Linux find recently modified files

Find the latest file by modified date

If I want to find the latest file (mtime) in a (big) directory containing subdirectories, how would I do it? Lots of posts I’ve found suggest some variation of ls -lt | head (amusingly, many suggest ls -ltr | tail which is the same but less efficient) which is fine unless you have subdirectories (I do). Then again, you could

find . -type f -exec ls -lt \ \+ | head 

which will definitely do the trick for as many files as can be specified by one command, i.e. if you have a big directory, -exec. \+ will issue separate commands; therefore each group will be sorted by ls within itself but not over the total set; the head will therefore pick up the lastest entry of the first batch. Any answers?

6 Answers 6

You do not need to recur to external commands (as ls ) because find can do all you need through the -printf action:

find /path -printf '%T+ %p\n' | sort -r | head 

Yeah, I came up with find . -type f -exec stat —format=%y \ \+ | sort -r | head -n1 but your solution is far cleaner!

You can also cull the output of head to include a certain number of lines. I only needed the first line, so I used head -n 1

@qwr wrote «Append | cut -d ‘ ‘ -f2 to get filename only». Thanks! Although better append | cut -d ‘ ‘ -f2 — to avoid problems with filenames that contain spaces.

I had a similar problem today, but I attacked it without find . I needed something short I could run over ssh to return the most recently edited file in my home directory. This is roughly what I came up with:

The -p option to ls adds a trailing slash to directories, the grep -v removes lines ending in a slash (aka, all directories), and the head -1 limits the output to a single file.

This is much less verbose than using find if all you want to return is the file name.

This is on my system faster than printf , though I don’t understand why

find /path -type f -exec stat -c "%y %n" <> + | sort -r | head 

EDIT: I guess this post is not ‘not particularly useful’ as I thought it was. This is a really fast solution that just keeps track of the most recently modified file (instead of sorting the entire list of files):

Spread over multiple lines for clarity it looks as follows:

find . -type f -printf '%T@ %p\n' | awk ' BEGIN < mostrecenttime = 0; mostrecentline = "nothing"; > < if ($1 >mostrecenttime) < mostrecenttime = $1; mostrecentline = $0; >> END < print mostrecentline; >' | cut -f2- -d ' ' 

Not a particularly useful post but since ‘arrange’ was discussing speed, I thought I’d share this.

arrange’s and enzotib’s solutions involve listing all files inside the directory with their mtimes and then sorting. As you know sorting is not necessary to find the maximum. Finding maximum can be done in linear time but sorting takes n log(n) time [I know the difference isn’t much, but still ;)]. I can’t think of a neat way of implementing this. [EDIT: A neat (albeit dirty looking) and fast implementation provided above.]

Next best thing — To find the most recently edited file in a directory, recursively find the most recently edited file in each level 1 subdirectory. Let this file represent the subdirectory. Now sort the level 1 files along with the representatives of the level 1 subdirectories. If the number of number of level 1 files and sub-dirs of each directory is nearly a constant, then this process should scale linearly with total number of files.

This is what I came up with to implement this:

findrecent() < < find "$1" -maxdepth 1 -type f -exec stat -c "%y %n" <>+ | sort -r | head -1 && find "$1" -mindepth 1 -maxdepth 1 -type d -exec findrecent <> \;; > | sort -r | head -1; > findrecent . 

I ran this and got a bunch of find: findrecent: No such file or directory errors. Reason: -exec of find runs in a different shell. I tried defining findrecent in .bashrc, .xsessionrc but these didn’t help [I’d appreciate help here]. In the end I resorted to putting

#!/bin/bash < find "$1" -maxdepth 1 -type f -exec stat -c "%y %n" <>+ | sort -r | head -1 && find "$1" -mindepth 1 -maxdepth 1 -type d -exec findrecent <> \;; > | sort -r | head -1; 

in a script called findrecent in my PATH and then running it.

I ran this, kept waiting and waiting with no output. Just to be sure I wasn’t dealing with any infinite loops I modified the file to

#!/bin/bash echo "$1" >&2 < find "$1" -maxdepth 1 -type f -exec stat -c "%y %n" <>+ | sort -r | head -1 && find "$1" -mindepth 1 -maxdepth 1 -type d -exec findrecent <> \;; > | sort -r | head -1; 

and tried again. It did work — but took 1 minute 35 seconds on my homefolder — arrange’s and enzotib’s solutions took 1.69, 1.95 seconds respectively!

So much for O(n)’s superiority over O(n log (n))! Damn you function call overhead! [Or rather script call overhead]

But this script does scale better than the earlier solutions and I bet it’ll run faster than them on google’s memory bank ;D

Источник

How to Find Last Modified Files in Linux?

This tutorial explains how to find last modified files in Linux using different commands and according to custom needs.

After reading this tutorial you’ll know how to execute the following tasks:

• How to find files modified in a specific day range
• How to find last modified specific file type (e.g mp4, png)
• Finding files modified before / after X minutes
• How to find files modified in a specific date
• Finding modified files recursively
• Search omitting files or directories
• Find files by access date

Finding last day modified files in Linux:

To start, let’s search files modified less than a day ago. To find files modified a day ago you can use the commands find and newermt used in the following example.

The find command is used to search files. The newermt command compares files timestamp with the argument passed, in this case “1 day ago”. Then, the ls command is passed to list the files.

To find last day modified files, you can also use the mtime command together with find. By specifying the option 0 as in the example below, mtime will return all files modified in the last 24 hours.

