Find files that have changed linux

List of Recently Modified Files

How can I Get a list of all files modified , say 3 months ago. I checked this question but I was not able to apply it to my scenario. I am trying this now , it seems to be working , but I know there should be a better way using find.

ls -ltR | grep -v '2011-05' | grep -v '2011-06' | grep -v '2011-07' | grep -v '2011-08 

4 Answers 4

One solution is: find . -type f -mtime 90

That finds files that was last modified 90 days ago (in those 24 hours that started 91 x 24 hours ago and ended 90 x 24 hours ago).

find . -type f -mtime -90 finds files that were modified in the last 90 days (or in the future).

find . -type f -mtime +90 finds files that were modified at least 91 days ago (at least in POSIX compliant find implementations).

As @hknik says, the -mtime operation on find is likely your best bet, but if you want to get all files around three months ago, then you need a bigger net:

find . -type f -mtime -105 -mtime +76 

This will find the regular files in the month surrounding three months ago, between 11 and 15 weeks ago.

(note the 76 instead of 7 x 11 = 77, as you want files whose age rounded down to an integer number of days is strictly greater than 76 to get files that are at least 77 days (11 weeks) old).

will list files modified 90 days ago (in those 24 hours that started 91 x 24 hours ago and ended 90 x 24 hours ago like with POSIX find -mtime 90 ).

will list files modified in the last 90 days (or in the future),

will list files modified between 91 and 100 days ago.

You can use «3 months ago» directly with the «newerXY» syntax:

 find . -maxdepth 2 -xdev -type f -newermt '3 months ago' 

(I added maxdepth and xdev to limit the search)

With these relative dates minutes, hours, days, weeks and months can be used.

«m» stands for modification time, «t» means direct time (and not the date of a reference file).

Or by combining two absolute dates to choose a time span; here from Jan 1 to Jan 15:

#] find . -maxdepth 2 -newermt 'Jan 1' ! -newermt 'Jan 15' -ls 415640 4 -rw-r--r-- 1 root root 2190 Jan 8 15:14 ./df.man 412465 4 -rw-r--r-- 1 root root 98 Jan 1 2020 ./ranfunc 412282 4 -rw------- 1 root root 23 Jan 13 16:53 ./.python_history 406542 0 lrwxrwxrwx 1 root root 56 Jan 8 19:46 ./.fvwm/.BGdefault -> /usr/share/fvwm/default-config/images/background/bg3.png 417900 28 -rw-r--r-- 1 root root 25990 Jan 3 09:48 ./xterm.2020.01.03.09.48.03.xhtml 

Источник

How to Find Last Modified Files in Linux?

This tutorial explains how to find last modified files in Linux using different commands and according to custom needs.

After reading this tutorial you’ll know how to execute the following tasks:

• How to find files modified in a specific day range
• How to find last modified specific file type (e.g mp4, png)
• Finding files modified before / after X minutes
• How to find files modified in a specific date
• Finding modified files recursively
• Search omitting files or directories
• Find files by access date

Finding last day modified files in Linux:

To start, let’s search files modified less than a day ago. To find files modified a day ago you can use the commands find and newermt used in the following example.

The find command is used to search files. The newermt command compares files timestamp with the argument passed, in this case “1 day ago”. Then, the ls command is passed to list the files.

To find last day modified files, you can also use the mtime command together with find. By specifying the option 0 as in the example below, mtime will return all files modified in the last 24 hours.

Find Last Modified Specific File Type in Linux:

You can use a wildcard to limit your search to a specific file type. In the following example, find and newermt are instructed to list all mp4 files modified a day ago.

cc lang=”bash” width=”100%” height=”100%” escaped=”true” theme=”blackboard”]$ find /home/linuxhint/*.mp4 -newermt “1 day ago” -ls[/cc

In the following example, find and newermt are used to find all .png images less than 15 days old.

Finding Last Hour Modified Files in Linux:

The following example combines the find command with the mmin command. We can use the mmin command to specify minutes. In the example below, the find and mmin commands will print all files under the /root directory, whose modifications are less than 60 minutes old.

Contrary to the previous example in which files modified in the past 60 minutes were found. You can also use +mmin to search files modified after X minutes. For example, the following command will show files modified 60 minutes ago or more.

Finding Files Modified on a Specific Date in Linux:

You can use the ls command to list files including their modification date by adding the -lt flag as shown in the example below. The flag -l is used to format the output as a log. The flag -t is used to list last modified files, newer first.

Then you can combine ls -lt with grep to print all files which were modified on a specific date.

Find Last Modified Files Recursively:

Previous examples are useful to find last modified files

The command below can be used to print last modified files recursively.

Search File by Date Omitting Files or Directories:

Contrary to the previous example, you can search files omitting directories. For this purpose, you need to implement the -type flag with the option f (file) as shown in the following example. As a result, you’ll see only final files and no directories.

You can also search directories only and the output will omit files. For this, just replace the f with a d after the -type flag.

Find Files by Access Date:

You also may want to find unmodified files by access date. For this purpose, you can use the atime command. It is similar to the mtime command explained before, but instead of identifying files by modification, it can display files by access. With this command you can learn the last accessed files and directories in the system.

The following command shows all files accessed in the past 10 days.

Like the previous command, you can also use the d option to show only directories:

If you don’t specify a type, atime will show all files and directories:

In the following example, find and atime are used to find files and directories with modification older than 20 days.

As with previous examples, you can also limit the listing to files or directories with the -type flag.

Conclusion:

As you can see, Linux offers different methods to find files according to modification time. Any Linux user level can easily learn those methods to search files with a single command. Finding files by modification or access within a system is part of the basic knowledge a Linux user needs.

