ls -l lists files alphabetically, so the file that changed five minutes ago gets lost in a long directory. Here’s how to sort by modification, access, change, and birth time with ls -t, -r, -u, -c, and find.Listing the contents of a directory is one of the first things you do on any Linux server, and most of the time ls is the command you reach for.
By default, though, ls sorts its output alphabetically by file name, which is fine for a small home directory but much less useful when you open /etc or /var/log and want to know what changed recently.
This comes up all the time in real sysadmin work. A service stops working after a package update, and you want to know which configuration files were just touched. A backup job runs every night, and a script needs to pick the latest archive. A log directory holds hundreds of rotated files, and you only care about the one that is being written right now.
The ls command can sort its output by time with a single flag, and it can sort by several different timestamps, not only the last modification time. Once you know which timestamp each flag uses, finding the newest or oldest files in any directory takes only a few seconds.
How Linux Tracks File Timestamps
Before sorting by time, it helps to know which times Linux actually stores for a file, because each ls sorting flag reads a different one, and choosing the wrong one gives you an order that looks random.
Every file has these timestamps, stored in its inode (the small record on disk that holds a file’s metadata):
mtime(modification time) changes when the contents of the file change. This is the timels -lshows by default.atime(access time) changes when the file is read, although most systems only update it occasionally, as explained below.ctime(change time) changes when the file’s metadata changes, such as its permissions, owner, or name, and also whenever the contents change. It is not the creation time, which is a common mix-up.btime(birth time) records when the file was created, on filesystems that support it, such as ext4, XFS, and Btrfs.
The easiest way to see all four at once is the stat command, so let’s run it against /etc/hosts:
stat /etc/hosts
Output:
File: /etc/hosts Size: 268 Blocks: 8 IO Block: 4096 regular file Device: 252,1 Inode: 1310834 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2026-11-02 08:55:10.412367219 +0530 Modify: 2026-10-28 14:03:22.180415667 +0530 Change: 2026-10-28 14:03:22.180415667 +0530 Birth: 2026-09-14 11:20:47.904112031 +0530
The size, inode number, and device line will differ on your system, so focus on the four time lines at the bottom. If Birth shows a dash (-), your filesystem or kernel doesn’t report the creation time for that file.
The access time needs one extra word of caution. Most Linux distributions mount filesystems with the relatime option by default, which means the kernel only updates atime when the old access time is earlier than the file’s modification or change time, or when it is more than 24 hours old. This saves a disk write on every read, but it also means that reading a file twice in the same afternoon doesn’t move it to the top of an access-time listing.
mtime and ctime for you, share it with someone who still thinks ctime means creation time.Read the Date and Time Column in ls -l Output
Now that you know which timestamps exist, let’s look at where ls shows them, since every sorting example below relies on reading this column correctly.
The -l option gives the long listing format, with permissions, link count, owner, group, size, the modification time, and the name:
ls -l /etc/nginx
Output:
total 68 drwxr-xr-x 2 root root 4096 Feb 9 2026 conf.d -rw-r--r-- 1 root root 1125 Dec 1 2023 fastcgi.conf -rw-r--r-- 1 root root 1055 Dec 1 2023 fastcgi_params -rw-r--r-- 1 root root 2837 Dec 1 2023 koi-utf -rw-r--r-- 1 root root 2223 Dec 1 2023 koi-win -rw-r--r-- 1 root root 5465 Dec 1 2023 mime.types drwxr-xr-x 2 root root 4096 Feb 9 2026 modules-available drwxr-xr-x 2 root root 4096 Feb 9 2026 modules-enabled -rw-r--r-- 1 root root 1446 Dec 1 2023 nginx.conf -rw-r--r-- 1 root root 180 Dec 1 2023 proxy_params -rw-r--r-- 1 root root 636 Dec 1 2023 scgi_params drwxr-xr-x 2 root root 4096 Sep 23 12:13 sites-available drwxr-xr-x 2 root root 4096 Apr 19 2026 sites-enabled drwxr-xr-x 2 root root 4096 Sep 23 12:13 snippets -rw-r--r-- 1 root root 664 Dec 1 2023 uwsgi_params -rw-r--r-- 1 root root 3071 Dec 1 2023 win-utf
Notice that some lines show a time such as 12:13, while others show a year such as 2026. GNU ls shows the time of day for files modified within the last six months and switches to the year for anything older, so Dec 01 2023 simply means the file is old enough that the exact time was left out. We will see how to always show the full timestamp in Example 3.
