[Gllug] stat'ing a file shows it was changed today and yet it has the date of a few days ago

[John Hearns]

On 20 June 2011 22:48, Nix <nix at esperi.org.uk> wrote:

Wht a great reply, thanks.

> No, this is not recorded anywhere (except if you have utterly insane
> auditing of some kind turned on).

You've hit a bit nail on the head here!

As a modern day shaman (read systems manager) I very often sort out or
otherwise diagnose problems by "looking at the systems logs".
This is the IT Crown equivalent of shutting yourself in a sweat lodge
for seven days, taking hallucinogenic mushrooms and returning with a
profound insight into the universe. Put more prosaically, you usually
can diagnose a lot about why something went wrong from log files.
However another major source of user questions in a group environment
is "who deleted /altered that file?" or "what happened exactly when
file xxx.yyy was written".
Sadly there is no tent I can disappear into to pronounce on this.
My point really being that users are baffled why I can tell what
happened at 13 seconds pst midnight on June 13th, but can't tell when
that file was created.
--
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug