stat Command in Linux Explained [With Examples]

The stat command in Linux is used to display detailed information about files and file systems. It's a utility that provides insights into the metadata of files - far more detail than what's offered by the commonly-used ls command.

The stat displays information about a file, much of which is stored in the file's inode. This includes details such as permissions, ownership (user and group), timestamps (access, modification, and change times), inode number, number of hard links, and more.

While the ls -l command provides a brief overview of file attributes in a directory-listing format, the stat command provides details about individual files or filesystems, from inode data to precise timestamps. Use ls for quick listings and stat for thorough file metadata examination.

Syntax

stat [option]... File...

• OPTION: These are optional flags or switches you can provide to modify the behavior of the stat command.
• FILE: This is the name of the file (or files) for which you wish to display the details. You can specify multiple filenames separated by spaces.

Options

Here's an overview of the most common stat command options:

• -c, --format=FORMAT: Customize the output based on the given format. You can specify format sequences to display specific details.
• -f, --file-system: Display file system status instead of file status.
• -L, --dereference: Dereference symbolic links to show details about the file the link points to, instead of the link itself.
• -t, --terse: Display output in a terse format, ideal for parsing by other programs or scripts. This format is more machine-readable.
• --printf=FORMAT: Like --format, but interpret backslash escapes and handle multiple files more consistently.

Basic Usage

Getting the status of a single file or directory

To retrieve detailed information about a specific file, simply use the stat command followed by the filename.

Example:

stat sample.txt

For a file named sample.txt, the output might look something like:

  File: sample.txt
  Size: 49              Blocks: 8          IO Block: 4096   regular file
Device: 800h/2048d      Inode: 20230       Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2023-09-14 00:58:44.478460584 +0000
Modify: 2023-09-14 00:58:44.478460584 +0000
Change: 2023-09-14 00:58:44.482460678 +0000
 Birth: 2023-09-14 00:58:44.478460584 +0000

For a Directory:

stat /home/ubuntu

Output:

  File: /home/ubuntu/
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 800h/2048d      Inode: 130122      Links: 8
Access: (0750/drwxr-x---)  Uid: ( 1000/  ubuntu)   Gid: ( 1000/  ubuntu)
Access: 2023-09-12 14:35:28.940329431 +0000
Modify: 2023-09-04 23:19:01.176445353 +0000
Change: 2023-09-04 23:19:01.176445353 +0000
 Birth: 2023-07-20 04:16:31.923793947 +0000

A key thing to note is the "File type" descriptor (regular file for files, directory for directories). Also, directories typically have a larger default size and can have multiple links (for subdirectories).

Displaying file system status instead of file status

When you want to display the file system status instead of the file status using the stat command, you'll need to use the -f or --file-system option. This option provides insights into the file system where the specified file or directory resides.

Example:

stat -f /home/ubuntu/

The output might look something like this:

  File: "/home/ubuntu/"
    ID: f189d67609c81943 Namelen: 255     Type: ext2/ext3
Block size: 4096       Fundamental block size: 4096
Blocks: Total: 6300673    Free: 4928531    Available: 4603316
Inodes: Total: 1593088    Free: 1468416

Here's a brief explanation of some of the output details:

• ID: A unique identifier for the file system.
• Namelen: Maximum length for filenames.
• Type: The type of file system (e.g., ext4, xfs, btrfs).
• Block size: The size in bytes of a block in the file system.
• Fundamental block size: The fundamental block size of the file system.
• Blocks: Details about the total, free, and available blocks.
• Inodes: Details about the total and free inodes

Output Components

When you run stat on a file, you will see a detailed output. Here's what each component means:

• File: The file's name.
• Size: Size of the file in bytes.
• Blocks: Number of blocks allocated for the file.
• IO Block: Size of block for filesystem I/O.
• File type: The type of the file (regular, directory, symlink).
• Device: File's device identifier.
• Inode: The inode number of the file.
• Links: The number of hard links.
• Access, Modify, and Change times: These represent the last access, modification, and change timestamps of the file respectively.
• Birth time: When the file was created.
• Access rights: File permissions in both human-readable and octal format.
• User ID (UID) and Group ID (GID): Ownership details.

Display Options

Formatting the output

The default output contains information such as file size, number of links, inode number, and more. If you want to format the output of the stat command, you can use the --format (or -c) option followed by a format sequence.

