Linux: How does file modification time affect directory modification time and directory access time

bash-scriptingdate-modifiedfindredhat-enterprise-linux

I would like to learn more about how file access time and file modification time related to directory access and modification times.

I did read the "questions allowed here" but if there is a better StackExchange site for this question please let me know. This is not an Ubuntu system so askubuntu.com is out.

System:

  • Redhat Enterprise Linux 5.5.56. No we can't upgrade, please do not ask about that.
  • I try to stick with bash.
  • find version 4.2.27

Problem: I want to make a bash script where, starting in the current directory where the script is run, I want to list directories and subdirectories that have not been modified for at least 300 days. These directories that I'm checking for contain files that MIGHT be have a modification time later than the directory modification time. I want to list only directory names that contain 'JOB' but not 'DIV', case sensitive.

Note: Our directories are arranged like this: CLS_xxx dirs will contain many GRP_xxx dirs. GRP_xxx dirs will contain many JOB_xxx dirs. JOB_dirs might contain many DIV_xxx dirs. So while I might be in the dir that contains all the CLS dirs, I only want to show dirs that contain JOB. 

/path/to/containerdir/
  CLS_xxx/
    GRP_xxx/
      JOB_xxx/
        Files under here might be modified later than the JOB_xxx dir.
        DIV_xxx/
          files under DIV/ might be modified later than the JOB_xxx dir.

Clear as mud? 🙂

Questions:

  • If a file is modified inside a directory, called JOB_1234, how does that affect the directory modification time?
  • Does changing a file affect the directory access time? Should I be using directory access time with find?
  • Is there even a switch for directory access time because I didn't see one in the man page my system has.
  • At what point is the directory mod time changed? When we change permissions on it? Change owners or group? Anything else?
  • When is the directory access time changed? When a file inside the dir is accessed or changed?

I was reading the man page for find but didn't find my answer. I also read about 8 pages from my Google search about find and didn't find my answer there either.

This command works fine for finding directory mod times > 300 days. 

find . -type d -print -mtime +300 | grep -v 'DIV' | grep -P 'JOB' | sort > $outfile

But my question is more around, what if files inside the dir were modified more recently? Given a dir that starts with JOB_, how can I find the most recent file or dir modification time of each JOB_ dir and the files within that JOB_ dir?

Thank you.

Best Answer

Many questions, so I'm going to answer the "how does it work" part, not "how do I get this working."

This is dependent on the file system used. I'm answering based on ext[234], others probably work the same way or similarly.

  1. No, the directory modification time doesn't change if a file is modified. The directory is not modified in this case in any way, it still contains the same files, directories etc linked to it.

  2. The same as previous, if "changing a file" means the same as "modifying some file."

    If you remove a file and add a new one with the same name, or move another file "on top" of another, then the directory is modified.

  3. When the directory is modified. This means linking/unlinking inodes into it, like files or subdirectories.

    Permission changes alter the change time, but not modification time. These are different.

    If you move the directory elsewhere, the change time will change, but modification time won't.

  4. Directory access time is changed when the directory is accessed, if it hasn't been turned off. The volume might be mounted with noatime which means no last access time is written usually. Note that directory data is also cached.

    Also if you just access a subdirectory, the access time on the parent(s) doesn't change.

So if you search for directories not changed in the past 300 days, they might still contain files that have changed. File creation or removal hasn't happened, but editing contents may have. You will have to check by files as you said.

Related Question