What is that file?

Learn the content and context of files with IBM AIX commands


What is a file?

There is a lot you can learn about files on IBM® AIX® , but first things first. What is a file anyway?

A file is a collection of data that can be read from or written to. A file can be a program you create, text you write, data you acquire, or a device you use. That definition comes from the AIX 7.1 Information Center (see Related topics). A file can be anything from a directory to a shell script, a compiled program, an operating system executable, a device, or a database index file (just to name a few).

This article looks at some of the commands that tell you about the content of files and, just as importantly, their context.

List files using the ls command

The first thing you usually know about a file is what it is called. The ls command lists the files in your current directory by name. Listing 1 shows the output of the ls command from the /home/ibmdw directory.

Listing 1. ls command example
 # ls readme sample.txt bin reports

The files listed all use the allowable characters for AIX file names. (For information on file-naming conventions, see Related topics.) Knowing the names of files is a start, but most people prefer a listing with more details. You can get a long listing with the ls -l command. This gives you more information, including:

  • When the file's contents were last changed
  • File permissions that show who owns it, what group it belongs to, and who is allowed to read it, update it, or run it
  • The size of the file

You can see an example of a long listing using ls -l in Listing 2. I added a header line for this example, but it will not appear as part of your normal command.

ls -l command

Listing 2.
ls -l command
$ ls -l 
total 608 mode links owner group size modified file name 
-rw-r--r-- 1 root system 187972 Nov 24 05:34 
drwxr-xr-x 2 ibmdw staff 256 Nov 24 05:29 bin 
-rw-r--r-- 1 root system 11 Nov 24 05:34 
-r-xr--r-- 1 ibmdw staff 109499 Nov 24 05:29 
-rw-r--r-- 1ibmdw staff 49 Nov 24 05:32 readme 
drwxr-xr-x 2 ibmdw staff 256 Nov 24 05:30 reports 
-rw-r--r-- 1 root system 2550 Nov 24 05:33 sample.txt

In this listing, there is one line for each file. The first character in the left column shows the type of file. The two most common file types are d, to indicate a directory, and -, to show an ordinary file. You then see the file mode (an essential part of file permissions), the number of links, and the owner and group that the file belongs to. After that, you see the file size, in bytes, followed by the date and time when the file was last modified. Finally, there is the file name.

The file-permissions information is beyond the scope of this article, but the Related topics section shows where you can go for a good explanation.

Many more options are available when you run the ls command. Table 1 describes some of the common ones.

Table 1. Common flags you can use with the ls command
‑a or ‑AAllows you to see the hidden files that start with a dot. That includes files such as .profile, which sets some user variables at login time.
Note: You can also see this information if you use the ls command when you are logged on as root.
-tSorts the files in order of their modification dates.
-rReverses the sort order.

The ls command is helpful for providing basic information, but there is a lot more you can learn about a file than what the ls command reports.

File names

A file's name can indicate what type of file it is. For instance, shell scripts often end in .sh, and configuration files might end in .cfg or .ini. You can often tell what the purpose of a file is by looking at its name and extension (if it has an extension). Table 2 shows some examples.

Table 2. Examples of how file names relate to file type
File nameDescription
startnode.shShell script to start WebSphere node
/etc/filesystemsList of file systems
Java14.sdk.tar.gzJava™ 1.4.2 Software Developer Kit tar file (compressed to gzip)

As you can see, the name of the file sometimes gives you an indication of what the file might be used for, but it is not an infallible rule. Because AIX is flexible with the type of file names you can use, there is no guarantee that you can tell the file type just from its name.

There are other pointers to what a file is used for, such as the directory name or the file system that the file belongs to. If you have a file system called /db_dat and another called /db_idx, there is a good chance that they are for database data files and index files, respectively.

File types

Some commands help you see the type of file you are dealing with. The file command tries to classify the file into one of the following categories:

  • ar archive library
  • block special
  • C-language source
  • character special
  • cpio archive
  • directory
  • empty
  • FORTRAN source
  • first in, first out (FIFO)
  • shell script (commands text)
  • socket
  • symbolic link
  • tar archive

The file command is especially important if you plan to view or edit a file. When you know what kind of file it is, you can determine the tools you need to see its contents.

File systems, directories, and filesets

Knowing a file's name and type is helpful, but a file does not stand on its own. It has relationships with other files. A file sits in a file system and belongs somewhere in a directory tree. Some files also belong to AIX filesets. This section provides some commands that help you see where a file sits in relation to other files.

Which file system?

