Linux find files modified last hour

How to Check a File’s Age and Modification Time in Linux

It is impossible to avoid file creation and modification of OS routines under Linux file management. Every time a user logs into a Linux operating system environment, it is almost a surety or guarantee that we are going to create, modify, or create and modify several files.

Linux makes it possible to find the age and modification time associated with a targeted file. So how does finding a file’s age and modification time help us? Well, for users who want to be thorough with every file footprint associated with their Linux operating system, this article guide is for you.

Also, for users that are interested in career paths related to system auditing, determining the age and modification time associated with an existing file is a priceless skill.

File Timestamps in Linux

During the file creation process in Linux, a file’s metadata is associated with three distinct timestamps. When a created file is accessed or modified, these three timestamps subsequently change.

It is also important to note that the Extended File System (EXT); primarily linked with the Linux Kernel, does not permit file-creation timestamps. Let us closely look at these three distinct timestamps.

File Modified Time in Linux

The modified timestamp determines the actual time a file’s data or content was changed. The modification time is updated each time a file’s content is edited and saved.

The Linux ls -l command can help us determine a file’s modified time.

If we modify the above file and run the ls -l command again, we should see a new/updated modified date and time as depicted in the screen capture below.

File Accessed Time in Linux

If you want to determine the last time a file was read, then we need to get the accessed timestamp. Please note that this metadata only points to when a file is referenced/read without any modification taking place on its metadata or content.

Here, we can use the Linux ls -lu command.

If we read this file using the cat command and run the above command again, the accessed time should change.

$ cat SystemLog.txt $ ls -lu SystemLog.txt

File Changed Time in Linux

The changed timestamp is associated with the time changes were made to a file’s metadata. For instance, if we change the filename or file permission, we can determine the changed time using the ls -lc command.

Let us rename the file and check the changed time again.

$ mv SystemLog.txt systemlog.txt $ ls -lc systemlog.txt

How to Find Files Modified, Accessed, and Changed Time Using Find Command

The find command makes it possible to search for files modified, accessed, and changed within a user-specified duration.

Finding Modified Files in Linux

For instance, we could search our Home directory for files modified within the last hour in the following manner:

Finding Accessed Files in Linux

We could also find accessed files in the last 20 minutes:

Finding Changed Files in Linux

We could also find changed files that have aged more than an hour ago.

$ find ~/Linuxshelltips -cmin +60

Find Age of a File in Linux

Consider the following bash script that makes use of Linux’s date utility to determine the age of a file.

#!/bin/sh [ "$#" -eq 0 ] && echo "Usage: file-age " && exit 1 filepath=$1 echo "$(basename $filepath): $(($(date +%s) - $(date -r "$filepath" +%s))) seconds"

Save the script file and make it executable.

To determine the age of a file, we have to specify the filename as an argument in the following manner.

The screen capture above concludes that the file systemlog.txt was born/created 3661 seconds ago.

We should now be able to comfortably determine the accessed time, changed time, modification time, and age of any file on our Linux system. Hope this article was useful. Feel free to leave a comment or feedback.

Источник

How to Find Last Modified Files in Linux?

This tutorial explains how to find last modified files in Linux using different commands and according to custom needs.

After reading this tutorial you’ll know how to execute the following tasks:

• How to find files modified in a specific day range
• How to find last modified specific file type (e.g mp4, png)
• Finding files modified before / after X minutes
• How to find files modified in a specific date
• Finding modified files recursively
• Search omitting files or directories
• Find files by access date

Finding last day modified files in Linux:

To start, let’s search files modified less than a day ago. To find files modified a day ago you can use the commands find and newermt used in the following example.

The find command is used to search files. The newermt command compares files timestamp with the argument passed, in this case “1 day ago”. Then, the ls command is passed to list the files.

To find last day modified files, you can also use the mtime command together with find. By specifying the option 0 as in the example below, mtime will return all files modified in the last 24 hours.

Find Last Modified Specific File Type in Linux:

You can use a wildcard to limit your search to a specific file type. In the following example, find and newermt are instructed to list all mp4 files modified a day ago.

cc lang=”bash” width=”100%” height=”100%” escaped=”true” theme=”blackboard”]$ find /home/linuxhint/*.mp4 -newermt “1 day ago” -ls[/cc

In the following example, find and newermt are used to find all .png images less than 15 days old.

Finding Last Hour Modified Files in Linux:

The following example combines the find command with the mmin command. We can use the mmin command to specify minutes. In the example below, the find and mmin commands will print all files under the /root directory, whose modifications are less than 60 minutes old.

