script for Finding modified files in last 24hrs

[Muthyala]

Hi

I need a script that will find all the files in a particular directory that have been modified in the last 24 hrs.

TIA
Sri

[Jonathan Fife · Accepted solution]

find /dir -mtime -1

This will recursively search subdirectories as well.

HTH

[Pete Randall]

The mtime -1 approach is going to turn up files from yesterday, which may be up to 47 hours and 59 minutes old. If you want exactly the last 24 hours, use the touch command to create two reference files, one with the current time and one with a time stamp 24 hours prior. Then use the find command with the -newer and ! -newer (not newer) options.


Pete

[Jonathan Fife]

In my environments -mtime -1 limits the find to any files modified less than 1 day (24 hours) ago.

$ date
Thu Sep 14 12:35:24 EDT 2006
$ touch -t 0609131234 testfile
$ ls -l
total 32
-rw-r--r-- 1 fifejj users 0 Sep 13 12:34 testfile
$ find . -mtime -1
.
./.sh_history
$ touch -t 0609131244 testfile
$ find . -mtime -1
.
./.sh_history
./testfile


The -newer approach is certainly the way to go if you ever want increments more granular than a 24-hour period, though.

[TwoProc]

find / -mtime 0

works every time.

[James R. Ferguson]

Hi:

Whether you choose to use '-mtime' for 24-hour granularity or the '-newer' switch for granularity down to seconds of time, *limit* what is returned to *files* with '-type f' and add the '-xdev' switch to prevent crossing mountpoints. For example:

# find / -xdev -type f -mtime -2 | xargs ls -l

...would search the root ('/') directory looking for files (but not directories) that have been modified in the last 48-hours (2-days). This will likely expose some files in '/etc/ which is a subdirectory of '/' but it will *not* cross mountpoints (e.g. '/usr')!

Regards!

...JRF...

[Pete Randall]

Contemplate this, then:

# find /work1 -mtime -1 -exec ll {} \; |head -1
total 699798
-rw-rw-r-- 1 jjo develop 223969 Mar 23 2004 #allflex.txt#


# find /work1 -mtime +1 -exec ll {} \; |head -1
-rw-rw-r-- 1 root informix 21186 Sep 11 23:28 /work1/logs/www/2006-0
9-11.user_verif



# find /work1 -mtime 1 -exec ll {} \; |head -6
-rw-rw-r-- 1 root informix 53 Sep 13 11:19 /work1/logs/www/06-09-
13.prodcnt



I still think the -newer approach is the only way to be accurate.


Pete

[James R. Ferguson]

Hi Pete:

You are seeing the fallacy of not confining your search to *files*:

Compare these:

# find /path -mtime -1 -exec ll {} \; | head

# find /path -type f -mtime -1 -exec ll {} \; | head

In the first case, recently modified directories are examined by the 'ls'.

Regards!

...JRF...

[Muthyala]

TIA