File Time in AIX

Question
This technote discusses timestamps associated with files in filesystems on AIX.

Answer
In AIX each file has three different timestamps associated with it. These can be seen in the system include file /usr/include/sys/stat.h :

st_atime Time when file data was last accessed.
st_mtime Time when file data was last modified.
st_ctime Time when the file metadata was last changed.

All times recorded are in seconds since the Unix epoch. (Note for completeness there are also counters for these in nanoseconds)

Access Time (atime)
This is a timestamp recorded in the filesystem when the file was last opened for reading. The timestamp reflects when the open() on the file was performed, not necessarily when data was last read from it.

The access time can be viewed via ls using the -u flag.

Modification Time (mtime)
This denotes when the content of the file was most recently changed.

The modification time is what ls -l reports by default.

Change time (ctime)
This marks when a file's metadata was changed, such as permissions or ownership.

This time cannot be seen with the 'ls' command.

Other Notes
Some operating systems also include a "file creation" time, but AIX does not.

These times can be seen via commands such as 'ls' or 'find' with the appropriate arguments given to print out the value desired.

An easy way to view all three simultaneously is with the /usr/bin/istat command:

$ istat p.out
Inode 263 on device 10/8 File
Protection: rw-r--r--
Owner: 0(root) Group: 0(system)
Link count: 1 Length 14682 bytes

Last updated: Tue Sep 15 10:50:15 PDT 2009
Last modified: Tue Sep 15 10:50:15 PDT 2009
Last accessed: Tue Nov 3 12:01:12 PST 2009

So this file had its contents modified on Sep 15, and that is also the time the metadata for the file was changed. The file was read last on Nov 3.

Some utilities such as tar specifically modify a file's time values to record a different time than would normally be present. For example, the default behavior of tar when restoring a file is to create the file, then set the modification time back to what it was set to in the tar archive.