Linux / Unix command to check when a file was renamed

Question

Is there a specific Unix / Linux command that will show when a file was renamed? I have a file in my Linux box and you want to know when the file was renamed. I tried ls -ltr , but only showed the date when it was created, not when it was last modified.

Is there a specific Unix / Linux command for this?

Answer 1

you can use

 stat filename 

Mark Access when it was last read.

Check Modify when it has been updated.

Check Change if it has been renamed.

Plus other file information, such as blocks, inodes, etc.

Answer 2

The behavior will depend on the type of file system. On classic Unix file systems (and in particular on the Mac OS X HFS file system), the interesting thing about renaming a file in the file system is that it does not affect the file inode at all; this only affects the directory (or directories) where the file was moved from / to. Thus, within the same file system, the only timestamps that change to rename are the time the directory containing the file was changed. For example, ^* :

 $ fl -a -c -m -n xxx.pl 2013-07-17 16:17:17 2013-07-17 16:17:17 2013-07-17 16:17:17 xxx.pl $ mv xxx.pl yyy.pl $ fl -a -c -m -n yyy.pl 2013-07-17 16:17:17 2013-07-17 16:17:17 2013-07-17 16:17:17 yyy.pl $ 

This means that in such file systems you cannot determine when a file was renamed some time after the file was renamed.

^{* fl is the brew home team; the call is equivalent to calling Mac OS X stat stat -f '%Sa %Sm %Sc %N' . This is only slightly related to the GNU / Linux stat team.}

Empirical evidence, on the other hand, shows that the Linux ext4 file system records the name change with the modification time of the inode itself.

 $ stat -c '%x %y %z %n' test.dat 2013-07-19 10:31:31.803842672 -0700 2013-07-19 10:31:31.803842672 -0700 2013-07-19 10:31:31.803842672 -0700 test.dat $ mv test.dat test.data $ stat -c '%x %y %z %n' test.data 2013-07-19 10:31:31.803842672 -0700 2013-07-19 10:31:31.803842672 -0700 2013-07-22 09:11:49.074339525 -0700 test.data $ 

So what you can do depends on which one you are working on and which file system your file is typing.

If you have an inotify service available and running, you can record the event, which is the renaming of the file, but if you do not record the event, there is no way “posthumous” to find out when the file was renamed.

Directory change time is not a good indicator of when a particular file was changed; It changes whenever any file is created, moved, deleted. If there is only one file in a directory, then the change time probably indicates when this file was created or renamed, but individual file directories are an exception, not a rule.

Answer 3

You can use the Inotify library to notify when something happens in a file. There are probably bindings to scripting languages.

Answer 4

On AIX, you can use the equivalent of "stat" -

istat file_name

You should be able to find out the file, the last updated, modified and available time to seconds, as well as additional information.