linux中如何查看文件创建时间
linux中默认可以查看到文件的mtime, ctime and atime，linux中对于对于EXT4文件系统类型，我们也可以查看文件的创建时间crtime，
mtime – last modification time 文件内容修改时间
ctime – last change time 这里不是createtime，是变动时间，例如文件内容、文件权限权限等的变更时间
atime – last access time 上次被访问时间
crtime– create time 文件创建时间
对于EXT4文件系统类型我们可以查看文件创建时间crtime，方法如下：
1，使用df -T 命令查看系统分区的文件系统类型
这个是最简单的命令，文件系统类型在Type列输出。只可以查看已经挂载的分区和文件系统类型。如下所示：
[root@root008 ~]# df -T /dev/sda1 xfs 508580 63024 445556 13% /boot /dev/sdc1 ext4 139203080 8699072 123409840 7% /opt/app/log
2，查找文件的inode编号
查找使用下面的命令终端的任何文件的inode号。
# ls -i /opt/app/log/server.log
15 /opt/app/log/server.log
第2步：查找文件创建时间（crtime）
# debugfs -R 'stat ' /dev/sdc1
命令说明：其中inode_number就是上面2步骤中获取到的文件inode编号，
/dev/sdc1是文件所在的文件系统名称，这两个一定要和要查看的文件对应
执行命令，就可以看到crtime字段（文件创建时间）：
# debugfs -R 'stat <15>' /dev/sdc1 debugfs 1.41.12 (17-May-2010) Inode: 13377 Type: regular Mode: 0600 Flags: 0x80000 Generation: 2326794244 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 223317 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 440 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "system_u:object_r:var_log_t:s0 00" (31) EXTENTS: (0-24): 35008-35032, (25-54): 164224-164253 引申阅读： 1，查看文件mtime, ctime and atime，转载自： https://www.cnblogs.com/lfree/p/13930375.html#4753947
--//大家都知道linux 文件系统的文件存在3个时间mtime, ctime and atime。简单解析如下： --//https://linoxide.com/file-system/file-timestamps-mtime-ctime-atime-linux/ mtime – Last modification time Mtime or modification time is the time of the last change to the file contents. 'Modification' means something inside the file was amended or deleted, or new data was added. ctime – last change time Ctime is the changed timestamp referring to changes made to attribute of a file such as ownership, access permission. It's the time at which the metadata related to the file changed. --//以前我总是理解c表示create，这是不对的。 atime – last access time Atime or access timestamp is the last time a file was read, read by one of the processes directly or through commands and scripts. --//通过一个简单的例子说明: \1. 使用stat命令，这个是最简单的方法： $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-04-29 08:51:47.000000000 +0800 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2019-12-30 09:41:44.000000000 +0800 $ chmod 664 z6.txt --//相当于修改ctime时间。 $ stat z6.txt File:z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-04-29 08:51:47.000000000 +0800 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:11:28.000000000 +0800 2.使用ls： $ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt --> mtime -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt --> ctime -rw-rw-r-- 1 oracle oinstall 2652 2020-04-29 08:51:47 z6.txt --> atime --//注意这个参数不能连用。也就是ls -l 缺省显示的mtime时间。 3.使用debugfs，不推荐这样的方式： # mount | column -t /dev/cciss/c0d0p2 on / type ext3 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw,gid=5,mode=620) /dev/cciss/c0d0p6 on /u01 type ext3 (rw) /dev/cciss/c0d0p1 on /boot type ext3 (rw) tmpfs on /dev/shm type tmpfs (rw) none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) tmpfs on /mnt/ramdisk type tmpfs (rw,size=8G) # debugfs -R 'stat /home/oracle/hrp430/testz/z6.txt' /dev/cciss/c0d0p2 debugfs 1.39 (29-May-2006) Inode: 9209574 Type: regular Mode: 0664 Flags: 0x0 Generation: 1719813277 User: 502 Group: 502 Size: 2652 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 8 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5fa35f50 -- Thu Nov 5 10:11:28 2020 atime: 0x5ea8cfa3 -- Wed Apr 29 08:51:47 2020 mtime: 0x5e0955d8 -- Mon Dec 30 09:41:44 2019 BLOCKS: (0):9216200 TOTAL: 1 4.补充测试： $ cat z6.txt $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:19:23.000000000 +0800 -->改变了atime时间 Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:11:28.000000000 +0800 $ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt -rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:19:23 z6.txt -->atime. --//实际上了解这些时间属性，可以知道什么时候做了一些改动，正常系统还是没有问题。 --//不过对于高手可以通过touch改动。 \# man touch ... DESCRIPTION Update the access and modification times of each FILE to the current time. Mandatory arguments to long options are mandatory for short options too. -a change only the access time -c, --no-create do not create any files -d, --date=STRING parse STRING and use it instead of current time -f (ignored) -m change only the modification time -r, --reference=FILE use this file's times instead of current time -t STAMP use [[CC]YY]MMDDhhmm[.ss] instead of current time --time=WORD change the specified time: WORD is access, atime, or use: equivalent to -a WORD is modify or mtime: equivalent to -m --help display this help and exit --version output version information and exit Note that the -d and -t options accept different time-date formats. If a FILE is -, touch standard output. --// -a 改变atime，-m 改变mtime,ctime如何使用touch修改不知道。简单测试： $ touch -a z6.txt $ stat z6.txt File:z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:26:49.000000000 +0800
Modify: 2019-12-30 09:41:44.000000000 +0800 Change: 2020-11-05 10:26:49.000000000 +0800 --//实际上ctime，atime都修改了。 $ touch -m z6.txt $ stat z6.txt File: z6.txt' Size: 2652 Blocks: 8 IO Block: 4096 regular file Device: 6802h/26626d Inode: 9209574 Links: 1 Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall) Access: 2020-11-05 10:27:40.000000000 +0800 Modify: 2020-11-05 10:28:41.000000000 +0800 Change: 2020-11-05 10:28:41.000000000 +0800 --//实际上ctime，mtime都修改了。 $ touch --time=ctime z6.txt touch: invalid argumentctime' for `--time' Valid arguments are:
atime',access', `use'mtime',modify' Try `touch --help' for more information.
2，linux查看分区文件系统类型的几种方法，转载自：https://blog.csdn.net/weixin_43223076/article/details/84454756
在Linux 中如何查看分区的文件系统类型，下面总结几种查看分区文件系统类型的方法。
1、df -T 命令查看
这个是最简单的命令，文件系统类型在Type列输出。只可以查看已经挂载的分区和文件系统类型。如下所示：
[root@mylnx008 ~]# df -T /dev/sdb Filesystem Type 1K-blocks Used Available Use% Mounted on /dev/sdb xfs 315467264 4356404 311110860 2% /mysql [root@mylnx008 ~]# df -T Filesystem Type 1K-blocks Used Available Use% Mounted on /dev/sda2 xfs 30929148 22455300 8473848 73% / devtmpfs devtmpfs 1746644 0 1746644 0% /dev tmpfs tmpfs 1757220 0 1757220 0% /dev/shm tmpfs tmpfs 1757220 24868 1732352 2% /run tmpfs tmpfs 1757220 0 1757220 0% /sys/fs/cgroup /dev/sda1 xfs 508580 63024 445556 13% /boot /dev/sdc1 ext4 139203080 8699072 123409840 7% /mnt/resource tmpfs tmpfs 351448 0 351448 0% /run/user/1000 /dev/sdb xfs 315467264 4356404 311110860 2% /mysql
2、parted -l命令查看
如下所示，parted -l 命令会输出文件系统类型（File system）， 其中参数l表示列出所有设备的分区信息。
[root@DB-Server ~]# parted -l Model: ATA ST500DM002-1BD14 (scsi) Disk /dev/sda: 500GB Sector size (logical/physical): 512B/512B Partition Table: msdos Number Start End Size Type File system Flags 1 32.3kB 107MB 107MB primary ext3 boot 2 107MB 500GB 500GB primary lvm
3、blkid命令查看
查看已格式化分区的UUID和文件系统。使用blkid可以输出分区或分区的文件系统类型，查看TYPE字段输出。
[root@DB-Server ~]# blkid /dev/mapper/VolGroup00-LogVol01: TYPE="swap" /dev/mapper/VolGroup00-LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3" /dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3" /dev/VolGroup00/LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3" /dev/VolGroup00/LogVol01: TYPE="swap" /dev/mapper/VolGroup00-LogVol03: UUID="f037ba1e-77a1-439a-8a10-b78c3cca68ec" SEC_TYPE="ext2" TYPE="ext3" [root@DB-Server ~]# blkid /dev/sda1 /dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3"
4、命令lsblk -f 查看
有些系统可能没有这个命令，需要安装。注意：lsblk -f也可以查看未挂载的文件系统类型
[root@mylnx008 ~]# lsblk -f NAME FSTYPE LABEL UUID MOUNTPOINT fd0 sda ├─sda1 xfs b98659b2-5f8c-493e-9304-658905ef1391 /boot └─sda2 xfs b7559ac5-b3a4-4b00-b98a-a2a2611806d0 / sdb xfs 6fcc5417-3c1b-4c71-aac7-344bac7654a4 /mysql sdc └─sdc1 ext4 1ad7da45-2366-4c4f-acd4-484600c4153a /mnt/resource
