On Tue, Aug 29, 2023 at 11:10:17AM +0200, Michael wrote: > On Tuesday, 29 August 2023 03:56:55 CEST, Greg Wooledge wrote: > > > The problem is, most Debian systems are set up to mount the core file > > systems with "relatime". This means you don't have a record of the > > last time each file was accessed, so you can't ask the computer which > > files were most recently opened. > > hm... > > i was curious about that and read the man page for 'mount(8)', in section > FILESYSTEM-INDEPENDENT MOUNT OPTIONS i found the following: > > relatime > Update inode access times relative to modify or change time. > Access time is only updated if the previous access time was > earlier than the current modify or change time. [...] > > so my understanding is, that access time is indeed updated if 'relatime' is > used as a mount option. to prevent updating access times 'noatime' should be > used.
It's changed *only* under the specific circumstance where the file has been modified since it was last read. If the file hasn't been written to (or metadata changed), atime isn't updated. So, imagine there's a doorbell.au file somewhere in Gene's file system, and that this file has been played, once in a while, for several years. It hasn't been *modified* in all that time. It's a very static file. But every once in a while, something opens it and reads it. In that situation, the mtime on the file is going to be "whenever it was created" (close enough for this discussion), and the atime is going to be "whenever it was first played", perhaps 5 or 10 or 20 years ago. Even though it was just played a few days ago. Long story short, sorting files by atime isn't going to reveal it. Unless of course Gene's file systems are mounted with an overriding option, and he's getting full historic atime behavior.