Find Last Modified Specific File Type in Linux:

You can use a wildcard to limit your search to a specific file type. In the following example, find and newermt are instructed to list all mp4 files modified a day ago.

cc lang=”bash” width=”100%” height=”100%” escaped=”true” theme=”blackboard”]$ find /home/linuxhint/*.mp4 -newermt “1 day ago” -ls[/cc

In the following example, find and newermt are used to find all .png images less than 15 days old.

Finding Last Hour Modified Files in Linux:

The following example combines the find command with the mmin command. We can use the mmin command to specify minutes. In the example below, the find and mmin commands will print all files under the /root directory, whose modifications are less than 60 minutes old.

Contrary to the previous example in which files modified in the past 60 minutes were found. You can also use +mmin to search files modified after X minutes. For example, the following command will show files modified 60 minutes ago or more.

Finding Files Modified on a Specific Date in Linux:

You can use the ls command to list files including their modification date by adding the -lt flag as shown in the example below. The flag -l is used to format the output as a log. The flag -t is used to list last modified files, newer first.

Then you can combine ls -lt with grep to print all files which were modified on a specific date.

Find Last Modified Files Recursively:

Previous examples are useful to find last modified files

The command below can be used to print last modified files recursively.

Search File by Date Omitting Files or Directories:

Contrary to the previous example, you can search files omitting directories. For this purpose, you need to implement the -type flag with the option f (file) as shown in the following example. As a result, you’ll see only final files and no directories.

You can also search directories only and the output will omit files. For this, just replace the f with a d after the -type flag.

Find Files by Access Date:

You also may want to find unmodified files by access date. For this purpose, you can use the atime command. It is similar to the mtime command explained before, but instead of identifying files by modification, it can display files by access. With this command you can learn the last accessed files and directories in the system.

The following command shows all files accessed in the past 10 days.

Like the previous command, you can also use the d option to show only directories:

If you don’t specify a type, atime will show all files and directories:

In the following example, find and atime are used to find files and directories with modification older than 20 days.

As with previous examples, you can also limit the listing to files or directories with the -type flag.

Conclusion:

As you can see, Linux offers different methods to find files according to modification time. Any Linux user level can easily learn those methods to search files with a single command. Finding files by modification or access within a system is part of the basic knowledge a Linux user needs.

I hope this tutorial was useful. Keep following Linux Hint for more Linux tips and tutorials.

About the author

David Adams

David Adams is a System Admin and writer that is focused on open source technologies, security software, and computer systems.

Источник

Find Files Modified in Last N Minutes in Linux

Finding recently modified files is a helpful parameter when troubleshooting your code or server. Learn how to find modified files in Linux command line.

Finding recently modified files is a helpful parameter when troubleshooting your code or server.

What log files were modified? What files changed when I ran this command? The versatile find command can help you get the answers.

The command below will find all the files that have been modified in the last five minutes in the current directory.

That’s just one example. Let me share how you can list files that are accessed and created in the last n minutes/days in detail.

Finding modified files in Linux

Before jumping to the explanatory part, first, I’d like to share the syntax of how you can use the find command to find files that are modified at the last n minute.

Here, n indicates how many minutes you want to check for. But you also have some options such as:

• -n will check for files modified in less than n minutes
• +n will check for files modified in more than n minutes
• n will check for files modified exactly n minutes ago

Similarly, you can also use -mtime instead of -mmin to check for files modified days ago.

Finding files modified in the last 5 minutes

So let’s suppose I want to list find files that are just modified in the last 5 minutes in the var directory; my command will be as follows:

As you can see, it just throws files, and I don’t find the given list useful and readable.

In this case, I’ll append -ls to have a much cleaner look and more info such as the file owner, permissions, and modification time.

find .var/ -type f -mmin -5 -ls

The find command allows a few actions on its result. The -ls is one such action. You don’t necessarily need to use find-exec or xargs for the ls command.

Finding files modified in the last n days

To find modified files in the last n days instead of n minutes, you just have to use -mtime instead of -mmin .

Suppose I want to find files that have been modified in the last one day, my command would be:

find /media/sagar/HDD/Downloads -type f -mtime -1 -ls

Find files older than X days

You can use the mtime parameter to find older files that have not been modified recently.

Let’s say you want to find files older than 30 days in the current directory. Use this command:

Find modified directories in the last n minutes or days

The find command can also bring a list of modified directories.

Just change -type f with -type d, which will let you search for directories instead of files.

For demonstration, I’ll be showing how you can get the list of modified directories under /.cache/mozilla/firefox:

find .cache/mozilla/firefox/ -type d -mmin -5 -ls

Similarly, you can find directories on which you worked a few days ago.

find Downloads/ -type d -mtime -1 -ls

Finding files that have been recently accessed or created

So how about finding files that were accessed or created last n minutes?

To find files that were accessed in the last n minutes, you’ll have to use -amin instead of -mmin .

To find files that were accessed in the last 5 minutes inside my preferred directory, I’d be using the given command:

find /media/sagar/HDD/Downloads -type f -amin -5 -ls

In the same way, you can also find files created in the last n minutes by using -cmin instead of -amin .

find /media/sagar/HDD/Downloads -type f -cmin -5 -ls

Conclusion

Basically, there is no limit to the use cases. You can modify it from -n to +n and you can search for older files. Use the ctime and you can get recently created or ancient files.

Learning the basics allows you to use the find command as per your need. I believe this tutorial gave you enough understanding of using the time parameter of the find command.

Источник