We're an ISO27001:2013 Certified Supplier

blog-post-featured-image

You’d be forgiven for thinking that the atime, or a file’s time of last access, does exactly what it says on the tin. The atime is updated every time a file or directory is accessed, right? If only things were that simple…

It turns out that keeping this field accurate is expensive, so the Linux kernel only changes it every so often. Updating the field means writing to the disk on every access, even if the data was cached in memory. Modern Linux systems generally have thousands of files open at any one time and updating the atime on all of those would lead to a crippling storm of disk activity.

The field isn’t used very often but it does have some really important uses. One of its most common uses is on mail servers, which can use the field to tell the user whether any mail has arrived in a mailbox since it was last looked at. It can also be helpful in finding old files to weed out of a directory.

How and when the field is updated has changed several times in Linux’s history, but the current default behaviour (relatime) has been around for over a decade. This behaviour updates the atime field either when the current value is before the mtime (time of last modification) or ctime (time of last status change), or if 24 hours have elapsed since the last update. The effect is that the access time is only updated after the file is modified or if the file was previously accessed over 24 hours ago. This keeps the field usable for its most common uses without having too much of a detrimental impact on the system.

You can select other behaviours in the filesystem mount options, for example in /etc/fstab:

  • noatime: never update access time fields.
  • nodiratime: don’t update access time fields on directories, but update files and other objects “normally”. You can combine this option with other atime behaviours.
  • strictatime: update access time fields on every access.
  • lazytime: only update the times (atime, mtime, and ctime) in memory; the updates are written to disk when some other change to the inode is required. See LWN’s Introducing lazytime article for more information about this particular option.

If you’d like to learn more about atime and how to change the behaviours on your filesystems, take a look at:

Photo by Heather Zabriskie on Unsplash