Is st_atime valid?

[Rich Teer]

On Fri, 18 Jul 2003, Ian Pilcher wrote:

> I am working on a "disk cleanup" type utility program. As you can
> imagine, it depends on getting accurate st_atime, st_mtime, and st_ctime
> values from stat(). Obviously, st_atime won't always be valid, because
> of the file system or mount options.
>
> How can I determine if the st_atime for a given file is valid?

If you're asking what I think you are, you can't. Strictly
speaking, the times will be valid - just not necessarily
accurate.

--
Rich Teer, SCNA, SCSA

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: [url]http://www.rite-online.net[/url]

[Mark Rafn]

Ian Pilcher <pilchman@attbi.com> wrote:

>I am working on a "disk cleanup" type utility program. As you can
>imagine, it depends on getting accurate st_atime, st_mtime, and st_ctime
>values from stat(). Obviously, st_atime won't always be valid, because
>of the file system or mount options.
>How can I determine if the st_atime for a given file is valid?

You cannot. Even if the FS is mounted in such a way that atime is updated,
there are a number of uses of a file that don't update the atime anyway (ISTR
that mmap() doesn't update it, and certainly some programs use files as
markers which are never actually opened and read, but would be bad to delete).
--
Mark Rafn [email]dagon@dagon.net[/email] <http://www.dagon.net/>

[Andy Isaacson]

In article <TyJRa.77620$GL4.19568@rwcrnsc53>,
Ian Pilcher <pilchman@attbi.com> wrote:

>I am working on a "disk cleanup" type utility program. As you can
>imagine, it depends on getting accurate st_atime, st_mtime, and st_ctime
>values from stat(). Obviously, st_atime won't always be valid, because
>of the file system or mount options.
>
>How can I determine if the st_atime for a given file is valid?

So to rephrase your question:

"If a filesystem is mounted read-only or 'noatime', how can I find out
when a file on it was accessed?"

(substitute "if a file's atime represents the most recent time the file was
accessed?" for the last line, if you like; they are equivalent questions.)

It should be obvious that this is impossible. The information you seek
was not recorded, because the admin explicitly asked that it not be
recorded.

-andy

[Ian Pilcher]

Andy Isaacson wrote:

>
> So to rephrase your question:
>
> "If a filesystem is mounted read-only or 'noatime', how can I find out
> when a file on it was accessed?"
>
> (substitute "if a file's atime represents the most recent time the file was
> accessed?" for the last line, if you like; they are equivalent questions.)

Actually, that's not what I want. I was just wondering if there was a
way to find out that a given file's atime is unreliable. (Something
less error-prone than parsing /etc/mtab and using realpath.)

Thanks!

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================

[Ian Pilcher]

Andy Isaacson wrote:

>
> Actually, what you ask for *is* what I said. What do you mean, "a given
> file's atime is unreliable"? You implicitly are asking for a per-file
> datum. Otherwise, the per-filesystem information available via
> popen("mount") should suffice. I'd also recommend using struct stat's
> st_dev field plus doing a stat on the device nodes parsed from mount's
> output, rather than realpath and /etc/mtab.
>

Nothing like two people talking past one another! I was rolling the
"determine what filesystem a file is on" step under the covers.

As you point out, I can determine the device on which a particular file
resides with the st_dev field from stat. I was really hoping, however,
that there was a better way to do the device<-->filesystem mapping than
parsing /etc/mtab (or the output of mount).

If the format ever changes, of course, there's no telling what the
results might be. Also, I've found that mount/mtab can be inaccurate if
/etc/mtab is on a read-only filesystem. So I need to determine if
/etc/mtab is on a read-only filesystem, which may not work if it is on
a read-only filesystem....

Any ideas?

Thanks!

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================

[Mark Rafn]

Ian Pilcher <pilchman@attbi.com> wrote:

>As you point out, I can determine the device on which a particular file
>resides with the st_dev field from stat. I was really hoping, however,
>that there was a better way to do the device<-->filesystem mapping than
>parsing /etc/mtab (or the output of mount).

Nope. This will be system-dependent, and you may need to change the parsing
code for each OS variant you support. I'd expect the mount output to be more
standard than /etc/mtab or /proc/mounts, either of which may be radically
different or missing on various systems.

