s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

stat

Show all details of a file: size, blocks, inode, links, permissions, owner, SELinux context and all its times.

Level
Everyday Linux
Group
Files and folders
Needs root
No
Package
coreutils

What it does

stat prints the inode information of a file. It shows more than ls -l: the permissions as numbers (0644), the inode number, the number of hard links, the device, and four times:

  • Access: last read.
  • Modify: last change of the data.
  • Change: last change of the inode (permissions, owner, links). It cannot be set with touch.
  • Birth: when the file was created (if the file system knows it).

With -c FORMAT you choose exactly what to print, which is great in scripts.

How to write it

stat [OPTION]... FILE...

Options 26

Most used

-c, --format=format
Print only these fields (see the format codes below).
--printf=format
Like -c, but read \n and \t, and no new line at the end.
-L, --dereference
Follow symbolic links.
-f, --file-system
Show the status of the file system instead of the file.
-t, --terse
Print everything on one line (for scripts).
--cached=mode
How to use cached data on network file systems: always, never, default.
--help
Show help.
--version
Show the version.

Format codes (for files)

%n
File name.
%s
Size in bytes.
%a
Permissions as numbers (like 644). With %A: like -rw-r--r--.
%U / %u
Owner name / owner number.
%G / %g
Group name / group number.
%i
Inode number.
%h
Number of hard links.
%F
File type (regular file, directory …).
%C
SELinux context.
%x %y %z %w
Access, modify, change and birth time (readable).
%X %Y %Z %W
The same times as seconds since 1970.
%b %B
Number of blocks, and the block size.
%d %D
Device number (decimal / hex).
%N
Quoted name, with the target for links.

Format codes (with -f)

%T
File system type (like xfs).
%S
Block size.
%b / %f / %a
Total / free / available blocks.
%c / %d
Total / free inodes.

Examples 11

$ run as a normal user# run as root (or with sudo)

  1. 1Show all details of a file

    stat /etc/passwd

    Size, inode, links, permissions (0644/-rw-r--r--), owner, SELinux context and 4 times.

  2. 2Get the permissions as a number

    stat -c '%a %n' /etc/shadow /etc/passwd
0 /etc/shadow
644 /etc/passwd

    Easy to compare with the expected values in a compliance check.

  3. 3Print owner and group

    stat -c '%U:%G' /var/www/html

    A wrong owner explains many "Permission denied" errors.

  4. 4See when a file really changed (incident response)

    stat -c 'modify=%y change=%z' /usr/bin/sudo

    If "change" is recent but "modify" is old, someone may have reset the time with touch.

  5. 5Count the hard links of a file

    stat -c '%h' data.txt

    More than 1 means other names point to the same data.

  6. 6Show the SELinux context

    stat -c '%C' /var/www/html/index.html
unconfined_u:object_r:httpd_sys_content_t:s0

    Same information as ls -Z.

  7. 7File system info: type and free inodes

    stat -f /var

    Shows the type (xfs), block size, free blocks and free inodes.

  8. 8Show the target of a link

    stat -c '%N' /etc/localtime
'/etc/localtime' -> '../usr/share/zoneinfo/Asia/Riyadh'

    Here: the time zone of the system.

  9. 9Age of a file in seconds (script)

    echo $(( $(date +%s) - $(stat -c %Y /var/backup/last.ok) ))

    Alert when the last backup flag file is too old.

  10. 10Compare permissions of many files

    stat -c '%a %U:%G %n' /etc/ssh/*

    The private host keys must be 600 (or 640 for group ssh_keys), owned by root.

  11. 11One-line output for a script

    stat -t /etc/hosts

    All fields in a fixed order on one line.

Watch out

  • "Change" (ctime) is not the creation time; it is the last change of the file's metadata.
  • Birth time can show "-" when the file system or kernel does not provide it.

Tips to remember

  • stat -c '%a %U:%G %n' FILE = permissions, owner and name in one short line.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man stat

Open the man page (linux.die.net)man7.org