2. mtime: The time of last modification.
  3. ctime: The time of the last change to the inode.

I assume the stat command is using a filesystem-specific method to get the birth time.

Anyway, I don't think any of these stats is guaranteed to be consistent with the rest (or even correct). For example, it is common to disable atime tracking to improve I/O performance.

Assuming the data is accurate, I think the other comment about the file being a copy is the best explanation.

[–] duncesplayed@lemmy.one 4 points 11 months ago (1 children)

The stat command is using statx, which gives you a slightly different struct. statx is the cool new Linux-only system call for stat-ing. Not every filesystem will support the new btime field. (And, as you correctly say, many of those time fields are wrong, anyway)

[–] cbarrick@lemmy.world 2 points 11 months ago

Ooo neat. I was not aware of this syscall. TIL!

[–] skullgiver@popplesburger.hilciferous.nl 1 points 11 months ago

The struct returned by stat doesn't, but statx contains creation time as well as well. I believe ext4 is already tracking the creation time even if stat can't provide it.

The stat command on modern distros should get you this additional metadata, unless you use an FS that doesn't track or expose it, of course.