My understanding of the following command is that it looks for files that have been modified in the last {x} minutes.
What does it mean if I exclude the - from mmin, what is it supposed to return?
COMMAND
find . -maxdepth 1 -mmin -20
-mmin -20 returns files that are modified less than 20 minutes ago.
-mmin 20 returns files that are modified exactly 20 minutes ago.
-mmin +20 returns any file modified 20 minutes ago or older.
From the find(1) man page:
Numeric arguments can be specified as
+n
for greater than n,
-n
for less than n,
n
for exactly n.
-mmin n
File's data was last modified n minutes ago.
i.e., -mmin -n means the data is modified less than n minutes ago and -mmin n means the data is modified exactly n minutes ago.
The minus is for 'or less'. '-mmin 20' will give you files modified exactly 20 minutes ago. mmin -20 gives you files modified 0 to 20 minutes ago.
Related
E.g., a MySQL server is running on my Ubuntu machine. Some data has been changed during the last 24 hours.
What (Linux) scripts can find the files that have been changed during the last 24 hours?
Please list the file names, file sizes, and modified time.
To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:
find /directory_path -mtime -1 -ls
Should be to your liking
The - before 1 is important - it means anything changed one day or less ago.
A + before 1 would instead mean anything changed at least one day ago, while having nothing before the 1 would have meant it was changed exacted one day ago, no more, no less.
Another, more humanist way, is to use -newermt option which understands human-readable time units.
Unlike -mtime option which requires the user to read find documentation to figure our what time units -mtime expects and then having the user to convert its time units into those, which is error-prone and plain user-unfriendly. -mtime was barely acceptable in 1980s, but in the 21st century -mtime has the convenience and safety of stone age tools.
Example uses of -newermt option with the same duration expressed in different human-friendly units:
find /<directory> -newermt "-24 hours" -ls
find /<directory> -newermt "1 day ago" -ls
find /<directory> -newermt "yesterday" -ls
You can do that with
find . -mtime 0
From man find:
[The] time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to
match -mtime 0, a file will have to have a modification in the past which is less than 24 hours ago.
On GNU-compatible systems (i.e. Linux):
find . -mtime 0 -printf '%T+\t%s\t%p\n' 2>/dev/null | sort -r | more
This will list files and directories that have been modified in the last 24 hours (-mtime 0). It will list them with the last modified time in a format that is both sortable and human-readable (%T+), followed by the file size (%s), followed by the full filename (%p), each separated by tabs (\t).
2>/dev/null throws away any stderr output, so that error messages don't muddy the waters; sort -r sorts the results by most recently modified first; and | more lists one page of results at a time.
For others who land here in the future (including myself), add a -name option to find specific file types, for instance: find /var -name "*.php" -mtime -1 -ls
This command worked for me
find . -mtime -1 -print
Find the files...
You can set type f = file
find /directory_path -type f -mtime -1 -exec ls -lh {} \;
👍
How can I search through a massive amount of data (28TB) to find the largest 10 files in the past 24 hours?
From the current answers below I've tried:
$ find . -type f -mtime -1 -printf "%p %s\n" | sort -k2nr | head -5
This command takes over 24 hours which defeats the purpose of searching for most recently modified in the past 24 hours. Are there any solutions known to be faster than the one above that can drastically cut search time? Solutions to monitor the system also will not work as there is simply too much to monitor and doing such could cause performance issues.
something like this?
$ find . -type f -mtime -1 -printf "%p %s\n" | sort -k2nr | head -5
top 5 modified files by size in the past 24 hours.
you can use the standard yet very powerful find command like this (start_directory is the directory where to scan files)
find start_directory -type f -mtime -1 -size +3000G
-mtime -1 option: files modified 1 day before or less
-size +3000G option: files of size at least 3 Gb
I work on a server system that does not allow me to store files more than 50 gigabytes. My application takes 20 minutes to generate a file. Is there any way whereby I can move all the files that are more than 30 minutes old from source to destination? I tried rsync:
rsync -avP source/folder/ user#destiantionIp:dest/folder
but this does not remove the files from my server and hence the storage limit fails.
