I am on the Ubuntu OS. I want to grep a word (say XYZ) inside all log files which are created within date range 28-may-2012 to 30-may-2012.
How do I do that?
This is a little different from Banthar's solution, but it will work with versions of find that don't support -newermt and it shows how to use the xargs command, which is a very useful tool.
You can use the find command to locate files "of a certain age". This will find all files modified between 5 and 10 days ago:
find /directory -type f -mtime -10 -mtime +5
To then search those files for a string:
find /directory -type f -mtime -10 -mtime +5 -print0 |
xargs -0 grep -l expression
You can also use the -exec switch, but I find xargs more readable (and it will often perform better, too, but possibly not in this case).
(Note that the -0 flag is there to let this command operate on files with embedded spaces, such as this is my filename.)
Update for question in comments
When you provide multiple expressions to find, they are ANDed together. E.g., if you ask for:
find . -name foo -size +10k
...find will only return files that are both (a) named foo and (b) larger than 10 kbytes. Similarly, if you specify:
find . -mtime -10 -mtime +5
...find will only return files that are (a) newer than 10 days ago and (b) older than 5 days ago.
For example, on my system it is currently:
$ date
Fri Aug 19 12:55:21 EDT 2016
I have the following files:
$ ls -l
total 0
-rw-rw-r--. 1 lars lars 0 Aug 15 00:00 file1
-rw-rw-r--. 1 lars lars 0 Aug 10 00:00 file2
-rw-rw-r--. 1 lars lars 0 Aug 5 00:00 file3
If I ask for "files modified more than 5 days ago (-mtime +5) I get:
$ find . -mtime +5
./file3
./file2
But if I ask for "files modified more than 5 days ago but less than 10 days ago" (-mtime +5 -mtime -10), I get:
$ find . -mtime +5 -mtime -10
./file2
Combine grep with find:
find -newermt "28 May 2012" -not -newermt "30 May 2012" -exec grep XYZ \{\} \;
find doesn't seem to have options where you can specify specific dates for timestamp comparison (at least the version on my laptop doesn't - there may be other versions and/or other tools that perform similarly), so you'll have to use the number of days. So, as of 2012/06/05, you want to find files newer than 9 days but older than 6 days:
find . -type f -ctime -9 -ctime +6 -print0 | xargs -0 grep XYZ
Related
I am trying to delete all files that are older than 7 days. The command is working but not correctly.
find '/files/tem_data/' -mtime +7 -exec rm -rf {} \+
It does delete files but it's not accurate.
ls -Artl | head -n 2
The find does delete files, but when I run the ls command does contain files that should be deleted. For example today is November 7th. The find should delete all files before November 1st. It does not. The command leaves files that are in October 30 and 31. How can I delete files that are older than 7 days.
If I run find command like 3 minutes later. It deletes files with the date of October 30 and a time of 3 minutes after it first ran.
From man find:
-atime n
File was last accessed n*24 hours ago. When find figures out how many
24-hour periods ago the file was last accessed, any fractional part is
ignored, so to match -atime +1, a file has to have been accessed at least
two days ago.
This means that your command actually deletes files that were accessed 8 or more days ago.
Since the time now is
$ date
Tue Nov 7 10:29:29 PST 2017
find will require files need to be older than:
$ date -d 'now - 8 days'
Mon Oct 30 11:29:05 PDT 2017
In other words, leaving some files from Oct 30 is expected and documented behavior.
To account for find rounding down, simply use -mtime +6 instead.
This is not the exact answer but you can try this as an sample.
find /path/to/ -type f -mtime +7 -name '*.gz' -execdir rm -- '{}' \;
Or for an alternative and also faster command is using exec's + terminator instead of \;:
find /path/to/ -type f -mtime +7 -name '*.gz' -execdir rm -- '{}' +
or
find /path/to/ -type f -mtime +7 -name '*.gz' -delete
find: the unix command for finding files/directories/links and etc.
/path/to/: the directory to start your search in.
-type f: only find files.
-name '*.gz': list files that ends with .gz.
-mtime +7: only consider the ones with modification time older than 7 days. -execdir ... \;: for each such result found, do the
following command in rm -- '{}': remove the file; the {} part is
where the find result gets substituted into from the previous part.
-- means end of command parameters avoid prompting error for those files starting with hyphen
.
In linux, using bash, what's the easiest way to find files that were modified more than an hour ago but less than 3 days ago?
Surely, there's got to be an easy way to do this. I keep searching and can't find an easy solution.
Find has -mtime and -mmin:
find . -mtime +3 -mmin -60
From the find manual:
Numeric arguments can be specified as:
+n for greater than n
-n for less than n
n for exactly n
This should suffice: find . -mtime -3 -mmin +60
I just tried it:
find ./ -mtime -3 -mmin +60 -exec ls -lhrt {} \; | awk '{print $5" "$6" "$7" "$8}'
I would like to delete files that are older than 59 minutes. I have this so far:
find /tmp -daystart -maxdepth 1 -mmin +59 -type f -name "*.*" -exec rm -f {} \;
This doesn't work and seems to delete all files. I've tested this several times and I think the issue is to do with daystart.
