4 ms·

When I stop and think about it writing access times for everything seems extremely wasteful... does anything actually use this field? Any reason I shouldn't cha

by gpm 1y ago

When I stop and think about it writing access times for everything seems extremely wasteful... does anything actually use this field? Any reason I shouldn't change all my file systems to mount with noatime? It's hard for me to imagine using it for anything myself, considering the number of times I do something like run a search (or a backup command) across literally every file I care about.

themafia 1y ago
The canonical example of an application that can break with 'noatime' is the "mutt" email client with mbox style single file email spools. Most modern applications are not designed to operate on shared files like this so in general 'noatime' is safe for 99.9% of software.
bryanlarsen 1y ago
Mail readers that use the mbox format are pretty much the only common user.
JoshTriplett 1y ago
Ideally, noatime would be the default, and applications that still care about atime would be updated to open with a new `O_ATIME` flag. Or, better yet, track it themselves independently. It's completely reasonable to turn it on. And also, when you're writing applications for Linux, consider using the `O_NOATIME` flag in your file opens.
- lq9AJ8yrfs 1y ago
  I think you're on to something, though it's optimistic to count on app devs to specify a novel platform-specific flag. "Don't break user-space" seems like it's in contest here. Maybe if you could taint a process (or perhaps the inode and/or path instead) so that its and its children's opens get the new o_atime flag by default, so that systemd or whatever could set it for legacy processes (or files/paths) that need it. Then distros or SRE's could put up with it without nagging all the SWEs about linuxisms. Some of whom may not know or care their code runs on linux.
- mmh0000 1y ago
  `relatime` is the default on many distros, and has long been "best-practice" for first pass Linux performance turning. MOUNT(8) relatime Update inode access times relative to modify or change time. Access time is only updated if the previous access time was earlier than or equal to the current modify or change time. (Similar to noatime, but it doesn’t break mutt(1) or other applications that need to know if a file has been read since the last time it was modified.) Since Linux 2.6.30, the kernel defaults to the behavior provided by this option (unless noatime was specified), and the strictatime option is required to obtain traditional semantics. In addition, since Linux 2.6.30, the file’s last access time is always updated if it is more than 1 day old.
  - JoshTriplett 1y ago
    relatime is not as good as noatime, and it doesn't solve the problem reported in the article, since you can still easily end up with a large number of atime updates if you have a large number of files.
pengaru 1y ago
It's one of those things that you don't care about until you do. As a former sysadmin through the dotcom booms, we regularly depended on atime for identifying which files are actively being used in myriad situations. Sometimes you're just confirming a config file was actually reloaded in response to your HUP signal. Other times you're trying to find out which data files a customer's cgi-bin mess is making use of. It's probably less relevant today where multi-user unix hosts are less common, but it was quite valuable information to maintain back then.
- __turbobrew__ 1y ago
  > we regularly depended on atime for identifying which files are actively being used in myriad situations You can do that with bpf tooling now, for example the `opensnoop` BCC program can capture all file opens on demand. You can also write tools which capture all POSIX IOs to specific files/directories. I can see atime sometimes being useful in some super niche use cases such as hisenbugs you cannot reproduce reliably, but I would be reaching for BPF tools first.
  - homebrewer 1y ago
    Forget bpf, Linux has the audit framework to solve exactly this problem, and it's been in heavy use for a couple of decades now https://www.redhat.com/en/blog/configure-linux-auditing-auditd https://www.redhat.com/en/blog/configure-linux-auditing-audi... https://linux-audit.com/linux-audit-framework/configuring-and-auditing-linux-systems-with-audit-daemon/ https://linux-audit.com/linux-audit-framework/configuring-an...
NekkoDroid 1y ago
> does anything actually use this field? Systemd in a way does. One of the systemd-tmpfiles entry option is to clean up unused files after some time (it ships defaults for /tmp/ after 10 days and /var/tmp/ after 30 days) and for this it checks atime, mtime and ctime to determin if it should delete the file (I think you can also take a flock on the file to prevent it from being deleted as well)
Avamander 1y ago
I've found it useful for forensic reasons and debugging.
williadc 1y ago
I use atime to identify archives that can be retired. It's common for circuit designer to release a lot of large files for their peers to analyze or incorporate into a parent/grandparent simulation. They will use that data for as long as it is still relevant, which means different things for different types of data, and the only consistent thing we've found is that if the data hasn't been accessed in awhile, then we can retire it.
p_l 1y ago
The original use case for access times was for backup purposes - long unused files would be marked for "reaping" by backup process and either moved to backup storage or moved to a different storage tier in a hierarchical storage management system

by gpm 1y ago

themafia 1y ago

The canonical example of an application that can break with 'noatime' is the "mutt" email client with mbox style single file email spools. Most modern applications are not designed to operate on shared files like this so in general 'noatime' is safe for 99.9% of software.

bryanlarsen 1y ago

Mail readers that use the mbox format are pretty much the only common user.

