Originally posted by: koc

Hi all,
I want to ask a question about file attributes in AIX (ownership, modification date, etc.). In our system, when I execute ls -la command, system shows file attributes according to its own attributes rather than system. Let me explain in detail. Assume that there is a word document (or html, whatever), if this document is lastly edited by User X on July 14 2010 at 10:04 but transferred to system by User Y on July 15 08:12, ls -al shows the attributes as July 14 10:04 user X. What I want is the latter one for auditing purposes. Is there any option regarding to handle this situation.

Best.

Originally posted by: orphy

You can you "ls -lc" to see when the last time the i-node was updated instead of the default modified time ls -l shows you. In your case, when the file was copied over, the i-node would get updated and thus you would get a newer time. You can play with it and use the istat command the various time changes to see if it fits your need. But, it all depends on what exactly you meant by auditing. To me, that is a very broad term. If you need something serious, you might need to look at the AIX auditing feature.
Orphy