I have this:

$ ls -l ff
ls: cannot access ff: No such file or directory

$ touch ff
$ stat ff
  File: `ff'
  Size: 0           Blocks: 0          IO Block: 4096   regular empty file
Device: 803h/2051d  Inode: 1057193     Links: 1
Access: (0644/-rw-r--r--)  Uid: ( 1000/   abc)   Gid: (    0/    root)
Access: 2011-09-18 20:36:08.351097228 -0700
Modify: 2011-09-18 20:36:07.340839847 -0700
Change: 2011-09-18 20:36:07.340839847 -0700

Why are mtime and ctime older than atime?


Might you have something running that is watching for changes to that directory?

If I try this with nothing running but a shell prompt, the Access time of ff matches the Modify and Change times. But if I open a Nautilus (GNOME file manager) window on the directory and try it, the Access time is almost exactly a second later.

What's happening in my case is that Nautilus is watching for changes to that directory because it has a window open on it. It sees that a new file was created and wants to know what icon to show, so it peeks into the file to see what kind of file it is -- which updates the Access time.

  • I'm getting the same 1 second difference when nautilus has the directory open, but it only happens when touch ff and stat ff are run in the command line as discreet line invocations. Joining the commands with ; on a single line doesn't give the 1 second difference, nor does running the commands in a script... but nautilus surely seems involved +1... or more likely it is its watchdog program.. Here is some general info on it: What causes Nautilus to restart whenever I kill it? – Peter.O Sep 19 '11 at 6:49
  • 1
    @fred: You have to wait at least 1 second between running touch and running stat, to give Nautilus a chance to access the file. – Jander Sep 19 '11 at 6:54

There is no reason for this 1 second difference, at least as far as the regular touch command is concerned.

 $ ls -l zz
    ls: cannot access zz: No such file or directory
    $ touch zz
    $ stat zz
      File: `zz'
      Size: 0           Blocks: 0          IO Block: 4096   regular empty file
    Device: 808h/2056d  Inode: 265633      Links: 1
    Access: (0644/-rw-r--r--)  Uid: ( 1000/jlliagre)   Gid: ( 1000/jlliagre)
    Access: 2011-09-19 07:35:50.679679571 +0200
    Modify: 2011-09-19 07:35:50.679679571 +0200
    Change: 2011-09-19 07:35:50.679679571 +0200

Use strace to verify the only system call affecting the created file by touch are:

open("zz", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
dup2(3, 0)                              = 0
close(3)                                = 0
utimensat(0, NULL, NULL, 0)             = 0
close(0)                                = 0

If true, there might be a daemon or something, like say an anti-virus, accessing your file after it is created.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.