[comp.unix.wizards] find: ctime & mtime

dan@hrc.UUCP (Dan Troxel VP) (12/20/88)

What is the difference of the find options ctime and mtime?
How will the two different options give me two differnt listings?
Or will they?
Should I use atime, to be safe, when I do incremental backups every night?
-- 
Dan Troxel VP of Computer Operations @ 
Handwriting Research Corporation - 2821 E. Camelback Road Suite 600
Phoenix, AZ  85016       WK 1-602-957-8870        HM 1-602-435-1240
UUCP : asuvax!hrc!dan

ark@alice.UUCP (Andrew Koenig) (12/20/88)

In article <388@hrc.UUCP>, dan@hrc.UUCP (Dan Troxel VP) writes:

> What is the difference of the find options ctime and mtime?

mtime is the last time the file was changed;
ctime is the last time the file's inode was changed.
Among the operations that will change the inode of a file
without changing the file are adding or deleting a link.
Thus, for example, renaming a file will change ctime but not mtime.


> Should I use atime, to be safe, when I do incremental backups every night?

ctime is almost surely best.
-- 
				--Andrew Koenig
				  ark@europa.att.com

guy@auspex.UUCP (Guy Harris) (12/21/88)

>What is the difference of the find options ctime and mtime?
>How will the two different options give me two differnt listings?
>Or will they?
>Should I use atime, to be safe, when I do incremental backups every night?

The difference between the "find" options is the same as the difference
between the "(inode) change time" and "modified time" of a file; see,
for instance, STAT(2).

The "modified time" is updated when a file's contents are modified,
either by writing to the file or by truncating it ("creat", "open" with
O_TRUNC, "(f)truncate" for folks lucky enough to have it).  The "(inode)
change time" is updated whenever the file's inode is changed; this
includes changing the link count (e.g. linking to it and, at least on
many systems, renaming it), changing the permissions on it, etc..  It
also is updated when the file is written to.

As such, "ctime" will list more files than "mtime" does; I would suggest
using "ctime", since that will back up files that have been e.g.
renamed, or have had their mode changed, so that restoring from the
backup restores those changes.

Using "atime" is probably a bad idea, since that will list every file
that somebody *looked at* in the given amount of time; this is a bit
excessive.

lml@cbnews.ATT.COM (L. Mark Larsen) (12/21/88)

In article <388@hrc.UUCP> dan@hrc.UUCP (Dan Troxel VP) writes:
>
>What is the difference of the find options ctime and mtime?
>How will the two different options give me two differnt listings?
>Or will they?
>Should I use atime, to be safe, when I do incremental backups every night?
>-- 
>Dan Troxel VP of Computer Operations @ 
>Handwriting Research Corporation - 2821 E. Camelback Road Suite 600
>Phoenix, AZ  85016       WK 1-602-957-8870        HM 1-602-435-1240
>UUCP : asuvax!hrc!dan

The three times are stored in the inode:
atime - the last time the contents of a file were accessed
mtime - the last time the contents of a file were changed
ctime - the last time the inode associated with a file was changed

Whenever a file is read, modified or the permissions or ownership are changed,
the ctime is updated.  The ctime is only updated by the operating system,
the other two times can be set arbitraily using touch(1).  Generally, it
is best to use the mtime option to find files that have really changed.

L. Mark Larsen
att!atlas!lml
lml@atlas.att.com