Help finding what is causing atime updates of shell rc files

We are trying to run a script to detect when a user last made any changes to a file in his/her directory and using atime. We keep finding many users get their .tcshrc or .cshrc files timestamp updated. We do run rsnapshot/rsync every day but those SHOULD be ignoring updating the atime. Does ‘[noatime](https://www.howtoforge.com/reducing-disk-io-by-mounting-partitions-with-noatime)’ need to be set in /etc/fstab as well? I’searched the the system and cron logs, can’t find anything that would do this but clearly something is.

file /u/host/ouruser/.tcshrc time=1579022575=5.88 days
file /u/host/ouruser/.cshrc time=1579022575=5.88 days
[root@ourserver ~]#  ls -lut /u/host/ouruser/.tcshrc
-rw-r--r-- 1 fred staff 568 Jan 14 12:22 /u/host/ouruser/.tcshrc
[root@ourserver ~]#  ls -lut /u/host/ouruser/.c
.cache/      .config/     .cshrc       .cshrc-hold
[root@ourserver ~]#  ls -lut /u/host/ouruser/.c
.cache/      .config/     .cshrc       .cshrc-hold
[root@ourserver ~]#  ls -lut /u/host/ouruser/.cshrc
-rw-r--r-- 1 ouruser staff 6219 Jan 14 12:22 /u/host/ouruser/.cshrc
1 Like

relatime is default:

$ mount | grep -v relatime
devtmpfs on /dev type devtmpfs (rw,nosuid,seclabel,size=1897052k,nr_inodes=474263,mode=755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,seclabel)
tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,mode=755)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,seclabel)

And this is what could be causing the modified atime’s on the shell files?

Atime.
Access Time stamp.

In the past, every time someone accessed file, its atime was updated.
relatime do this less frequently.
relatime is the default because it is not break some apps that still can be broken by noatime.