Find file today linux

How to use ‘find’ to search for files created on a specific date? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

9 Answers 9

As pointed out by Max, you can’t, but checking files modified or accessed is not all that hard. I wrote a tutorial about this, as late as today. The essence of which is to use -newerXY and ! -newerXY :

Example: To find all files modified on the 7th of June, 2007:

$ find . -type f -newermt 2007-06-07 ! -newermt 2007-06-08 

To find all files accessed on the 29th of september, 2008:

$ find . -type f -newerat 2008-09-29 ! -newerat 2008-09-30 

Or, files which had their permission changed on the same day:

$ find . -type f -newerct 2008-09-29 ! -newerct 2008-09-30 

If you don’t change permissions on the file, ‘c’ would normally correspond to the creation date, though.

My version of find (GNU 4.2.32) doesn’t seem to support the -newerXY predicates. Is there a particular minimum version needed? Or is it a case of compiling find with a special configure switch?

@yukondude: You’re right. The version of find I have locally — GNU 4.4.0 — has it, while 4.1.20 that I have on Dreamhost doesn’t. The kludge with creating two files should work in either, though.

Note that the -newerxt is available on FreeBSD since 2001 (where it was first provided as a patch in 1998), a few other BSDs and GNU find (since 4.3.3 in 2007), based on HP/UX find, which introduced -newerXY (but where Y == t is not supported).

Note that the exclamation point may need to be escaped ( \! ) if you have Bash history substitution enabled (which is the default). Or you can disable it with set +H .

Use this command to search for files and folders on /home/ add a time period of time according to your needs:

find /home/ -ctime time_period 

Examples of time_period:

• More than 30 days ago: -ctime +30
• Less than 30 days ago: -ctime -30
• Exactly 30 days ago: -ctime 30

It’s two steps but I like to do it this way:

First create a file with a particular date/time. In this case, the file is 2008-10-01 at midnight

Now we can find all files that are newer or older than the above file (going by file modified date).
You can also use -anewer for accessed and -cnewer file status changed.

find / -newer /tmp/t find / -not -newer /tmp/t 

You could also look at files between certain dates by creating two files with touch

touch -t 0810010000 /tmp/t1 touch -t 0810011000 /tmp/t2 

This will find files between the two dates & times

find / -newer /tmp/t1 -and -not -newer /tmp/t2 

IMO, right now this should be the accepted solution. I couldn’t get -newermt to run on 2.6.18-348.18.1.el5 kernel, let alone newer kernels.

find ./ -type f -ls |grep '10 Sep' 

[root@pbx etc]# find /var/ -type f -ls | grep "Dec 24" 791235 4 -rw-r--r-- 1 root root 29 Dec 24 03:24 /var/lib/prelink/full 798227 288 -rw-r--r-- 1 root root 292323 Dec 24 23:53 /var/log/sa/sar24 797244 320 -rw-r--r-- 1 root root 321300 Dec 24 23:50 /var/log/sa/sa24 

mywiki.wooledge.org/ParsingLs — a better approach is probably to print the creation date in machine-readable form, perhaps with stat if you don’t have find -printf .

Regarding «million files» use find ./ -type f -mtime -60 -ls | grep ’10 Sep’ if this date is inside the last 60 days.

You can’t. The -c switch tells you when the permissions were last changed, -a tests the most recent access time, and -m tests the modification time. The filesystem used by most flavors of Linux (ext3) doesn’t support a «creation time» record. Sorry!

In fact, it’s not just the filesystem type — there is no system interface for obtaining such information, even if the filesystem held it. One of the deficiencies of Unix going back to the earliest days, which is why Unix will never take off.

@Max: is right about the creation time.

However, if you want to calculate the elapsed days argument for one of the -atime , -ctime , -mtime parameters, you can use the following expression

ELAPSED_DAYS=$(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) 

Replace «2008-09-24» with whatever date you want and ELAPSED_DAYS will be set to the number of days between then and today. (Update: subtract one from the result to align with find ‘s date rounding.)

So, to find any file modified on September 24th, 2008, the command would be:

find . -type f -mtime $(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) 

This will work if your version of find doesn’t support the -newerXY predicates mentioned in @Arve:’s answer.

Источник

How to Find Recent or Today’s Modified Files in Linux

In this article, we will explain two, simple command line tips that enable you to only list all today’s files.

One of the common problems Linux users encounter on the command line is locating files with a particular name, it can be much easier when you actually know the filename.

However, assuming that you have forgotten the name of a file that you created (in your home folder which contains hundreds of files) at an earlier time during the day and yet you need to use urgently.

Below are different ways of only listing all files that you created or modified (directly or indirectly) today.

1. Using the ls command, you can only list today’s files in your home folder as follows, where:

1. -a – list all files including hidden files
2. -l – enables long listing format
3. —time-style=FORMAT – shows time in the specified FORMAT
4. +%D – show/use date in %m/%d/%y format

# ls -al --time-style=+%D | grep 'date +%D'

In addition, you can sort the resultant list alphabetically by including the -X flag:

# ls -alX --time-style=+%D | grep 'date +%D'

You can also list based on size (largest first) using the -S flag:

# ls -alS --time-style=+%D | grep 'date +%D'

2. Again, it is possible to use the find command which is practically more flexible and offers plenty of options than ls, for the same purpose as below.