>If the format ever changes, of course, there's no telling what the
>results might be. Also, I've found that mount/mtab can be inaccurate if
>/etc/mtab is on a read-only filesystem. So I need to determine if
>/etc/mtab is on a read-only filesystem, which may not work if it is on
>a read-only filesystem....

Yup. parsing the output of mount is a little better. Even this doesn't
tell you whether the last access to the file updated the atime. Perhaps the
filesystem is mounted ro most of the time, but currently is rw for some
reason. Is the atime "valid"?

Fundamentally, atime is usless except as an untrusted hint about the file.
Get used to this idea; no amount of checking can tell you that an old atime
on a file means it hasn't been read recently.
--
Mark Rafn [email]dagon@dagon.net[/email] <http://www.dagon.net/>

[Rich Teer]

On Thu, 24 Jul 2003, Ian Pilcher wrote:

> I am, however, having trouble accepting that there isn't even a reliable
> way to determine if the filesystem on which a file resides is
> *currently* mounted in such a way that reading it will update the atime.

There is: check /etc/mnttab for the readonly or noatime options
on the file system in question. If either is present, the atime
won't be updated.

--
Rich Teer, SCNA, SCSA

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: [url]http://www.rite-online.net[/url]

[Ian Pilcher]

Rich Teer wrote:

> On Thu, 24 Jul 2003, Ian Pilcher wrote:
>
> There is: check /etc/mnttab for the readonly or noatime options
> on the file system in question. If either is present, the atime
> won't be updated.
>

Except that /etc/mtab may not be accurate if the root filesystem (or
/etc filesystem) is mounted read-only.

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================

[Jason Creighton]

On Thu, 24 Jul 2003 00:10:17 GMT
Ian Pilcher <pilchman@attbi.com> wrote:

> Mark Rafn wrote:

> > Fundamentally, atime is usless except as an untrusted hint about the file.
> > Get used to this idea; no amount of checking can tell you that an old atime
> > on a file means it hasn't been read recently.

>
> I am used to the idea that atime isn't really "reliable". (Sorry, but I
> really don't know a better word.)
>
> I am, however, having trouble accepting that there isn't even a reliable
> way to determine if the filesystem on which a file resides is
> *currently* mounted in such a way that reading it will update the atime.

Well, you _could_ do something like this:

(I am new to both C and UNIX programming, so there's probably errors in this code)

#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <stdio.h>

#define BUFLEN 1

int main(int argc, char **argv) {
struct stat fileinfo;
time_t oldatime;
FILE *fp;
/* I know I could just use argv[1] all the time, but I think it looks ugly. */
char *filename;
char dummy[BUFLEN];

if(argc != 2) {
printf("Usage: %s <file>\n", argv[0]);
exit(1);
}

filename = argv[1];

if(stat(filename, &fileinfo) != 0) {
printf("Can't stat %s: %s\n", filename, strerror(errno));
exit(1);
}

oldatime = fileinfo.st_atime;

if((fp = fopen(filename, "r")) == NULL) {
printf("Error opening %s: %s\n", filename, strerror(errno));
exit(1);
}

/* is casting to size_t the right thing to do here? */
fread(dummy, (size_t)BUFLEN, (size_t)BUFLEN, fp);
fclose(fp); /* Probably should check for error */


/* Should just write wrapper function instead if duplicating code */
if(stat(filename, &fileinfo) != 0) {
printf("Can't stat %s: %s", filename, strerror(errno));
exit(1);
}

if(oldatime != fileinfo.st_atime) {
printf("File %s's atime is being updated\n", filename);
} else {
printf("File %s's atime is not being updated\n", filename);
}

return 0;
}

~/prog/c$ ./atime-check /etc/passwd
File /etc/passwd's atime is not being updated
~/prog/c$ mount
/dev/ide/host0/bus0/target0/lun0/part3 on / type reiserfs (rw,noatime)
/dev/ide/host0/bus0/target0/lun0/part5 on /home type reiserfs (rw,noatime)
none on /proc type proc (rw)
/dev/ide/host0/bus0/target0/lun0/part1 on /mnt/hurd type ext2 (rw)
~/prog/c$ su
Password:
/home/jason/prog/c# mount -o remount,atime /
/home/jason/prog/c# exit
~/prog/c$ ./atime-check /etc/passwd
File /etc/passwd's atime is being updated

.....but this is ugly. But if you *need* to know if an atime is being updated,
this works.

