Find the files that have been changed in last 24 hours
E.g., a MySQL server is running on my Ubuntu machine. Some data has been changed during the last 24 hours. What (Linux) scripts can find the files that have been changed during the last 24 hours? Please list the file names, file sizes, and modified time.
7 Answers 7
To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:
find /directory_path -mtime -1 -ls The — before 1 is important — it means anything changed one day or less ago. A + before 1 would instead mean anything changed at least one day ago, while having nothing before the 1 would have meant it was changed exacted one day ago, no more, no less.
The argument to -mtime is interpreted as the number of whole days in the age of the file. -mtime +n means strictly greater than, -mtime -n means strictly less than.
Another, more humanist way, is to use -newermt option which understands human-readable time units (see man find and search for -newerXY ).
Unlike -mtime option which requires the user to read find documentation to figure our what time units -mtime expects and then having the user to convert its time units into those, which is error-prone and plain user-unfriendly. -mtime was barely acceptable in 1980s, but in the 21st century -mtime has the convenience and safety of stone age tools.
Example uses of -newermt option with the same duration expressed in different human-friendly units:
find / -newermt "-24 hours" -ls find / -newermt "1 day ago" -ls find / -newermt "yesterday" -ls How to delete files older than X hours
This will delete of the files older than 1 day. However, what if I need a finer resolution that 1 day, say like 6 hours old? Is there a nice clean way to do it, like there is using find and -mtime?
9 Answers 9
Does your find have the -mmin option? That can let you test the number of mins since last modification:
find $LOCATION -name $REQUIRED_FILES -type f -mmin +360 -delete Or maybe look at using tmpwatch to do the same job. phjr also recommended tmpreaper in the comments.
Using —mmin +X returns all files with my find. My fault for not checking this first, but this command just deleted most of my home directory. For me, —mmin -X is the correct argument.
tmpreaper is a fork of tmpwatch. It is safer, and exists as a debian package in the distro. Benefits over find -delete : tmpreaper will not remove symlinks, sockets, fifos, or special files
Point out that $REQUIRED_FILES need to be in quotes (double quotes) and you can use a pattern like: «.txt» for all .txt files or files beginning with a pattern like: «temp-» to delete all files named with temp-
@PaulDixon how to modify this so that $LOCATION and $REQUIRED_FILES can both have multiple values such as dir1 dir2 and *.txt *.tmp ?
@Enissay $LOCATION is a single directory. For multiple extensions you’d probably want to use a pattern with -regex — see stackoverflow.com/questions/5249779/…
Here is the approach that worked for me (and I don’t see it being used above)
$ find /path/to/the/folder -name '*.*' -mmin +59 -delete > /dev/null deleting all the files older than 59 minutes while leaving the folders intact.
Better to single-quote ‘*.*’ or the shell will expand it to actual filenames instead of keeping it as a wildcard for find to resolve. This breaks find ‘s recursive operation on subdirs.
Also keep in mind that -name ‘*.*’ will not delete files that have no extension, such as README , Makefile , etc.
You could to this trick: create a file 1 hour ago, and use the -newer file argument.
(Or use touch -t to create such a file).
there is no -older switch (at least in my find command), and that’s what would be needed. -newer doesn’t help.
can you give a touch command that would generate a file 1 hour old that will work on machines that can’t use -mmin? (If you’re on Linux, -mmin is available, if not then date and other commands are also feeble in comparison.)
@iconoclast touch -t $(date -d ‘-1 hour’ +%Y%m%d%H%M.00) test Creates file test that’s always 1 hour old.
To rm files and directories older than file.ext run rm -r `find -maxdepth 1 -not -newer file.ext` . To rm files and directories newer than file.ext do rm -r `find -maxdepth 1 -newer file.ext` . To place file.ext where you want it in time run touch -t $(date -d ‘-1 hour’ +%Y%m%d%H%M.00) file.ext where ‘-1 hour’ specifies «1 hour ago». Credit: xoftl, rovr138, nickf.
Example 6 Selecting a File Using 24-hour Mode The descriptions of -atime, -ctime, and -mtime use the ter- minology n ``24-hour periods''. For example, a file accessed at 23:59 is selected by: example% find . -atime -1 -print at 00:01 the next day (less than 24 hours later, not more than one day ago). The midnight boundary between days has no effect on the 24-hour calculation. If you do not have «-mmin» in your version of «find», then «-mtime -0.041667» gets pretty close to «within the last hour», so in your case, use:
so, if X means 6 hours, then:
works because 24 hours * 0.25 = 6 hours
Was hopeful because this old UNIX doesn’t have -mmin, but, sadly this is of no help as this old UNIX also does not like fractional values for mtime: find: argument to -mtime must be an integer in the range -2147483647 to 2147483647
If one’s find does not have -mmin and if one also is stuck with a find that accepts only integer values for -mtime , then all is not necessarily lost if one considers that «older than» is similar to «not newer than».
