Softpanorama (slightly skeptical) Open Source Software Educational Society

May the source be with you, but remember the KISS principle ;-) Softpanorama Search

Unix find tutorial

Prev | Contents | Next

Part 4: Selecting files using their age

Find permits selection of files based on Unix mtime, ctime, and atime attributes.  The standard unit is 24 hour periods (a day). GNU find also permits using minutes for the period, for example:

find / -mmin -10

Standard predicates that work with age of the file in file are : "-atime/-ctime/-mtime" [+|-]n and they use  24 hour periods (a day).  Each compares with value provided with the Unix timestamps: the last time a files's "access time", "file change time, to be more exact, the inode change time" and "content modification time".

n is time interval -- an integer with optional sign. It is measured in 24-hour periods (days) or minutes counted from the current moment.

• n: If the integer n does not have sign this means exactly n 24-hour periods (days) ago, 0 means today.
  
• +n: if it has plus sing, then it means "more then n 24-hour periods (days) ago", or older then n,
  
• -n: if it has the minus sign, then it means less than n 24-hour periods (days) ago (-n), or younger then n. It's evident that -1 and 0 are the same and both means "today".

Examples:

• Find everything in your home directory modified in the last 24 hours:

  find $HOME -mtime -1

• Find everything in your home directory modified in the last seven 24-hour periods (days):

  find $HOME -mtime -7

• Find everything in your home directory that have NOT been modified in the last year:

  find $HOME -mtime +365
  

• To find html files that have been modified in the last seven 24-hour periods (days), I can use -mtime with the argument -7 (include the hyphen):

  find . -mtime -7 -name "*.html" -print

  Note: If you use the number 7 (without a hyphen), find will match only html files that were modified exactly seven 24-hour periods (days) ago:

  find . -mtime 7 -name "*.html" -print

• To find those html files that were not touched for at least seven 24-hour periods (days),  use +7:

  find . -mtime +7 -name "*.html" -print

Unix keeps track of three timestamps. Of them atime is the simplest the non-controversial: it stands for access time which is when the file was last read.

It is important to understand the precise meaning of  ctime and mtime timestamps.  The most common misconception here is to view  ctime as file "creation time". It is actually "change time". Here are more formal explanations: 

• ctime is the inode change time. When does the inode change, when you of course update a file, but also when you do things like changing the permissions of the file but not necessarily its contents. It would ne better to call this attribute change time as it indicates the last time a file’s metadata (inode) was changed.  ctime  changes when you change file's ownership or access permissions. As the man page for stat explains: “The field st_ctime is changed by writing or by setting inode information (i.e., owner, group, link count, mode, etc.).”
   
• mtime: is the "content modification time", so if you change the contents of the file, this timestamp is updated. Changes of name, ownership and permissions does not affect it 

For a given file ctime and mtime can be different depending on if you just modified the inode or the contents of the file (which updates ctime as well). Commands like chown, chmod, and ln change only ctime.  Touch command change only mtime. For example if you need to change the date to Jun 21, 2008 9AM to example.txt, then you can go (-t parameter in touch has format [[CC]YY]MMDDhhmm[.SS]):

    touch -t 200907210900 example.txt

The second important thing to understand that unless -daystart option is used [Gnu find only], time in Unix find is measured in 24 hour periods (fractions are allowed in GNU find) from the current moment.

Those 24 hours periods are usually called "days" but the definition of "days" used in find is different from common usage  (calendar days are typically understood as 24 hour periods starting at midnight). The "day" in "find language" is interpreted as "24 hour periods starting from the current time". Here is how working with time ranges described in GNU find documentation  (Finding Files)

2.3.1 Age Ranges

These tests are mainly useful with ranges (‘+n’ and ‘-n’).

