date
the time, in any formatdate prints the system clock. With a format string after a plus sign it produces a date in exactly the shape you want — used constantly to name backups and log files.
date +%F gives 2026-09-30: the form that sorts correctly and belongs in file names.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
Day, date, time, time zone and year, in the system’s local time.
%F is year-month-day and %T is hours:minutes:seconds. Everything after the + is the template.
Five and a half hours behind Indian time. Logs from machines in different zones are compared in UTC.
Many logs record time as seconds since 1970. -d @number turns one back into a readable date.
Switches
A switch changes how the command behaves. These are the ones used day to day; man date lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
+FORMAT- Print using a format: %F is the date, %T the time, %s the timestamp.
-u- Use UTC instead of local time.
-d STRING- Show the time described, such as "yesterday" or "@1790745127".
-I- ISO 8601 format: 2026-09-30.
-R- RFC 5322 format, as used in email headers.
-s STRING- Set the system clock. Needs root.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
date +%sPrints the current time as a Unix timestamp.
tar -czf backup-$(date +%F).tar.gz site/Puts today’s date in a file name.
date -d "next friday"Works out a date described in words.
timedatectlShows the time zone and whether the clock is synchronised by NTP.
In cybersecurity
Security depends on machines agreeing what time it is.
TLS certificates look expired or not yet valid, Kerberos logins fail, and one-time codes are rejected when the clock has drifted.
Tracing an incident across several machines needs their timestamps to line up. Keep NTP running and prefer UTC on servers.
Changing the time needs root, because moving it backwards can hide activity or revive an expired credential.