I've read the man page and it seems to base time on the beginning of the day rather than from 24 hours ago. If this is the case how can I accurately delete files that are older than 59 minutes? Do I need to account for daystart and add some more minutes?
Example:
ubuntu#ip-10-138-30-118:/tmp$ ls -la
total 8
drwxrwxrwt 2 root root 4096 Jul 20 14:39 ./
drwxr-xr-x 23 root root 4096 Jun 25 18:34 ../
-rw-rw-r-- 1 ubuntu ubuntu 0 Jul 20 12:35 a.txt
Both the following commands, return the file:
ubuntu#ip-10-138-30-118:/tmp$ find /tmp -daystart -maxdepth 1 -mmin +59 -type f -name "*.*"
/tmp/a.txt
And:
ubuntu#ip-10-138-30-118:/tmp$ find /tmp -daystart -maxdepth 1 -mmin +359 -type f -name "*.*"
/tmp/a.txt
However, the file is not older than 659 minutes (10.9 hours)! But at 759 (12.65 hours), it doesn't return the file anymore?
When used with -mmin, -daystart appears to make it calculate from the end of today, not the beginning.
If you just want to find files modified more than 59 minutes ago, you don't need that option. -mmin calculates from the current time by default.
barmar#dev:~/testdir$ date
Sat Jul 20 10:02:20 CDT 2013
barmar#dev:~/testdir$ ls -l
total 0
-rw-r--r-- 1 barmar adm 0 Jul 20 09:57 a.txt
barmar#dev:~/testdir$ find . -maxdepth 1 -mmin +2 -type f
./a.txt
barmar#dev:~/testdir$ find . -maxdepth 1 -mmin +10 -type f
this should work for you
find /path -mmin +59 -type f -exec rm -fv {} \;
I'd like to list out all files with modification dates in the last n days (or even simply after Y-m-d) in a directory. It must work recursively through all subdirectories as well.
How can I do this?
Ideal output:
file.txt Mar 26 15:15
file2.txt Mar 27 01:15
Acceptable output:
file.txt
file2.txt
Answered! (Thanks for all the help)
$ find . -type f -mtime -1 -exec ls -lah {} \;
-rw-r--rw- 1 apache apache 18K Mar 26 08:22 ./file1.txt
-rw-r--rw- 1 apache apache 12K Mar 26 09:23 ./dir1/file2.txt
-rw-r--rw- 1 apache apache 16K Mar 26 10:24 ./dir1/dir2/file3.txt
find . -type f -mtime -1 -exec ls -l {} \;
will list all files within last 24 hours, with a long listing just to confirm modification date
use :
find . -mtime +1
For more informations, see
man find
find dir -mtime +1 -print
That will find all files in dir and subdirectories that were modified 1 day ago or before that.
How do I find all the files that were create only today and not in 24 hour period in unix/linux
On my Fedora 10 system, with findutils-4.4.0-1.fc10.i386:
find <path> -daystart -ctime 0 -print
The -daystart flag tells it to calculate from the start of today instead of from 24 hours ago.
Note however that this will actually list files created or modified in the last day. find has no options that look at the true creation date of the file.
find . -mtime -1 -type f -print
To find all files that are modified today only (since start of day only, i.e. 12 am), in current directory and its sub-directories:
touch -t `date +%m%d0000` /tmp/$$
find . -type f -newer /tmp/$$
rm /tmp/$$
Source
I use this with some frequency:
$ ls -altrh --time-style=+%D | grep $(date +%D)
After going through many posts I found the best one that really works
find $file_path -type f -name "*.txt" -mtime -1 -printf "%f\n"
This prints only the file name like
abc.txt not the /path/tofolder/abc.txt
Also also play around or customize with -mtime -1
This worked for me. Lists the files created on May 30 in the current directory.
ls -lt | grep 'May 30'
Use ls or find to have all the files that were created today.
Using ls : ls -ltr | grep "$(date '+%b %e')"
Using find : cd $YOUR_DIRECTORY; find . -ls 2>/dev/null| grep "$(date '+%b %e')"
find ./ -maxdepth 1 -type f -execdir basename '{}' ';' | grep `date +'%Y%m%d'`
You can use find and ls to accomplish with this:
find . -type f -exec ls -l {} \; | egrep "Aug 26";
It will find all files in this directory, display useful informations (-l) and filter the lines with some date you want... It may be a little bit slow, but still useful in some cases.
Just keep in mind there are 2 spaces between Aug and 26. Other wise your find command will not work.
find . -type f -exec ls -l {} \; | egrep "Aug 26";
If you're did something like accidentally rsync'd to the wrong directory, the above suggestions work to find new files, but for me, the easiest was connecting with an SFTP client like Transmit then ordering by date and deleting.
To get file before 24 hours execute below command:
find . -type f -mtime 1 -exec ls -l {} \;
To get files created today execute below command:
find . -type f -mtime -1 -exec ls -l {} \;
To Get files created before n days before, where +2 is before 2 days files in below command:
find . -type f -mtime +2 -exec ls -l {} \;