On touching a new file why is mtime and ctime older than atime?

Question

I have this:

$ ls -l ff
ls: cannot access ff: No such file or directory


$ touch ff
$ stat ff
  File: `ff'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 803h/2051d  Inode: 1057193     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/   abc)   Gid: (    0/    root)
Access: 2011-09-18 20:36:08.351097228 -0700
Modify: 2011-09-18 20:36:07.340839847 -0700
Change: 2011-09-18 20:36:07.340839847 -0700

Why are mtime and ctime older than atime?

score 6 · Accepted Answer · answered Sep 19 '11 at 06:05

6

Might you have something running that is watching for changes to that directory?

If I try this with nothing running but a shell prompt, the Access time of ff matches the Modify and Change times. But if I open a Nautilus (GNOME file manager) window on the directory and try it, the Access time is almost exactly a second later.

What's happening in my case is that Nautilus is watching for changes to that directory because it has a window open on it. It sees that a new file was created and wants to know what icon to show, so it peeks into the file to see what kind of file it is -- which updates the Access time.

answered Sep 19 '11 at 06:05

Jander

16,272
6
50
66

I'm getting the same 1 second difference when `nautilus` has the directory open, but it only happens when `touch ff` and `stat ff` are run in the command line as discreet line invocations. Joining the commands with `;` on a single line doesn't give the 1 second difference, nor does running the commands in a script... but nautilus surely seems involved +1... or more likely it is its watchdog program.. Here is *some* general info on it: [What causes Nautilus to restart whenever I kill it?](http://askubuntu.com/questions/16966/what-causes-nautilus-to-restart-whenever-i-kill-it) – Peter.O Sep 19 '11 at 06:49
1

@fred: You have to wait at least 1 second between running `touch` and running `stat`, to give Nautilus a chance to access the file. – Jander Sep 19 '11 at 06:54

score 1 · Answer 2 · answered Sep 19 '11 at 06:05

There is no reason for this 1 second difference, at least as far as the regular touch command is concerned.

 $ ls -l zz
    ls: cannot access zz: No such file or directory
    $ touch zz
    $ stat zz
      File: `zz'
      Size: 0           Blocks: 0          IO Block: 4096   regular empty file
    Device: 808h/2056d  Inode: 265633      Links: 1
    Access: (0644/-rw-r--r--)  Uid: ( 1000/jlliagre)   Gid: ( 1000/jlliagre)
    Access: 2011-09-19 07:35:50.679679571 +0200
    Modify: 2011-09-19 07:35:50.679679571 +0200
    Change: 2011-09-19 07:35:50.679679571 +0200

Use strace to verify the only system call affecting the created file by touch are:

open("zz", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
dup2(3, 0)                              = 0
close(3)                                = 0
utimensat(0, NULL, NULL, 0)             = 0
close(0)                                = 0

If true, there might be a daemon or something, like say an anti-virus, accessing your file after it is created.

On touching a new file why is mtime and ctime older than atime?

2 Answers2