If we were able to create a file that that has an mtime of our cut-off time, we can ask find to locate the files that are «not newer than» our reference file.
To create a file that has the correct time stamp is a bit involved because a system that doesn’t have an adequate find probably also has a less-than-capable date command that could do things like: date +%Y%m%d%H%M%S -d «6 hours ago» .
Fortunately, other old tools can manage this, albeit in a more unwieldy way.
To begin finding a way to delete files that are over six hours old, we first have to find the time that is six hours ago. Consider that six hours is 21600 seconds:
$ date && perl -e '@d=localtime time()-21600; \ printf "%4d%02d%02d%02d%02d.%02d\n", $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]' > Thu Apr 16 04:50:57 CDT 2020 202004152250.57 Since the perl statement produces the date/time information we need, use it to create a reference file that is exactly six hours old:
$ date && touch -t `perl -e '@d=localtime time()-21600; \ printf "%4d%02d%02d%02d%02d.%02d\n", \ $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]'` ref_file && ls -l ref_file Thu Apr 16 04:53:54 CDT 2020 -rw-rw-rw- 1 root sys 0 Apr 15 22:53 ref_file Now that we have a reference file exactly six hours old, the «old UNIX» solution for «delete all files older than six hours» becomes something along the lines of:
$ find . -type f ! -newer ref_file -a ! -name ref_file -exec rm -f "<>" \; It might also be a good idea to clean up our reference file.
How do I find all the files that were created today in Unix/Linux?
On my Fedora 10 system, with findutils-4.4.0-1.fc10.i386 :
find -daystart -ctime 0 -print The -daystart flag tells it to calculate from the start of today instead of from 24 hours ago.
Note however that this will actually list files created or modified in the last day. find has no options that look at the true creation date of the file.
That is almost perfect for me, clean and concise, just missing the «-f» flag to get only files (without current dir)
(@ephemient: Well, with *nix, the ctime of an inode was colloquially known as the creation time, even if the specification said (inode) change time (keeping neither changes to file names nor contents, but meta data like ownership, permissions,…. sleuthkit on «MAC» meaning))
find . -mtime -1 -type f -print Don’t use backticks; don’t use pwd except for printing (that’s the p in pwd ) the working directory. Use . to reference current directory.
this answer is incorrect — this displays the files created in the last 24 hours, not the files created today
@G.Lebret -ctime is the time the file’s status was last changed. Unix doesn’t store file creation time, last modified time is obviously equivalent to creation time if nothing modified the file after it was created.
To find all files that are modified today only (since start of day only, i.e. 12 am), in current directory and its sub-directories:
touch -t `date +%m%d0000` /tmp/$$ find . -type f -newer /tmp/$$ rm /tmp/$$ I use this with some frequency:
$ ls -altrh --time-style=+%D | grep $(date +%D) After going through many posts I found the best one that really works
find $file_path -type f -name "*.txt" -mtime -1 -printf "%f\n" This prints only the file name like abc.txt not the /path/tofolder/abc.txt
Also also play around or customize with -mtime -1
This worked for me. Lists the files created on May 30 in the current directory.
Use ls or find to have all the files that were created today.
Using ls : ls -ltr | grep «$(date ‘+%b %e’)»
Using find : cd $YOUR_DIRECTORY ; find . -ls 2>/dev/null| grep «$(date ‘+%b %e’)»
find ./ -maxdepth 1 -type f -execdir basename '<>' ';' | grep `date +'%Y%m%d'` Welcome to Stack Overflow. Code dumps without any explanation are rarely helpful. Stack Overflow is about learning, not providing snippets to blindly copy and paste. Please edit your question and explain how it answers the specific question being asked. See How to Answer. This is especially important when answering old questions (this one is over 12 years old) with existing answers.
You can use find and ls to accomplish with this:
find . -type f -exec ls -l <> \; | egrep "Aug 26"; It will find all files in this directory, display useful informations ( -l ) and filter the lines with some date you want. It may be a little bit slow, but still useful in some cases.