Killing multiple processes at once in Linux

Requirement 1:  Kill all the running processes owned by a particular user.

List all the Process IDs of user

# pgrep -u <username>         

Find Real UID of user
# id <username>

Kill all the processes owned by user with Real UID specified.
# pkill -U <Real UID>           

Example:

Killing all the processes owned by userid 'nagios'

# pgrep -u nagios

# id nagios 

   uid=510(nagios) gid=510(nagios) groups=510(nagios)

# pkill –U 510

Requirement 2:  Kill all processes that are running with some process-name or string (from ps output)

Using "For" loop:

[root@hostxyz ~]# for i in `ps -ef | grep -v grep | grep [username/some string] | awk '{print $2}'`; do kill -9 $i; echo “process id $i is killed”; done

Using "Xargs":
[root@hostxyz ~]# ps aux | grep -v grep | grep [username/some string] | awk '{print $2}' | xargs kill -9

Sample execution:  

To kill all processes that has string "jboss" in it 

[root@hostxyz ~]# for i in `ps -ef | grep -v grep | grep jboss | awk '{print $2}'`; do kill -9 $i; echo "Process id $i is killed"; done

[root@hostxyz ~]# ps aux | grep -v grep | grep jboss | awk '{print $2} | xargs kill -9

Enabling/Disabling CPUs in Linux

We could get into situation to either disable or enable one or more CPU on a running Linux server (without reboot) and the Linux kernel does support that feature. The reason could be for improving the performance of server or for saving some computing power.


To check the list of CPUs available:


[root@hostxyz ]# cat /proc/cpuinfo


[root@hostxyz ~]# cd /sys/devices/system/cpu
[root@hostxyz cpu]# pwd
/sys/devices/system/cpu
[root@hostxyz cpu]# ls -l
total 0
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu0
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu1
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu2
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu3
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu4
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu5
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu6
drwxr-xr-x 4 root root    0 Mar  6 00:30 cpu7
-rw-r--r-- 1 root root 4096 Mar  6 00:30 sched_mc_power_savings
[root@hostxyz cpu]#

Suppose I want to disable the CPU no 5:

[root@hostxyz cpu]# cd cpu5

[root@hostxyz cpu5]# ls

cache  crash_notes  online  topology

[root@hostxyz cpu5]# cat online

1

[root@hostxyz cpu5]# echo 0 > online

[root@hostxyz cpu5]# cat /proc/cpuinfo | grep -i 'Processor'

processor       : 0

processor       : 1

processor       : 2

processor       : 3

processor       : 4                             

processor       : 6

processor       : 7

[root@hostxyz cpu5]#

[root@hostxyz cpu5]# cat /proc/interrupts

           CPU0       CPU1       CPU2       CPU3       CPU4       CPU6       CPU7

  0:  346882565          0          0          0          0          0          0    IO-APIC-edge  timer

  1:          0          0          0          0          0          0          0    IO-APIC-edge  i8042

  8:          0          0          0          0          0          0          0    IO-APIC-edge  rtc

  9:          0          0          0          0          0          0          0   IO-APIC-level  acpi

 14:          0          0          0          0          0          0          0    IO-APIC-edge  ata_piix

 15:          0          0          0          0          0          0          0    IO-APIC-edge  ata_piix

 66:         19          0          0          0          0          0          0   IO-APIC-level  ehci_hcd:usb1

 74:          0          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb2

 82:         49          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb3

 90:          0          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb4

 98:       1647        431          0     380368          0         53          0   IO-APIC-level  lpfc

106:       1667         53          0     380346          0        374          0   IO-APIC-level  lpfc

122:    3359627          0          0          0          0          0          0         PCI-MSI  eth0

169:       4954       4701          0     404864          0          0          0   IO-APIC-level  ioc0

NMI:       4505       2316       2389       2332       2882       2164       2909

LOC:  339979108  339988403  339978966  339984061  339983989  339992274  339992202

ERR:          0

MIS:          0

[root@hostxyz cpu5]#

In the above /proc output, you could see the CPU5 has gone !!!!!!!!!

