The ls -al command shows the following output;

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe

What are all the fields in the preceding display?


4 Answers 4


In the order of output;

-rwxrw-r--    1    root   root 2048    Jan 13 07:11 afile.exe
  • file permissions (-rwxrw-r--),
  • number of (hard) links (1),
  • owner name (root),
  • owner group (root),
  • file size in bytes (2048),
  • time of last modification (Jan 13 07:11), and
  • file/directory name (afile.exe)

File permissions is displayed as following;

  • first character is most often -, l or d. A d indicates a directory, a - represents a regular file, l is a symlink (or soft link) and other letters are used for other types of special files
  • three sets of characters, three times, indicating permissions for owner, group and other:
    • r = readable
    • w = writable
    • x = executable (for files) or accessible (for directories)
  • this may be followed by some other character of there are extended permissions, like e.g. Linux ACL that are marked with a +.

In your example -rwxrw-r--, this means the line displayed is:

  • a regular file (displayed as -)
  • readable, writable and executable by owner (rwx)
  • readable, writable, but not executable by group (rw-)
  • readable but not writable or executable by other (r--)

The number of hard links means the number of names the inode has, i.e. links created with ln without the -s option.

  • 20
    There are more than 2 types of file. - is not for non-directories, it's for regular files, there's more than r, w and x permissions. On most systems, the first field is also used to indicate the presence of extra attributes like ACLs, security attributes or other extended attributes. Also note that for symlinks, the target of the symlink is also displayed in the output of ls -l. Commented Nov 29, 2013 at 21:06
  • 15
    The first character can have different values (eg. b, D, and p`). There's a full explanation on Wikipedia.
    – ashes999
    Commented Oct 14, 2014 at 13:53
  • 23
    The numbers of fields is poorly explained. For files it means number of hard links. For directory: number of directories inside directory + this directory itself + 1.
    – yanpas
    Commented Mar 19, 2016 at 19:20
  • 21
    What does number of links mean? Thanks. Commented Jan 6, 2017 at 11:41
  • 8
    info ls has more info Commented Mar 5, 2018 at 9:21

The output of the "ls" command depends on the version of "ls", the options used, the platform used, etc. It appears from your example that you're using it from a typical un*x (such as Linux), and probably using a typical modern "ls" version. In which case:

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe
^ ^  ^  ^ ^    ^      ^      ^    ^      ^            ^- Filename.
| |  |  | |    |      |      |    |      \-------------- Time of last modification.
| |  |  | |    |      |      |    \--------------------- File Size OR for directory size of the metadata. (Size is *usually* in bytes on modern systems; See below.)
| |  |  | |    |      |      \-------------------------- Group Name (for example, Users, Administrators, etc)
| |  |  | |    |      \--------------------------------- Owner Acct
| |  |  | |    \---------------------------------------- Link count (what constitutes a "link" here varies)
| |  |  | \--------------------------------------------- Alternative Access (blank means none defined, anything else varies)
| \--\--\----------------------------------------------- Read, Write and Special access modes for [U]ser, [G]roup, and [O]thers (everyone else)
\------------------------------------------------------- File type flag        

I am not sure why your link count is so high for the example file you listed. Some platforms have an odd notion of what constitutes a "link". These usually include hard links and symbolic links, as well as directory entries (which is why directories often have high link counts – its parent has one link, the directory has a link to itself in the . entry, and each of its sub-directories has a link back via ..).

Some versions and/or command line flags will list the number of blocks used instead of the number of bytes; a filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as "1", meaning 1 block is used, from 1025 to 2048 as "2", using 2 blocks, and so on. But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.

The special/alternative access flag is usually a blank space, but on some platforms, it may be used to indicate there are special/alternative access modes (such as ACLs and security descriptors on WIN32, etc), and varies widely – consult your manual, man pages, info tool, or what-not.

The permissions (mode) flags (UUUGGGOOO) are three sets of three chars, where the first set is "User" (i.e., Owner), the second set is "Group" and the third set is "Others" (i.e., everyone else; anyone who is neither Owner nor Group). The three permissions flags in each set are typically r or - meaning the User/Group/Others can read the file (r) or not (-), followed by w or - indicating whether they can write to the file (you can have files which you can write to, but cannot read, as odd as that may sound!), and the third character is a 'catch-all' flag for other modes, typically something like x for execute (for directories, it means you can attempt to access the directory contents), or - for none. Sometimes you may encounter an s or S for setuid and/or setgid programs, or other less common characters; see your ls documentation for the mode characters it will show.

Finally, the very first character is the file type; typically one of: d for directory, l for a symbolic link (hard links show normally without a special character of their own), or - for a normal file. There are many other, but less commonly seen, file types for various filesystems. These first ten characters (file type and permissions) are discussed on Wikipedia. Again, your documentation will tell you exactly what kind of file types your command supports and displays.

BTW, if you cannot find a man/info page for ls itself (man ls/info ls), try looking in the "coreutils" package (info coreutils). Also note that among the more common platforms, Microsoft platforms tend not to translate very well to ls output, so you may see odd behavior, flags, or other unusual info in the output, depending on how your version of ls was compiled, what it was linked against, etc.

