2 minute read

Context

When investigating files, order matters.

Whether you’re checking logs, build artifacts, or recently modified configs, seeing files in the right order can immediately surface:

  • what changed most recently
  • what hasn’t changed in a long time
  • which files are actively being written

The ls command provides several ways to sort output by time—if you know which flags to use.

Default Behavior

By default, ls sorts alphabetically:

ls

This is rarely helpful when you care about recency.

Sort by Modification Time (Most Common)

To sort files by modification time (newest first):

ls -lt

This is the most commonly used time-based sort.

Flags explained:

  • -l → long listing format
  • -t → sort by modification time

Newest files appear at the top.

Reverse the Order

To show the oldest files first:

ls -ltr

The -r flag reverses the sort order.

This is useful when you want to see:

  • what changed earliest
  • long-lived files
  • stale artifacts

What “Time” Does ls Actually Use?

By default, ls -t sorts by modification time (mtime).

Linux tracks multiple timestamps:

  • mtime — file content modified
  • ctime — metadata changed (permissions, ownership)
  • atime — file accessed

Different flags expose different timestamps.

Sort by Change Time (ctime)

To sort by metadata change time:

ls -ltc

This is useful when:

  • permissions were changed
  • files were moved or renamed
  • ownership was updated

Combine with reverse order:

ls -ltcr

Sort by Access Time (atime)

To sort by last access time:

ls -ltu

This can help identify:

  • files that are still being read
  • unused files
  • unexpected access patterns

Note that many systems disable or relax atime updates for performance reasons.

Limit Output to the Most Recent Files

To see only the most recent entries:

ls -lt | head

Or the oldest:

ls -ltr | head

This is especially helpful in large directories.

Include Hidden Files

Hidden files are often the ones that matter most.

Include them with:

ls -lat

Combine as needed:

ls -latr

Practical Examples

See the most recently modified files in /var/log:

ls -lt /var/log | head

Find old files in a directory:

ls -ltr | head

Inspect recent config changes:

ls -lt /etc

Common Mistakes

  • Assuming ls -t uses creation time (it doesn’t)
  • Forgetting -a and missing hidden files
  • Confusing ctime with creation time
  • Relying on atime when it’s disabled

Understanding timestamps prevents bad assumptions.

Practical Tips

  • Use -lt as a default when debugging
  • Add -r when looking for stale files
  • Remember which timestamp you care about
  • Combine with head or tail for clarity

A well-chosen ls command often answers questions faster than heavier tools.

Takeaways

  • ls supports multiple time-based sorts
  • mtime is the default and most useful
  • ctime reflects metadata changes
  • atime shows access—but may be unreliable
  • Ordering output by date speeds up troubleshooting

Knowing how to sort ls output turns a basic command into a powerful diagnostic tool.

You May Also Enjoy