CrackOps
Interview PrepTracksLinuxAWS LabSoonInterview RoomSoon
Sign inStart free
CrackOps

Interview prep for the people who keep production up.

[email protected]
ProductInterview PrepTracksDashboardInterview Room
RolesDevOpsSREPlatformCloud
CompanyAboutContactPrivacyTerms
© CrackOps
Linux / File & Directory Management / stat

stat

Show a file's inode: size, permissions, owner and timestamps

Intermediatefilesysteminodeforensicsscripting

stat prints everything the filesystem knows about a file: type, size, blocks, inode number, link count, permissions in octal and symbolic form, owner, and all four timestamps. With -c it prints exactly the fields you ask for, which makes it the right tool for scripts.

Syntaxstat [OPTION]... FILE... stat -c FORMAT FILE stat -f FILE

Watch it run

You want the full metadata of a config file before and after a change.

devops@devops-lab: ~/app — zsh — 96×28
➜ ~/app
Step 1 of 3
stat Dockerfile

One screen with everything in the inode. Read the notes for each line.

Anatomy of a command

$
commandstat

Read the file's inode with the statx() system call and print it.

How it works

stat calls the statx() system call, which returns the file's inode metadata without opening or reading the file: file type and mode bits, owner and group IDs, size, the number of 512-byte blocks allocated, the preferred I/O block size, device and inode numbers, hard-link count, and timestamps. Access (atime) is the last read, Modify (mtime) the last content change, Change (ctime) the last inode change of any kind, including chmod, chown, rename or a new hard link, and Birth (btime) the creation time on filesystems that record it, like ext4 and XFS. stat translates the IDs to names via the user database. By default it follows nothing: on a symlink it shows the link itself; -L follows it to the target. stat -f calls statfs() instead and describes the filesystem the file lives on: type, block counts and free inodes.

Options you'll actually use

-c FORMATPrint only the given fields (one line per file)
--printf FORMATLike -c but interprets \n and \t, no automatic newline
-LFollow symlinks and show the target
-fShow the filesystem (type, blocks, inodes free) instead of the file
-tTerse, machine-readable single line
%a / %APermissions in octal (644) / symbolic (-rw-r--r--)
%U %G / %u %gOwner and group names / numeric IDs
%s / %bSize in bytes / number of blocks allocated
%x %y %z %wAccess, modify, change and birth time (human)
%X %Y %ZThe same times as Unix epoch seconds
%i / %h / %FInode number / hard-link count / file type

Common mistakes

ls -l file | awk '{print $1}' to check permissions in a script

ls output is formatted for humans and varies (ACL '+', SELinux '.', locale dates).

stat -c %a file (octal) or stat -c %A file (symbolic)
Treating ctime as 'creation time'

ctime is the inode change time: it updates on chmod, chown, rename and writes.

Birth (%w / %W) is creation time, on filesystems that store it
Expecting Access to change every time a file is read

Most systems mount with relatime: atime is only updated if it's older than mtime or more than 24 hours old.

Don't rely on atime for 'last used'; use audit logs (auditd) if you need reads tracked

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show the full stat output of ~/app/config/app.yaml and identify its inode number and link count.

  2. 2

    Print just the octal permissions and owner of ~/app/.env. Is it too open? Fix it and print again.

  3. 3

    ~/app.yaml is a symlink. Print its own size, then the size of the file it points to.

  4. 4

    Check how many free inodes the filesystem holding your home directory has.

Related commands

lsList directory contentstouchCreate empty files or update timestampslnCreate hard links and symbolic linksdfReport used and free space per filesystemchmodChange file permissions
PrevioustreeNextln
Linux / File & Directory Management / stat

stat

Show a file's inode: size, permissions, owner and timestamps

Intermediatefilesysteminodeforensicsscripting

stat prints everything the filesystem knows about a file: type, size, blocks, inode number, link count, permissions in octal and symbolic form, owner, and all four timestamps. With -c it prints exactly the fields you ask for, which makes it the right tool for scripts.

Syntaxstat [OPTION]... FILE... stat -c FORMAT FILE stat -f FILE

Watch it run

You want the full metadata of a config file before and after a change.

devops@devops-lab: ~/app — zsh — 96×28
➜ ~/app
Step 1 of 3
stat Dockerfile

One screen with everything in the inode. Read the notes for each line.

Anatomy of a command

$
commandstat

Read the file's inode with the statx() system call and print it.

How it works

stat calls the statx() system call, which returns the file's inode metadata without opening or reading the file: file type and mode bits, owner and group IDs, size, the number of 512-byte blocks allocated, the preferred I/O block size, device and inode numbers, hard-link count, and timestamps. Access (atime) is the last read, Modify (mtime) the last content change, Change (ctime) the last inode change of any kind, including chmod, chown, rename or a new hard link, and Birth (btime) the creation time on filesystems that record it, like ext4 and XFS. stat translates the IDs to names via the user database. By default it follows nothing: on a symlink it shows the link itself; -L follows it to the target. stat -f calls statfs() instead and describes the filesystem the file lives on: type, block counts and free inodes.

Options you'll actually use

-c FORMATPrint only the given fields (one line per file)
--printf FORMATLike -c but interprets \n and \t, no automatic newline
-LFollow symlinks and show the target
-fShow the filesystem (type, blocks, inodes free) instead of the file
-tTerse, machine-readable single line
%a / %APermissions in octal (644) / symbolic (-rw-r--r--)
%U %G / %u %gOwner and group names / numeric IDs
%s / %bSize in bytes / number of blocks allocated
%x %y %z %wAccess, modify, change and birth time (human)
%X %Y %ZThe same times as Unix epoch seconds
%i / %h / %FInode number / hard-link count / file type

Common mistakes

ls -l file | awk '{print $1}' to check permissions in a script

ls output is formatted for humans and varies (ACL '+', SELinux '.', locale dates).

stat -c %a file (octal) or stat -c %A file (symbolic)
Treating ctime as 'creation time'

ctime is the inode change time: it updates on chmod, chown, rename and writes.

Birth (%w / %W) is creation time, on filesystems that store it
Expecting Access to change every time a file is read

Most systems mount with relatime: atime is only updated if it's older than mtime or more than 24 hours old.

Don't rely on atime for 'last used'; use audit logs (auditd) if you need reads tracked

Interview questions

Practice

Try these on a Linux machine of your own. Each task has a hint and a solution.

  1. 1

    Show the full stat output of ~/app/config/app.yaml and identify its inode number and link count.

  2. 2

    Print just the octal permissions and owner of ~/app/.env. Is it too open? Fix it and print again.

  3. 3

    ~/app.yaml is a symlink. Print its own size, then the size of the file it points to.

  4. 4

    Check how many free inodes the filesystem holding your home directory has.

Related commands

lsList directory contentstouchCreate empty files or update timestampslnCreate hard links and symbolic linksdfReport used and free space per filesystemchmodChange file permissions
PrevioustreeNextln