One more caveat: The file time stamp is usually the date/time the file was last modified, not the time the file was created. In fact, on a un*x-ish filesystem, there is no record of the file creation time; the ctime field does NOT mean "creation time" as it does on FAT/NTFS filesystems, but rather, it means the "inode [C]hange time" – the time the inode itself was last modified. The "mtime" (last [M]odified) and atime (last [A]ccesed/read) timestamps are the same on both systems – although the precision (FAT has a granularity of two seconds, for example) and time zone may vary.

  • 5
    Which system includes symbolic links in the link count?
    – celtschk
    Commented Jul 6, 2014 at 7:24
  • 1
    Sorry, I was not clear.. No system I know includes symbolic links in the link count.. I only meant in "what constitutes a 'link'". For example, in Windows', a "shell link" is considered a link, but most console commands will treat it as a normal file. This includes ls, which will not include it in the link count. To the best of my knowledge, unless the sources for 'ls' is otherwise modified, it only reports what the OS reports for the link count.
    – C. M.
    Commented Jul 6, 2014 at 14:30
  • 2
    Including sym-links and .lnk files would require a walk of the entire directory try. Just to list a file. It would be waaaaaaaaaaaaay slow. It only includes hard link. That is the number of directory entries that the file has. (it is used by the garbage collector. When the reference count gets to zero, then the file is deleted.) Commented Mar 5, 2018 at 9:26
  • 1
    Normally, my understanding of operating systems (OS) and file systems (FS) would agree, but I've seen some oddities from time to time with certain OS's and FS's. Although, it's not always part of the OS/FS; Sometimes, the oddities are the result of trying to port a tool from one OS to another, and then trying to adjust it for the new platform--the differences in the CTIME field between EXT and FAT/NTFS, for example--and how NTFS implements different kinds of "links" (shell links, reparse points, etc), making it difficult to give an exact and uniform definition.
    – C. M.
    Commented Mar 14, 2018 at 23:18
  • 2
    Additional note: the file size for a directory is only the size of the metadata of the directory, not the total size of the files under the directory.
    – wisbucky
    Commented May 22, 2018 at 21:18

On GNU systems, it is described in ls info page in a very detailed way. All you had to do to find it: just open man ls and find in the end link to the full documentation: info coreutils 'ls invocation'.

Here is quote from it:

     In addition to the name of each file, print the file type, file
     mode bits, number of hard links, owner name, group name, size, and
     timestamp (*note Formatting file timestamps::), normally the
     modification time.  Print question marks for information that
     cannot be determined.

     Normally the size is printed as a byte count without punctuation,
     but this can be overridden (*note Block size::).  For example, `-h'
     prints an abbreviated, human-readable count, and
     `--block-size="'1"' prints a byte count with the thousands
     separator of the current locale.

     For each directory that is listed, preface the files with a line
     `total BLOCKS', where BLOCKS is the total disk allocation for all
     files in that directory.  The block size currently defaults to 1024
     bytes, but this can be overridden (*note Block size::).  The
     BLOCKS computed counts each hard link separately; this is arguably
     a deficiency.

     The file type is one of the following characters:

          regular file

          block special file

          character special file

          high performance ("contiguous data") file


          door (Solaris 2.5 and up)

          symbolic link

          off-line ("migrated") file (Cray DMF)

          network special file (HP-UX)

          FIFO (named pipe)

          port (Solaris 10 and up)


          some other file type

     The file mode bits listed are similar to symbolic mode
     specifications (*note Symbolic Modes::).  But `ls' combines
     multiple bits into the third character of each set of permissions
     as follows:

          If the set-user-ID or set-group-ID bit and the corresponding
          executable bit are both set.

          If the set-user-ID or set-group-ID bit is set but the
          corresponding executable bit is not set.

          If the restricted deletion flag or sticky bit, and the
          other-executable bit, are both set.  The restricted deletion
          flag is another name for the sticky bit.  *Note Mode

          If the restricted deletion flag or sticky bit is set but the
          other-executable bit is not set.

          If the executable bit is set and none of the above apply.


     Following the file mode bits is a single character that specifies
     whether an alternate access method such as an access control list
     applies to the file.  When the character following the file mode
     bits is a space, there is no alternate access method.  When it is
     a printing character, then there is such a method.

     GNU `ls' uses a `.' character to indicate a file with an SELinux
     security context, but no other alternate access method.

     A file with any other combination of alternate access methods is
     marked with a `+' character.
  • 1
    Thank you! I was unsure about the "character special file" meaning of the c in the first column when listing /dev/ Commented Jun 29, 2018 at 19:42

The first column is the file mode, the next column is the numbers of link that the file has, the third and fourth are the name of the owner and the group which the file belongs to. Next column says the number of bytes of the file (some ls implementations have a -h option to see this information in a more user-friendly form). The last two columns indicate the timestamp and the name of the file. You'd read the man page for more info.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .