What do the fields in ls -al output mean?

Question

The ls -al command shows the following output;

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe

What are all the fields in the preceding display?

Answer 1

In the order of output;

-rwxrw-r--    1    root   root 2048    Jan 13 07:11 afile.exe

• file permissions (-rwxrw-r--),
• number of (hard) links (1),
• owner name (root),
• owner group (root),
• file size in bytes (2048),
• time of last modification (Jan 13 07:11), and
• file/directory name (afile.exe)

File permissions is displayed as following;

• first character is most often -, l or d. A d indicates a directory, a - represents a regular file, l is a symlink (or soft link) and other letters are used for other types of special files
• three sets of characters, three times, indicating permissions for owner, group and other:
  • r = readable
  • w = writable
  • x = executable (for files) or accessible (for directories)
• this may be followed by some other character of there are extended permissions, like e.g. Linux ACL that are marked with a +.

In your example -rwxrw-r--, this means the line displayed is:

• a regular file (displayed as -)
• readable, writable and executable by owner (rwx)
• readable, writable, but not executable by group (rw-)
• readable but not writable or executable by other (r--)

The number of hard links means the number of names the inode has, i.e. links created with ln without the -s option.

Answer 2

The output of the "ls" command depends on the version of "ls", the options used, the platform used, etc. It appears from your example that you're using it from a typical un*x (such as Linux), and probably using a typical modern "ls" version. In which case:

-rwxrw-r--    10    root   root 2048    Jan 13 07:11 afile.exe
?UUUGGGOOOS   00  UUUUUU GGGGGG ####    MON DD XX:XX FILENAME
^ ^  ^  ^ ^    ^      ^      ^    ^      ^            ^- Filename.
| |  |  | |    |      |      |    |      \-------------- Time of last modification.
| |  |  | |    |      |      |    \--------------------- File Size OR for directory size of the metadata. (Size is *usually* in bytes on modern systems; See below.)
| |  |  | |    |      |      \-------------------------- Group Name (for example, Users, Administrators, etc)
| |  |  | |    |      \--------------------------------- Owner Acct
| |  |  | |    \---------------------------------------- Link count (what constitutes a "link" here varies)
| |  |  | \--------------------------------------------- Alternative Access (blank means none defined, anything else varies)
| \--\--\----------------------------------------------- Read, Write and Special access modes for [U]ser, [G]roup, and [O]thers (everyone else)
\------------------------------------------------------- File type flag        

I am not sure why your link count is so high for the example file you listed. Some platforms have an odd notion of what constitutes a "link". These usually include hard links and symbolic links, as well as directory entries (which is why directories often have high link counts – its parent has one link, the directory has a link to itself in the . entry, and each of its sub-directories has a link back via ..).

Some versions and/or command line flags will list the number of blocks used instead of the number of bytes; a filesystem with a block size of 1024 bytes will list all sizes up to 1024 bytes as "1", meaning 1 block is used, from 1025 to 2048 as "2", using 2 blocks, and so on. But listing block sizes by default (without explicitly using a command line option) is rare on most modern un*x machines.

The special/alternative access flag is usually a blank space, but on some platforms, it may be used to indicate there are special/alternative access modes (such as ACLs and security descriptors on WIN32, etc), and varies widely – consult your manual, man pages, info tool, or what-not.

The permissions (mode) flags (UUUGGGOOO) are three sets of three chars, where the first set is "User" (i.e., Owner), the second set is "Group" and the third set is "Others" (i.e., everyone else; anyone who is neither Owner nor Group). The three permissions flags in each set are typically r or - meaning the User/Group/Others can read the file (r) or not (-), followed by w or - indicating whether they can write to the file (you can have files which you can write to, but cannot read, as odd as that may sound!), and the third character is a 'catch-all' flag for other modes, typically something like x for execute (for directories, it means you can attempt to access the directory contents), or - for none. Sometimes you may encounter an s or S for setuid and/or setgid programs, or other less common characters; see your ls documentation for the mode characters it will show.

