ls is the first command most people learn and the one whose man page almost nobody finishes. GNU coreutils ls has over fifty options; in practice about twenty of them cover everything you do day to day — and a few of the defaults, like quoting and the six-month date format, surprise people for years.
This cheat sheet is organised by task: what to show, how to sort, which timestamp, and how to read the long format. Flags are for GNU ls as shipped on Debian, Ubuntu, RHEL and Fedora; macOS and BSD differences get their own table. For the wider toolbox, see the Linux tools cheat sheet.
What to Show
| Flag | Long form | What it does |
|---|---|---|
-l | Long format: type, permissions, links, owner, group, size, time, name | |
-a | --all | Include hidden entries, including . and .. |
-A | --almost-all | Hidden entries, but without . and .. — usually what you want |
-h | --human-readable | Sizes as 4.0K, 12M, 1.3G (with -l or -s) |
-d | --directory | List the directory itself, not its contents |
-R | --recursive | Recurse into subdirectories |
-1 | One entry per line | |
-F | --classify | Append a type marker: / dir, * executable, @ symlink, | FIFO, = socket |
-p | Append / to directories only | |
-i | --inode | Show inode numbers — hard links share one |
-n | --numeric-uid-gid | Like -l, with numeric UID and GID instead of names |
-s | --size | Allocated size in blocks (disk usage, not file length) |
-Z | --context | SELinux security context (RHEL, Fedora) |
-L | --dereference | Show the target of symlinks instead of the link itself |
-I PATTERN | --ignore=PATTERN | Hide entries matching a shell glob |
$ ls -lhA /etc/ssh
$ ls -ld /var/log # permissions of the directory itself
$ ls -d */ # only directories in the current directory
$ ls -A | wc -l # count entries (ls prints one per line into a pipe)
$ ls -l -I '*.gz' /var/log # skip compressed rotations
$ ls -lZ /var/www/html # SELinux labels
Sorting
The default sort is alphabetical according to your locale. Every sort flag can be flipped with -r.
| Flag | Sorts by | Typical use |
|---|---|---|
-t | Modification time, newest first | ls -lt | head |
-tr | Modification time, oldest first | Newest file ends up next to your prompt |
-S | Size, largest first | ls -lhS |
-X | Extension | Group .conf, .log, .gz together |
-v | Natural version order | file2 before file10; kernel versions in order |
-U | No sorting — directory order | Fastest listing of huge directories |
--sort=WORD | none, size, time, version, extension | Readable form in scripts |
--group-directories-first | Directories before files | Pairs with any other sort |
# Ten largest files in a directory, human-readable
$ ls -lhS /var/log | head -n 11
# What changed most recently?
$ ls -lt /etc | head -n 6
# Version-aware sort
$ ls releases/
v1.10 v1.2 v1.9
$ ls -v releases/
v1.2 v1.9 v1.10
-S does not recurse — it sorts the entries of one directory, and a directory's own size is just its metadata block. For "what is using space" use du or the disk usage analyzer.
Huge directories — in a directory with millions of files, ls reads everything before it can sort. ls -U or -f skips sorting and starts printing right away.
Timestamps and Time Formats
A file has several timestamps, and ls -l shows only one of them — modification time — unless told otherwise. The same flag changes both which time is displayed and which time -t sorts by.
| Flag | Timestamp | Changes when |
|---|---|---|
| (default) | mtime — modification | File contents are written |
-c | ctime — status change | Contents, permissions, owner or link count change |
-u | atime — last access | File is read (subject to relatime and noatime) |
--time=birth | Creation time | File is created — needs coreutils 8.32+ and filesystem support |
| Option | Example output |
|---|---|
| (default) | Oct 2 09:12 (or Mar 14 2026 if older than six months) |
--time-style=long-iso | 2026-10-02 09:12 |
--time-style=full-iso | 2026-10-02 09:12:44.183452917 +0000 |
--full-time | Same as -l --time-style=full-iso |
--time-style=+%Y-%m-%d | 2026-10-02 (any date(1) format) |
# Which files had permissions or ownership changed recently?
$ ls -lct /etc | head
# Exact, sortable timestamps for a log or a ticket
$ ls -l --time-style=long-iso /var/backups
The six-month rule — files modified more than six months ago, or with a timestamp in the future, show the year instead of the time of day. That is why a column of times suddenly turns into years.
For one file, use stat — stat file prints access, modify, change and (where supported) birth times at full precision in one go.
Reading ls -l Output
$ ls -la /srv/app
total 24
drwxr-xr-x 4 deploy deploy 4096 Oct 2 09:12 .
drwxr-xr-x 4 root root 4096 Sep 14 11:03 ..
