How to display modified date time with ‘find’ command?
With a find command, I can display directories names with multiple levels. The following command display all directories under /var path with a depth of 2:
find /var -maxdepth 2 -type d; /var /var/log /var/log/sssd /var/log/samba /var/log/audit /var/log/ConsoleKit /var/log/gdm /var/log/sa stat /var/log/samba | grep 'Modify:' Modify: 2014-01-02 11:21:27.762346214 -0800 Is there a way to combine the two commands so that directories will be listed with modified date time?
6 Answers 6
The accepted answer works but it’s slow. There’s no need to exec stat for each directory, find provides the modification date and you can just print it out directly. Here’s an equivalent command that’s considerably faster:
find /var -maxdepth 2 -type d -printf "%p %TY-%Tm-%Td %TH:%TM:%TS %Tz\n" A much better solution. It also works with the find from msys running on Windows, which lacks a stat command.
More helpful links for explanation of % formatters. unix.stackexchange.com/a/215236/216480 or on the man page search for «-printf format»
While the format string «%p %Tc» does work, it formats the output slightly differently. E.g. «/var/spool Mon 29 Sep 2014 09:05:54 BST» instead of «/var/spool 2014-09-29 09:05:54.000000000 +0100».
You could use the -exec switch for find and define the output format of stat using the -c switch as follows:
find /var -maxdepth 2 -type d -exec stat -c «%n %y» <> \;
This should give the filename followed by its modification time on the same line of the output.
The -printf option below avoids calling stat for every file found. In my test the command yields almost identical output, just an extra digit’s precision on the seconds.
For MacOS the format arg character for stat is -f . find /var -maxdepth 2 -type d -exec stat -f «%t%Sm %N» <> \;
Recent GNU versions of find also include a -printf option which includes date fields. If you need to print the file’s name and modification time in the standard «C» format, you can use -printf «%c %p\n» .
If you want the date in a specific format, you can use the %C followed by a field character. For example, 4-digit year would be %CY , with Y being the character for 4-digit year.
Note that if you need multiple fields, you’ll need to specify %C multiple times. For example, YYYY-MM-DD format would look like %CY-%Cm-%Cd .
Check the man pages or online documentation for additional details.
Here is a working example:
find . -name favicon.ico -printf "%c %p\n" Find the files that have been changed in last 24 hours
E.g., a MySQL server is running on my Ubuntu machine. Some data has been changed during the last 24 hours. What (Linux) scripts can find the files that have been changed during the last 24 hours? Please list the file names, file sizes, and modified time.
7 Answers 7
To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:
find /directory_path -mtime -1 -ls The — before 1 is important — it means anything changed one day or less ago. A + before 1 would instead mean anything changed at least one day ago, while having nothing before the 1 would have meant it was changed exacted one day ago, no more, no less.
The argument to -mtime is interpreted as the number of whole days in the age of the file. -mtime +n means strictly greater than, -mtime -n means strictly less than.
Another, more humanist way, is to use -newermt option which understands human-readable time units (see man find and search for -newerXY ).
Unlike -mtime option which requires the user to read find documentation to figure our what time units -mtime expects and then having the user to convert its time units into those, which is error-prone and plain user-unfriendly. -mtime was barely acceptable in 1980s, but in the 21st century -mtime has the convenience and safety of stone age tools.
Example uses of -newermt option with the same duration expressed in different human-friendly units:
find / -newermt "-24 hours" -ls find / -newermt "1 day ago" -ls find / -newermt "yesterday" -ls How to use ‘find’ to search for files created on a specific date? [closed]
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
9 Answers 9
As pointed out by Max, you can’t, but checking files modified or accessed is not all that hard. I wrote a tutorial about this, as late as today. The essence of which is to use -newerXY and ! -newerXY :
Example: To find all files modified on the 7th of June, 2007:
$ find . -type f -newermt 2007-06-07 ! -newermt 2007-06-08 To find all files accessed on the 29th of september, 2008:
$ find . -type f -newerat 2008-09-29 ! -newerat 2008-09-30 Or, files which had their permission changed on the same day:
$ find . -type f -newerct 2008-09-29 ! -newerct 2008-09-30 If you don’t change permissions on the file, ‘c’ would normally correspond to the creation date, though.
My version of find (GNU 4.2.32) doesn’t seem to support the -newerXY predicates. Is there a particular minimum version needed? Or is it a case of compiling find with a special configure switch?
@yukondude: You’re right. The version of find I have locally — GNU 4.4.0 — has it, while 4.1.20 that I have on Dreamhost doesn’t. The kludge with creating two files should work in either, though.
Note that the -newerxt is available on FreeBSD since 2001 (where it was first provided as a patch in 1998), a few other BSDs and GNU find (since 4.3.3 in 2007), based on HP/UX find, which introduced -newerXY (but where Y == t is not supported).
Note that the exclamation point may need to be escaped ( \! ) if you have Bash history substitution enabled (which is the default). Or you can disable it with set +H .
Use this command to search for files and folders on /home/ add a time period of time according to your needs:
find /home/ -ctime time_period Examples of time_period:
- More than 30 days ago: -ctime +30
- Less than 30 days ago: -ctime -30
- Exactly 30 days ago: -ctime 30
It’s two steps but I like to do it this way:
First create a file with a particular date/time. In this case, the file is 2008-10-01 at midnight
Now we can find all files that are newer or older than the above file (going by file modified date).
You can also use -anewer for accessed and -cnewer file status changed.
find / -newer /tmp/t find / -not -newer /tmp/t You could also look at files between certain dates by creating two files with touch
touch -t 0810010000 /tmp/t1 touch -t 0810011000 /tmp/t2 This will find files between the two dates & times
find / -newer /tmp/t1 -and -not -newer /tmp/t2 IMO, right now this should be the accepted solution. I couldn’t get -newermt to run on 2.6.18-348.18.1.el5 kernel, let alone newer kernels.
find ./ -type f -ls |grep '10 Sep' [root@pbx etc]# find /var/ -type f -ls | grep "Dec 24" 791235 4 -rw-r--r-- 1 root root 29 Dec 24 03:24 /var/lib/prelink/full 798227 288 -rw-r--r-- 1 root root 292323 Dec 24 23:53 /var/log/sa/sar24 797244 320 -rw-r--r-- 1 root root 321300 Dec 24 23:50 /var/log/sa/sa24 mywiki.wooledge.org/ParsingLs — a better approach is probably to print the creation date in machine-readable form, perhaps with stat if you don’t have find -printf .
Regarding «million files» use find ./ -type f -mtime -60 -ls | grep ’10 Sep’ if this date is inside the last 60 days.
You can’t. The -c switch tells you when the permissions were last changed, -a tests the most recent access time, and -m tests the modification time. The filesystem used by most flavors of Linux (ext3) doesn’t support a «creation time» record. Sorry!
In fact, it’s not just the filesystem type — there is no system interface for obtaining such information, even if the filesystem held it. One of the deficiencies of Unix going back to the earliest days, which is why Unix will never take off.
@Max: is right about the creation time.
However, if you want to calculate the elapsed days argument for one of the -atime , -ctime , -mtime parameters, you can use the following expression
ELAPSED_DAYS=$(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) Replace «2008-09-24» with whatever date you want and ELAPSED_DAYS will be set to the number of days between then and today. (Update: subtract one from the result to align with find ‘s date rounding.)
So, to find any file modified on September 24th, 2008, the command would be:
find . -type f -mtime $(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) This will work if your version of find doesn’t support the -newerXY predicates mentioned in @Arve:’s answer.