Linux find all files with date

How to use ‘find’ to search for files created on a specific date? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

9 Answers 9

As pointed out by Max, you can’t, but checking files modified or accessed is not all that hard. I wrote a tutorial about this, as late as today. The essence of which is to use -newerXY and ! -newerXY :

Example: To find all files modified on the 7th of June, 2007:

$ find . -type f -newermt 2007-06-07 ! -newermt 2007-06-08 

To find all files accessed on the 29th of september, 2008:

$ find . -type f -newerat 2008-09-29 ! -newerat 2008-09-30 

Or, files which had their permission changed on the same day:

$ find . -type f -newerct 2008-09-29 ! -newerct 2008-09-30 

If you don’t change permissions on the file, ‘c’ would normally correspond to the creation date, though.

My version of find (GNU 4.2.32) doesn’t seem to support the -newerXY predicates. Is there a particular minimum version needed? Or is it a case of compiling find with a special configure switch?

@yukondude: You’re right. The version of find I have locally — GNU 4.4.0 — has it, while 4.1.20 that I have on Dreamhost doesn’t. The kludge with creating two files should work in either, though.

Note that the -newerxt is available on FreeBSD since 2001 (where it was first provided as a patch in 1998), a few other BSDs and GNU find (since 4.3.3 in 2007), based on HP/UX find, which introduced -newerXY (but where Y == t is not supported).

Note that the exclamation point may need to be escaped ( \! ) if you have Bash history substitution enabled (which is the default). Or you can disable it with set +H .

Use this command to search for files and folders on /home/ add a time period of time according to your needs:

find /home/ -ctime time_period 

Examples of time_period:

• More than 30 days ago: -ctime +30
• Less than 30 days ago: -ctime -30
• Exactly 30 days ago: -ctime 30

It’s two steps but I like to do it this way:

First create a file with a particular date/time. In this case, the file is 2008-10-01 at midnight

Now we can find all files that are newer or older than the above file (going by file modified date).
You can also use -anewer for accessed and -cnewer file status changed.

find / -newer /tmp/t find / -not -newer /tmp/t 

You could also look at files between certain dates by creating two files with touch

touch -t 0810010000 /tmp/t1 touch -t 0810011000 /tmp/t2 

This will find files between the two dates & times

find / -newer /tmp/t1 -and -not -newer /tmp/t2 

IMO, right now this should be the accepted solution. I couldn’t get -newermt to run on 2.6.18-348.18.1.el5 kernel, let alone newer kernels.

find ./ -type f -ls |grep '10 Sep' 

[root@pbx etc]# find /var/ -type f -ls | grep "Dec 24" 791235 4 -rw-r--r-- 1 root root 29 Dec 24 03:24 /var/lib/prelink/full 798227 288 -rw-r--r-- 1 root root 292323 Dec 24 23:53 /var/log/sa/sar24 797244 320 -rw-r--r-- 1 root root 321300 Dec 24 23:50 /var/log/sa/sa24 

mywiki.wooledge.org/ParsingLs — a better approach is probably to print the creation date in machine-readable form, perhaps with stat if you don’t have find -printf .

Regarding «million files» use find ./ -type f -mtime -60 -ls | grep ’10 Sep’ if this date is inside the last 60 days.

You can’t. The -c switch tells you when the permissions were last changed, -a tests the most recent access time, and -m tests the modification time. The filesystem used by most flavors of Linux (ext3) doesn’t support a «creation time» record. Sorry!

In fact, it’s not just the filesystem type — there is no system interface for obtaining such information, even if the filesystem held it. One of the deficiencies of Unix going back to the earliest days, which is why Unix will never take off.

@Max: is right about the creation time.

However, if you want to calculate the elapsed days argument for one of the -atime , -ctime , -mtime parameters, you can use the following expression

ELAPSED_DAYS=$(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) 

Replace «2008-09-24» with whatever date you want and ELAPSED_DAYS will be set to the number of days between then and today. (Update: subtract one from the result to align with find ‘s date rounding.)

So, to find any file modified on September 24th, 2008, the command would be:

find . -type f -mtime $(( ( $(date +%s) - $(date -d '2008-09-24' +%s) ) / 60 / 60 / 24 - 1 )) 

This will work if your version of find doesn’t support the -newerXY predicates mentioned in @Arve:’s answer.

Источник

Linux: List Files by Date

Previously, we published a tutorial explaining how to list files by size in Linux. After reading the current tutorial, you will be able to list files by both last and first date modification, by a specific date, and last or first access on the current directory or the entire system.

The knowledge provided in this document is mandatory for all the Linux user levels.

All the steps shown in this article include screenshots to make it easy for all the Linux users to follow and apply them.

