linux中默認可以查看到文件的mtime, ctime and atime，linux中對於對於EXT4文件系統類型，我們也可以查看文件的創建時間crtime，
mtime – last modification time 文件內容修改時間
ctime – last change time 這里不是createtime，是變動時間，例如文件內容、文件權限權限等的變更時間
atime – last access time 上次被訪問時間
crtime– create time 文件創建時間
對於EXT4文件系統類型我們可以查看文件創建時間crtime，方法如下：
1，使用df -T 命令查看系統分區的文件系統類型
這個是最簡單的命令，文件系統類型在Type列輸出。只可以查看已經掛載的分區和文件系統類型。如下所示：
[root@root008 ~]# df -T
/dev/sda1 xfs 508580 63024 445556 13% /boot
/dev/sdc1 ext4 139203080 8699072 123409840 7% /opt/app/log
2，查找文件的inode編號
查找使用下面的命令終端的任何文件的inode號。
# ls -i /opt/app/log/server.log
15 /opt/app/log/server.log
第2步：查找文件創建時間（crtime）
# debugfs -R 'stat <inode_number>' /dev/sdc1
命令說明：其中inode_number就是上面2步驟中獲取到的文件inode編號，
/dev/sdc1是文件所在的文件系統名稱，這兩個一定要和要查看的文件對應
執行命令，就可以看到crtime字段（文件創建時間）：
# debugfs -R 'stat <15>' /dev/sdc1 debugfs 1.41.12 (17-May-2010) Inode: 13377 Type: regular Mode: 0600 Flags: 0x80000 Generation: 2326794244 Version: 0x00000000:00000001 User: 0 Group: 0 Size: 223317 File ACL: 0 Directory ACL: 0 Links: 1 Blockcount: 440 Fragment: Address: 0 Number: 0 Size: 0 ctime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 atime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 mtime: 0x5230b7ae:55efa068 -- Thu Sep 12 00:04:22 2013 crtime: 0x4eeacc8a:0948eb58 -- Fri Dec 16 10:13:54 2011 Size of extra inode fields: 28 Extended attributes stored in inode body: selinux = "system_u:object_r:var_log_t:s0 00" (31) EXTENTS: (0-24): 35008-35032, (25-54): 164224-164253
引申閱讀：
1，查看文件mtime, ctime and atime，轉載自： https://www.cnblogs.com/lfree/p/13930375.html#4753947
--//大家都知道linux 文件系統的文件存在3個時間mtime, ctime and atime。簡單解析如下：
--//https://linoxide.com/file-system/file-timestamps-mtime-ctime-atime-linux/
mtime – Last modification time
Mtime or modification time is the time of the last change to the file contents. 'Modification' means something inside
the file was amended or deleted, or new data was added.
ctime – last change time
Ctime is the changed timestamp referring to changes made to attribute of a file such as ownership, access permission.
It's the time at which the metadata related to the file changed.
--//以前我總是理解c表示create，這是不對的。
atime – last access time
Atime or access timestamp is the last time a file was read, read by one of the processes directly or through commands
and scripts.
