{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
        "slug": "interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps",
        "url": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/"
        },
        "title": "Interpret tmpfiles cleanup age using all applicable timestamps",
        "summary": "An old modification time alone may not make a file eligible for cleanup.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "video-evidence",
            "label": "Video evidence & analytics",
            "alt": "Multiple synchronized camera views converging into a verifiable evidence frame.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:15:32+00:00",
        "modified_at": "2026-10-20T18:34:33+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 268,
        "potentially_affected": "Review age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.",
        "dse_recommendation": "DSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task.",
        "primary_source": {
            "name": "Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages",
            "url": "https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html",
            "published_on": null,
            "authority": "manpages.debian.org"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>An old modification time alone may not make a file eligible for cleanup.</p>\n<h2>Source facts</h2>\n<p>The Debian tmpfiles.d manual explains that age checks normally consider modification time, access time, and, for files, status-change time. A sufficiently recent applicable timestamp prevents cleanup. The age-by form can restrict which timestamp types count. Files and directories have documented differences, so a simple oldest-mtime listing does not reproduce the cleanup decision.</p>\n<p>Source: <a href=\"https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html\">Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages</a>.</p>\n<h2>Applicability</h2>\n<p>Review age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task. Identify whether another process recently accessed or changed metadata on them. Use an explicit timestamp policy only when it matches the data owner’s retention intent, rather than to force an expected disk-space result. Keep the distinction between file and directory treatment in the runbook. Avoid altering timestamps on important files merely to make a maintenance command delete them.</p>\n<h2>Verification</h2>\n<p>Using a disposable tree, compare files with old content modification but recent access or metadata changes. Observe the supported cleanup decision under the intended rule. Confirm the selected age policy preserves actively used data and removes only the test entries that meet the documented condition. Retain the rule, current test time and applicable timestamp values with each outcome. Ask the data owner to approve the chosen timestamp policy and compare one retained and one removed test entry against that same calculation.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html\">Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages</a>. Reviewed October 20, 2026.</p>",
        "content_text": "An old modification time alone may not make a file eligible for cleanup.\nSource facts\nThe Debian tmpfiles.d manual explains that age checks normally consider modification time, access time, and, for files, status-change time. A sufficiently recent applicable timestamp prevents cleanup. The age-by form can restrict which timestamp types count. Files and directories have documented differences, so a simple oldest-mtime listing does not reproduce the cleanup decision.\nSource: Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages.\nApplicability\nReview age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.\nDSE recommendation\nDSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task. Identify whether another process recently accessed or changed metadata on them. Use an explicit timestamp policy only when it matches the data owner’s retention intent, rather than to force an expected disk-space result. Keep the distinction between file and directory treatment in the runbook. Avoid altering timestamps on important files merely to make a maintenance command delete them.\nVerification\nUsing a disposable tree, compare files with old content modification but recent access or metadata changes. Observe the supported cleanup decision under the intended rule. Confirm the selected age policy preserves actively used data and removes only the test entries that meet the documented condition. Retain the rule, current test time and applicable timestamp values with each outcome. Ask the data owner to approve the chosen timestamp policy and compare one retained and one removed test entry against that same calculation.\nOfficial reference\nDebian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.",
        "content_markdown": "An old modification time alone may not make a file eligible for cleanup.\n\n## Source facts\n\nThe Debian tmpfiles.d manual explains that age checks normally consider modification time, access time, and, for files, status-change time. A sufficiently recent applicable timestamp prevents cleanup. The age-by form can restrict which timestamp types count. Files and directories have documented differences, so a simple oldest-mtime listing does not reproduce the cleanup decision.\n\nSource: [Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html).\n\n## Applicability\n\nReview age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.\n\n## DSE recommendation\n\nDSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task. Identify whether another process recently accessed or changed metadata on them. Use an explicit timestamp policy only when it matches the data owner’s retention intent, rather than to force an expected disk-space result. Keep the distinction between file and directory treatment in the runbook. Avoid altering timestamps on important files merely to make a maintenance command delete them.\n\n## Verification\n\nUsing a disposable tree, compare files with old content modification but recent access or metadata changes. Observe the supported cleanup decision under the intended rule. Confirm the selected age policy preserves actively used data and removes only the test entries that meet the documented condition. Retain the rule, current test time and applicable timestamp values with each outcome. Ask the data owner to approve the chosen timestamp policy and compare one retained and one removed test entry against that same calculation.\n\n## Official reference\n\n[Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
                "url": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "IT",
                        "item": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Interpret tmpfiles cleanup age using all applicable timestamps",
                        "item": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/#article",
                "identifier": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
                "url": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/",
                "headline": "Interpret tmpfiles cleanup age using all applicable timestamps",
                "description": "An old modification time alone may not make a file eligible for cleanup.",
                "abstract": "An old modification time alone may not make a file eligible for cleanup.",
                "articleBody": "An old modification time alone may not make a file eligible for cleanup.\nSource facts\nThe Debian tmpfiles.d manual explains that age checks normally consider modification time, access time, and, for files, status-change time. A sufficiently recent applicable timestamp prevents cleanup. The age-by form can restrict which timestamp types count. Files and directories have documented differences, so a simple oldest-mtime listing does not reproduce the cleanup decision.\nSource: Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages.\nApplicability\nReview age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.\nDSE recommendation\nDSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task. Identify whether another process recently accessed or changed metadata on them. Use an explicit timestamp policy only when it matches the data owner’s retention intent, rather than to force an expected disk-space result. Keep the distinction between file and directory treatment in the runbook. Avoid altering timestamps on important files merely to make a maintenance command delete them.\nVerification\nUsing a disposable tree, compare files with old content modification but recent access or metadata changes. Observe the supported cleanup decision under the intended rule. Confirm the selected age policy preserves actively used data and removes only the test entries that meet the documented condition. Retain the rule, current test time and applicable timestamp values with each outcome. Ask the data owner to approve the chosen timestamp policy and compare one retained and one removed test entry against that same calculation.\nOfficial reference\nDebian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:15:32+00:00",
                "dateModified": "2026-10-20T18:34:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/video-evidence-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Interpret tmpfiles cleanup age using all applicable timestamps"
                },
                "articleSection": [
                    "IT",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "IT",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 268,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages",
                    "url": "https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html"
                }
            }
        ]
    }
}