Topics explained in this document include:

Listing Files by Date Using the ls Command

The first command explained in this tutorial is the ls (list) command available in all the Linux distributions. In this section, you will learn the different tips to show files based on the different time/date related conditions.

1. Listing Files by Last Modification Date

In the first example, we list the files sorted by modification date within a directory. To achieve it, we execute the ls command followed by the -lt flag.

As you can see, the last modified files appear on top of the list.

You can get the inverse result, showing the last modified files within a directory at the bottom of the list. This can be done by adding an r to the previous flag, which means using the -ltr flag as shown in the following figure:

That’s how you can use the ls command to list the files by last modification time.

2. List Files by Last Access Date

To list the files by last access time, use the previous command adding a “u” in the flag as shown in the following example:

As you can see in the previous figure, the last accessed files show up on top of the list.

To print the last accessed files first, run the following command, adding an “r”.

Keep reading in the following illustrations to learn how to find the files by exact date.

3. List Files by Exact Date

If you want to search the files by the exact date, you can combine the ls with grep as shown in the following example. The following command shows all the modified files on the 2021-12-02 date.

4. List Specific Month Modified Files

The following example shows how to list the files by month. This shows all the files which were modified on a specific month, but not on a specific year. Therefore, if we search the files from May 31 using the following command, it shows the files modified on May 31 of all years.

Listing Files by Date Using the find Command

This section explains how to list the files by date with the find command, combined with the previous explained ls command.

The following section shows an additional listing time conditions.

1. How to List Files by Time Interval Using the find Command

The following example shows how to use the find command followed by the -mtime flag to list the files and directories under the /var/log/snort/ directory which were created or modified in the last 24 hours, where -1 indicates a day.

The following example does the same, but the -3 instead of -1 instructs find and ls to show the created or modified files in the last 3 days.

Contrary to the previous example, you also can use the mtime flag to specify the files before a specific date. For example, if we used the -3 flag to list the modified files in the last 3 days, we can use the +3 file to list the files which were modified before three days ago, older than 72 hours (without including files modified in the last 3 days).

Combining both options is possible like in the following example in which we list the files older than 5 days, but newer than 15 days.

The previously described methods are excellent to easily find the files you know when were created or modified.

2. List All Modified Files After or Before a Specific Date

You also can use the find command followed by the -newermt flag to find the files which were modified after or before a specific date.

Therefore, if we want to list the files modified after 22/05/18, we run the command shown in the following figure:

Contrary to the previous example, if we want to list only the files which were modified before 2022/05/18, we run the command shown in the following screenshot. Note that we added a “!” symbol before the -newermt flag.

Keep reading to learn how to do the same with the minute units.

3. Listing After Certain Minutes Modified Files

When using the find command, you also can implement the -mmin flag to specify the minute units.

The following command instructs the find to show the files which were modified in the last 3 minutes within the current directory (Dot).

We optimized this tutorial for the users looking for a fast solution by showing practical examples first. You can read the explanation on how the previously described commands work in the following illustrations:

What Are mtime, atime and ctime Timestamps

Every Linux file (including directories) has 3 timestamps in its metadata which contain information on file access, file modification, or metadata modification.

The mtime, atime and ctime timestamps are known as MAC Timestamps because of their initials.

• The mtime Timestamp: This timestamp contains information on file creation or modification date. This is the timestamp checked by the previously explained commands when we want to manage or list the files by their creation or modification date.
• The atime Timestamp: This timestamp contains information about the file’s last access. This is the timestamp checked by the previously explained commands when we want to list the last accessed files.
• The ctime Timestamp: This timestamp does not contain information on the file itself, but on its metadata. This timestamp does not inform us about modifications on the file content, but modifications on the metadata like file permissions. If we are looking for files whose permissions were recently edited, we can use the ctime to find these files.

By learning what timestamps are, you can understand how the commands we executed in the previous sections work.

Conclusion

As any user may suppose, knowing how to find and list the files by date or time is a must to know for every Linux user. This can help us for any type of task, from daily tasks to related administration complex tasks. As you can see, all the described steps are pretty easy to learn and implement. In some cases, you can get the same result using the different commands. Here, we only described a way for each listing type to avoid redundancy and prioritize the user understanding.

Any Linux user can incorporate those commands and improve his experience before the Linux terminals. It is highly recommended to practice all the examples shown, at least to remember their existence, by reading the man page for specifications. All instructions in this document are useful for all the Linux distributions.

Thank you for reading this tutorial explaining how to list the files by date in Linux. Keep following us for more professional Linux articles.

About the author

David Adams

David Adams is a System Admin and writer that is focused on open source technologies, security software, and computer systems.

Источник