How to find files modified in last x minutes (find -mmin does not work as expected)
I’m trying to find files modified in last x minutes, for example in the last hour. Many forums and tutorials on the net suggest to use the find command with the -mmin option, like this: find . -mmin -60 |xargs ls -l However, this command did not work for me as expected. As you can see from the following listing, it also shows files modified earlier than 1 hour ago:
-rw------- 1 user user 9065 Oct 28 23:13 1446070435.V902I67a5567M283852.harvester -rw------- 1 user user 1331 Oct 29 01:10 1446077402.V902I67a5b34M538793.harvester -rw------- 1 user user 1615 Oct 29 01:36 1446078983.V902I67a5b35M267251.harvester -rw------- 1 user user 72365 Oct 29 02:27 1446082022.V902I67a5b36M873811.harvester -rw------- 1 user user 69102 Oct 29 02:27 1446082024.V902I67a5b37M142247.harvester -rw------- 1 user user 2611 Oct 29 02:34 1446082482.V902I67a5b38M258101.harvester -rw------- 1 user user 2612 Oct 29 02:34 1446082485.V902I67a5b39M607107.harvester -rw------- 1 user user 2600 Oct 29 02:34 1446082488.V902I67a5b3aM465574.harvester -rw------- 1 user user 10779 Oct 29 03:27 1446085622.V902I67a5b3bM110329.harvester -rw------- 1 user user 5836 Oct 29 03:27 1446085623.V902I67a5b3cM254104.harvester -rw------- 1 user user 8970 Oct 29 04:27 1446089232.V902I67a5b3dM936339.harvester -rw------- 1 user user 165393 Oct 29 06:10 1446095400.V902I67a5b3eM290158.harvester -rw------- 1 user user 105054 Oct 29 06:10 1446095430.V902I67a5b3fM265065.harvester -rw------- 1 user user 1615 Oct 29 06:24 1446096244.V902I67a5b40M55701.harvester -rw------- 1 user user 1620 Oct 29 06:24 1446096292.V902I67a5b41M337769.harvester -rw------- 1 user user 10436 Oct 29 06:36 1446096973.V902I67a5b42M707215.harvester -rw------- 1 user user 7150 Oct 29 06:36 1446097019.V902I67a5b43M415731.harvester -rw------- 1 user user 4357 Oct 29 06:39 1446097194.V902I67a5b56M446687.harvester -rw------- 1 user user 4283 Oct 29 06:39 1446097195.V902I67a5b57M957052.harvester -rw------- 1 user user 4393 Oct 29 06:39 1446097197.V902I67a5b58M774506.harvester -rw------- 1 user user 4264 Oct 29 06:39 1446097198.V902I67a5b59M532213.harvester -rw------- 1 user user 4272 Oct 29 06:40 1446097201.V902I67a5b5aM534679.harvester -rw------- 1 user user 4274 Oct 29 06:40 1446097228.V902I67a5b5dM363553.harvester -rw------- 1 user user 20905 Oct 29 06:44 1446097455.V902I67a5b5eM918314.harvester Actually, it just listed all files in the current directory. We can take one of these files as an example and check if its modification time is really as displayed by the ls command:
stat 1446070435.V902I67a5567M283852.harvester File: ‘1446070435.V902I67a5567M283852.harvester’ Size: 9065 Blocks: 24 IO Block: 4096 regular file Device: 902h/2306d Inode: 108680551 Links: 1 Access: (0600/-rw-------) Uid: ( 1001/ user) Gid: ( 1027/ user) Access: 2015-10-28 23:13:55.281515368 +0100 Modify: 2015-10-28 23:13:55.281515368 +0100 Change: 2015-10-28 23:13:55.313515539 +0100 As we can see, this file was definitely last modified earlier than 1 hour ago! I also tried find -mmin 60 or find -mmin +60 , but it did not work either. Why is this happening and how to use the find command correctly?
Find the files that have been changed in last 24 hours
E.g., a MySQL server is running on my Ubuntu machine. Some data has been changed during the last 24 hours. What (Linux) scripts can find the files that have been changed during the last 24 hours? Please list the file names, file sizes, and modified time.
7 Answers 7
To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:
find /directory_path -mtime -1 -ls The — before 1 is important — it means anything changed one day or less ago. A + before 1 would instead mean anything changed at least one day ago, while having nothing before the 1 would have meant it was changed exacted one day ago, no more, no less.
The argument to -mtime is interpreted as the number of whole days in the age of the file. -mtime +n means strictly greater than, -mtime -n means strictly less than.
Another, more humanist way, is to use -newermt option which understands human-readable time units (see man find and search for -newerXY ).
Unlike -mtime option which requires the user to read find documentation to figure our what time units -mtime expects and then having the user to convert its time units into those, which is error-prone and plain user-unfriendly. -mtime was barely acceptable in 1980s, but in the 21st century -mtime has the convenience and safety of stone age tools.
Example uses of -newermt option with the same duration expressed in different human-friendly units:
find / -newermt "-24 hours" -ls find / -newermt "1 day ago" -ls find / -newermt "yesterday" -ls Get Last Modified Date of File in Linux
I’m new to Linux. I’m using the command-line. I’m trying to view the last modified date of a file. How do I do that in Linux from the Command Line?
@BrunoBieri It’s the modification date. See man ls . Typical Linux file systems don’t even track creation date — see the accepted answer for the kinds of dates kept track of.
7 Answers 7
As mentioned by @edvinas.me, stat tells you various information about the file including the last modified date.
At first, I was confused with Modify and Change, just to clarify, stat output lists:
- Access shows the time of last data access (e.g. read).