If you want to find out which file system a file belongs to, looking down the list of file systems produced by the df command can sometimes be misleading. You might think that the /usr/tmp/hostmibd.log file belongs in /usr, but in fact it belongs to /var. As it turns out, the /usr/tmp parent directory is a symbolic link to /var/tmp, as Listing 3 shows.

Listing 3. List directory with symbolic link
 # ls -ld tmp lrwxrwxrwx 1 bin bin 8 Sep 13 2010 tmp -> /var/tmp

So, if that file starts growing, it uses free space in /var, not /usr. Fortunately, you can let AIX figure this out for you by using the df command and adding the file name as an argument, as shown in Listing 4.

Listing 4. Using the df command with file name as argument
 # cd /usr/tmp # df aixmibd.log Filesystem 512-blocks Free %Used I
used %Iused Mounted on /dev/hd9var 2097152 1237000 42% 17545 11% /var

This is especially useful if you have symbolic links or a lot of nested file systems. It is also helpful if you are using a script and need to identify the file system that a file belongs to.

Which directory?

Files belong to a directory path that you can trace back to the root directory (/). For example, the file called myfile might belong to /a/very/long/directory/path.

Sometimes it is helpful to be able to display the file name without the full path. To do that, you can use the basename command shown in Listing 5.

Listing 5. A basename command example
 # basename /a/very/long/directory/path/myfile myfile

If you want to remove the basename and just keep the rest up to the final slash (/), use the dirname command shown in Listing 6.

Listing 6. A dirname command example
 # dirname /a/very/long/directory/path/myfile /a/very/long/directory/path

These commands are generally more helpful in a script when you want to split up a string. You can store the result in a variable and then run dirname or basename on that string.

Which fileset?

Many files are part of an AIX fileset. You can determine which fileset a file belongs to by using the lslpp -Jw command followed by the file name with its full path. Listing 7 shows that the mksysb command (the /usr/bin/mksysb file) belongs to the bos.sysmgt.sysbr fileset.

Listing 7. Display the fileset that a file belongs to
File Fileset                
/usr/sbin/installp                 bos.rte.install          File
/usr/clvm/sbin/linstallpv          prpq.clvm                File
                                   bos.sysmgt.nim.client    File

You can also use the fileset as the starting point and list the files that belong to it. You do this using lslpp -f followed by the fileset name. Listing 8 is an example.

Listing 8. List files included in a fileset
 lslpp -f bos.sysmgt.sysbr Fileset File
Path: /usr/lib/objrepos bos.sysmgt.sysbr
/usr/lib/bootpkg/ /usr/lib/bootpkg/
/usr/sbin/bootpkg /usr/samples/oem_cdwriters/burn_cd_jodian
 /usr/lpp/bosinst/cdfs.optional.list /usr/sbin/mkinsttape
 /usr/bin/mkszfile /usr/lib/bootpkg/
 /usr/lpp/bosinst/tape /usr/lpp/bosinst/image.template
 /usr/lpp/bosinst/CheckSize /usr/lpp/bosinst/BosMenus
 /usr/lpp/bosinst/bi_main /usr/lpp/bosinst/bosinst.template.README 
/usr/lpp/bosinst/bosinst.template /usr/lpp/bosinst/Get_RVG_Disks 
/usr/lpp/bos.sysmgt/mkcd.README.html /usr/lpp/bosinst/iscsi/iscsi_cfg
 /usr/lib/bootpkg/ /usr/lib/bootpkg/
 /usr/lpp/bosinst/post_vgsync /usr/samples/oem_cdwriters /
usr/sbin/mkdvd -> /usr/sbin/mkcd /usr/lpp/bosinst/cdeject
/usr/sbin/mkrr_fs -> /usr/samples/oem_cdwriters/mkrr_fs_gnu 
/usr/bin/restwparfiles -> /usr/bin/listvgbackup 
/usr/bin/listvgbackup /usr/lib/bootpkg/
/usr/lpp/bos.sysmgt/README.oem_cdwriters -> 
 /usr/lpp/bosinst/iscsi/iscsi_smit /usr/bin/lsmksysb ->
 /usr/bin/listvgbackup /usr/lib/bootpkg/
 /usr/bin/lssavevg -> /usr/bin/listvgbackup
 /usr/bin/savewpar -> 
 /usr/sbin/burn_cd -> 
 /usr/bin/mkvgdata -> /usr/bin/mkszfile 
/usr/bin/savevg -> /usr/bin/mksysb
/usr/bin/mkwpardata -> 
/usr/bin/restorevgfiles ->
 /usr/bin/lssavewpar ->
Path: /etc/objrepos bos.sysmgt.sysbr /etc/preserve.list

File fingerprints

Every file on your system is unique. Even if you make a copy of a file, that copy is a different file from the original. The contents might be the same, but the file is still unique. How is that so?

