linux中如何查看文件创建时间

linux中默认可以查看到文件的mtime, ctime and atime，linux中对于对于EXT4文件系统类型，我们也可以查看文件的创建时间crtime，

mtime – last modification time 文件内容修改时间

ctime – last change time 这里不是createtime，是变动时间，例如文件内容、文件权限权限等的变更时间

atime – last access time 上次被访问时间

crtime– create time 文件创建时间

对于EXT4文件系统类型我们可以查看文件创建时间crtime，方法如下：

1，使用df -T 命令查看系统分区的文件系统类型

这个是最简单的命令，文件系统类型在Type列输出。只可以查看已经挂载的分区和文件系统类型。如下所示：

[root@root008 ~]# df -T 
/dev/sda1      xfs         508580    63024    445556  13% /boot
/dev/sdc1      ext4       139203080  8699072    123409840  7% /opt/app/log

2，查找文件的inode编号

查找使用下面的命令终端的任何文件的inode号。

# ls -i /opt/app/log/server.log

15 /opt/app/log/server.log

第2步：查找文件创建时间（crtime）

# debugfs -R 'stat ' /dev/sdc1

命令说明：其中inode_number就是上面2步骤中获取到的文件inode编号，

/dev/sdc1是文件所在的文件系统名称，这两个一定要和要查看的文件对应

执行命令，就可以看到crtime字段（文件创建时间）：

# debugfs -R 'stat <15>' /dev/sdc1
debugfs 1.41.12 (17-May-2010)
Inode: 13377   Type: regular    Mode:  0600   Flags: 0x80000
Generation: 2326794244    Version: 0x00000000:00000001
User:     0   Group:     0   Size: 223317
File ACL: 0    Directory ACL: 0
Links: 1   Blockcount: 440
Fragment:  Address: 0    Number: 0    Size: 0
 ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
 atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
 mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013
crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011
Size of extra inode fields: 28
Extended attributes stored in inode body:
  selinux = "system_u:object_r:var_log_t:s0 00" (31)
EXTENTS:
(0-24): 35008-35032, (25-54): 164224-164253
引申阅读：
1，查看文件mtime, ctime and atime，转载自：  https://www.cnblogs.com/lfree/p/13930375.html#4753947

--//大家都知道linux 文件系统的文件存在3个时间mtime, ctime and atime。简单解析如下： --//https://linoxide.com/file-system/file-timestamps-mtime-ctime-atime-linux/ mtime – Last modification time Mtime or modification time is the time of the last change to the file contents. 'Modification' means something inside the file was amended or deleted, or new data was added. ctime – last change time Ctime is the changed timestamp referring to changes made to attribute of a file such as ownership, access permission. It's the time at which the metadata related to the file changed. --//以前我总是理解c表示create，这是不对的。 atime – last access time Atime or access timestamp is the last time a file was read, read by one of the processes directly or through commands and scripts. --//通过一个简单的例子说明: \1. 使用stat命令，这个是最简单的方法： $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-04-29 08:51:47.000000000 +0800 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2019-12-30 09:41:44.000000000 +0800 $ chmod 664 z6.txt --//相当于修改ctime时间。 $ stat z6.txt File:z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-04-29 08:51:47.000000000 +0800 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:11:28.000000000 +0800 2.使用ls： $ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt --> mtime -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt --> ctime -rw-rw-r-- 1 oracle oinstall 2652 2020-04-29 08:51:47 z6.txt --> atime --//注意这个参数不能连用。也就是ls -l 缺省显示的mtime时间。 3.使用debugfs，不推荐这样的方式： # mount | column -t /dev/cciss/c0d0p2 on / type ext3 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) /dev/cciss/c0d0p6 on /u01 type ext3 (rw) /dev/cciss/c0d0p1 on /boot type ext3 (rw) tmpfs on /dev/shm type tmpfs (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) tmpfs on /mnt/ramdisk type tmpfs (rw,size=8G) # debugfs -R 'stat /home/oracle/hrp430/testz/z6.txt' /dev/cciss/c0d0p2 debugfs 1.39 (29-May-2006) Inode: 9209574 Type: regular Mode: 0664 Flags: 0x0 Generation: 1719813277 User: 502 Group: 502 Size: 2652 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5fa35f50 -- Thu Nov 5 10:11:28 2020 atime: 0x5ea8cfa3 -- Wed Apr 29 08:51:47 2020 mtime: 0x5e0955d8 -- Mon Dec 30 09:41:44 2019 BLOCKS: (0):9216200 TOTAL: 1 4.补充测试： $ cat z6.txt $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:19:23.000000000 +0800 -->改变了atime时间 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:11:28.000000000 +0800 $ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:19:23 z6.txt　-->atime. --//实际上了解这些时间属性，可以知道什么时候做了一些改动，正常系统还是没有问题。 --//不过对于高手可以通过touch改动。 \# man touch ... DESCRIPTION Update the access and modification times of each FILE to the current time. Mandatory arguments to long options are mandatory for short options too. -a change only the access time -c, --no-create do not create any files -d, --date=STRING parse STRING and use it instead of current time -f (ignored) -m change only the modification time -r, --reference=FILE use this file's times instead of current time -t STAMP use [[CC]YY]MMDDhhmm[.ss] instead of current time --time=WORD change the specified time: WORD is access, atime, or use: equivalent to -a WORD is modify or mtime: equivalent to -m --help display this help and exit --version output version information and exit Note that the -d and -t options accept different time-date formats. If a FILE is -, touch standard output. --// -a 改变atime，-m 改变mtime,ctime如何使用touch修改不知道。简单测试： $ touch -a z6.txt $ stat z6.txt File:z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:26:49.000000000 +0800

Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:26:49.000000000 +0800 --//实际上ctime，atime都修改了。 $ touch -m z6.txt $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:27:40.000000000 +0800 Modify: 2020-11-05 10:28:41.000000000 +0800 Change: 2020-11-05 10:28:41.000000000 +0800 --//实际上ctime，mtime都修改了。 $ touch --time=ctime z6.txt touch: invalid argumentctime' for `--time' Valid arguments are:

• atime',access', `use'
• mtime',modify' Try `touch --help' for more information.

2，linux查看分区文件系统类型的几种方法，转载自：https://blog.csdn.net/weixin_43223076/article/details/84454756

在Linux 中如何查看分区的文件系统类型，下面总结几种查看分区文件系统类型的方法。

1、df -T 命令查看

这个是最简单的命令，文件系统类型在Type列输出。只可以查看已经挂载的分区和文件系统类型。如下所示：

[root@mylnx008 ~]# df -T /dev/sdb
Filesystem     Type 1K-blocks    Used Available Use% Mounted on
/dev/sdb       xfs  315467264 4356404 311110860   2% /mysql
[root@mylnx008 ~]# df -T
Filesystem     Type     1K-blocks     Used Available Use% Mounted on
/dev/sda2      xfs       30929148 22455300   8473848  73% /
devtmpfs       devtmpfs   1746644        0   1746644   0% /dev
tmpfs          tmpfs      1757220        0   1757220   0% /dev/shm
tmpfs          tmpfs      1757220    24868   1732352   2% /run
tmpfs          tmpfs      1757220        0   1757220   0% /sys/fs/cgroup
/dev/sda1      xfs         508580    63024    445556  13% /boot
/dev/sdc1      ext4     139203080  8699072 123409840   7% /mnt/resource
tmpfs          tmpfs       351448        0    351448   0% /run/user/1000
/dev/sdb       xfs      315467264  4356404 311110860   2% /mysql

2、parted -l命令查看

如下所示，parted -l 命令会输出文件系统类型（File system）， 其中参数l表示列出所有设备的分区信息。

[root@DB-Server ~]# parted -l
Model: ATA ST500DM002-1BD14 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number  Start   End    Size   Type     File system  Flags
1      32.3kB  107MB  107MB  primary  ext3         boot
2      107MB   500GB  500GB  primary               lvm

3、blkid命令查看

查看已格式化分区的UUID和文件系统。使用blkid可以输出分区或分区的文件系统类型，查看TYPE字段输出。

[root@DB-Server ~]# blkid
/dev/mapper/VolGroup00-LogVol01: TYPE="swap"
/dev/mapper/VolGroup00-LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3"
/dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3"
/dev/VolGroup00/LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3"
/dev/VolGroup00/LogVol01: TYPE="swap"
/dev/mapper/VolGroup00-LogVol03: UUID="f037ba1e-77a1-439a-8a10-b78c3cca68ec" SEC_TYPE="ext2" TYPE="ext3"
[root@DB-Server ~]# blkid  /dev/sda1
/dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3"

4、命令lsblk -f 查看

有些系统可能没有这个命令，需要安装。注意：lsblk -f也可以查看未挂载的文件系统类型

[root@mylnx008 ~]# lsblk -f
NAME   FSTYPE LABEL UUID                                 MOUNTPOINT
fd0
sda
├─sda1 xfs          b98659b2-5f8c-493e-9304-658905ef1391 /boot
└─sda2 xfs          b7559ac5-b3a4-4b00-b98a-a2a2611806d0 /
sdb    xfs          6fcc5417-3c1b-4c71-aac7-344bac7654a4 /mysql
sdc
└─sdc1 ext4         1ad7da45-2366-4c4f-acd4-484600c4153a /mnt/resource