[root@hostxyz cpu5]# cat online

0

Enabling the CPU 5 back:

[root@hostxyz cpu5]# echo 1 > online

[root@hostxyz cpu5]# cat /proc/cpuinfo | grep -i 'Processor'

processor       : 0

processor       : 1

processor       : 2

processor       : 3

processor       : 4

processor       : 5

processor       : 6

processor       : 7

[root@hostxyz cpu5]#

[root@hostxyz cpu5]# cat /proc/interrupts

           CPU0       CPU1       CPU2       CPU3       CPU4       CPU5       CPU6       CPU7

  0:  346920869          0          0          0          0          0          0          0    IO-APIC-edge  timer

  1:          0          0          0          0          0          0          0          0    IO-APIC-edge  i8042

  8:          0          0          0          0          0          0          0          0    IO-APIC-edge  rtc

  9:          0          0          0          0          0          0          0          0   IO-APIC-level  acpi

 14:          0          0          0          0          0          0          0          0    IO-APIC-edge  ata_piix

 15:          0          0          0          0          0          0          0          0    IO-APIC-edge  ata_piix

 66:         19          0          0          0          0          0          0          0   IO-APIC-level  ehci_hcd:usb1

 74:          0          0          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb2

 82:         49          0          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb3

 90:          0          0          0          0          0          0          0          0   IO-APIC-level  uhci_hcd:usb4

 98:       1647        431          0     380412          0          0         53          0   IO-APIC-level  lpfc

106:       1667         53          0     380390          0          0        374          0   IO-APIC-level  lpfc

122:    3360061          0          0          0          0          0          0          0         PCI-MSI  eth0

169:       4954       4703          0     404921          0          0          0          0   IO-APIC-level  ioc0

NMI:       4505       2317       2389       2332       2883       2428       2164       2910

LOC:  340016644  340025946  340016502  340021607  340021535  339927925  340029818  340029746

ERR:          0

MIS:          0

[root@hostxyz cpu5]#

In the above /proc output, you can see that I brought back the CPU 5 back.

All about TIME in Linux

Below given are some useful commands pertaining to Time and Date:

[root@hostxyz ]# clock --show
Tue 08 Mar 2011 02:27:07 PM CST  -0.950788 seconds

[root@hostxyz ]# hwclock
Tue 08 Mar 2011 02:27:17 PM CST  -0.438789 seconds
[root@hostxyz ]#

Set the hardware clock by executing:

# /sbin/hwclock --systohc

Syncing the time with other or Internet Time servers:

# /usr/bin/rdate -s  <remote server ip/hostname>

Syncing the time with NTP server:

# ntpdate -u <NTP server IP/Hostname>

 
Use "time" command to find the time of execution of a command:

[root@hostxyz ]# time updatedb



real    0m13.759s



user    0m0.293s



sys     0m1.190s



[root@hostxyz ]# times updatedb



0m0.044s 0m0.029s



0m3.839s 0m1.830s



[root@hostxyz ]#

# Timezone config file

[root@hostxyz ]# cat /etc/sysconfig/clock
ZONE="America/Chicago"
UTC=true
ARC=false
[root@hostxyz ]#

If you wish the Change the Timezone to IST, follow the below steps:

# rm -rf  /etc/localtime

Change to the directory /usr/share/zoneinfo here you will find a list of time zone regions. Choose the most appropriate region, if you live in India in city Chennai, you will find a directory "Indian".

Create a symbolic link to the appropriate timezone to /etc/localtime. 

# ln -sf /usr/share/zoneinfo/Indian/Chennai /etc/localtime 
[root@hostxyz zoneinfo]# cat zone.tab | grep -w Indian
CC    -1210+09655       Indian/Cocos
CX    -1025+10543       Indian/Christmas
IO    -0720+07225       Indian/Chagos
KM    -1141+04316       Indian/Chennai
MG    -1855+04731       Indian/Antananarivo
MU    -2010+05730       Indian/Mauritius
MV    +0410+07330       Indian/Maldives
RE    -2052+05528       Indian/Reunion
SC    -0440+05528       Indian/Mahe
TF    -492110+0701303   Indian/Kerguelen
YT    -1247+04514       Indian/Mayotte

[root@hostxyz zoneinfo]#

Steps to upgrade openssh package

1st Method

1.  Download the latest openssh package from http://www.openssh.org/ under /usr/local.

2.  Extract the package: # tar -xvf openssh-<version>.tar.gz

3.  Take a note of current SSH installation on the server by executing the following commands:

      # which ssh

      # rpm -qa | grep ssh

      # rpm -qf  `which ssh` 

      Also take a backup of /etc/ssh folder.