A file is made up of more than its contents. Even the file name does not make it unique because you can have two files with the same name, as long as they are in different directories. So what is it that makes one file different from another? To answer that question, you can look at the file's inode. The inode is a kind of table of contents. Each file has an inode number, and that number is unique to that file within the file system.

You can examine the file's inode information with the istat command, which shows you the file's inode number and the device where the file resides. The inode also shows the file's last access time, permissions, and extended permissions. (For more information about extended permissions and access control lists, or ACLs, see Related topics.) Listing 9 shows an example of the output of the istat command.

Listing 9. An istat command example
 # istat lspartition 
Inode 321985 on device 10/9 
File Protection: rwxr-xr-x Owner: 2(bin) Group: 2(bin) Link count: 1 Length 19884 bytes 
Last updated: Thu Nov 17 10:19:59 EST 2011 
Last modified: Wed Jul 20 01:06:07 EST 2011 
Last accessed: Wed Jul 20 06:02:35 EST 2011

You can see three date and timestamp fields in the output of the istat command. Table 3 lists and describes these fields.

Table 3. Date and timestamp fields in the istat command output
Last updatedShows the date and time of the last inode update. This field is updated when a file is renamed, its permissions are changed, or other changes are made to the file table of contents.
Last modifiedShows the date and time of the last change to the file itself, rather than just to the inode.
Last accessedShows the date and time the file was last opened, even if no updates were made to the file.

You can use any of these timestamps to search for files using the find command. The find command uses flags to allow you to narrow your search to files that have been accessed, modified, or had their inodes updated within a certain time period. For example, by calling find with -mtime (modification time), you can locate files that have been changed within a specific number of 24-hour periods. Listing 10 shows how to list all files that have been changed in the last three days, starting from the current directory.

Listing 10. Find files by their modification time in days
 find . -mtime -3

Similarly, you can search for files that have been modified, updated, or accessed within a specific number of minutes. Listing 11 shows how to find files that have been accessed within the last 10 minutes.

Listing 11. Find files by their modification time in minutes
 find . -amin -10

The AIX command documentation for the find command explains these options in more detail (see Related topics).

File size

To display the size of a file, use the du command. This is easier than converting the output of the ls -l command. For more details on how to display the size of a file, see Related topics.

File contents

If the file is a text file, you can view its contents (provided you have read permissions on the file). There are many commands that help you see part or all of an American Standard Code for Information Interchange (ASCII) file. Table 4 lists and describes some of those commands.

Table 4. Commands for viewing ASCII file contents
more or pgShows the file one page at a time
headShows the first few lines of the file
tailShows the last few lines of the file. If the file is still being updated, you can see a continuous view by using tail -f
viewShows the file contents in a vi editor session in read-only mode

Even if a file is not in ASCII format, you can view the printable strings in the file by using the strings command.

File users

To see if a file is in use by a process, use the fuser command. You can list the name of the user who owns the process by using fuser -u. If you are confident that the process can be terminated, you can stop it by using fuser -k.

More file information

Many other commands can inform you about files and help you manage them. There are commands to delete, copy, move, or rename files. You can also use commands to display file contents or find text strings within files. You can count the characters, lines, or words in a file. You can compare files and display the differences. Table 5 lists a few of the most helpful commands for managing files. Documentation on all of these commands is available in the AIX Information Center (see Related topics).

Table 5. Other commands for managing files
catConcatenates or displays files
cmpCompares two files
colrmExtracts columns from a file
cpCopies files
cutWrites out selected bytes, characters, or fields from each line of a file
devnmShows the device a file resides on
diff, bdiffCompares text files
diff3Compares three files
dircmpCompares two directories
ffLists the paths of all files in a file system
grepSearches a file for a pattern
mvMoves files
nlNumbers the lines in a file
rmRemoves (unlinks) files or directories
pasteMerges the lines of several files or subsequent lines in one file
sdiffProvides a side-by-side comparison of files
sortSorts files, merges files that are already sorted, and checks files to determine if they have been sorted
sumGets a checksum and block count of a file
uniqReports or deletes repeated lines in a file
wcCounts the number of lines, words, and bytes in a file
whichLocates a program file, including aliases and paths


This article showed you some of the AIX commands that you can use for working with files, but there are many more. In fact, every command works with files in one way or another. As you can see, it is beneficial to revisit the command documentation from time to time because there might be new flags or commands available. When you make good use of the available commands, your system administration work becomes a lot easier.

Downloadable resources

Related topics


Sign in or register to add and subscribe to comments.

Zone=AIX and UNIX
ArticleTitle=What is that file?