Here are some commonly used format sequences:

• %a: Access rights in octal format.
• %A: Access rights in human-readable format.
• %b: Number of blocks allocated (with --block-size set to 512 bytes).
• %B: Size in bytes of each block reported by %b.
• %C: SELinux security context string.
• %d: Device number in decimal.
• %D: Device number in hex.
• %f: Raw mode in hex.
• %F: File type. E.g., directory, regular file, symbolic link, etc.
• %g: Group ID of the owner.
• %G: Group name of the owner.
• %h: Number of hard links.
• %i: Inode number.
• %m: Mount point.
• %n: File name.
• %N: Quoted file name with dereference (if a symbolic link).
• %o: I/O block size for file system I/O.
• %s: Total size in bytes.
• %t: Major device type in hex (for character/block device files).
• %T: Minor device type in hex (for character/block device files).
• %u: User ID of the owner.
• %U: User name of the owner.
• %W: Time of file birth (time since Epoch); - if unknown.
• %w: Time of file birth in human-readable format; - if unknown.
• %x: Last access time in human-readable format.
• %X: Last access time as seconds since the Epoch.
• %y: Last modification time in human-readable format.
• %Y: Last modification time as seconds since the Epoch.
• %z: Last status change time in human-readable format.
• %Z: Last status change time as seconds since the Epoch.

Remember to refer to the stat man page (man stat) to get a detailed list and description of all available format sequences.

Examples:

Display the file name and its size:

stat --format='%n %s' sample.txt

Display user and group ownership:

stat --format='User: %U, Group: %G' sample.txt

Retrieve only the modification time:

stat -c '%y' sample.txt

Using wildcard that matches all files and directories:

Example:

stat -c '%.10y %n' /home/ubuntu/*

This command is helpful for obtaining a concise listing of files in /home/ubuntu with their modification date and name. Note: The %.10y will display only the first 10 characters of the file's modification time.

When stat is used on file systems, some of the format sequences will produce outputs that are relevant to the file system rather than individual files.

Here are a few format sequences relevant for file systems:

• %n - File system name
• %s - Block size (for faster transfers)
• %b - Total data blocks in the file system
• %f - Free blocks in the file system
• %a - Free blocks available to non-superuser
• %i - Total inodes in the system
• %I - Inodes per block (how many inodes fit into a block)
• %c - File system capabilities

For example to Display total and free blocks in a file system:

stat --file-system --format='%n: Total Blocks: %b, Free Blocks: %f' /mnt/backup

Note: The -c option with stat is a GNU extension, and it's not part of the POSIX standard. This means it works on systems that use GNU Core Utilities (often found in Linux distributions), but it may not be available on other Unix-like systems such as BSD variants, macOS (without GNU utilities installed), and some other UNIX systems. You may also use a wide variety of format sequences with --printf to display attributes.

Using --terse for a concise display

The --terse option in the stat command provides a concise and compact display of the file or directory information. It's a way to get the necessary details without the descriptive labels, making the output easier to read for scripts or when you just want the raw data.

Example:

stat --terse samplefile.txt
samplefile.txt 699 8 81b4 1000 1000 800 130262 1 0 0 1690872032 1690521254 1690521254 1690521254 4096

Break down of terse output:

• %n: samplefile.txt - File name.
• %s: 699 - Total size in bytes.
• %b: 8 - Number of blocks allocated.
• %f: 81b4 - File's mode in hexadecimal.
• %u: 1000 - User ID of owner.
• %g: 1000 - Group ID of owner.
• %D: 800 - Device number in hex.
• %i: 130262 - Inode number.
• %h: 1 - Number of hard links.
• %t: 0 - Major device type in hex (seems to be 0 for this non-device file).
• %T: 0 - Minor device type in hex (similarly, 0 for this non-device file).
• %X: 1690872032 - Time of last access, seconds since Epoch.
• %Y: 1690521254 - Time of last modification, seconds since Epoch.
• %Z: 1690521254 - Time of last change, seconds since Epoch.
• %W: 1690521254 - Time of file birth (if known), seconds since Epoch.
• %o: 4096 - I/O Block size.

