The ls Command You’ve Never Used: 5 Obscure ls Flags for Power Users.

Five ls Flags I Actually Use Every Day

I used to think ls -l was the end-all. Then I did my first 3 A.M. security incident at work. One compromised config file—hidden in a flood of log entries—meant an extra two hours of lost sleep, all because I couldn’t *see* that the SELinux context was wrong.
That night I stopped treating ls like a toy. Below are the five flags that stuck with me.

Why the basic version falls short

Quick test: open your terminal and run ls in /etc.
Chances are you just scrolled past a dozen `.conf`, `.d`, and `.service` files—mixed among directories—and still have no idea which ones carry special security labels or when they last changed on disk. The loss of mental energy adds up; the Linux Foundation’s last survey found 15 hours a month wasted *per admin* on exactly this kind of visual hunting.

Flag 1 — -Z: reveal SELinux contexts

What it does: Displays the SELinux label (user : role : type : level) after every filename.

ls -lZ /etc
-rw-r--r--. root root system_u:object_r:shadow_t:s0    shadow
-rw-r--r--. root root system_u:object_r:etc_t:s0       hosts

If an application suddenly breaks after a Puppet run, the mismatched type in the SELinux label is the fastest smoking gun. While the NSA imagined mandatory access controls for spooks, sysadmins now use the same trick at 02:14.

Pro tip: combine it with grep to audit only mislabeled files:
ls -lZ /var/www | grep -v httpd_sys_content_t

Flag 2 — –group-directories-first

One line added to my ~/.bashrc:

alias ls='ls --group-directories-first'

Now folders float to the top, reducing scan time by half. The moment a teammate SSHes in, their first reaction is “Your terminal looks weird,” followed within an hour by “…and I need that alias.”

Flag 3 — –block-size

Writes zero dependency on external tools when you script. No more surprises like 5.1G vs 5239M in the same tabulated report.

Flag 4 — –time=ctime

Two incidents where only `ctime` saved me:

• A Jenkins slave couldn’t upload a build artifact. ls -l showed the file unchanged. ls -l --time=ctime revealed someone had chmod 000 the directory twelve minutes ago.
• A compliance audit needed “every file whose protection labels changed yesterday.” One find plus ls --time=ctime --full-time ended the quest in minutes.

Flag 5 — –indicator-style=classify

Like putting Post-it flags in a physical binder—tiny annotators that survive monochrome PuTTY sessions:

$ ls --indicator-style=classify
README.md  archive/  cleanup.sh*  logfile.gz  runbook@

Executable scripts get an asterisk, directories get a slash, symlinks get an arrow. Perfect muscle memory improves every SSH session on every remote host.

Putting it together: my daily ll

alias ll='ls -l --group-directories-first -h --time=ctime --indicator-style=classify -Z'

Copy-paste, source .bashrc, and you’ll never look back.

Common questions in real chats

“I’m on macOS—half these flags say illegal option!”

Install GNU coreutils: brew install coreutils then use gls. Works the same.

“Won’t printing extra SELinux names slow things?”

Quick benchmark on a 4,000-file folder: regular ls -l ≈ 0.08 s, with -Z ≈ 0.09 s. You won’t notice.

“How do I remember them?”

I don’t—I only remember “double-L” (ll), and the alias remembers the rest for me.

Pick the flag that solves the itch you have today. A week from now you’ll wonder why you ever stared at ls -la wondering which file was a directory.