Topics: AIX, System Admin

The creation date of a UNIX file

UNIX doesn't store a file creation timestamp in the inode information. The timestamps recorded are the last access timestamp, the last modified timestamp and the last changed timestamp (which is the last change to the inode information). When a file is brand new, the last modified timestamp will be the creation timestamp of the file, but that piece of information is lost as soon as the file is modified in any way.

To get this information, use the istat command, for example for the /etc/rc.tcpip file: 

# ls -li /etc/rc.tcpip
 8247 -rwxrwxr-- 1 root  system   6607 Jan 06 06:25 /etc/rc.tcpip
Now you know the inode number: 8247. 
# istat /etc/rc.tcpip
Inode 8247 on device 10/4       File
Protection: rwxrwxr--
Owner: 0(root)          Group: 0(system)
Link count:   1         Length 6607 bytes

Last updated:   Wed Jan  6 06:25:49 PST 2010
Last modified:  Wed Jan  6 06:25:49 PST 2010
Last accessed:  Tue May  4 14:00:37 PDT 2010
The same type of information can be found using the fsdb command. Start the fsdb command with the file system where the file is located; in the example below the root file system. Then type the number of the inode, followed by "i": 
# fsdb /
File System:                                /
File System Size:                      2097152  (512 byte blocks)
Disk Map Size:                              20  (4K blocks)
Inode Map Size:                             38  (4K blocks)
Fragment Size:                            4096  (bytes)
Allocation Group Size:                    2048  (fragments)
Inodes per Allocation Group:              4096
Total Inodes:                           524288
Total Fragments:                        262144

8247i
i#:   8247  md: f---rwxrwxr--  ln:    1  uid:    0  gid:    0
szh:        0  szl:     6607  (actual size:     6607)
a0: 0x1203      a1: 0x1204      a2: 0x00        a3: 0x00
a4: 0x00        a5: 0x00        a6: 0x00        a7: 0x00
at: Tue May 04 14:00:37 2010
mt: Wed Jan 06 06:25:49 2010
ct: Wed Jan 06 06:25:49 2010




If you found this useful, here's more on the same topic(s) in our blog:


UNIX Health Check delivers software to scan Linux and AIX systems for potential issues. Run our software on your system, and receive a report in just a few minutes. UNIX Health Check is an automated check list. It will report on perfomance, capacity, stability and security issues. It will alert on configurations that can be improved per best practices, or items that should be improved per audit guidelines. A report will be generated in the format you wish, and the report includes the issues discovered and information on how to solve the issues as well.

Interested in learning more?