Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== BASH - Commands - ls - ls output fields definitions ======

The output of the **ls** command depends on the version of "ls", the options used, the platform used, etc. 

<code bash>
ls -al
</code>

returns:

<code bash>
-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe
</code>

----

<code bash>
-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe
?UUUGGGOOOS   00  UUUUUU GGGGGG ####    ^             ^-- File name.
^ ^  ^  ^ ^    ^      ^      ^    ^     \-- Date Time stamp.
| |  |  | |    |      |      |    \--- File Size.
| |  |  | |    |      |      \-------- Group Name (for example, Users, Administrators, etc).
| |  |  | |    |      \--------------- Owner Name.
| |  |  | |    \---------------------- Link count (Usually refers to number of hard links; but can vary.)
| |  |  | \--------------------------- Alternative Access (blank means none defined, anything else varies)
| \--\--\----------------------------- File Mode Permissions.  Read, Write and Special access modes for [U]ser, [G]roup, and [O]thers (everyone else).
\------------------------------------- File Type flag.
</code>

  * **File Type flag**:  The very first character. Typically one of: **d** for directory, **l** for a symbolic link (hard links show normally without a special character of their own), or **-** for a normal file.
      * There are many others, but less commonly seen, file types for various filesystems.  These first ten characters (file type and permissions) are discussed on [[https://en.wikipedia.org/wiki/File_system_permissions#Notation_of_traditional_Unix_permissions|Wikipedia]].  Again, your documentation will tell you exactly what kind of file types your command supports and displays.
  * **File Mode Permissions**:   Three sets of three chars, where:
      * First set is permissions for the "User" (i.e., Owner)
      * Second set is permissions for the "Group" 
      * Third set is permissions for "Others" (i.e., everyone else; anyone who is neither Owner nor Group).
  * **Link count**:  For files it means number of hard links.  For directories, its the number of directories inside the directory + this directory itself.
  * **Alternative Access flag**:  Usually a blank space, but on some platforms, it may be used to indicate there are special/alternative access modes (such as ACLs and security descriptors on WIN32, etc), and varies widely – consult your manual, man pages, info tool, or what-not.
  * **File Size**:  Some versions and/or command line flags will list the number of blocks used instead of the number of bytes; a filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as "1", meaning 1 block is used, from 1025 to 2048 as "2", using 2 blocks, and so on.  But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.
  * **Date Time stamp**:  Usually the date/time the file was last modified, not the time the file was created.



<WRAP info>
**NOTE:**  If you cannot find a man/info page for **ls** itself (**man ls** / **info ls**), try looking in the **coreutils** package (**info coreutils**).

Also note that among the more common platforms, Microsoft platforms tend not to translate very well to **ls** output, so you may see odd behavior, flags, or other unusual info in the output, depending on how your version of "ls" was compiled, what it was linked against, etc.
</WRAP>



----

===== File Types flag =====

On most systems, the first field is also used to indicate the presence of extra attributes like ACLs, security attributes or other extended attributes.

|-|Regular file|
|b|Block special file|
|c|Character special file|
|C|High performance ("contiguous data") file|
|d|Directory|
|D|Door (Solaris 2.5 and up)|
|l|Symbolic link|
|M|Off-line ("migrated") file (Cray DMF)|
|n|Network special file (HP-UX)|
|p|FIFO (named pipe)|
|P|Port (Solaris 10 and up)|
|s|Socket|
|?|Some other file type|

----

===== File Mode Permissions =====

Each of the three characters represent the read, write, and execute permissions:

Usually in the form:

<code>
rwx rwx rwx
</code>

  * First set of rwx are permissions for the owner of the file.
  * Second set of rwx are permissions for the group that the owner belongs to.  Everyone in the same group will get these permissions to the file.
  * Third set of rwx are permissions for others.  That are not the owner; nor part of the group the owner is part of.

|r|Reading is permitted.|
|w|Writing is permitted.|
|x|Execution is permitted.  For directories it means you can attempt to access the directory contents.|
|-|The specific permission is not allowed.|

but **ls** can combine multiple bits into the third character of each set of permissions as follows:

|s|If the set-user-ID or set-group-ID bit and the corresponding executable bit are both set.|
|S|If the set-user-ID or set-group-ID bit is set but the corresponding executable bit is not set.|
|t|If the restricted deletion flag or sticky bit, and the other-executable bit, are both set.  The restricted deletion flag is another name for the sticky bit.|
|T|If the restricted deletion flag or sticky bit is set but the other-executable bit is not set.|
|x|If the executable bit is set and none of the above apply.|

<WRAP info>
**NOTE:** Sometimes you may encounter an **s** or **S** for setuid and/or setgid programs, or other less common characters.

See your **ls** documentation for the mode characters it will show.
</WRAP>




----

===== Alternative Access Types =====


----

===== Links =====

Some platforms have an odd notion of what constitutes a **link**.

These usually include hard links and symbolic links, as well as directory entries (which is why directories often have high link counts – its parent has one link, the directory has a link to itself in the . entry, and each of its sub-directories has a link back via ..

----

===== File Size =====

Some versions and/or command line flags will list the number of blocks used instead of the number of bytes.

A filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as "1", meaning 1 block is used, from 1025 to 2048 as "2", using 2 blocks, and so on.

But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.

<WRAP info>
**NOTE:** The file size for a directory is only the size of the metadata of the directory, not the total size of the files under the directory.
</WRAP>

----


===== Date Time stamp =====

The **Date Time stamp** is usually the date/time the file was last modified, not the time the file was created.

<WRAP info>
**NOTE:**  On un*x-ish filesystems there is no record of the file creation time

The **ctime** field does NOT mean "creation time" as it does on FAT/NTFS filesystems, but rather, it means the "inode [C]hange time" – the time the inode itself was last modified.

The **mtime** (last [M]odified) and atime (last [A]ccesed/read) timestamps are the same on both systems – although the precision (FAT has a granularity of two seconds, for example) and time zone may vary.
</WRAP>

----

===== References =====

https://en.wikipedia.org/wiki/Unix_file_types

https://en.wikipedia.org/wiki/File_system_permissions#Notation_of_traditional_Unix_permissions