4.  Go to /usr/local/openssh-<version no>/ 

5.  Compile the openssh package as follows:

     # ./configure --with-kerberos5 --with-pam --with-md5-passwords 

6. make 

7. make install 

8. Check if the system is using the newly compiled openssh package by running the 'which' and 'ssh -v' command. 

9. Manually link the older version of  'ssh' command to new version:

   # mv /usr/sbin/ssh /usr/sbin/ssh_old

   # ln -s /usr/local/bin/ssh /usr/sbin/ssh  

2nd Method (by overriding existing SSH config)

1.  Download the latest openssh package from http://www.openssh.org/ under /usr/local.

2.  Extract the package: # tar -xvf openssh-<version>.tar.gz

3.  Take a note of current SSH installation on the server by executing the following commands:

      # which ssh

      # rpm -qa | grep ssh

      # rpm -qf  `which ssh` 

      Also take a backup of /etc/ssh folder.

4.  Go to /usr/local/openssh-<version no>/ 

5.  Compile the openssh package as follows:

./configure --prefix=/usr --sysconfdir=/etc/ssh --with-ssl-dir=/opt/openssl-0.9.8e --with-pam  --with-kerberos5 --with-md5-passwords --with-tcp-wrappers

6. make 

7. make install 

8. Check if the system is using the newly compiled openssh package by running the 'which' and 'ssh -v' command. 

Using 'date' command smartly

Here I have shown some examples for using 'date' command in various forms. This will be helpful for deriving some logic in scripting.

Current time:
[root@hostxyz ~]# date
Fri Mar  4 12:37:29 CST 2011


Output only the day of week:
[root@hostxyz ~]# date +%a
Fri


Output the Time 1 hour before:
[root@hostxyz ~]# date +%Y%m%d%H%M%S -d  "1 hour ago"
20110304113732
[root@hostxyz ~]#


Output the Time 2 hours before:
[root@hostxyz ~]# date   --date='2 hour ago' +'%b %e %H:'
Mar  4 10:
[root@hostxyz ~]#

Finding Yesterday's day and assigning to a variable DAY_1:  
DAY_1=`(date --date='1 days ago' '+&#37;a')`
echo $DAY_1

Finding day for two days ago and assigning to a variable DAY_2:

DAY_2=`(date --date='2 days ago' '+%a')`

echo $DAY_2

Suspending and resuming a running process in Linux

In Linux, a running process or command execution can be stopped in one terminal and made it to run from other terminal.  Let say you triggered a cp command for copying some huge volumes of data from one filesystem to other, from your own workstation. After initiating the command you realized that it would take more time to complete. In this situation, you got to deal with 2 issues. One is, incase you lost the connection to server, the command execution will stop, and other one is that you have to keep your workstation connected until the command execution completes.

Solution:

1.   Making the job to run in back-ground is a simple solution but it is not always possible to do it, when your script/command needs some set of inputs. Syntax for making a command execution to run in the back-ground is as follows:  # nohup  <command set> &     
(e.g   # nohup cp -apR /somefolder  /otherfolder & ).

2.   Start the job on first terminal (say Terminal-A). Open another terminal (say Terminal-B) where you can run the job uninterruptedly. On Terminal-B find out the Parent Process ID (PPID) of the Job which you started on Terminal-A. 

Execute the kill command with signal 19 to Suspend the process  
             # kill -19 <PID>

Go to Terminal-A and press Ctrl+z

Then come back to Terminal-B and execute the kill command with signal 18 to Continue the process
            # kill -18 <PID>

Exit from Terminal-A by running ‘exit’ command, Now your job/process will continue to run on Terminal-B.

Note: Please ensure that you suspend the PPID (Parent PID) of the Job (not the PID of its child process).  If you suspend the PID of child process and exit from Terminal-A, the parent process will get hang-up signal and terminate the execution, and the PID which you suspended will become defunct process.

Monitoring command execution at regular intervals

I use these 2 methods to monitor command execution at regular intervals. One by using the command “watch” and another by using a small while statement.