Secondly, if I use the mv command, the files that are still getting generated also move to the destination folder and the program fails.
You can use find along with -exec for this:-
Replace /sourcedirectory and /destination/directory/ with the source and target paths as you need.
find /sourcedirectory -maxdepth 1 -mmin -30 -type f -exec mv "{}" /destination/directory/ \;
What basically the command does is, it tries to find files in the current folder -maxdepth 1 that were last modified 30 mins ago -mmin -30 and move them to the target directory specified. If you want to use the time the file was last accessed use -amin -30.
Or if you want to find files modified within a range you can use something like -mmin 30 -mmin -35 which will get you the files modified more than 30 but less than 35 minutes ago.
References from the man page:-
-amin n
File was last accessed n minutes ago.
-atime n
File was last accessed n*24 hours ago. When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime
+1, a file has to have been accessed at least two days ago.
-mmin n
File's data was last modified n minutes ago.
-mtime n
File's data was last modified n*24 hours ago. See the comments for -atime to understand how rounding affects the interpretation of file modification times.
I'd need a shell command to show of the last modified and new files on the whole server (recursive) and echoing them into a txt file in the root.
Has anybody something like this?
I tried
find / - mmtime 30 -printf "%AD %Ar - %p\n" 2> /dev/null | sort -r > /lastmodified.txt
to post all names of all modified files from the last 30 days into a txt file in root, but it shows me only the files of the server itself and not the directories where my websites are uploaded to.
Thank you in advance - I am not an expert, and this is what I found so far. It is relative urgent as I need this to fix hacked files which has happend last week.
From http://content.hccfl.edu/pollock/Unix/FindCmd.htm:
find . -mtime 0 # find files modified within the past 24 hours
find . -mtime -1 # find files modified within the past 24 hours
find . -mtime 1 # find files modified between 24 and 48 hours ago
find . -mtime +1 # find files modified more than 48 hours ago
Make sure that you have only one 'm' and a minus sign in -mtime -30, as suggested in chorobas comment, to get last 30 days. -mtime 30 would give just files exactly 30 days ago.
You may want to use option -daystart to get files of last 30 days starting from midnight instead of just 30*24 hours ago. Use %TD and %Tr instead of %AD and %Ar to get modification times (instead of access times).
The final command would then be:
find / -daystart -mtime -30 -printf "%TD %Tr - %p\n" 2> /dev/null | sort -r > /lastmodified.txt
Note that the sort will break in January as 12 is sorted before 01. If you want to make sure the dates are always in order, use for example time definition %T+ (2012-11-29+21:07:41.0000000000) or %Tu/%Tm/%Td %TH:%TM (12/11/29 21:07)
What about inotify-tools
https://github.com/rvoicilas/inotify-tools/wiki#wiki-getting
http://linux.die.net/man/1/inotifywait
inotifywait example 2
#!/bin/sh
EVENT=$(inotifywait --format '%e' ~/file1)
[ $? != 0 ] && exit
[ "$EVENT" = "MODIFY" ] && echo 'file modified!'
[ "$EVENT" = "DELETE_SELF" ] && echo 'file deleted!'
# etc...
I want to check files which are recently added to the folder in unix environment.
is there any find check
find -name 'filename' timestamp last 5 mins ??
To locate files modified less than 5 minutes ago
find -name 'filename' -mmin -5
From the man page:
-mmin n
File's data was last modified n minutes ago.
-mtime n
File's data was last modified n*24 hours ago.
-mmin is supported under most recent versions of GNU find.
To find all files modified in the last 24 hours (last full day) in current directory and its sub-directories:
find . -mtime -1 -print
Source
In zsh:
ls *(mm-5) # or 'mh' to detect stuff modified in the last 5 hours etc.