--//通過一個簡單的例子說明:
1. 使用stat命令，這個是最簡單的方法：
$ stat z6.txt
File: `z6.txt'
Size: 2652 Blocks: 8 IO Block: 4096 regular file
Device: 6802h/26626d Inode: 9209574 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall)
Access: 2020-04-29 08:51:47.000000000 +0800
Modify: 2019-12-30 09:41:44.000000000 +0800
Change: 2019-12-30 09:41:44.000000000 +0800
$ chmod 664 z6.txt
--//相當於修改ctime時間。
$ stat z6.txt
File: `z6.txt'
Size: 2652 Blocks: 8 IO Block: 4096 regular file
Device: 6802h/26626d Inode: 9209574 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall)
Access: 2020-04-29 08:51:47.000000000 +0800
Modify: 2019-12-30 09:41:44.000000000 +0800
Change: 2020-11-05 10:11:28.000000000 +0800
2.使用ls：
$ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt
-rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt --> mtime
-rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt --> ctime
-rw-rw-r-- 1 oracle oinstall 2652 2020-04-29 08:51:47 z6.txt --> atime
--//注意這個參數不能連用。也就是ls -l 缺省顯示的mtime時間。
3.使用debugfs，不推薦這樣的方式：
# mount | column -t
/dev/cciss/c0d0p2 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/cciss/c0d0p6 on /u01 type ext3 (rw)
/dev/cciss/c0d0p1 on /boot type ext3 (rw)
tmpfs on /dev/shm type tmpfs (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
tmpfs on /mnt/ramdisk type tmpfs (rw,size=8G)
# debugfs -R 'stat /home/oracle/hrp430/testz/z6.txt' /dev/cciss/c0d0p2
debugfs 1.39 (29-May-2006)
Inode: 9209574 Type: regular Mode: 0664 Flags: 0x0 Generation: 1719813277
User: 502 Group: 502 Size: 2652
File ACL: 0 Directory ACL: 0
Links: 1 Blockcount: 8
Fragment: Address: 0 Number: 0 Size: 0
ctime: 0x5fa35f50 -- Thu Nov 5 10:11:28 2020
atime: 0x5ea8cfa3 -- Wed Apr 29 08:51:47 2020
mtime: 0x5e0955d8 -- Mon Dec 30 09:41:44 2019
BLOCKS:
(0):9216200
TOTAL: 1
4.補充測試：
$ cat z6.txt
$ stat z6.txt
File: `z6.txt'
Size: 2652 Blocks: 8 IO Block: 4096 regular file
Device: 6802h/26626d Inode: 9209574 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall)
Access: 2020-11-05 10:19:23.000000000 +0800 -->改變了atime時間
Modify: 2019-12-30 09:41:44.000000000 +0800
Change: 2020-11-05 10:11:28.000000000 +0800
$ echo -l -lc -lu | tr ' ' '\n' |xargs -I Q ls --color=auto --time-style=+"%Y-%m-%d %H:%M:%S" Q z6.txt
-rw-rw-r-- 1 oracle oinstall 2652 2019-12-30 09:41:44 z6.txt
-rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:11:28 z6.txt
-rw-rw-r-- 1 oracle oinstall 2652 2020-11-05 10:19:23 z6.txt -->atime.
--//實際上了解這些時間屬性，可以知道什么時候做了一些改動，正常系統還是沒有問題。
--//不過對於高手可以通過touch改動。
# man touch
...
DESCRIPTION
Update the access and modification times of each FILE to the current time.
Mandatory arguments to long options are mandatory for short options too.
-a change only the access time
-c, --no-create
do not create any files
-d, --date=STRING
parse STRING and use it instead of current time
-f (ignored)
-m change only the modification time
-r, --reference=FILE
use this file's times instead of current time
-t STAMP
use [[CC]YY]MMDDhhmm[.ss] instead of current time
--time=WORD
change the specified time: WORD is access, atime, or use: equivalent to -a WORD is modify or mtime: equivalent to -m
--help display this help and exit
--version
output version information and exit
Note that the -d and -t options accept different time-date formats.
If a FILE is -, touch standard output.
