tmpwatchc updates directory ctime?

UNIX for Advanced & Expert Users
1

Hi,

I noticed that some directories under /tmp were updated ctime daily. As you can see below, I thought that was because of tmpwatch.

[root@localhost ~]# cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
[root@localhost ~]# ls /etc/cron.daily/
0anacron  0logwatch  cups  logrotate  makewhatis.cron  mlocate.cron  prelink  rpm  tmpwatch
[root@localhost ~]# ls -lc /tmp
total 44
drwx------ 3 root root 4096 Nov 10 11:15 gconfd-root
drwx------ 2 root root 4096 Nov 10 11:15 keyring-qFRB6k
srwxr-xr-x 1 root root    0 Nov 10 11:16 mapping-root
drwx------ 2 root root 4096 Nov 10 11:16 orbit-root
drwx------ 2 root root 4096 Nov 10 11:15 ssh-rAIQTP2769
drwx------ 2 root root 4096 Nov 10 11:16 virtual-root.X9XGxG
[root@localhost ~]# date
Thu Nov 10 11:17:14 CST 2011
[root@localhost ~]# /etc/cron.daily/tmpwatch
[root@localhost ~]# ls -lc /tmp
total 44
drwx------ 3 root root 4096 Nov 10 11:17 gconfd-root
drwx------ 2 root root 4096 Nov 10 11:17 keyring-qFRB6k
srwxr-xr-x 1 root root    0 Nov 10 11:16 mapping-root
drwx------ 2 root root 4096 Nov 10 11:17 orbit-root
drwx------ 2 root root 4096 Nov 10 11:17 ssh-rAIQTP2769
drwx------ 2 root root 4096 Nov 10 11:17 virtual-root.X9XGxG
[root@localhost ~]#

But how come tmpwatch updates directory ctime? Even if there is no file deleted under that directory:

[root@localhost ~]# ls -lc
total 92
drwxr-xr-x 2 root root  4096 Nov 28 13:26 Desktop
-rw------- 1 root root  1414 Feb  3  2010 anaconda-ks.cfg
-rw-r--r-- 1 root root 51009 Feb  3  2010 install.log
-rw-r--r-- 1 root root  3696 Feb  3  2010 install.log.syslog
drwxr-xr-x 2 root root  4096 Nov 28 13:33 test
[root@localhost ~]# ls test
file
[root@localhost ~]# ls test/file  -lc
-rw-r--r-- 1 root root 0 Nov 28 13:30 test/file
[root@localhost ~]# date
Mon Nov 28 14:00:17 CST 2011
[root@localhost ~]# /usr/sbin/tmpwatch -umc 1 /root/test
[root@localhost ~]# ls -lc
total 92
drwxr-xr-x 2 root root  4096 Nov 28 13:26 Desktop
-rw------- 1 root root  1414 Feb  3  2010 anaconda-ks.cfg
-rw-r--r-- 1 root root 51009 Feb  3  2010 install.log
-rw-r--r-- 1 root root  3696 Feb  3  2010 install.log.syslog
drwxr-xr-x 2 root root  4096 Nov 28 14:00 test
[root@localhost ~]# ls test/file  -lc
-rw-r--r-- 1 root root 0 Nov 28 13:30 test/file
[root@localhost ~]#

The file "/root/test/file" does not change, but "/root/test" gets updated ctime. Why?

THANKS

2

Ctime is the time that a file/directory's status was last changed. It is likely that the process you mention is working in the directory, and then resetting the access time of the directory to what it was prior to the examination. The intent is to be an invisible access so that if you the user run a find command with the -atime option, accesses by maintenance programmes such as this will not factor into the search. However, adjusting the access time (or the mod time) on a file/directory causes the state to change and thus is recorded in the ctime timestamp, and you end up with what you are seeing.

This is a guess; I'm not at all familiar with tmpwatch and its behaviour.