atimes

[plug@arcticmail.com]

The atime is only changed when the contents of a
file are read, so a "find -print" or "ls -l" have
no effect on atime.  Something like
"find / -type f -exec file {} \;" would change
the atime, though.

One use of atime would be after an intrusion
to determine what files the cracker looked at.

Another use of atime is disk grooming.  Rather
than doing a BOFHish

  rm -rf /home/john

to free up disk space, you could do

  find /home/john -type f -atime +365 -exec rm -f {} \;

If you ain't accessed it in over a year, you
ain't gonna miss it.


D


* On Fri, Jan 12, 2001 at 11:19:31AM -0800, Lucas Vogel wrote:
> I was just reading about that yesterday in the LinuxJournal weekly email
> newsletter. From their email:
> 
> "Another useful option to put in /etc/fstab is "noatime", which prevents
> access times from being updated when files on that partition are read.
> Webmasters of busy servers use noatime on the partition where their document
> root lives to get better performance. "
> 
> IMHO the best environment for the noatime option is for "safe" nonsystem
> files, such as webpages or the like. Places where you OBVIOUSLY don't want
> something like noatime to be set would be log files, etc.
> 
> My humble 0.02,
> Lucas Vogel
> 
> P.S. my apologies to all for not making the meeting last night...
> 
> -----Original Message-----
> From: Ken Bowley [mailto:johann@trod.org]
> Sent: Friday, January 12, 2001 12:01 PM
> To: plug-discuss@lists.PLUG.phoenix.az.us
> Subject: atimes
> 
> 
> Okay...  I know I've taught this in classes before when talking about
> system tuning, but what are the side effects of turning off
> atimes?  (using the noatime option when mounting a filesystem)
> 
> I've recently been playing around with it, and can't believe the
> difference it makes!  Have you ever done a `find / --print` and NOT had
> the hard drive sound like it's going to rattle out of the computer?
> 
> Now, back to my question, what are the side effects of disabling
> atimes?  Are there any utilities that really need to know the last time a
> file was accessed? (which would include the last time someone did
> something like a `ls -l`)
> 
> -=-=-=-=-=-=-=-=-=-=-=[The Realm of Darkness]=-=-=-=-=-=-=-=-=-=-= O-
>  Ken Bowley                                        johann@trod.org
>  AKA: Lord Johann                              http://www.trod.org
> -=-=-=-=-=[ Linux, the choice of the GNU generation ]=-=-=-=-=-=-=-=-
> LCP, LCI, and Brainbench Linux MVP
> 
> 
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post
> to the list quickly and you use Netscape to write mail.
> 
> Plug-discuss mailing list  -  Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
> 
> ________________________________________________
> See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't post to the list quickly and you use Netscape to write mail.
> 
> Plug-discuss mailing list  -  Plug-discuss@lists.PLUG.phoenix.az.us
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>