- Modify shows the time of last data modification.
- Change shows the time the file status last changed.
~ $ touch foo ~ $ stat foo File: ‘foo’ Size: 0 Blocks: 0 IO Block: 4096 regular empty file Device: fc01h/64513d Inode: 410397 Links: 1 Access: (0644/-rw-r--r--) Uid: (80972/ etomort) Gid: (18429/ eem_tw) Access: 2015-09-21 12:06:11.343616258 +0200 Modify: 2015-09-21 12:06:11.343616258 +0200 Change: 2015-09-21 12:06:11.343616258 +0200 Birth: - ~ $ echo "Added bar to foo file" >> foo ~ $ stat foo File: ‘foo’ Size: 42 Blocks: 8 IO Block: 4096 regular file Device: fc01h/64513d Inode: 410654 Links: 1 Access: (0644/-rw-r--r--) Uid: (80972/ etomort) Gid: (18429/ eem_tw) Access: 2015-09-21 12:09:31.298712951 +0200 Modify: 2015-09-21 12:09:31.298712951 +0200 Change: 2015-09-21 12:09:31.302713093 +0200 Birth: - ~ $ chmod 444 foo ~ $ stat foo File: ‘foo’ Size: 42 Blocks: 8 IO Block: 4096 regular file Device: fc01h/64513d Inode: 410654 Links: 1 Access: (0444/-r--r--r--) Uid: (80972/ etomort) Gid: (18429/ eem_tw) Access: 2015-09-21 12:09:31.298712951 +0200 Modify: 2015-09-21 12:09:31.298712951 +0200 Change: 2015-09-21 12:10:16.040310543 +0200 Birth: - Use stat command for that:
Another way that is more flexible is using date -r . From man date :
-r, --reference=FILE display the last modification time of FILE This has the advantage of allowing you to specify the output format, e.g.
$ date -r foo Thu Aug 31 10:36:28 AEST 2017 $ date -r foo -R Thu, 31 Aug 2017 10:36:28 +1000 $ date -r foo -u Thu Aug 31 00:36:28 UTC 2017 $ date -r foo +%s 1504139788 Yes, very helpful, thanks. Here is a bash function that will rename a file to be prefixed by the modified time: function mvfilestime() < if [ x"$<1>» = «x» ] ; then echo «mvfilestime: Missing argument of file to mv» else f=$(date +»%Y-%m-%d-%H-%M» -r $<1>)-$ <1>echo mv $ <1>$ mv $ <1>$ fi >
#> ls -l /home/TEST/ total 16 -rw-r--r-- 1 rfmas1 nms 949 Nov 16 12:21 create_nd_lists.py -rw-r--r-- 1 rfmas1 nms 0 Nov 16 12:35 enb_list -rw-r--r-- 1 rfmas1 nms 0 Nov 16 12:35 nb_list -rw-r--r-- 1 rfmas1 nms 0 Nov 16 12:35 nodes_ip.txt -rw-r--r-- 1 rfmas1 nms 0 Nov 16 12:35 rnc_list Building off of @Adam Taylor ‘s comment in @phoops ‘s answer and @Sparhawk ‘s answer.
To specifically just get the date (using October 3, 2019 for examples because it was my last birthday)
- stat -c %y file | cut -d’ ‘ -f1 will give you 2019-10-03
- date +%F -r file will also give you 2019-10-03
- date +%D -r file will give you 10/03/19
- date +%x -r file will probably give either 10/03/2019 , or 10/03/19 if you’re in the U.S. and either 03/10/2019 , or 03/10/19 if you’re in the U.K., just to name a couple examples (of course there are more possibilities)
These date format options are, to my understanding, combinations of other format options. Here are some explanations from the man page:
%b locale’s abbreviated month name (e.g., Jan)
%B locale’s full month name (e.g., January)
.
%d day of month (e.g, 01)
%D date; same as %m/%d/%y
%e day of month, space padded; same as %_d
%F full date; same as %Y-%m-%d
.
%m month (01..12)
.
%x locale’s date representation (e.g., 12/31/99)
.
%y last two digits of year (00..99)
%Y year
.
By default, date pads numeric fields with zeroes.
The following optional flags may follow `%’:
— (hyphen) do not pad the field
_ (underscore) pad with spaces
0 (zero) pad with zeros
^ use upper case if possible
use opposite case if possible
N.B.: These flags don’t work on the «combo formats» like %F , %D and %x . They are for the «singular field formats«.
Apparently this last flag (#) does not work as I’d expect (e.g., if date +%b gives Oct , date +%#b gives OCT as opposed to oCT ) I guess this would be useless, but I’d think a lower case option would be more useful. date +%#p does turn date +%p which might give PM or AM into pm or am , respectively. So I guess it’s not a ‘per-character’ case switch but sets the case of all the characters in the string to the opposite case of the majority of the characters? Also date +%P gives pm or am , but neither date +%^P nor date +%#P change its output. My guess for this case is that %P is just an alias for %#p , and it seems that whenever you add more than one flag, the behavior is undefined/unpredictable ( e.g., date +%0-e gives the same as date +%-e : 3 and date +%-0e gives the same as date +%0e : 03 , which makes you think that only the flag next to the letter works or that it goes left to right, but both date +%#^p and date +%^#p give pm or am , [depending on the time of course] ) unless there’s some hidden order of operations? Sorry for digressing.
Also, if you run the command locale -k LC_TIME | grep ^d_fmt , you can see the combo for the specific locale of your system (e.g., d_fmt=»%m/%d/%Y» ).
And you can make your own combo. For example,