What does the output of return os.lstat(logFile)[ST_CTIME] mean?

[alberttresens]

Hi,
I am trying to get the creation time of a file to be able to correlate it's
content timestamps with other log files.
In order to get the creation time of the file one a Linux machine i used:

return os.lstat(logFile)[ST_CTIME]

That returns to me something like: 1279620166

I would like to know the meaning of this number.
Is it in seconds since the epoch?
Or is some other respresentation?

Thanks,
Albert

 

[Steven D'Aprano]

Hi,
I am trying to get the creation time of a file to be able to correlate
it's content timestamps with other log files. In order to get the
creation time of the file one a Linux machine i used:

You're out of luck. Neither Unix nor Linux store the creation time of
files, at least not on any file system I know of. It stores three
timestamps: mtime, ctime, and atime.

atime is the simple one -- it is "access time", or when the file was last
read.

mtime is "modification time" -- it is when the file *contents* were last
changed.

But ctime is NOT creation time, as many people imagine. It is "change
time", and it changes whenever EITHER the file contents are changed, OR
when the file metadata (permissions, owner, name, etc.) change.

So any time mtime changes, so does ctime. But not visa versa.

return os.lstat(logFile)[ST_CTIME]

That returns to me something like: 1279620166

I would like to know the meaning of this number. Is it in seconds since
the epoch?

Yes.

 

[alberttresens]

Hi, thanks for the reply.

But what i am more concerned about, as I am trying to correlate logs, is
what is the timestamp:
1279620166 mean?
Is it seconds since the epoch or the ISO time in seconds?

Any idea?

Thanks a lot!!

Hi,
I am trying to get the creation time of a file to be able to correlate
it's content timestamps with other log files. In order to get the
creation time of the file one a Linux machine i used:

You're out of luck. Neither Unix nor Linux store the creation time of
files, at least not on any file system I know of. It stores three
timestamps: mtime, ctime, and atime.

atime is the simple one -- it is "access time", or when the file was last
read.

mtime is "modification time" -- it is when the file *contents* were last
changed.

But ctime is NOT creation time, as many people imagine. It is "change
time", and it changes whenever EITHER the file contents are changed, OR
when the file metadata (permissions, owner, name, etc.) change.

So any time mtime changes, so does ctime. But not visa versa.

return os.lstat(logFile)[ST_CTIME]

That returns to me something like: 1279620166

I would like to know the meaning of this number. Is it in seconds since
the epoch?

Yes.

 

[Thomas Jollans]

Hi, thanks for the reply.

Alas, you didn't actually read it:

But what i am more concerned about, as I am trying to correlate logs, is
what is the timestamp:
1279620166 mean?
Is it seconds since the epoch or the ISO time in seconds?

Any idea?

Thanks a lot!!

[...]

Yes.

You quoted the answer to your question in the same e-mail. fascinating.

A little side note:

You should never rely on this, though: some file systems don't store
this (I think) and many users/sysadmins actually disable this
(mount -o noatime) for performance reasons. (Also, on an SSD, I imagine
enabling atime, and with it many, many additional writes, could
noticeably detriment disk lifetime)