Using watch command:
 # watch -n <time interval in seconds>  “command” or just  # watch  “command”


Examples:
# watch -n 10 "cat /proc/meminfo | grep -i Mem"      <- Watch Memory utilization at 10 seconds intervals
# watch -n 15 10 “du -sh |  grep /somefilesystem”     <- Watch disk utilization at 15 seconds interval.
# watch "ps aux|grep jboss"                                     <- Watch jboss process with default time interval


Using while statement:
while true; do <commands separated by semicolon>; sleep <time interval in seconds>; done  


Examples:

[adevaraju@hostxyz ~]$ while true; do cat /proc/meminfo | grep -i mem; uptime; echo; sleep 10; done
MemTotal:      4194480 kB
MemFree:         36776 kB
 01:52:51 up 14 days,  9:07,  1 user,  load average: 0.00, 0.00, 0.00


MemTotal:      4194480 kB
MemFree:         36652 kB
 01:53:01 up 14 days,  9:07,  1 user,  load average: 0.00, 0.00, 0.00


MemTotal:      4194480 kB
MemFree:         36776 kB
 01:53:11 up 14 days,  9:07,  1 user,  load average: 0.00, 0.00, 0.00


# while true; do echo Current time is  `date "+%H Hour: %M Minutes: %S Seconds"`; sleep 4; done
Current time is 01 Hour: 47 Minutes: 26 Seconds
Current time is 01 Hour: 47 Minutes: 30 Seconds
Current time is 01 Hour: 47 Minutes: 34 Seconds
Current time is 01 Hour: 47 Minutes: 38 Seconds
Current time is 01 Hour: 47 Minutes: 42 Seconds
Current time is 01 Hour: 47 Minutes: 46 Seconds
Current time is 01 Hour: 47 Minutes: 50 Seconds
Current time is 01 Hour: 47 Minutes: 54 Seconds
Current time is 01 Hour: 47 Minutes: 58 Seconds
Current time is 01 Hour: 48 Minutes: 02 Seconds
Current time is 01 Hour: 48 Minutes: 06 Seconds
#
PS:  “watch” command wouldn’t work properly if the command sets are complex. It will just display the result of first iteration and stay there forever.

Executing cronjobs on specific days in a month

You can use this post as a reference to schedule the Cronjobs in more Granular fashion.

Situation:

We had a requirement to execute couple of scripts on specific Saturdays of a month throughout the year  i.e., First script (say /opt/firstscript.sh) should be executed on all Saturdays EXCEPT first Saturday of the month, and the Second script (say /opt/secondscript.sh) should be executed ONLY on first Saturday of the month. This we required to do for scheduling Weekly Tape backups.

Executing a script on all Saturdays is fairly simple, we need to just specify number 6 on 5^th column on crontab entry, but here the scenario is different.

The solution for this is shown below. This uses ‘date’ command to check if the current date is a first Saturday of a month.

0  2  *  *  6     [ $(date +%d) -gt 7 ]  && /opt/firstscript.sh               
# Executes at 2am on all Saturdays Except the first Saturday of the month (Saturdays other than 1^st  can fall only after 7^th ).

0  22  *  *  6   [ $(date +%d) -le 7 ]  && /opt/secondscript.sh        

# Executed at 10 PM ONLY on first Saturday of the month (A first Saturday can either be 7^th or less than that ).

Checking NFS and SAMBA shares

NFS

How to check the NFS shares available from a NFS Client ?

#  showmount -e <NFS Server IP>

Example

[root@hostxyz /]# showmount -e nfsserver.domain.com

Export list for nfsserver.domain.com:

/VOL0           stoash01-d3,staat01-d3,rdbash01,10.20.23.16,10.20.64.31,10.100.14.96 ,10.100.16.12 

/VOL1           (everyone)

/ORAAPPS        (everyone)

/ret_vol3       (everyone)

/nas_server_bkp (everyone)

/testnfs        (everyone)

[root@hostxyz /]#

From NFS server, how to find the list of NFS clients accessing the NFS share currently ?

Execute the following script:
for i in `cat /var/lib/nfs/rmtab | awk -F":" '{print $1}' | sort -u`; do nslookup $i | tail -2 | awk '{print $4}'; done

---------------------------------------------------------------------------------------------------------------------------------------------------------
SAMBA

How to find the list of Samba shares available from a Windows Server?