-rw------- 1 deploy deploy 220 Sep 14 11:03 .env
-rw-r-----+ 1 deploy www 1843 Oct 1 17:40 app.conf
lrwxrwxrwx 1 deploy deploy 12 Oct 2 09:10 current -> releases/v42
-rwsr-x--- 1 root deploy 8728 Aug 3 08:21 helper
drwxr-xr-x 12 deploy deploy 4096 Oct 2 09:10 releases
drwxrwsr-x 2 deploy www 4096 Oct 2 09:12 shared
| Column | Example | Meaning |
|---|---|---|
| 1st character | d, -, l | File type (see below) |
| Next 9 | rw-r----- | Permissions for owner, group, others |
| Trailing marker | + or . | + means an ACL is set; . means an SELinux context and no ACL |
| Link count | 12 | Hard links; for a directory, 2 plus its number of subdirectories |
| Owner, group | deploy www | Names, or numbers if the account no longer exists |
| Size | 1843 | Bytes (use -h); for symlinks, the length of the target path |
| Time | Oct 1 17:40 | mtime by default |
| Name | current -> releases/v42 | Symlinks show their target |
| Type | Meaning | Special bit | Meaning |
|---|---|---|---|
| - | Regular file | s in owner x | setuid, and executable |
| d | Directory | S in owner x | setuid, not executable — usually a mistake |
| l | Symbolic link | s in group x | setgid; on a directory, new files inherit the group |
| c / b | Character / block device | t in other x | Sticky: only owners can delete (like /tmp) |
| p / s | Named pipe / socket | T in other x | Sticky, not executable by others |
The total line — the first line, total 24, is the disk space used by the listed files in 1 KiB blocks (or human-readable with -h), not a file count.
Decode permissions quickly — paste a string like rwxr-s--- into the chmod calculator, or read the full model in our Linux file permissions guide.
See the ACL behind the + — getfacl app.conf shows the extra entries. ls only tells you that one exists.
Quoting, Colors and Aliases
Since coreutils 8.25, ls quotes names that contain spaces or special characters when writing to a terminal, so a file called my file shows as 'my file'. It is not part of the name; it is there so you can paste it back into a shell.
| Option | Effect |
|---|---|
-N | --literal: print names as they are, no quoting |
-Q | --quote-name: wrap every name in double quotes |
-b | --escape: C-style escapes for non-printable characters |
-q | Show non-printable characters as ? |
--quoting-style=WORD | literal, shell, shell-always, shell-escape, c, escape, locale |
--color=WHEN | auto (only on a terminal), always, never |
# Where does ll come from on this machine?
$ type ll
ll is aliased to `ls -alF' # Ubuntu/Debian ~/.bashrc
ll is aliased to `ls -l --color=auto' # RHEL/Fedora /etc/profile.d/colorls.sh
# Bypass an alias for one run
$ \ls
$ command ls
# Customise colors
$ dircolors -p > ~/.dircolors
$ eval "$(dircolors -b ~/.dircolors)"
--color=always in pipes — it embeds escape codes in the output, which breaks grep and awk downstream. auto is the right setting for aliases.
Useful aliases — alias lt='ls -lhtr' for newest-last and alias lsz='ls -lhS' for largest-first, cover most ad-hoc investigations.
GNU vs macOS, and When Not to Use ls
| Task | GNU / Linux | macOS / BSD |
|---|---|---|
| Color output | --color=auto | -G |
| Meaning of -G | Omit group in long listing | Enable color |
| Directories first | --group-directories-first | Not available |
| Full timestamp | --full-time | -lT |
| Extended attributes | getfattr / -Z for SELinux | -l@ |
| ACLs | + marker, then getfacl | -le |
| Install GNU ls | Already installed | brew install coreutils, then gls |
Do not parse ls output in scripts. File names can contain spaces, newlines and glob characters, and the format changes with locale, terminal and age of the file. Use globs, find or stat instead:
# Wrong: breaks on spaces and newlines in names
for f in $(ls *.log); do gzip "$f"; done
# Right: let the shell expand the glob
for f in ./*.log; do [ -e "$f" ] && gzip "$f"; done
# Size and name, machine-readable
$ stat -c '%s %n' /var/log/*.log
$ find /var/log -maxdepth 1 -name '*.log' -printf '%s\t%TY-%Tm-%Td\t%p\n'
# Newest file in a directory, safely
$ find /var/backups -maxdepth 1 -type f -printf '%T@ %p\n' | sort -n | tail -n 1
Recursive listings — ls -R is fine for a quick look; for anything you filter or act on, find is more precise. Our Linux commands reference covers both.
The [ -e ] check — if no file matches, an unquoted glob stays literal as ./*.log. The test skips that case without needing shell options like nullglob.
Frequently Asked Questions
How do I list files sorted by size in Linux?
Use ls -lhS to list the largest files first with human-readable sizes, or ls -lhSr for smallest first. This sorts the entries of a single directory only; to find what uses the most space across subdirectories, use du -sh * or a disk usage tool.
How do I show hidden files with ls?
ls -a shows all entries including . and .., and ls -A shows hidden files without those two. Combine with -l for details: ls -lA. Hidden files are simply names that start with a dot.
Why does ls show a year instead of a time for some files?
GNU ls shows the time of day only for files modified within the last six months. Older files, and files with timestamps in the future, show the year instead. Use --time-style=long-iso or --full-time to get a consistent format.
What does the + or . after the permissions in ls -l mean?
A + means the file has an access control list beyond the normal permission bits; inspect it with getfacl. A . means the file has an SELinux security context and no ACL; view it with ls -Z.
Why does ls put quotes around some file names?
Since coreutils 8.25, ls quotes names containing spaces or special characters when the output is a terminal, so they can be pasted back into a shell safely. The quotes are not part of the name. Use ls -N or --quoting-style=literal to turn them off.