Jason Creighton

[Rich Teer]

On Thu, 24 Jul 2003, Ian Pilcher wrote:

> Except that /etc/mtab may not be accurate if the root filesystem (or
> /etc filesystem) is mounted read-only.

OK, this is where we start getting flavour specific. What I'm about
to post applies to Solaris; it may or may not apply to other flavours.

First: mounting root as read only seems kind of tricky*, as files like
/var/utmpx need to be updated. Secondly, from Solaris 8, /etc/mnttab
isn't even a real file. It's a pseudo filesystem that looks like a
real file.

* And probably ill advised.

--
Rich Teer, SCNA, SCSA

President,
Rite Online Inc.

Voice: +1 (250) 979-1638
URL: [url]http://www.rite-online.net[/url]

[Ian Pilcher]

Jason Creighton wrote:

>
> Well, you _could_ do something like this:
>

.....

Thanks for the thought. Unfortunately, since my program will make use
of the st_atime values, I can't change them.

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================

[Ian Pilcher]

Rich Teer wrote:

> OK, this is where we start getting flavour specific. What I'm about
> to post applies to Solaris; it may or may not apply to other flavours.

I'm trying to avoid being flavor-specific, although it looks like that
may be inevitable.

> First: mounting root as read only seems kind of tricky*, as files like
> /var/utmpx need to be updated. Secondly, from Solaris 8, /etc/mnttab
> isn't even a real file. It's a pseudo filesystem that looks like a
> real file.
>
> * And probably ill advised.

Agreed about read-only root being tricky. The only legitimate reason I
can think of is a "rescue mode" of some sort.

I'm developing this on Red Hat Linux, and /etc/mtab is a regular file.
There is also /proc/mounts, but it's Linux-only, and it has its own
format oddities.

The best I can come up with at this point is:

* stat /etc/mtab & save st_atime

* sleep for 1 second

* read /etc/mtab

* stat /etc/mtab again, and compare st_atime's

* abort if the two time values are equal

(I don't particularly care if /etc/mtab is on a noatime filesystem, but
better safe than sorry.)

This will work if /etc/mtab is a regular file, but it might barf on
Solaris or any other system that uses a virtual file.

Can anyone think of anything better?

Thanks!

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================

[Jason Creighton]

On Thu, 24 Jul 2003 17:47:58 GMT
Ian Pilcher <pilchman@attbi.com> wrote:

> Jason Creighton wrote:
>

> >
> > Well, you _could_ do something like this:
> >

> ....
>
> Thanks for the thought. Unfortunately, since my program will make use
> of the st_atime values, I can't change them.

Hmm, you're right. Since you're relying upon atime in the first place,
you can't just change it randomly. I can't think of a clean way to do
what you want. So, what that in mind, here's what I think is the
cleanest solution: Put "<name of utility> CAN NOT OPERATE ON FILESYSTEMS
THAT DO NOT MAINTAIN atime!" in bold letters in the manpage.

Jason Creighton

[Ian Pilcher]

Jason Creighton wrote:

>
> Hmm, you're right. Since you're relying upon atime in the first place,
> you can't just change it randomly. I can't think of a clean way to do
> what you want. So, what that in mind, here's what I think is the
> cleanest solution: Put "<name of utility> CAN NOT OPERATE ON FILESYSTEMS
> THAT DO NOT MAINTAIN atime!" in bold letters in the manpage.
>

Actually, I've always planned to have it come up in a dialog box the
first time the program is run. Imagine the reaction of a typical Linux
newbie (who has only used Windows or MacOS before), and I think it's
pretty clear that the program should do everything possible to identify
any problematic filesystems.

The good news is that this typical newbie won't have any filesystems
mounted read-only or with the "noatime" option. So the combination of a
reminder for advanced users and the aforementioned "good faith" effort
should be adequate.

It's still kind of mind boggling, however, to thing that there's no
truly portable way for an application to enumerate all mounted file-
systems and their mount options.

--
================================================== ======================
Ian Pilcher [email]pilchman@attbi.com[/email]
================================================== ======================