Linux – Fastest way to get creation and last modification times of a lot of files



  • a directory
  • a sh pattern which yields a subset of files directly in this directory (like *.log)
  • a sh pattern which can, given a filename,

what is the fastest way (in ksh) to obtain for each file filtered in by the pattern:

  • its name
  • the date and time of its last modification (i.e. text appended)
  • the date and time where it was created (supposing it was created in the directory were it is when we access it)

Ideally, it would work on both:

  • AIX 6100-04-03-1009
  • Linux 2.6.18
  • SunOS 5.10

Best Answer

A Posix file system node typically has three time attributes:

  • atime (access time) -- when was the file last read
  • mtime (modification time) -- when was it last written to.
  • ctime (change time) -- when was its inode (metadata) changed.

The ctime attribute is frequently misunderstood as creation time, and sometimes it is, which tends to confuse people.

POSIX shells have no standard way of extracting these three attributes, and you will depend on the ls command. ls -l $file by default shows modification time.

  • ls -lc $file shows ctime
  • ls -lu $file shows atime

It is recommended to use ls --time-style=full-iso or another iso format for consistent output, if you are on a GNU/linux system.

In Perl and other scripting languages, it's easier to stat() a file and access its attributes. Perl even has the -M, -A, and -C operators that return mtime, atime, and ctime for a file system object. Note the time offset, though. Perl tends to report times relative to the process start time.