1. -maxdepth level is used to specify the level (in terms of sub-directories) below the starting point (current directory in this case) to which the search operation will be carried out.
2. -newerXY , this works if timestamp X of the file in question is newer than timestamp Y of the file reference. X and Y represent any of the letters below:
   1. a – access time of the file reference
   2. B – birth time of the file reference
   3. c – inode status change time of reference
   4. m – modification time of the file reference
   5. t – reference is interpreted directly as a time

   This means that, only files modified on 2016-12-06 will be considered:

   # find . -maxdepth 1 -newermt "2016-12-06"

   

   Important: Use the correct date format as reference in the find command above, once you use a wrong format, you will get an error as the one below:

   # find . -maxdepth 1 -newermt "12-06-2016" find: I cannot figure out how to interpret '12-06-2016' as a date or time 

   Alternatively, use the correct formats below:

   # find . -maxdepth 1 -newermt "12/06/2016" OR # find . -maxdepth 1 -newermt "12/06/16"

   

   You can get more usage information for ls and find commands in our following series of articles on same.

   In this article, we explained two important tips of how to list only today’s files with the help of ls and find commands. Make use of the feedback form below to send us any question(s) or comments about the topic. You can as well inform us of any commands used for the same goal.

   Источник

   How to Find Files Based on Timestamp in Linux

   The find command in Linux is used to search for files and folders based on different parameters. These parameters can be the filename, size, type of file, etc.

   One such parameter is the timestamp of the file. In Linux (and all Unix based file systems) there are 3 timestamps maintained for every file:

   1. Last Modification Time
   2. Last Access Time
   3. Last Status Change Time (i.e., when metadata of the file like permissions are changed)

   Let’s see how to use find to search for files based on each of these timestamps.

   Find File Timestamps in Linux

   First of all, we can run the ‘stat‘ command in Linux to get all these timestamps for a file. For example for a file with the name ‘stat‘, run:

   

   Find Files Based on Timestamp

   Now, to find files based on the timestamp, we use the argument ‘-newerXY’ of find from the man page.

   

   Thus in the argument ‘-newerXY’ , we can have X as a, c, or m, respectively for last access, last status change, and last modification times, and Y as t, so that we can have the next argument to be a timestamp string.

   Note: The birth time, i.e. creation time of a file is not maintained in Unix based file systems

   To generalize, the command to be run looks like this:

   Here, the format of the timestamp should be: ‘YYYY-MM-DD HH:MM:SS’.

   Let’s try this on a folder with few files and only two files having accessed, modified and status changed after a specified time.

   find . -newerat ‘2021-02-19 06:34’ find . -newerct ‘2021-02-19 06:34’ find . -newermt ‘2021-02-19 06:34’

   

   Verify with ‘stat’ if the timestamps of both files are indeed greater than the specified time.

   

   Conclusion

   We have learned how to use the ‘-newerXY’ the argument of command find to search for files based on timestamp.

   Note that you can also use another file for a reference timestamp instead of explicitly specifying the timestamp, in which case the ‘t’ from the argument can be skipped.

   Thanks a lot for reading and let us know your thoughts in the comments below!

   Источник

   How do I find a recent file by date created?

   However, because app is such a generic name, many results show up. I would like to find a directory named app, which was created today. Is there a flag or command to achieve this?

   *nix file systems don’t record the file creation/birth time and GNU find(1) doesn’t offer to search by birth time. That’s why all answers are and will be about (status) modification time.

   @ThomasWeller: The manual says, “ -ctime n : File’s status was last changed […]” (emphasis added). Nothing about file creation time.

   @DavidFoerster: thanks. So we have -mtime for modified and -ctime for changed. That sounds really great and absolutely not confusing. Well, not your fault.

   @ThomasWeller: Yeah, having -smtime or something alike for file status modification time would be more intuitive.

   4 Answers 4

   To search the whole filesystem ( / ) for

   • directories ( -type d ),
   • called app ( -name app ),
   • that were modified more recently than one day (i.e., 24 hours) ago ( -mtime 0 ),

   find / -name app -type d -mtime 0 

   In particular see the explanation of the -mtime flag and the » find $HOME -mtime 0 » example:

   [T]o match -mtime 0, a file will have to have a modification in the past which is less than 24 hours ago.

   (Thus the time in days since the file was modified is rounded down to the nearest integer for purposes of being matched by -mtime .)

   Creation is considered a form of modification for the purpose of file timestamps, so this will work even if the file’s contents weren’t altered after it was created. It will also match folders with modification timestamps in the last day that were created earlier, but you probably don’t have many such folders whose exact name is app .

   When a file was created is not typically stored in the filesystem. But the time at which its metadata were last changed (e.g., name/location, ownership, permissions) is stored. If you prefer to go by that to when the file’s contents were modified, use -ctime in place of -mtime :

   find / -name app -type d -ctime 0 

   For both -mtime and -ctime , the original creation of the file qualifies as a modification / status change.

   Источник