Finally, the very first character is the file type; typically one of: d for directory, l for a symbolic link (hard links show normally without a special character of their own), or - for a normal file. There are many other, but less commonly seen, file types for various filesystems. These first ten characters (file type and permissions) are discussed on Wikipedia. Again, your documentation will tell you exactly what kind of file types your command supports and displays.

BTW, if you cannot find a man/info page for ls itself (man ls/info ls), try looking in the "coreutils" package (info coreutils). Also note that among the more common platforms, Microsoft platforms tend not to translate very well to ls output, so you may see odd behavior, flags, or other unusual info in the output, depending on how your version of ls was compiled, what it was linked against, etc.

One more caveat: The file time stamp is usually the date/time the file was last modified, not the time the file was created. In fact, on a un*x-ish filesystem, there is no record of the file creation time; the ctime field does NOT mean "creation time" as it does on FAT/NTFS filesystems, but rather, it means the "inode [C]hange time" – the time the inode itself was last modified. The "mtime" (last [M]odified) and atime (last [A]ccesed/read) timestamps are the same on both systems – although the precision (FAT has a granularity of two seconds, for example) and time zone may vary.

Answer 3

On GNU systems, it is described in ls info page in a very detailed way. All you had to do to find it: just open man ls and find in the end link to the full documentation: info coreutils 'ls invocation'.

Here is quote from it:

`-l'
`--format=long'
`--format=verbose'
     In addition to the name of each file, print the file type, file
     mode bits, number of hard links, owner name, group name, size, and
     timestamp (*note Formatting file timestamps::), normally the
     modification time.  Print question marks for information that
     cannot be determined.

     Normally the size is printed as a byte count without punctuation,
     but this can be overridden (*note Block size::).  For example, `-h'
     prints an abbreviated, human-readable count, and
     `--block-size="'1"' prints a byte count with the thousands
     separator of the current locale.

     For each directory that is listed, preface the files with a line
     `total BLOCKS', where BLOCKS is the total disk allocation for all
     files in that directory.  The block size currently defaults to 1024
     bytes, but this can be overridden (*note Block size::).  The
     BLOCKS computed counts each hard link separately; this is arguably
     a deficiency.

     The file type is one of the following characters:

    `-'
          regular file

    `b'
          block special file

    `c'
          character special file

    `C'
          high performance ("contiguous data") file

    `d'
          directory

    `D'
          door (Solaris 2.5 and up)

    `l'
          symbolic link

    `M'
          off-line ("migrated") file (Cray DMF)

    `n'
          network special file (HP-UX)

    `p'
          FIFO (named pipe)

    `P'
          port (Solaris 10 and up)

    `s'
          socket

    `?'
          some other file type

     The file mode bits listed are similar to symbolic mode
     specifications (*note Symbolic Modes::).  But `ls' combines
     multiple bits into the third character of each set of permissions
     as follows:

    `s'
          If the set-user-ID or set-group-ID bit and the corresponding
          executable bit are both set.

    `S'
          If the set-user-ID or set-group-ID bit is set but the
          corresponding executable bit is not set.

    `t'
          If the restricted deletion flag or sticky bit, and the
          other-executable bit, are both set.  The restricted deletion
          flag is another name for the sticky bit.  *Note Mode
          Structure::.

    `T'
          If the restricted deletion flag or sticky bit is set but the
          other-executable bit is not set.

    `x'
          If the executable bit is set and none of the above apply.

    `-'
          Otherwise.

     Following the file mode bits is a single character that specifies
     whether an alternate access method such as an access control list
     applies to the file.  When the character following the file mode
     bits is a space, there is no alternate access method.  When it is
     a printing character, then there is such a method.

     GNU `ls' uses a `.' character to indicate a file with an SELinux
     security context, but no other alternate access method.

     A file with any other combination of alternate access methods is
     marked with a `+' character.

Answer 4

The first column is the file mode, the next column is the numbers of link that the file has, the third and fourth are the name of the owner and the group which the file belongs to. Next column says the number of bytes of the file (some ls implementations have a -h option to see this information in a more user-friendly form). The last two columns indicate the timestamp and the name of the file. You'd read the man page for more info.