— Test: -atime n
— Test: -ctime n
— Test: -mtime n

True if the file was last accessed (or its status changed, or it was modified) n*24 hours ago. The number of 24-hour periods since the file's timestamp is always rounded down; therefore 0 means “less than 24 hours ago”, 1 means “between 24 and 48 hours ago”, and so forth. Fractional values are supported but this only really makes sense for the case where ranges (‘+n’ and ‘-n’) are used.

— Test: -amin n
— Test: -cmin n
— Test: -mmin n

True if the file was last accessed (or its status changed, or it was modified) n minutes ago. These tests provide finer granularity of measurement than ‘-atime’ et al., but rounding is done in a similar way (again, fractions are supported). For example, to list files in /u/bill that were last read from 2 to 6 minutes ago:

          find /u/bill -amin +2 -amin -6

— Option: -daystart

Measure times from the beginning of today rather than from 24 hours ago. So, to list the regular files in your home directory that were modified yesterday, do

          find ~/ -daystart -type f -mtime 1

The ‘-daystart’ option is unlike most other options in that it has an effect on the way that other tests are performed. The affected tests are ‘-amin’, ‘-cmin’, ‘-mmin’, ‘-atime’, ‘-ctime’ and ‘-mtime’. The ‘-daystart’ option only affects the behavior of any tests which appear after it on the command line.

---

Previous: Age Ranges, Up: Time

2.3.2 Comparing Timestamps

— Test: -newerXY reference
 

Succeeds if timestamp ‘X’ of the file being considered is newer than timestamp ‘Y’ of the file reference. The letters ‘X’ and ‘Y’ can be any of the following letters:

‘a’

Last-access time of reference
 

‘B’

Birth time of reference (when this is not known, the test cannot succeed)
 

‘c’

Last-change time of reference
 

‘m’

Last-modification time of reference
 

‘t’

The reference argument is interpreted as a literal time, rather than the name of a file. See Date input formats, for a description of how the timestamp is understood. Tests of the form ‘-newerXt’ are valid but tests of the form ‘-newertY’ are not.

For example the test -newerac /tmp/foo succeeds for all files which have been accessed more recently than /tmp/foo was changed. Here ‘X’ is ‘a’ and ‘Y’ is ‘c’.

Not all files have a known birth time. If ‘Y’ is ‘b’ and the birth time of reference is not available, find exits with an explanatory error message. If ‘X’ is ‘b’ and we do not know the birth time the file currently being considered, the test simply fails (that is, it behaves like -false does).

Some operating systems (for example, most implementations of Unix) do not support file birth times. Some others, for example NetBSD-3.1, do. Even on operating systems which support file birth times, the information may not be available for specific files. For example, under NetBSD, file birth times are supported on UFS2 file systems, but not UFS1 file systems.

There are two ways to list files in /usr modified after February 1 of the current year. One uses ‘-newermt’:

     find /usr -newermt "Feb 1"

The other way of doing this works on the versions of find before 4.3.3:

     touch -t 02010000 /tmp/stamp$$
     find /usr -newer /tmp/stamp$$
     rm -f /tmp/stamp$$

— Test: -anewer file
— Test: -cnewer file
— Test: -newer file

True if the file was last accessed (or its status changed, or it was modified) more recently than file was modified. These tests are affected by ‘-follow’ only if ‘-follow’ comes before them on the command line. See Symbolic Links, for more information on ‘-follow’. As an example, to list any files modified since /bin/sh was last modified:

          find . -newer /bin/sh

— Test: -used n

True if the file was last accessed n days after its status was last changed. Useful for finding files that are not being used, and could perhaps be archived or removed to save disk space.

Expressions can be use to select files created or modified during contain intervals, for example files that are at least one week old (7 days) but less then 30 days old. You can combine the predicates like this:

	find . -mtime +30 -a -mtime -7 -print0

Note: If you use parameters with find command in scripts be careful when -mtime parameter is equal zero ( -mtime +0 ). Earlier versions of GNU find incorrectly interpret the following expression:

find -mtime +0 -mtime -1

find  -mtime -1

Prev | Contents | Next