Practical Examples of Sorting ls Output by Time
With the timestamps and the date column in mind, we can start sorting. The examples below build on each other, moving from the everyday ls -lt to sorting a whole directory tree.
Example 1: Sort Files by Modification Time with ls -lt
The -t option tells ls to sort by time, newest first, and by default it uses the modification time. Combined with -l, it is the quickest way to see what changed recently in a directory such as /etc, which is exactly where you look after an update or a configuration change goes wrong.
Since /etc holds a few hundred entries, pipe the output into head so only the first few lines are shown:
ls -lt /etc | head -n 6
Output:
total 1092 -rw-r--r-- 1 root root 95381 Nov 2 09:12 ld.so.cache drwxr-xr-x 3 root root 4096 Nov 2 09:11 nginx drwxr-xr-x 2 root root 4096 Nov 2 09:11 alternatives -rw-r----- 1 root shadow 1302 Nov 1 18:40 shadow -rw-r--r-- 1 root root 2914 Nov 1 18:40 passwd
The first line, total, is the disk space used by the listed files in 1K blocks, so head -n 6 gives you that line plus the five newest entries. In this example you can see that something in the nginx directory changed at 09:11, and that passwd and shadow changed the evening before, which usually means a user account was added or modified.
You can also write the same sort in a longer, more readable form with --sort=time, which is handy in scripts that other people will read:
ls -l --sort=time /etc | head -n 6
Example 2: List the Newest Files Last with ls -ltr
The first example puts the newest files at the top, which works well with head, but in a directory with hundreds of files, the top of the output scrolls off the screen. Adding -r reverses the order, so the newest files end up at the bottom, right above your prompt where you can read them without scrolling.
This is probably the single most used form of the command on servers, especially in log directories:
ls -ltr /var/log
Output:
... -rw-r----- 1 syslog adm 184322 Nov 2 08:30 auth.log.1 drwxr-xr-x 2 root root 4096 Nov 2 09:05 nginx -rw-r----- 1 syslog adm 48210 Nov 2 09:18 auth.log -rw-r----- 1 syslog adm 912644 Nov 2 09:20 syslog
The last lines show the files that are being written right now, which tells you which log to open first when you are chasing a live problem.
ls -ltr just saved you from scrolling through a long log directory, share it with a teammate who still opens every log file one by one.Example 3: Show the Full Date and Time with –full-time
Earlier we saw that ls -l hides the time of day for older files and never shows seconds. When two files changed within the same minute, or you need to match a file against a timestamp in a log, that isn’t precise enough.
The --full-time option fixes this by printing the complete date, time down to nanoseconds, and the time zone offset, and it works together with -t:
ls -lt --full-time /etc/nginx
Output:
total 64 -rw-r--r-- 1 root root 1477 2026-11-02 09:11:37.551209183 +0530 nginx.conf drwxr-xr-x 2 root root 4096 2026-10-28 14:10:02.118540871 +0530 conf.d drwxr-xr-x 2 root root 4096 2026-10-28 14:10:02.118540871 +0530 sites-available drwxr-xr-x 2 root root 4096 2026-10-28 14:10:02.118540871 +0530 sites-enabled -rw-r--r-- 1 root root 1125 2026-04-14 10:02:18.000000000 +0530 fastcgi.conf -rw-r--r-- 1 root root 1055 2026-04-14 10:02:18.000000000 +0530 fastcgi_params
Files that came from a package often show .000000000 because the package stores times only to the second. If the full nanosecond timestamp is more than you need, --time-style lets you choose a shorter format, such as long-iso, which gives a sortable date and time without seconds:
ls -lt --time-style=long-iso /etc/nginx
Output:
total 64 -rw-r--r-- 1 root root 1477 2026-11-02 09:11 nginx.conf drwxr-xr-x 2 root root 4096 2026-10-28 14:10 conf.d
Example 4: Sort by Access, Change, or Birth Time
So far every example sorted by modification time. The other timestamps we met with stat are useful too, for example when you want to know which scripts in a directory were actually run recently, or which files had their permissions changed.
Use these options together with -l and -t:
-ushows the access time instead of the modification time, and sorts by it when-tis also given. On its own with-l, it shows the access time but still sorts by name, so remember to add-t.-cworks the same way for the change time (ctime), which is useful after a chmod or chown that didn’t touch the file contents.--time=birthsorts by and shows the creation time, on filesystems and kernels that report it.
For example, to see which scripts in /usr/local/bin were read most recently, sort by access time:
ls -ltu /usr/local/bin
To find files whose permissions or ownership changed recently in a web root, sort by change time instead:
ls -ltc /var/www/html
Because of the relatime behaviour explained earlier, treat the access-time order as a rough guide rather than an exact record of every read.