JoshTriplett 1y ago

Ideally, noatime would be the default, and applications that still care about atime would be updated to open with a new `O_ATIME` flag. Or, better yet, track it themselves independently. It's completely reasonable to turn it on. And also, when you're writing applications for Linux, consider using the `O_NOATIME` flag in your file opens.

lq9AJ8yrfs 1y ago
I think you're on to something, though it's optimistic to count on app devs to specify a novel platform-specific flag. "Don't break user-space" seems like it's in contest here. Maybe if you could taint a process (or perhaps the inode and/or path instead) so that its and its children's opens get the new o_atime flag by default, so that systemd or whatever could set it for legacy processes (or files/paths) that need it. Then distros or SRE's could put up with it without nagging all the SWEs about linuxisms. Some of whom may not know or care their code runs on linux.
mmh0000 1y ago
`relatime` is the default on many distros, and has long been "best-practice" for first pass Linux performance turning. MOUNT(8) relatime Update inode access times relative to modify or change time. Access time is only updated if the previous access time was earlier than or equal to the current modify or change time. (Similar to noatime, but it doesn’t break mutt(1) or other applications that need to know if a file has been read since the last time it was modified.) Since Linux 2.6.30, the kernel defaults to the behavior provided by this option (unless noatime was specified), and the strictatime option is required to obtain traditional semantics. In addition, since Linux 2.6.30, the file’s last access time is always updated if it is more than 1 day old.
- JoshTriplett 1y ago
  relatime is not as good as noatime, and it doesn't solve the problem reported in the article, since you can still easily end up with a large number of atime updates if you have a large number of files.

pengaru 1y ago

It's one of those things that you don't care about until you do. As a former sysadmin through the dotcom booms, we regularly depended on atime for identifying which files are actively being used in myriad situations. Sometimes you're just confirming a config file was actually reloaded in response to your HUP signal. Other times you're trying to find out which data files a customer's cgi-bin mess is making use of. It's probably less relevant today where multi-user unix hosts are less common, but it was quite valuable information to maintain back then.

__turbobrew__ 1y ago
> we regularly depended on atime for identifying which files are actively being used in myriad situations You can do that with bpf tooling now, for example the `opensnoop` BCC program can capture all file opens on demand. You can also write tools which capture all POSIX IOs to specific files/directories. I can see atime sometimes being useful in some super niche use cases such as hisenbugs you cannot reproduce reliably, but I would be reaching for BPF tools first.
- homebrewer 1y ago
  Forget bpf, Linux has the audit framework to solve exactly this problem, and it's been in heavy use for a couple of decades now https://www.redhat.com/en/blog/configure-linux-auditing-auditd https://www.redhat.com/en/blog/configure-linux-auditing-audi... https://linux-audit.com/linux-audit-framework/configuring-and-auditing-linux-systems-with-audit-daemon/ https://linux-audit.com/linux-audit-framework/configuring-an...

NekkoDroid 1y ago

> does anything actually use this field? Systemd in a way does. One of the systemd-tmpfiles entry option is to clean up unused files after some time (it ships defaults for /tmp/ after 10 days and /var/tmp/ after 30 days) and for this it checks atime, mtime and ctime to determin if it should delete the file (I think you can also take a flock on the file to prevent it from being deleted as well)

Avamander 1y ago

I've found it useful for forensic reasons and debugging.

williadc 1y ago

I use atime to identify archives that can be retired. It's common for circuit designer to release a lot of large files for their peers to analyze or incorporate into a parent/grandparent simulation. They will use that data for as long as it is still relevant, which means different things for different types of data, and the only consistent thing we've found is that if the data hasn't been accessed in awhile, then we can retire it.

p_l 1y ago

The original use case for access times was for backup purposes - long unused files would be marked for "reaping" by backup process and either moved to backup storage or moved to a different storage tier in a hierarchical storage management system