--// -a 改變atime，-m 改變mtime,ctime如何使用touch修改不知道。簡單測試：
$ touch -a z6.txt
$ stat z6.txt
File: `z6.txt'
Size: 2652 Blocks: 8 IO Block: 4096 regular file
Device: 6802h/26626d Inode: 9209574 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall)
Access: 2020-11-05 10:26:49.000000000 +0800
Modify: 2019-12-30 09:41:44.000000000 +0800
Change: 2020-11-05 10:26:49.000000000 +0800
--//實際上ctime，atime都修改了。
$ touch -m z6.txt
$ stat z6.txt
File: `z6.txt'
Size: 2652 Blocks: 8 IO Block: 4096 regular file
Device: 6802h/26626d Inode: 9209574 Links: 1
Access: (0664/-rw-rw-r--) Uid: ( 502/ oracle) Gid: ( 502/oinstall)
Access: 2020-11-05 10:27:40.000000000 +0800
Modify: 2020-11-05 10:28:41.000000000 +0800
Change: 2020-11-05 10:28:41.000000000 +0800
--//實際上ctime，mtime都修改了。
$ touch --time=ctime z6.txt
touch: invalid argument `ctime' for `--time'
Valid arguments are:
- `atime', `access', `use'
- `mtime', `modify'
Try `touch --help' for more information.
2，linux查看分區文件系統類型的幾種方法，轉載自：https://blog.csdn.net/weixin_43223076/article/details/84454756
在Linux 中如何查看分區的文件系統類型，下面總結幾種查看分區文件系統類型的方法。
1、df -T 命令查看
這個是最簡單的命令，文件系統類型在Type列輸出。只可以查看已經掛載的分區和文件系統類型。如下所示：
[root@mylnx008 ~]# df -T /dev/sdb
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sdb xfs 315467264 4356404 311110860 2% /mysql
[root@mylnx008 ~]# df -T
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sda2 xfs 30929148 22455300 8473848 73% /
devtmpfs devtmpfs 1746644 0 1746644 0% /dev
tmpfs tmpfs 1757220 0 1757220 0% /dev/shm
tmpfs tmpfs 1757220 24868 1732352 2% /run
tmpfs tmpfs 1757220 0 1757220 0% /sys/fs/cgroup
/dev/sda1 xfs 508580 63024 445556 13% /boot
/dev/sdc1 ext4 139203080 8699072 123409840 7% /mnt/resource
tmpfs tmpfs 351448 0 351448 0% /run/user/1000
/dev/sdb xfs 315467264 4356404 311110860 2% /mysql
2、parted -l命令查看
如下所示，parted -l 命令會輸出文件系統類型（File system）， 其中參數l表示列出所有設備的分區信息。
[root@DB-Server ~]# parted -l
Model: ATA ST500DM002-1BD14 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32.3kB 107MB 107MB primary ext3 boot
2 107MB 500GB 500GB primary lvm
3、blkid命令查看
查看已格式化分區的UUID和文件系統。使用blkid可以輸出分區或分區的文件系統類型，查看TYPE字段輸出。
[root@DB-Server ~]# blkid
/dev/mapper/VolGroup00-LogVol01: TYPE="swap"
/dev/mapper/VolGroup00-LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3"
/dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3"
/dev/VolGroup00/LogVol00: UUID="1c0d5470-1503-4a18-b184-53483466d948" TYPE="ext3"
/dev/VolGroup00/LogVol01: TYPE="swap"
/dev/mapper/VolGroup00-LogVol03: UUID="f037ba1e-77a1-439a-8a10-b78c3cca68ec" SEC_TYPE="ext2" TYPE="ext3"
[root@DB-Server ~]# blkid /dev/sda1
/dev/sda1: LABEL="/boot" UUID="582b189c-396c-4da8-a7a3-1effaa3e4000" TYPE="ext3"
4、命令lsblk -f 查看
有些系統可能沒有這個命令，需要安裝。注意：lsblk -f也可以查看未掛載的文件系統類型
[root@mylnx008 ~]# lsblk -f NAME FSTYPE LABEL UUID MOUNTPOINT fd0 sda ├─sda1 xfs b98659b2-5f8c-493e-9304-658905ef1391 /boot └─sda2 xfs b7559ac5-b3a4-4b00-b98a-a2a2611806d0 / sdb xfs 6fcc5417-3c1b-4c71-aac7-344bac7654a4 /mysql sdc └─sdc1 ext4 1ad7da45-2366-4c4f-acd4-484600c4153a /mnt/resource