last time file opened
This depends on exactly what you mean by "opened", but in general, yes. There are three timestamps normally recorded:
mtime— updated when the file contents change. This is the "default" file time in most cases.
ctime— updated when the file or its metadata (owner, permissions) change
atime— updated when the file is read
So, generally, what you want to see is the
atimeof a file. You can get that with
ls. You can use
ls -luto do this, although I prefer to use
ls -l --time=atime(which should be supported in almost all modern Linux distributions) because I don't use it often, and when I do I can remember it better. And to sort by time, add the
-tflag to ls. So there you go.
There is a big caveat, though. Updating the atime every time a file is read causes a lot of usually-unnecessary IO, slowing everything down. So, most Linux distributions now default to the
noatimefilesystem mount option, which basically kills atimes, or else
relatime, which only updates atimes once a limit has passed (normally once per day) or if the file was actually modified since the previous read. You can find if these options are active by running the
Also, note that access times are by inode, not by filename, so if you have hardlinks, reading from one will update all names that refer to the same file.
And, be aware that c is not "creation"; creation isn't tracked by Unix/Linux filesystems, which seems strange but actually makes sense because the filesystem has no way of knowing if it is the original — maybe the file was created forty years ago and copied here. And, in fact, many file editors work by making copies over the original. If you need that information, it's best to use a version control system like
I'd give you more than +1 if I could, simply for not calling ctime "Creation Time".
According to the mount manpage, *relatime* has nothing to do with daily limits, but only looks at the atime *relative* to mtime and ctime. If atime is older than mtime or ctime, atime is updated. If atime is newer than both, then it is left alone. The purpose of this is to preserve the *relation* between atime and mtime / ctime, since some applications use that information, like mutt to see if it has read your mailbox since it was last updated.
@jw013 This has been the case since the 2.6.30 kernel. It's true that some older distributions may not have this behavior. (But for distributions like Fedora, it was true even back when I wrote the original version of this answer three years ago.) Look for an updated `mount` manpage.
`ls` shortens the time by default to a sensible precision. To see the time in full precision one can use `--full-time`.
$ ls -l --time=mtime ls: invalid argument ‘mtime’ for ‘--time’ Valid arguments are: - ‘atime’, ‘access’, ‘use’ - ‘ctime’, ‘status’ Try 'ls --help' for more information.