Cybersecurity Updates & Tools

stat Command in Linux: View File and Filesystem Metadata

The stat command in Linux displays detailed metadata about files and filesystems. Where ls gives a condensed summary suitable for directory listings, stat shows everything at once: inode number, block allocation, all three timestamps, permissions, and ownership.

How to Use the stat Command in Linux

The basic syntax is:

bashstat [OPTION]... FILE...

Run stat on a file to see its full metadata:

bashstat file.txt
  File: file.txt  Size: 4030        Blocks: 8          IO Block: 4096   regular fileDevice: 801h/2049d  Inode: 13633379    Links: 1Access: (0644/-rw-r--r--)  Uid: (1000/linuxize)  Gid: (1000/linuxize)Access: 2019-11-06 09:52:17.991979701 +0100Modify: 2019-11-06 09:52:17.971979713 +0100Change: 2019-11-06 09:52:17.971979713 +0100 Birth: -

Key fields explained:

  • Size — file size in bytes
  • Blocks — number of 512-byte blocks allocated on disk. A file with IO Block: 4096 and Blocks: 8 has 8 × 512 = 4096 bytes of allocated storage, regardless of actual content size
  • IO Block — the filesystem block size in bytes
  • Inode — the inode number, which identifies the file’s metadata record on disk independently of its name
  • Links — hard link count. When this is greater than 1, multiple directory entries point to the same inode and therefore the same file data
  • Access/Modify/Change — atime, mtime, and ctime timestamps
  • Birth — file creation time. Requires Linux kernel 4.11 or later on filesystems that support it (ext4, btrfs, xfs). Shows - when not stored; check your filesystem type with df -T /path
  • Context — SELinux security context; only shown on SELinux-enabled systems

Display Filesystem Info and Handle Symlinks

Filesystem info with -f. To see information about the filesystem that contains the file, not the file itself:

bashstat -f file.txt

The output includes filesystem type (ext2/ext3, btrfs, etc.), block size, total and free block counts, and total and free inode counts. This is similar to df but operates at a lower level and does not include mount point information.

Symlinks. By default, stat shows metadata for the symlink itself, not the file it points to. The output includes symbolic link as the file type and the symlink’s own timestamps:

bashstat /etc/resolv.conf

To follow the symlink and display the target file’s metadata, use -L:

bashstat -L /etc/resolv.conf

This is useful when debugging why a symlink appears to point somewhere unexpected — comparing the output of both commands shows the symlink inode versus the target inode.

Custom Output Formats and Scripting Examples

Use --format= to print only the fields you need. This is efficient in scripts:

bashstat --format="%F" /dev/null       # file type onlystat --format="%s" file.txt        # size in bytesstat --format="%a" file.txt        # permissions in octalstat --format="%A %U %n" file.txt  # permissions, owner, and name

The most useful format directives: %n (filename), %s (size), %F (file type), %a (octal permissions), %A (symbolic permissions), %U (owner), %G (group), %i (inode), %y (mtime), %x (atime).

Use --printf= when you need escape sequences in the output:

bashstat --printf='Name: %n\nPermissions: %a\n' /etc

Unlike --format--printf interprets \n as a newline and \t as a tab. When processing multiple files, --format adds a newline between each file automatically; --printf does not.

Assign values to variables in a script:

bashperms=$(stat --format="%a" file.txt)owner=$(stat --format="%U" file.txt)

For machine-parseable single-line output, use terse mode (-t), which prints all fields without labels, suitable for parsing with awk or cut.

Note: This guide covers GNU stat on Linux. BSD and macOS use different flags and format directives.

Use stat when ls does not show enough detail — particularly for inode numbers, hard link counts, birth time, and precise timestamp values. Leave a comment below if you run into any issues.