Contrary to the previous example in which files modified in the past 60 minutes were found. You can also use +mmin to search files modified after X minutes. For example, the following command will show files modified 60 minutes ago or more.

Finding Files Modified on a Specific Date in Linux:

You can use the ls command to list files including their modification date by adding the -lt flag as shown in the example below. The flag -l is used to format the output as a log. The flag -t is used to list last modified files, newer first.

Then you can combine ls -lt with grep to print all files which were modified on a specific date.

Find Last Modified Files Recursively:

Previous examples are useful to find last modified files

The command below can be used to print last modified files recursively.

Search File by Date Omitting Files or Directories:

Contrary to the previous example, you can search files omitting directories. For this purpose, you need to implement the -type flag with the option f (file) as shown in the following example. As a result, you’ll see only final files and no directories.

You can also search directories only and the output will omit files. For this, just replace the f with a d after the -type flag.

Find Files by Access Date:

You also may want to find unmodified files by access date. For this purpose, you can use the atime command. It is similar to the mtime command explained before, but instead of identifying files by modification, it can display files by access. With this command you can learn the last accessed files and directories in the system.

The following command shows all files accessed in the past 10 days.

Like the previous command, you can also use the d option to show only directories:

If you don’t specify a type, atime will show all files and directories:

In the following example, find and atime are used to find files and directories with modification older than 20 days.

As with previous examples, you can also limit the listing to files or directories with the -type flag.

Conclusion:

As you can see, Linux offers different methods to find files according to modification time. Any Linux user level can easily learn those methods to search files with a single command. Finding files by modification or access within a system is part of the basic knowledge a Linux user needs.

I hope this tutorial was useful. Keep following Linux Hint for more Linux tips and tutorials.

About the author

David Adams

David Adams is a System Admin and writer that is focused on open source technologies, security software, and computer systems.

Источник

How to Find Files Modified in Last 24 Hours in Linux

A Linux operating system administrator or veteran user understands and relates to the implications of unmet file management routines and objectives. File management improves the overall workflow such that each user’s actions are associated with specific file changes or modifications.

It makes it easy to note any viable changes or modifications made on a system or user file data, the system user that made the file changes or modifications, and the time stamp associated with each file change and modification.

In Linux, achieving such a feat is possible through the Linux command line environment using the find command.

Linux Find Command

The Linux find command is effective in identifying the changes associated with a particular system or user file over a specified time frame. Therefore, if you have a file whose data you think has had some modification or changes, you can clarify your suspicion through the find command.

The basic syntax of the find command is as follows:

$ find /directory/path/to/your/files -mtime -N -ls

• find: This command segment is responsible for tracing the existence of any modified file(s) based on the provided file location path.
• /directory/path/to/your/files: This portion is the system path that points to the suspected modified files that interest you.
• -mtime -N: This portion holds the time value (-N) in an integer format. The -N is the specified period/time range you wish to check for the existence of any file modification footprints.
• -ls: If modified files exist in your targeted directory, it will list and display them as Linux terminal outputs.

Find Files Modified in Last 24 Hours Using Find Command

To demonstrate the possible existence of files modified on your Linux system within the last 24 hours, we would implement a find command similar to the following:

$ find /path/to/your/files/directory -mtime -1 -ls

From the above command syntax, the find command portion “-1” references a 24-hour time frame or a day since any file modifications might have taken place.

On my end, I will check the possibility of any file modifications on one of my system folders as follows:

$ find /home/dnyce/Documents/Work/LinuxShellTips/September -mtime -1 -ls

As per the above screen capture output, the file “how to convert xlsx to CSVFormat in Linux.docx” has tested positive for being modified within the last 24-hour window. A more detailed output of the above screen capture is as follows:

We now know the read-write privileges (-rw-rw-r–), system user (dnyce), file size (958150 bytes), and modification time (16:28) associated with the listed file.

If we want to stretch our output for a period like the last 3 days, we would implement this command in the following manner:

$ find /home/dnyce/Documents/Work/LinuxShellTips/September -mtime -3 -ls

As you can see, we have more output files that have tested positive for modification.

The Linux find command can help you achieve a lot in terms of the priceless file management milestones it provides. You not only get to pinpoint the modified files but also determine other critical information like the user that made the modification, the time of the modification, and the size of the file after the modification.

To explore more find command options, run man find on your Linux terminal or read the following articles.

Источник