# smbclient -L Samba server IP –Uusername
Password:


[root@hostxyz /]# smbclient -L windows.tcprod.com -Uadevaraju

Password:

Domain=[TCPROD] OS=[Windows Server 2003 R2 3790 Service Pack 2] Server=[Windows Server 2003 R2 5.2]

        Sharename       Type      Comment

        ---------       ----      -------

        IPC$            IPC       Remote IPC

        sqldb_htk       Disk

        webash01-dev    Disk

        C$              Disk      Default share

        VOL3            Disk

        testsmb         Disk

        SMBSYSENG       Disk

        HPUniver.3      Printer   HP Universal Printing PS

        HPUniver.2      Printer   HP Universal Printing PCL 5

        ADMIN$          Disk      Remote Admin

        HPUniver        Printer   HP Universal Printing PCL 6

        print$          Disk      Printer Drivers

        F$              Disk      Default share

        nas_server_bkp  Disk

        SMBVOL1         Disk

        windowsprodbackup Disk

        SMBVOL0         Disk

        Report_server_bkp Disk

        E$              Disk      Default share

        exchange_db     Disk

        sysengdata      Disk


How to mount a Windows Share on to a Linux mount point:


Syntax: 
Put this entry in /etc/fstab and do 'mount -a'
//Windows server IP/Sambashare  /Linux_mount cifs username=XXX,password=XXXX 0 0


Example:
//Windows_server/sambashare      /linux_mnt cifs username=ashok,password=XXXX  0 0

Sudo access to a specific command set

Lets say we have a requirement to give sudo access only to a particular command set.  Let’s take couple of scenarios like this:

1.   We want to give privilege to DBA team to mount/umount ONLY a particular filesystem ( /oracle_data) but  we don’t want them to mount/umount other filesystem.

2.   We want to give privilege to NOC team to start/stop ONLY the httpd service but we don’t want them to start/stop other services.

The syntax in /etc/sudoers file should be as follows:

%dbateam          ALL=(ALL) NOPASSWD:  /bin/mount /oracle_data, /bin/umount /oracle_data

%nocteam          ALL=(ALL) NOPASSWD:  /sbin/service httpd start, /sbin/service httpd stop, /sbin/service httpd status

Having set like this, the respective team members can execute the commands as follows:

# sudo /bin/mount /oracle_data      # Works

# sudo /bin/umount /oracle_data    # Works

# sudo /bin/mount /other_filesystem     # This will fail

# sudo /sbin/service httpd start       #  Works

# sudo /sbin/service httpd stop       #  Works

# sudo /sbin/service httpd restart   #   Fails. Since restart is not specified

# sudo /sbin/service nfs start           #  This will fail

Finding total size of files owned by a particular user

Syntax:

# find <pathname> -user <username> -ls | awk '{sum += $7} END {printf "Total size: %8.4f MB\n", sum/1024/1024}'

Example:

Foldername to search: /nasllm-ih
Username:  rram

[root@hostxyz ~]# find /nasllm-ih -user rram -ls | awk '{sum += $7} END {printf "Total size: %8.4f MB\n", sum/1024/1024}'                   

Total size: 958.7282 MB

[root@hostxyz ~]#

Validation:

Here I have created a folder /root/ashok consists files owned by user “adevaraju” of total size: 160 MB under its various sub-directories.

[root@hostxyz ~]# ls -lRh /root/ashok

/root/ashok:

total 21M

drwxr-xr-x 3 adevaraju root 4.0K Dec 14 06:30 d1

drwxr-xr-x 2 adevaraju root 4.0K Dec 14 06:35 d2

-rw-r--r-- 1 adevaraju root  10M Dec 14 06:21 file1

-rw-r--r-- 1 adevaraju root  10M Dec 14 06:22 file4

/root/ashok/d1:

total 21M

drwxr-xr-x 2 adevaraju root 4.0K Dec 14 06:35 dx

-rw-r--r-- 1 adevaraju root  10M Dec 14 06:22 file2

-rw-r--r-- 1 adevaraju root  10M Dec 14 06:22 file3

/root/ashok/d1/dx:

total 21M

-rw-r--r-- 1 adevaraju root 10M Dec 14 06:30 file5

-rw-r--r-- 1 adevaraju root 10M Dec 14 06:30 file6

/root/ashok/d2:

total 101M

-rw-r--r-- 1 adevaraju root 100M Dec 14 06:30 file7

[root@oralsb11-new ~]#

 [root@oralsb11-new ~]# du -sh ashok/

161M    ashok/

[root@hostxyz ~]# find /root/ashok -user adevaraju -ls | awk '{sum += $7} END {printf "SUM: %8.4f MB\n", sum/1024/1024}'

SUM: 160.0156 MB

[root@hostxyz ~]#

PS: By replacing the search folder to '/', we can find the total size of files owned by a specified user in the entire system.

