Monitoring File ctime changes?

Stuart Jansen sjansen at
Mon Mar 26 13:27:40 MDT 2007

On Mon, 2007-03-26 at 13:01 -0600, Michael Lovell wrote:
> I have an interesting situation with a backup system. The system
> determines what files have changed for the incremental backups by
> looking at the ctime on the file. No big deal there. Unfortunately,
> there is something that will change the ctime on all of the files on a
> 1.4TB volume which causes the backup system to backup the whole volume
> every week or two. Do any of you know an easy way to monitor for a
> change in ctime and be able to report what process changed it? The
> volume that this is happening with is running on a server with Novell
> OES and samba 3.0.20 that has both Windows and Mac Clients connecting to
> it. The weird thing is that this one volume is the only one it is
> happening to this one volume. The others on the server don't have this
> problem. Any thoughts on this? Thanks for the help in advance.
> Mike Lovell

I'll leave someone else to discover a neat auditd or selinux hack to
accomplish this. Instead, I'll point out a common misconception about
ctime: ctime records when the inode of a file was modified. For example,
changing the owner, permissions, and a slew of other metadata results in
a ctime change. I seriously doubt that's the the sort criteria you want
to use to govern backups.

Stuart Jansen              e-mail/jabber: sjansen at
                           google talk:   stuart.jansen at

"However beautiful the strategy, you should occasionally look at 
the results." -- Winston Churchill
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : 

More information about the PLUG mailing list