22 Oct 2018

find mtime: identify recent files in Unix

find command has a great operator for narrowing down the list of results: mtime.

as you probably know from the atime, ctime and mtime post, the mtime is a file property confirming the last time the file was modified.

find uses mtime option to identify files based on when they were modified.

Typical ways of using find mtime are shown below.

Find files modified in the last 24 hours

Thi can be useful for identifying current log files, like this:

greys@server:~ $ sudo find /var/log -mtime 0
/var/log/secure
/var/log/wtmp
/var/log/datadog
/var/log/datadog/trace-agent.log
/var/log/datadog/agent.log.329
/var/log/datadog/agent.log
/var/log/lastlog
/var/log/messages
/var/log/audit
/var/log/audit/audit.log
/var/log/audit/audit.log.1
/var/log/cron
/var/log/btmp
/var/log/grafana
/var/log/grafana/grafana.log
/var/log/grafana/grafana.log.2018-10-20.001

Each of the files from this list has been updated today. You can use the exec option of the find command to invoke ls command and show timestamps for each file:

greys@server:~ $ sudo find /var/log -mtime 0 -exec ls -ld {} \;
-rw------- 1 root root 1732312 Oct 20 17:18 /var/log/secure
-rw-rw-r--. 1 root utmp 105600 Oct 20 17:15 /var/log/wtmp
drwxr-xr-x 2 dd-agent dd-agent 4096 Oct 20 10:23 /var/log/datadog
-rw-r--r-- 1 dd-agent dd-agent 2639084 Oct 20 17:18 /var/log/datadog/trace-agent.log
-rw-r--r-- 1 dd-agent dd-agent 10485782 Oct 20 10:23 /var/log/datadog/agent.log.329
-rw-r--r-- 1 dd-agent dd-agent 6271115 Oct 20 17:18 /var/log/datadog/agent.log
-rw-r--r--. 1 root root 292876 Oct 20 17:15 /var/log/lastlog
-rw------- 1 root root 188372446 Oct 20 17:18 /var/log/messages
drwx------. 2 root root 4096 Oct 20 06:32 /var/log/audit
-rw------- 1 root root 2567908 Oct 20 17:18 /var/log/audit/audit.log
-r-------- 1 root root 8388638 Oct 20 06:32 /var/log/audit/audit.log.1
-rw------- 1 root root 41498 Oct 20 17:01 /var/log/cron
-rw------- 1 root utmp 6091392 Oct 20 17:14 /var/log/btmp
drwxr-xr-x 2 grafana grafana 4096 Oct 20 09:59 /var/log/grafana
-rw-r--r-- 1 grafana grafana 172 Oct 20 09:59 /var/log/grafana/grafana.log
-rw-r--r-- 1 grafana grafana 524 Oct 19 22:09 /var/log/grafana/grafana.log.2018-10-20.001

Find files modified more than 7 days ago

This doesn’t have to be 7 days, you can specify any number here. This command is useful for confirming which (log) files haven’t been modified for more than a week – it could mean they are safe to delete.

This is how a start of such a list would look (bear in mind I’m running this on October 20th, 2018):

greys@server:~ $ sudo find /var/log -mtime +7 -exec ls -ld {} \;
-rw------- 1 root root 2309193 Sep 23 03:29 /var/log/secure-20180923
-rw------- 1 root root 0 Oct 8 03:35 /var/log/maillog-20181014
-rw------- 1 root root 44268 Sep 30 03:50 /var/log/cron-20180930
drwxr-xr-x. 2 root root 4096 Sep 18 2017 /var/log/anaconda
-rw-------. 1 root root 0 Jan 19 2018 /var/log/anaconda/syslog
-rw-------. 1 root root 0 Jan 19 2018 /var/log/anaconda/program.log
-rw-------. 1 root root 0 Jan 19 2018 /var/log/anaconda/journal.log
-rw-------. 1 root root 0 Jan 19 2018 /var/log/anaconda/anaconda.log
-rw-------. 1 root root 0 Jan 19 2018 /var/log/anaconda/X.log

Find all the files modified in the last 30 days

Again, this doesn’t have to be exactly 30 days, it can be any number. I’m using 30 because it’s roughly 1 month and is a round enough number for backup/restore points.

Here I’m checking what’s been updated in my home directory in the past 30 days:

greys@server:~ $ sudo find /home/greys -mtime -30 -exec ls -ld {} \;
drwx------ 4 greys greys 4096 Sep 21 21:30 /home/greys
-rw------- 1 greys greys 7335 Oct 20 17:22 /home/greys/.bash_history
-rw------- 1 greys greys 162 Sep 21 21:30 /home/greys/.Xauthority

find mtime: identify recent files in Unix

Find files modified in the last 24 hours

Find files modified more than 7 days ago

Find all the files modified in the last 30 days

See Also

Contact Me

Recommended

IT Consultancy

Recent Articles

macOS Sequoia 15.0

Video: Has This Worked Before?

Homelab: Mac Pro 2013 32GB

Recent Tweets