topic Re: Looking for files hours/mins old in Operating System - HP-UX

Looking for files hours/mins old

Jim Griffiths — Mon, 02 Dec 2002 16:27:08 GMT

Hi,

Does anyone have a script for this or suggestions as to the best way of writing one? Just to be clear this is the problem whereby find works on a granularity of days when searching for files. I have to process files depending on how old they are, but typically hours/mins not days. I have an idea of piping ls -t into awk or cut or something, converting the hours/mins to a number and comparing to system time (also converted to something I can manipulate as a number) BUT think I might have a problem with "day boundaries" eg script runs hourly say for files 2 hrs old (say), runs at 1am but fails to pick up files with modification date/time just prior to midnight.

Any idea?

Thanks,

Jim

Re: Looking for files hours/mins old

Patrick Wallek — Mon, 02 Dec 2002 16:30:45 GMT

I think what you need to look at is the -newer option to find. You can 'touch' a file and give it a particular timestamp, for example 'touch 12021000 testfile' will create a file with the timestamp of today at 10:00. Once that is done you can use the -newer option to find to find file(s) that are newer than the file you just created. 'man find' for more details on '-newer'.

Re: Looking for files hours/mins old

Pete Randall — Mon, 02 Dec 2002 16:31:26 GMT

Jim,

Check out this thread (in particular, JRF's answer concerning "newer"):

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xf6640fe6d0f7d61190050090279cd0f9,00.html

Pete

Re: Looking for files hours/mins old

Shannon Petry — Mon, 02 Dec 2002 16:31:46 GMT

Take a bit of creativity, but you can do this with 2 commands.

First, touch a new file. This is a base file.
Next, find has an option that you can look at a template file for datestamp. Now just use find's args to see if something is older than the file.

If you really need to be specific about 2 hours old, then your forced to look at the current `date +%H` and subtract from it the timestamp field with lots of purdy awk expressions.

Regards,
Shannon

Re: Looking for files hours/mins old

John Poff — Mon, 02 Dec 2002 16:32:55 GMT

Hi Jim,

One way to do it might be to use 'touch' to create a file with a specific date/time stamp, and then use 'find' to get all the files newer than your touch file. Something like this:

touch -t 12021005 myfile

find . -newer myfile

That should find the files newer than 'myfile', which should have a timestamp of 10:05am. The 'find' command will find anything newer than the myfile timestamp, so it should have any problems with midnight, etc.

Does that help?

JP

Re: Looking for files hours/mins old

MANOJ SRIVASTAVA — Mon, 02 Dec 2002 16:40:06 GMT

Hi Jim

Basically the approach is to use awk and create the list of file using a specific combination

for eg

ls -lR | awk '{if($6=="Aug" && $7=="8" ) print $NF }'

will pritn all files created on that particualr day , you can be creative with == expresions and use > or < and also in case you want a specific time range may be you can again use the same command and compare the time stamp field.

Manoj Srivastava

Re: Looking for files hours/mins old

James R. Ferguson — Mon, 02 Dec 2002 16:53:00 GMT

Hi Jim:

'find' can to this quite easily. Consider the case where you want to find files modified between 12/02/2002 and 12/02/2002:

# cd /tmp
# touch -mt 12020000 ref1
# touch -mt 12020800 ref2
# find . $ -type f -a -newer /tmp/ref1 -a ! -newer /tmp/ref2 $|xargs -n 100 ls -l {}

Notice that 'find' is restricted to entities that are of type "file". In this example, the files are simply listed. A pipe to 'xargs' is used in place of adding an '-exec' to the 'find' since it is less resource intensive on your system. An 'exec' will cause a process to be spawned for every file found. The 'xargs' will block (bundle) '-n' arguments at a time, greatly reducing process overhead.

See the man pages for more information and options.

Regards!

...JRF...

Re: Looking for files hours/mins old

Jim Griffiths — Mon, 02 Dec 2002 18:10:46 GMT

All of some help, Thanks, but a bit of clarification. I want to able to process files eg say OVER 2hrs old(Shannon - don't need exactly 2hrs old). Pete - 2nd link on suggested thread might of some use if I can decipher a suggested C program. If I have to use the -newer qualifier, with the script in a cron job I could presumably have the script generate (or touch a file) to be used with find -newer 2 hrs LATER if you see what I mean! What do you think?

Thanks,

Jim

Re: Looking for files hours/mins old

Jim Griffiths — Mon, 02 Dec 2002 18:17:36 GMT

JFR,

Apologies, I see what mean, I can essentially do the same thing and generate a file with desired modification time using touch -mt

Thanks, I think I'm sorted,

Jim

Re: Looking for files hours/mins old

john korterman — Mon, 02 Dec 2002 20:58:50 GMT

Hi Jim,
maybe a little late, but I have dealt something similar, namely a request that the number of seconds since the last modfication time of a certain file be written out.
The approach used is a good deal slower that the other suggestions, but also has some good sides.

The last modification of the file - to get the second also - was obtained like this:
# echo | cpio -o 2>/dev/null | cpio -ivt 2>/dev/null

Output example for /etc/passwd:
100444 root 2685 Nov 15 12:56:17 2002 /etc/passwd

The attached script can be used (with 7 parameters, see explanation in script) for returning the number of seconds elapsed since unix start, i.e. midnight Jan 1, 1970, and a specified date, e.g Nov. 15 2002 12:56:17, example:

# ./return_seconds.sh 1970 2002 Nov 15 12 56 17
# 1037364977

The number of seconds since unix start and current "date" can be calculated by running the attached script without parameters, e.g.:
# ./return_seconds.sh
# 1038863680

Difference:
# echo 1038863680 - 1037364977 | bc
# 1498703

The first parameter of the script can be used to define a year to whose midnight to count back to; if you expect a difference of hours only you can increase execution speed considerably by entering "current minus one".

Hope it is of some use,
John K.