Getting Started with stat - Reading File Metadata

Getting Started with stat - Reading File Metadata
Reading time: About 12 min Difficulty: Intermediate

What stat Shows You

stat retrieves detailed file metadata in a single command — more than ls -l provides. It shows timestamps, inode numbers, hard link counts, block usage, and every attribute the filesystem records.

Quick Summary

  • Check file timestamps → stat filename
  • Extract a single field in scripts → stat -c "%Y" filename (mtime as Unix timestamp)
  • Check filesystem block/inode usage → stat -f /path

Basic Usage

$ stat /etc/hosts
  File: /etc/hosts
  Size: 220             Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 1179676     Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-05-28 09:12:34.000000000 +0000
Modify: 2026-03-10 14:22:05.000000000 +0000
Change: 2026-03-10 14:22:05.000000000 +0000
 Birth: 2025-01-15 08:00:00.000000000 +0000

The output includes the filename, size, inode number, permissions, owner/group, and three types of timestamps.

Reading the Output Fields

Field Meaning
Size File size in bytes
Blocks Disk space used in 512-byte blocks
IO Block Filesystem block size
Inode Inode number (unique identifier in the filesystem)
Links Hard link count
Access (0644/...) Permissions in octal and symbolic notation
Uid / Gid Owning user and group

Blocks counts 512-byte disk blocks actually allocated, not just the logical file size. It can be larger than Size due to block boundary alignment.

Understanding the Three Timestamps

The stat output shows three timestamps: Access, Modify, and Change. They are related but distinct.

Timestamp Short name Updated when
Access atime The file is read
Modify mtime The file's contents change
Change ctime The inode attributes change (including after mtime updates)
Birth btime The file is created (filesystem-dependent)

ctime is not creation time

Change stands for "change", not "creation". Running chmod or chown also updates ctime. For true creation time, use Birth — but some filesystems (non-ext4) display -- for Birth.

Performance Note on atime

On many Linux systems, reading a file triggers an atime write. Performance-sensitive systems often disable this with the noatime mount option.

$ grep noatime /etc/fstab

Using Inode Numbers

The inode number uniquely identifies a file within a filesystem. Hard links share the same inode.

$ stat /etc/hosts | grep Inode
    Inode: 1179676
# Create a hard link and verify they share the same inode
$ ln file.txt hardlink.txt
$ stat -c "%i %n" file.txt hardlink.txt
1234567 file.txt
1234567 hardlink.txt

The Links count becomes 2, confirming that two names (directory entries) point to the same inode.

Format Options for Scripts

Use -c (or --format) to extract specific fields in scripts.

# File size in bytes
$ stat -c "%s" /var/log/syslog
1048576

# Last modification time (Unix timestamp)
$ stat -c "%Y" /var/log/syslog
1748700000

# Permissions (octal) and owner
$ stat -c "%a %U" /etc/hosts
644 root

# Multiple fields formatted
$ stat -c "Name: %n | Size: %s bytes | Modified: %y" /etc/hosts
Name: /etc/hosts | Size: 220 bytes | Modified: 2026-03-10 14:22:05.000000000 +0000

Common format specifiers:

Specifier Meaning
%n File name
%s Size in bytes
%a Permissions (octal)
%A Permissions (symbolic, e.g. -rw-r--r--)
%U Owner username
%G Owner group name
%i Inode number
%y Last modification time (human-readable)
%Y Last modification time (Unix timestamp)
%x Last access time
%z Last status change time
%h Hard link count

%y vs %Y: lowercase %y gives a human-readable timestamp; uppercase %Y gives epoch seconds. Use %Y in scripts for arithmetic and comparison.

Filesystem Information with -f

The -f flag reports filesystem-level statistics rather than individual file metadata.

$ stat -f /
  File: "/"
    ID: fd0000000000 Namelen: 255     Type: ext2/ext3
Block size: 4096       Fundamental block size: 4096
Blocks: Total: 20000000  Free: 12000000  Available: 11000000
Inodes: Total: 5000000   Free: 4800000
Field Meaning
Block size Filesystem block size
Blocks: Total/Free/Available Total, free, and non-root-available blocks
Inodes: Total/Free Total and remaining inode count

When a filesystem has space but write operations fail, check inode exhaustion: Inodes: Free near zero. You can also check with df -i. Inode exhaustion is a common cause of "no space left on device" despite apparent free space.

Practical Use Cases

Check when a file was last modified

$ stat -c "%y" /etc/nginx/nginx.conf
2026-04-01 10:30:00.000000000 +0000

Record mtime before a backup

$ stat -c "%Y %n" /important/data.db
1748700000 /important/data.db

Compare modification times across files

$ for f in /etc/nginx/*.conf; do stat -c "%Y %n" "$f"; done | sort -n
1748600000 /etc/nginx/mime.types
1748700000 /etc/nginx/nginx.conf

Get permissions in numeric form (for chmod)

$ stat -c "%a" /etc/hosts
644

Next Reading