# Interpret tmpfiles cleanup age using all applicable timestamps

> An old modification time alone may not make a file eligible for cleanup.

- Canonical URL: https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:32+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An old modification time alone may not make a file eligible for cleanup.

## Potentially affected

Review age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.

## DSE recommendation

DSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task.

## Article

An old modification time alone may not make a file eligible for cleanup.

## Source facts

The Debian tmpfiles.d manual explains that age checks normally consider modification time, access time, and, for files, status-change time. A sufficiently recent applicable timestamp prevents cleanup. The age-by form can restrict which timestamp types count. Files and directories have documented differences, so a simple oldest-mtime listing does not reproduce the cleanup decision.

Source: [Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html).

## Applicability

Review age eligibility and age-by selection in the Debian trixie tmpfiles.d manual.

## DSE recommendation

DSE recommends inspecting the rule and the relevant timestamps before diagnosing retained files as a failed cleanup task. Identify whether another process recently accessed or changed metadata on them. Use an explicit timestamp policy only when it matches the data owner’s retention intent, rather than to force an expected disk-space result. Keep the distinction between file and directory treatment in the runbook. Avoid altering timestamps on important files merely to make a maintenance command delete them.

## Verification

Using a disposable tree, compare files with old content modification but recent access or metadata changes. Observe the supported cleanup decision under the intended rule. Confirm the selected age policy preserves actively used data and removes only the test entries that meet the documented condition. Retain the rule, current test time and applicable timestamp values with each outcome. Ask the data owner to approve the chosen timestamp policy and compare one retained and one removed test entry against that same calculation.

## Official reference

[Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages](https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html). Reviewed October 20, 2026.

## Primary reference

- Name: Debian systemd manual — tmpfiles.d(5) — systemd — Debian trixie — Debian Manpages
- Authority: manpages.debian.org
- URL: https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Interpret tmpfiles cleanup age using all applicable timestamps,” DSE Security, https://update.dsesecurity.com/updates/interpret-tmpfiles-cleanup-age-using-all-applicable-timestamps/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.