Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!zaphod.mps.ohio-state.edu!van-bc!twg!bill
From: bill@twg.bc.ca (Bill Irwin)
Newsgroups: comp.unix.admin
Subject: What action updates a file's ACCESS time?
Keywords: file access time
Message-ID: <331@twg.bc.ca>
Date: 20 Nov 90 07:49:26 GMT
Organization: The Westrheim Group, Vancouver, B.C., Canada
Lines: 32

I would like to know ALL the possible activities that could result in a file's
access  time (ls -lu) being updated.  I have performed the following, with the
noted result:

1) vi the file and quit without saving (access time updated)

2) TAR archive some files to tape (updated)

3) list file names to a file and printer
   ls -l > /tmp/list  (not updated)
   ls -l | lp         (not updated)

Are  there  any other actions that could be done that would update the  access
times?  Specifically, if you saw many directories of program source code files
(over  160  files)  that had an access time between 6 and  7pm  (after  office
hours),  would you conclude that someone had used an editor and looked at each
file  within the hour, or would you conclude that the files had been  archived
to tape or diskette?

I  just thought of another action that would probably update the access  time:
using  grep  to search the files for a pattern.  I haven't tested this, but  I
would  assume that grep reads through the files looking for the pattern, which
would  be the same type of activity as a vi on the file to the OS.  This would
certainly  be  a far less sinister activity than archiving source  code  after
hours.

I would appreciate any tips in this direction.
-- 
Bill Irwin    -       The Westrheim Group     -    Vancouver, BC, Canada
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
uunet!van-bc!twg!bill     (604) 431-9600 (voice) |     UNIX Systems
bill@twg.bc.ca            (604) 430-4329 (fax)   |     Integration