Port numbers in Linux

Ports in computer networking is an application-specific or process-specific software construct serving as a communications endpoint. It is used by Transport Layer protocols of the Internet Protocol Suite, such as Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). A specific port is identified by its number, commonly known as the port number, the IP address with which it is associated, and the protocol used for communication.

The Internet Assigned Numbers Authority (IANA) is responsible for maintaining the official assignments of port numbers for specific uses. However, many unofficial uses of both well-known and registered port numbers occur in practice.

The port numbers are divided into three ranges:

Well-Known/Standard Ports   (Range: 0 to 1023 )

Used by system processes that provide widely-used types of network services such as SSH, Telnet, SMTP, FTP etc

Registered Ports, and    (Range:  1024 to 49151 )

Used by specific service upon applications such as Oracle database listener (1521), MySql (3306), Microsoft Terminal server (3389) etc.

Dynamic and/or Private Ports. (Range: 49152 to 65535 )

These ports can’t be registered by IANA.  This is used for custom or temporary purposes and for automatic allocation of short-lived (or ephemeral ) ports which is used internally by application/processes. You can see these ports by running ‘netstat’ command under “Local address” column.

In Linux, the port details can be viewed by checking the /etc/services file  and the non-standard (un-registered) ports used by the server can be find using /proc/sys/net/ipv4/ip_local_port_range file.

[adevaraju@host01 ~]$ cat /proc/sys/net/ipv4/ip_local_port_range

32768   61000

[adevaraju@host01 ~]$

Finding file creation time in Linux

Question:  In Linux, is it possible to find the actual time when a file was created first?

The Answer is NO until Ext3. 

File creation time ISN’T maintained in Linux with file-system Ext3 or earlier version. 
It will change when file content changes. It is explained with an example here:

[adevaraju@cac1-t1 ~]$ date

Tue Nov  9 01:22:25 CST 2010                                                      # Time now is 01:22:25

[adevaraju@cac01-t1 ~]$ echo "Some text on the file " > testfile       # Creating a file

[adevaraju@cac01-t1 ~]$ ls -lc testfile

-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Shows file change time as 01:22

 [adevaraju@cac01-t1 ~]$ ls -lu testfile

-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Access time is also 01:22

[adevaraju@cac01-t1 ~]$ cat testfile                                       # Now am accessing the file

Some text on the file

 [adevaraju@cac01-t1 ~]$ ls -lc testfile                            

-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:22 testfile     # Change time remains the same

[adevaraju@cac01-t1 ~]$ ls -lu testfile

-rw-r--r-- 1 adevaraju domain users 23 Nov  9 01:23 testfile     # Access time changed to 01:23

[adevaraju@cac01-t1 ~]$ date

Tue Nov  9 01:23:32 CST 2010

[adevaraju@cac01-t1 ~]$ echo "Additional text to the file" >> testfile # file content changed

 [adevaraju@cac01-t1 ~]$ ls -lc testfile                                                                            

-rw-r--r-- 1 adevaraju domain users 51 Nov  9 01:24 testfile      # Change time changes to 01:24

[adevaraju@cacllm01-t1 ~]$ ls -lu testfile

-rw-r--r-- 1 adevaraju domain users 51 Nov  9 01:23 testfile      # But access time remains the same since we did only changes to file.

[adevaraju@cacllm01-t1 ~]$ date

Tue Nov  9 01:24:22 CST 2010

[adevaraju@cacllm01-t1 ~]$

Atlast the original file creation time (which is 01:22) is gone, we CAN’T retrieve that information.

PS:  EXT4 file-system comes out with a feature to find the File-creation time. 

It is explained in this post:  http://ashok-linux-tips.blogspot.com/2012/04/how-to-get-file-creation-time-in-linux.html