File Access dates changed unexpectedly. Metadata crawler?

dk flag

Is it usual for file access dates (read dates) to change without human interaction? Which applies for all files under /home/myusername/ if I see that correctly but not for system files. My personal files get a recent file access date that looks like the result of a batch processing, so multiple files at the same minute, although I didn't access them and I also didn't copy them at the file access date.

I noticed the behavior when I wanted to attach a file to an email and sorted by "Used recently" in the dialogue to choose a file more quickly. There are files listed that I didn't use at the specific date and time. This behavior wasn't present on my system from the beginning, it was freshly installed (no upgrade) approx. 2 years ago. The problem started a few weeks ago.

Does Ubuntu 20.04 LTS have some meta data crawler or daemon that processes files in batch mode and changes the read date of every file it accesses? Or do I have to worry that my system was compromised?

The file change dates remain untouched.

I'm sorry if this question is trivial but I didn't find anything specific on askubuntu or on the web concerning this problem (but I found much stuff on how to change file dates etc.)

I Have No Idea avatar
dk flag
It apparently happens for all file types in the same fashion (office files, image files, text files, pdf files, xml files) and it gets refreshed often (accessed usually the day I look for it).
jp flag

It's not normal for personal files to change access date/time unless they are accessed somehow ... Although browsing a directory with some applications e.g. email client attach dialog might indeed change access date/time which is especially known for file-types like images and videos that are previewed as thumbnails.

However, who or what had accessed a certain file is not per se logged by default ... There might be traces in some specific applications' logs generally for system files and not personal files and that's it.

Bottom line is that unless you have auditing service on and active for a certain file/directory, there is no way for knowing who or what accessed the file.

You can setup auditing like so:

sudo apt install auditd

Then, start monitoring a file like so:

sudo auditctl -w /path/to/file

Or a directory(be careful with auditing directories as the logfile size might grow extremely large especially for Home) like so:

sudo auditctl -w /path/to/directory/

You can list currently audited files/directories entries like so:

sudo auditctl -l

and delete those entries like so:

sudo auditctl -W file/directory

The audit information will be written to the file:


That you can view and search with e.g.:

grep "something" /var/log/audit/audit.log

or with e.g.:

ausearch --file "file-name"

and get reports with e.g.:



  • man auditd - The Linux Audit daemon.
  • man auditctl - a utility to assist controlling the kernel's audit system.
  • man ausearch - a tool to query audit daemon logs.
  • man aureport - a tool that produces summary reports of audit daemon logs.
I Have No Idea avatar
dk flag
Thank you, I'm gonna try this. Another strange thing I noticed: If I access some media with VLC player, the file access date of the particular file played doesn't get updated (played today, file access date yesterday). I checked the date with the gnome file manager, with ls -ul and stat.
I Have No Idea avatar
dk flag
Yesterday, I added some directories using 'sudo auditctl -w /path/to/directory/' Today I searched for file changes via 'sudo aureport -f', but the timestamps that get displayed by aureport don't match the ones that I see via the file system (the same in Gnome file manager, 'ls -ul' and 'stat' commands). File system access date is today, aureport access date is yesterday.
I sit in a Tesla and translated this thread with Ai:


Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.