Customizing the time format

The stat command itself allows you to extract different time-related data using format sequences:

• %x: Last access time in human-readable format.
• %X: Last access time as seconds since the Epoch.
• %y: Last modification time in human-readable format.
• %Y: Last modification time as seconds since the Epoch.
• %z: Last status change time in human-readable format.
• %Z: Last status change time as seconds since the Epoch.

If you need more customized time formats than these, there are some workarounds.

Truncate to YYYY-MM-DD HH:MM:SS:

You can format it to a specific length, for example by using the precision .19, you can specify that you want only the first 19 characters of this output - stat -c '%.19y' sample.txt.

stat -c '%.19y' sample.txt

This will truncate the usual %y output to the first 19 characters, giving a concise "YYYY-MM-DD HH:MM:SS" format without the additional microseconds and timezone information.

Using date command:

Let's extract time from stat timestamp in "YYYY-MM-DD" format followed by the time in 12-hour AM/PM format.

date --date="@"`stat -c '%Y' /home/ubuntu` "+%F %r"
2023-09-15 12:25:13 AM

Alternatively, we can use a combination of printf and stat to format and display file modification time. Example:

printf '%(%F %r)T\n' "$(stat -c %Y /home/ubuntu)"
2023-09-15 12:25:13 AM

Here the %T format specifier in printf is used to format time, and it takes an epoch time as an argument.

Get only the date:

date  -d "@$(stat -c %Y /home/ubuntu)" +%Y%m%d
20230904

Timestamps

One of the primary uses of stat is to retrieve timestamps associated with a file or directory. Specifically, there are three primary timestamps:

• Access Time (atime): The last time the file or directory was accessed.
• Modification Time (mtime): The last time the contents of the file or directory were modified.
• Change Time (ctime): The last time the file or directory's metadata (such as permissions or ownership) was changed.
• Birth Time (crtime): This represents when the file or directory was created. However, it's worth noting that not all filesystems support the birth timestamp, and even if they do, not all tools and utilities might display or handle it.

Timestamp format:

Access: 2023-09-12 14:35:28.940329431 +0000
Modify: 2023-09-04 23:19:01.176445353 +0000
Change: 2023-09-04 23:19:01.176445353 +0000
Birth: 2023-07-20 04:16:31.923793947 +0000

Here's a breakdown of the format:

• Date (e.g., 2023-09-12): Presented in the YYYY-MM-DD format.
• Time (e.g., 14:35:28.940329431): Presented in the HH:MM:SS.NANONANO format, where NANONANO represents nanoseconds.
• Timezone Offset (e.g., +0000): This represents the difference between the local time and Coordinated Universal Time (UTC). This offset indicates that the time is in UTC with no difference between the local time and UTC.

Symbolic Links

By default, when you run the stat command on a symlink, it will show information about the target file or directory the symlink points to, not the symlink itself. The output will include a line indicating that the file is a symbolic link and showing the path to which it points.

stat config-link.conf

To get information about the symlink itself, use the -L or --dereference option:

stat -L config-link.conf

Examples and Use Cases

Here are some practical examples and use cases to showcase stat utility.

Get the size, access rights, and filename of a file:

stat -c '%s %A %n' samplefile.txt
699 -rw-rw-r-- samplefile.txt

Retrieve the access, modification, and change time of a file:

stat -c "Access: %x Modify: %y Change: %z" samplefile.txt
Access: 2023-08-01 06:40:32.739052702 +0000 Modify: 2023-07-28 05:14:14.558963915 +0000 Change: 2023-07-28 05:14:14.562964006 +0000

Check the file type:

stat -c %F samplefile.txt
regular file

Determine the block size of a file's filesystem:

stat -c %o samplefile.txt
4096

Check when a file was last accessed:

stat -c '%x' samplefile.txt
2023-08-01 06:40:32.739052702 +0000

This will display the last access time in a human-readable format

Find the size of a file:

stat -c '%s' samplefile.txt
699

This will return the size of the file in bytes.

Check the inode number of a file:

stat -c %i samplefile.txt
130262

Find out the device on which the file is located:

stat -c %D samplefile.txt
800

This will give you a hexadecimal representation of the device on which the file is located.

Interpreting 800: 80 usually corresponds to the major number of the first SCSI/SATA disk (/dev/sda). 0 as the minor number indicates the entire disk rather than a specific partition on that disk. So, 800 generally refers to the whole disk /dev/sda.