Example 5: Get the Newest File or Directory in a Script
The examples so far were for reading on screen, but sorting by time is just as useful inside scripts. A common case is a backup directory where a nightly job writes a new archive, and another script needs to copy or verify only the latest one.
Since -t sorts newest first, taking the first line of the output gives you the most recent file:
latest=$(ls -t /srv/backups/*.tar.gz | head -n 1) echo "Latest backup: $latest"
Output:
Latest backup: /srv/backups/web-2026-11-02.tar.gz
The same idea works for directories. The -d option tells ls to list directories themselves instead of their contents, and the */ pattern matches only directories, so this shows which project folder was changed most recently:
ls -ltd /srv/projects/*/
Keep in mind that parsing ls output is only safe when the file names are under your control, as with the dated backup names above. A file name containing a newline character would break the result, which is why the next example uses find for cases where you can’t be sure what the names look like.
Example 6: Sort Files by Time Across Subdirectories with find
Every example so far sorted the files inside one directory. If you try ls -ltR on a directory tree, ls still sorts each subdirectory separately, so you can’t see which file across the whole tree changed last.
For that, find command is the right tool, because its -printf option can print each file’s modification time in a sortable format. The %T+ directive prints the time as YYYY-MM-DD+HH:MM:SS, which sorts correctly as plain text, and %p prints the path:
sudo find /var/log -type f -printf '%T+ %pn' | sort -r | head -n 5
Output:
2026-11-02+09:20:14.5521378870 /var/log/syslog 2026-11-02+09:20:14.1189022310 /var/log/journal/8f3c2a.../system.journal 2026-11-02+09:18:41.7703315260 /var/log/auth.log 2026-11-02+09:05:12.3341908870 /var/log/nginx/access.log 2026-11-02+08:30:00.9921045310 /var/log/nginx/error.log
We use sudo here because several log directories are readable only by root or the adm group, and without it find prints Permission denied for those directories and skips them. The sort -r puts the newest files first, and head -n 5 keeps the five most recent ones from the entire tree.
If you only need files that changed within a recent window rather than a full sorted list, find /etc -type f -mmin -60 lists every file under /etc modified in the last 60 minutes, which is often the fastest way to answer “what did that update just change?”
ls -ltR and scrolls.Tips for Using ls Time Sorting Every Day
Now that you can sort by any timestamp, a few small habits make these commands faster to use and avoid some confusing results.
If you type ls -ltr many times a day, add a short alias to your ~/.bashrc so it’s always available. The extra -h flag prints sizes such as 1.2M instead of raw byte counts, which makes the listing easier to scan:
echo "alias lt='ls -ltrh'" >> ~/.bashrc source ~/.bashrc
When you compare times across servers, remember that ls shows times in the server’s local time zone. If one server runs in UTC and another in IST, the same moment shows up five and a half hours apart. Setting the TZ variable for a single command shows the times in UTC so that you can compare them directly:
TZ=UTC ls -lt --full-time /etc/nginx
Recent Ubuntu releases ship the Rust-based uutils coreutils as the default ls, while Rocky Linux, AlmaLinux, and RHEL use GNU coreutils.
The options in this article behave the same on both for everyday sorting, but small details such as the exact output spacing can differ, so check the output on your own system before relying on it in a script.
Finally, if a file you just copied shows an old modification time, that is expected. Commands such as cp -p, rsync -a, and tar extraction keep the original modification time on purpose, so the file sorts by when its contents last changed, not by when it arrived on your server.
Its ctime, on the other hand, will show the copy time, which is another case where ls -ltc gives you the answer you’re looking for.
Conclusion
You can now sort any directory listing by modification, access, change, or birth time using ls -t with -u, -c, or --time, reverse the order with -r, and print exact timestamps with --full-time.
For whole directory trees, find with -printf '%T+ %pn' and sort shows the newest files across every subdirectory at once.
If you’d like to get just as comfortable with the rest of the everyday command line, our 100+ Essential Linux Commands course on Pro Tecmint covers ls, find, sort, stat, and many more with practical examples.
And when you’re ready to turn one-liners like the backup example into reliable scripts, Bash Scripting for Beginners walks you through it step by step.
We’d love to hear how you sort by time on your own servers. Do you rely on ls -ltr, or have you switched to find for most of these jobs?
Have you ever been caught out by relatime or by ctime not meaning creation time? Feel free to share your favourite alias or post a confusing listing in the comments, and we’ll help you read it.
