Filesysteme Tipps und Tricks: Difference between revisions

From Lolly's Wiki
Jump to navigationJump to search
m (Text replacement - "[[Kategorie:" to "[[Category:")
m (Text replacement - "</source" to "</syntaxhighlight")
 
Line 9: Line 9:
Filesystem        Size  Used Avail Use% Mounted on
Filesystem        Size  Used Avail Use% Mounted on
data/backup/dumps  24G  8.6G  16G  36% /var/data/dumps
data/backup/dumps  24G  8.6G  16G  36% /var/data/dumps
</source>
</syntaxhighlight>


====You need the i-node number of the file====
====You need the i-node number of the file====
Line 15: Line 15:
# ls -i /var/data/dumps/sackhalter_20140407.dump  
# ls -i /var/data/dumps/sackhalter_20140407.dump  
103 /var/data/dumps/sackhalter_20140407.dump
103 /var/data/dumps/sackhalter_20140407.dump
</source>
</syntaxhighlight>


====Get the metadata of the file====  
====Get the metadata of the file====  
Line 21: Line 21:
# zdb -dddd data/backup/dumps 103 | grep crtime
# zdb -dddd data/backup/dumps 103 | grep crtime
crtime Tue Jul 29 13:00:18 2014
crtime Tue Jul 29 13:00:18 2014
</source>
</syntaxhighlight>


===Creation time on ext2/3/4===
===Creation time on ext2/3/4===
Line 29: Line 29:
Filesystem      Size  Used Avail Use% Mounted on
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        15G  8.4G  5.8G  60% /
/dev/sda1        15G  8.4G  5.8G  60% /
</source>
</syntaxhighlight>


====You need the i-node number of the file====
====You need the i-node number of the file====
Line 35: Line 35:
# ls -i /usr/bin/passwd  
# ls -i /usr/bin/passwd  
130776 /usr/bin/passwd
130776 /usr/bin/passwd
</source>
</syntaxhighlight>


====Get the metadata of the file====  
====Get the metadata of the file====  
Line 41: Line 41:
# debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime
# debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime
crtime: 0x5391870e:a6803fc8 -- Fri Jun  6 11:17:02 2014
crtime: 0x5391870e:a6803fc8 -- Fri Jun  6 11:17:02 2014
</source>
</syntaxhighlight>


====Nice oneliner====  
====Nice oneliner====  
Line 47: Line 47:
# file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'
# file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'
crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd
crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd
</source>
</syntaxhighlight>

Latest revision as of 06:14, 26 November 2021


Get the creation time... not the changetime

Creation time on zfs

You need the Filesystem where the file resides

# df -h /var/data/dumps/sackhalter_20140407.dump 
Filesystem         Size  Used Avail Use% Mounted on
data/backup/dumps   24G  8.6G   16G  36% /var/data/dumps

You need the i-node number of the file

# ls -i /var/data/dumps/sackhalter_20140407.dump 
103 /var/data/dumps/sackhalter_20140407.dump

Get the metadata of the file

# zdb -dddd data/backup/dumps 103 | grep crtime
	crtime	Tue Jul 29 13:00:18 2014

Creation time on ext2/3/4

You need the Filesystem where the file resides

# df -h /usr/bin/passwd 
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        15G  8.4G  5.8G  60% /

You need the i-node number of the file

# ls -i /usr/bin/passwd 
130776 /usr/bin/passwd

Get the metadata of the file

# debugfs -R 'stat <130776>' /dev/sda1 2>/dev/null | grep crtime
crtime: 0x5391870e:a6803fc8 -- Fri Jun  6 11:17:02 2014

Nice oneliner

# file=/etc/passwd ; ls -1i ${file} | nawk -v dev=$(df --output=source ${file} | tail -n +2) 'BEGIN{debugfs="debugfs -R \"stat <INODE>\" /dev/sda1 2>/dev/null";}{file=$2;command=debugfs;gsub(/INODE/,$1,command); while (command | getline){if(/crtime/){print $0,file}}; close(command);}'
crtime: 0x54009e05:24f51228 -- Fri Aug 29 17:36:37 2014 /etc/passwd