From: Andrew Tridgell
Subject: tip of the day (ls -laut)
Date:   Sun, 5 Sep 1999 23:31:48 +1000

This tip is based on a tool familiar to all Linux users, the humble
program /bin/ls. While ls has a multitude of uses many users may not
realise that it contains within it a powerful debugging tool. It is
often one of the first tools I reach for when diagnosing a systems
problem under Linux and other Unix-like operating systems.

The tool is the -u switch. The -u switch tells ls to display not the
last modification date of a file but the last access date. While this
may seem a trivial difference if you think about it you will realise
just how useful this is. For example:

     ls -laut --full-time ~/ | less

quickly tells you what startup files are being read after you
login. The above command lists files, including "dot" files, in your
home directory and display their last access dates in descending order
with 1 second resolution. The top few files are the ones most recently
accessed. This can quickly tell you if all your hard work editing
.xsession is being totally ignored by your X startup
procedures.

Similarly the command:

    ls -laut --full-time /etc/ | less

tells you what config files in /etc/ are being read. That can save you
a lot of wasted effort.

A recent example of the usefulness of this humble option to ls was
when a sysadmin at ANU came to me after spending hours trying to get
his /etc/X11/XF86Config setup to properly set the refresh rates he
wanted. A quick test with:

    ls -lu --full-time /etc/X11/XF86Config

showed that the config file was not being read when he started X. A
few seconds later we worked out that X was instead using
/root/XF86Config, which he'd created as a backup when he started
without realising that X looks there for a config file before looking
in /etc/X11/.

Of course, ls -u only tells you what is and isn't being read, it
doesn't give you the details. That's where strace and ltrace come in,
but we'll save them for another tip of the day.

Cheers, Tridge

PS: If someone has optimised your system then maybe the access times
on your filesystem have been switched off. Use the command "mount" to
see if your filesystem has the "noatime" flag set, or test it by
reading a file and seeing if the access date goes up.