2

Earlier today I did a full system image restore from backup. Shortly thereafter when I ran:

# find / -type f -printf "%TY-%Tm-%Td %TT %p\n" | sort -r

I noticed the files under /sys directory had just modified. Moreover, they were almost within the same minute. Later in the day they were again modified, and again within the same minute, except the /sys/module directory:

/sys# ls -alt
total 4
drwxr-xr-x   2 root root    0 Aug 13 00:37 block
drwxr-xr-x   7 root root    0 Aug 13 00:37 firmware
drwxr-xr-x  38 root root    0 Aug 13 00:37 bus
drwxr-xr-x  12 root root    0 Aug 13 00:37 fs
drwxr-xr-x   2 root root    0 Aug 13 00:37 hypervisor
drwxr-xr-x   4 root root    0 Aug 13 00:37 dev
drwxr-xr-x  16 root root    0 Aug 13 00:37 devices
drwxr-xr-x  68 root root    0 Aug 13 00:37 class
drwxr-xr-x   2 root root    0 Aug 13 00:37 power
drwxr-xr-x  15 root root    0 Aug 13 00:37 kernel
dr-xr-xr-x  13 root root    0 Aug 12 21:06 .
drwxr-xr-x 152 root root    0 Aug 12 21:06 module
drwxr-xr-x  22 root root 4096 Aug 12 19:50 ..

What do these modification times mean?

James Bowery
  • 158
  • 6

2 Answers2

2

Like /proc /sys is a pseudo file system maintained by the Linux kernel.

The sysfs virtual files export information about various kernel subsystems, hardware devices, and associated device drivers and allow (limited) interaction with those drivers and underlying hardware.

In that regard they are not normal files and directories, there is no need for them to be in included in your back-ups and if the timestamps on those files hold particular meaning, and I don't know if they do, that meaning will probably be driver dependent.

More on https://en.wikipedia.org/wiki/Sysfs

HBruijn
  • 72,524
  • 21
  • 127
  • 192
1

The /sysfs file-system (which is mounted at /sys directory) is a pseudo file-system managed by the kernel (the operating system's executive). One of the key abstractions of Unix and Linux operating systems is "everything is a file", including all I/O devices. All devices have a virtual file which allows user programs to access devices in a similar way to opening a text file.

/sysfs presents the kernel's hardware and device-driver information as the /sys hierarchical file-system, representing all hardware and driver modules. This allows user-space utilities to report on the machine's state. Utilities such as-:

  • lshw - lists hardware configurition
  • lscpu - lists CPU information

When I/O device changes take place on a system, the changes are represented in files within /sys. Any changes within a directory affect the modification time of the directory.

For example, if the machine wakes up from a sleep state the contents of /sys/power will change. Or when a new USB device is plugged into a USB port, the change will be represented in /sys/block and /sys/devices.

suspectus
  • 548
  • 1
  • 4
  • 11
  • I suspected as much. But the synchronized change in all but one of the top directories, hours after a reboot, makes me wonder what this implies. It's *almost* as though the system rebooted itself -- except that the `/sys/modules` directory was unaffected (and `uptime` shows no such reboot happened). – James Bowery Aug 13 '19 at 14:34
  • this could happen for example if the power state had changed from run, idle or sleep states. – suspectus Aug 13 '19 at 14:43