What is the meaning of each field with the output of `stat` on OSX?

Question

$ stat Cargo.toml
16777220 9094681422 -rw-r--r-- 1 tonytonyjan staff 0 109 "Jan 19 10:05:13 2019" "Dec 31 17:52:29 2018" "Dec 31 17:52:29 2018" "Dec 14 16:32:26 2018" 4096 8 0 Cargo.toml

man stat does not explain but mention that the output is obtained by lstat:

The information displayed is obtained by calling lstat(2) with the given argument and evaluating the returned structure.

After man lstat, it gives a C structure which looks like what I am looking for:

The buf argument is a pointer to a stat structure as defined by <sys/stat.h> and into which information is placed concerning the file.  When the macro
     _DARWIN_FEATURE_64_BIT_INODE is not defined (see below for more information about this macro), the stat structure is defined as:

     struct stat { /* when _DARWIN_FEATURE_64_BIT_INODE is NOT defined */
         dev_t    st_dev;    /* device inode resides on */
         ino_t    st_ino;    /* inode's number */
         mode_t   st_mode;   /* inode protection mode */
         nlink_t  st_nlink;  /* number of hard links to the file */
         uid_t    st_uid;    /* user-id of owner */
         gid_t    st_gid;    /* group-id of owner */
         dev_t    st_rdev;   /* device type, for special file inode */
         struct timespec st_atimespec;  /* time of last access */
         struct timespec st_mtimespec;  /* time of last data modification */
         struct timespec st_ctimespec;  /* time of last file status change */
         off_t    st_size;   /* file size, in bytes */
         quad_t   st_blocks; /* blocks allocated for file */
         u_long   st_blksize;/* optimal file sys I/O ops blocksize */
         u_long   st_flags;  /* user defined flags for file */
         u_long   st_gen;    /* file generation number */
     };

Unfortunately, I still cannot map each field to the output of stat, for example:

$ stat Cargo.toml
16777220 9094681422 -rw-r--r-- 1 tonytonyjan staff 0 109 "Jan 19 10:05:13 2019" "Dec 31 17:52:29 2018" "Dec 31 17:52:29 2018" "Dec 14 16:32:26 2018" 4096 8 0 Cargo.toml

• 16777220 - device inode resides on
• 9094681422 - inode
• -rw-r--r-- - protection mode
• 1 - number of hard links
• tonytonyjan - user
• staff - group
• 0 - Not sure. Is it device type?
• 109 - size
• "Jan 19 10:05:13 2019" - last access
• "Dec 31 17:52:29 2018" - last modification
• "Dec 31 17:52:29 2018" - last file statu change
• "Dec 14 16:32:26 2018" - There should have been only 3 timestamps, what is this?
• 4096 - file size in bytes
• 8 - blocks allocated for file
• 0 - optimal file sys I/O ops blocksize? user defined flags? or file generation number?
• Cargo.toml - filename

My questions:

1. Does the first 0 stand for st_rdev?
2. What is the difference between st_dev and st_rdev?
3. What does the seconds 0 stand for?
4. Manybe I did not find the correct man page (neither man stat nor man lstat). Is there any official documentation which explan each stat field in detail? Where can I find it?

Answer 1

Use stat -s. It prints the fields in the same order, but with labels (and omitting the filename):

:; stat -s /etc/man.conf | fmt
st_dev=16777220 st_ino=641593 st_mode=0100644 st_nlink=1 st_uid=0
st_gid=0 st_rdev=0 st_size=4574 st_atime=1547885737 st_mtime=1500152545
st_ctime=1512806119 st_birthtime=1500152545 st_blksize=4194304
st_blocks=0 st_flags=32

Your first mystery field is st_rdev, the “device type, for special file inode”. Since we're not statting a device file, this is zero.

Your second mystery field is st_birthtimespec, the “time of file creation(birth)” (see the stat(2) man page). This is a Darwin 64-bit extension.

Your 4096 is not the file size in bytes. It is st_blksize, “optimal blocksize for I/O”. In my example, it is 4194304. Perhaps your file is on an HFS+ filesystem. Mine is on an APFS filesystem.

Your third mystery field is st_flags, “user defined flags for file”. Yours is zero, so no flags set. My example (/etc/man.conf) has UF_COMPRESSED set.

What is the difference between st_dev and st_rdev?

The st_dev field refers to the device (hard drive/partition/whatever) containing the file. The st_rdev field, for device files, tells the kernel what device the file itself represents. Try running stat on some device files in /dev, like /dev/null and /dev/rdisk0 to see non-zero st_rdev values.

Manybe I did not find the correct man page (neither man stat nor man lstat). Is there any official documentation which explan each stat field in detail? Where can I find it?

Use man 1 stat to learn about the flags to the command-line stat program, like the -s flag I used. Then use man 2 stat, and your favorite search engine, to learn what the fields mean.