I hope this tutorial was useful. Keep following Linux Hint for more Linux tips and tutorials.

About the author

David Adams

David Adams is a System Admin and writer that is focused on open source technologies, security software, and computer systems.

Источник

How to find files that change?

Question How do I get the file names of the files that have changed? In this case a.txt have been deleted, d.txt have been added, and b.txt have changed md5sum.

#!/bin/bash mkdir -p FFF touch FFF/a.txt rm -f FFF/b.txt touch FFF/b.txt touch FFF/c.txt rm -f FFF/d.txt echo "before" find FFF -name "*.txt" -exec md5sum '<>' \; echo "" # makes some changes that I want to catch rm -f FFF/a.txt echo "test" > FFF/b.txt touch FFF/d.txt echo "after" find FFF -name "*.txt" -exec md5sum '<>' \; 

You will have to maintain the set of files available in an array like structure before you begin processing. Maintain file list «after» and then you will have to implement and algorithm to check between these two arrays — may be easier in perl than shell script.

@ring bearer is right. This would be hard to code and hard to maintain in shell-script, but very easy in Perl or Python.

5 Answers 5

There are several options to find that will find files that have changed since a given point in time. For example, you could touch a temporary file at the start of the script, then run find -newer tmpfile to find all files that have been modified since you touch ed that temporary file.

This wouldn’t show files that have been deleted, would it? Anyway, +1 for pointing out the -newer flag.

Identifying files that have changed between particular states by their hashes (and presence in the directory structure) is essentially what the version control system git does anyway, so why not just use that? Here’s a slight modification of your script, which adds the following steps:

1. A first step to initialize the current directory as a git repository.
2. After the first set of files are created, it creates a commit from the current state of the directory.
3. After the subsequent set of modifications, it creates a second commit to record the modified state of the directory.
4. Finally, uses git diff to show the changes between those two commits.

The modified script looks like:

#!/bin/bash # Initialize the current directory as a git repository: git init mkdir -p FFF touch FFF/a.txt rm -f FFF/b.txt touch FFF/b.txt touch FFF/c.txt rm -f FFF/d.txt echo "before" find FFF -name "*.txt" -exec md5sum '<>' \; echo "" # Record the state of the directory as a new commit: git add -A . git commit -m "Initial state" # makes some changes that I want to catch rm -f FFF/a.txt echo "test" > FFF/b.txt touch FFF/d.txt echo "after" find FFF -name "*.txt" -exec md5sum '<>' \; # Record the modified state of the directory as a second commit: git add -A . git commit -m "New state" # Output the difference between those two commits: git diff --name-only HEAD^ HEAD 

The output from that script is then:

Initialized empty Git repository in /home/mark/tmp/foobar/.git/ before d41d8cd98f00b204e9800998ecf8427e FFF/b.txt d41d8cd98f00b204e9800998ecf8427e FFF/c.txt d41d8cd98f00b204e9800998ecf8427e FFF/a.txt [master (root-commit) 8a6d1d9] Initial state 0 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 FFF/a.txt create mode 100644 FFF/b.txt create mode 100644 FFF/c.txt after d41d8cd98f00b204e9800998ecf8427e FFF/d.txt d8e8fca2dc0f896fd7cb4cb0031ba249 FFF/b.txt d41d8cd98f00b204e9800998ecf8427e FFF/c.txt [master 810b0f5] New state 2 files changed, 1 insertions(+), 0 deletions(-) rename FFF/ d.txt> (100%) FFF/a.txt FFF/b.txt FFF/d.txt 

The last 3 lines are the output from the git diff command.

Источник

How To Find Files Modified In The Last N Days Or Minutes Using find

This article explains how to find all files in a directory that have been changed in the last N minutes or days, or those with a modification date older than N minutes or days, with examples. This is done using the find command.

To find the files that have been changed (with the files data modification time older than) in the last N days from a directory and subdirectories, use:

find /directory/path/ -mtime -N -ls

• find is the Unix command line tool for finding files (and more)
• /directory/path/ is the directory path where to look for files that have been modified. Replace it with the path of the directory where you want to look for files that have been modified in the last N days
• -mtime -N is used to match files that had their data modified in the last N days. Replace N with a number (integer)
• -ls lists the resulting files (the files that have been modified in the last N days) in ls -dils format on standard output. You can skip this, but using it you’ll get more information like the file size, permissions, the modification date, etc.

• Find all files modified in the last day (24 hours; between now and a day ago) in a directory and subdirectories:

find /directory/path/ -mtime -1 -ls

-mtime -1 is the same as -mtime 0 .

find /directory/path/ -mtime -30 -ls

But what if you need to find the files that have a modification date older than N , for example older than 30 days? In that case you need to use +N instead of -N , like this:

find /directory/path/ -mtime +N -ls

find /directory/path/ -mtime +7 -ls

find /directory/path/ -mtime +1 -ls

find /directory/path/ -mtime 1 -ls

So why is 1 one day ago, and +1 older than 2 days / 48 hours ago? That’s because according to the man find , any fractional parts are ignored, so if a file was last modified 1 day and 23 hours ago, -mtime +1 won’t match it, treating it as if the file was last modified 1 day, 0 hours, 0 minutes, and 0 seconds ago; see this explanation on why that’s the case

This being the case, how can you get all files modified at least 1 day ago? Use +0 :

find /directory/path/ -mtime +0 -ls

Using minutes instead of days

To find the files that have been modified N minutes ago, or with a modification date older than N , simply replace -mtime with -mmin .

So if you want to find the files that have been changed (with the files data modification time older than) in the last N minutes from a directory and subdirectories, use:

find /directory/path/ -mmin N -ls

find /directory/path/ -mmin -5 -ls

find /directory/path/ -mmin +5 -ls

Источник