topic Re: Inquiry on File in Operating System - Linux

Inquiry on File

Pando — Sat, 14 Apr 2007 03:16:23 GMT

Dear Gurus,

I would like to ask what does the letter "T" stands for in the file permission attribute? Below is the example:
-r-------T 1 daemon daemon 300 Apr 14 04:56 C0d569c2360.reply

Also, i would like to ask, how would i search files in a year basis say for example, i want to search for files for the year 2004?

Max points for all correct answers! Thanks!

Re: Inquiry on File

Dennis Handly — Sat, 14 Apr 2007 04:28:05 GMT

From ls(1):
T No execute/search by others; set sticky bit on execution

For 2004, you can just grep for 2004:
$ ll ... | grep -w 2004

You can add -R for recursive.

If you want to use find(1), you would have to set up two reference files, one on Dec 31, 2003 and one on Dec 31, 2004 and then:
$ touch 1231235903 jan-file
$ touch 1231235904 dec-file
$ find paths -newer jan-file ! -newer dec-file ! -name dec-file

Re: Inquiry on File

Robert-Jan Goossens — Sat, 14 Apr 2007 04:41:22 GMT

Hi Pando,

Have a look at this thread about the meaning of "sticky bit"

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=103855

# cd /tmp
# touch -mt 0401010000 ref1
# touch -mt 0412312359 ref2
# find /filesystem $ -type f -a -newer /tmp/ref1 -a ! -newer /tmp/ref2 $|xargs -n 100 ls -l {}

0412312359 ( 04 year, 12 mounth, 31 day, 23 hour, 59 minutes)

Hope this helps,
Robert-Jan

Re: Inquiry on File

Steven Schweda — Sat, 14 Apr 2007 05:30:43 GMT

I'm accustomed to dealing with /BEFORE and
/SINCE, where this problem doesn't arise, so
I see "find -newer" as badly designed, but
why would anyone want to leave a one-minute
hole in the year by specifyng "1231235904" or
"0412312359"? (And even adding ".59" to get
seconds seems like a bad idea to me.)

Assuming that "man find" is accurate (so that
"newer" really means "newer"), and that the
file system keeps date-time to better than
one-second precision, then it would appear
that "find" needs either "-newas" or "-older"
to do this job properly. But, in any case,
I'd specify midnight-to-midnight and not
midnight-to-almost_midnight (or
almost_midnight-to-almost_midnight) and take
my chances with a potential one-instant error
rather than with a one-minute (or one-second)
error. If the time resolution of the file
system is no better than one second, then
"-newer" with yyyy-12-31 23:59:59 should be
good enough, but using plain 23:59 seems like
asking for trouble.

Or am I missing something obvious (again)?

Re: Inquiry on File

john korterman — Sat, 14 Apr 2007 06:32:00 GMT

Hi,

....and a diplomatic compromise for finding the files whose last change of content was registered in 2004:

$ find . -type f -exec ls -l {} \;| awk '$8~/2004/{print $9}'

regards,
John K.

Re: Inquiry on File

Dennis Handly — Thu, 06 Oct 2011 23:11:52 GMT

>Steven: And even adding ".59" to get seconds seems like a bad idea to me.)

Ah, right. "touch -t" is needed, see JRF's post below.

>Assuming that "man find" is accurate (so that "newer" really means "newer"),

Yes, I found my dec file but not jan.

>that the file system keeps date-time to better than one-second precision

No, only seconds.

Re: Inquiry on File

Hein van den Heuvel — Sat, 14 Apr 2007 08:15:19 GMT

Steven >> Or am I missing something obvious (again)?

Yes, your are obviously missing VMS with where (most) utilities use a common set of file selection funtions (such as the / BEFORE and /SINCE mentioned). Where files have creation dates, and where date&time stamps are recorded in sub-second precision and where the system and thus dates are designed to last well beyond 2038.

Now if VMS could only do a FORK properly...

Cheers,
Hein.

Re: Inquiry on File

James R. Ferguson — Sat, 14 Apr 2007 10:34:31 GMT

Hi Pando:

In keeping with the philosophy that there's always more than one way to do something, here's a Perl solution to find (recursively) all files in a directory whose last modification year matches your specification:

# perl -MFile::Find -le 'find(sub{print $File::Find::name if -f && ((localtime((stat)[9]))[5])==$ARGV[0]-1900},".")' 2004

In general, 'cd' to the diretory of interest and pass the year for which you want to find files.

Regards!

...JRF...

Re: Inquiry on File

Steven Schweda — Sat, 14 Apr 2007 12:27:27 GMT

> No, only seconds.

Ok, fine. I suppose that a limitation like
that makes the "find" feature shortage more
tolerable. (I hear that it's also possible
to lean one drunk up against another drunk,
and get a configuration more stable than
either drunk trying to stand by himself.)

But 23:59 is still lame.

> Yes, your are obviously missing VMS [...]

It shows, doesn't it.

Re: Inquiry on File

James R. Ferguson — Sat, 14 Apr 2007 13:25:47 GMT

Hi (again):

Steven > But 23:59 is still lame

OK, I'll agree with that part, but the precision can easily be expanded to one-second resolution. As noted, the smallest granular resolution that stat() offers is in epoch seconds. The use of two reference times with 'find' can accommodate this (see the manpages for 'touch(1)').

# touch -mt 200312312359.59 /tmp/ref1
# touch -mt 200501010000.00 /tmp/ref2
# find . -type f -newer /tmp/ref1 -a ! -newer /tmp/ref2

...offers Pando the ability to find any file modified in the year 2004.

The Perl solution I suggested also adapts the maxiumum one-second resolution. Take your choice. Both are limited to the underlying granularity of the 'stat' structure (see the manpages for stat(5)).

Regards!

...JRF...

Re: Inquiry on File

Sandman! — Sat, 14 Apr 2007 15:16:32 GMT

See ls(1) and chmod(2) for the sticky bit and try the awk to find all 2004 files:

# find / -type f -exec ll + | awk '$8=2004'

~hope it helps

Re: Inquiry on File

James R. Ferguson — Sat, 14 Apr 2007 20:41:13 GMT

Hi (again):

Sandman's solution needs to escape the "+" character since it is special to the shell. Otherwise, the 'find' is correct as written. Thus:

# find / -type f -exec ll \+ | awk '$8=2004'

For the specific question asked, this works well. Using this technique for finding files in year N-1 where the current year is N will not always yield accurate results. For instance, in April 2007, when the time of last modification is less than six months ago as are October, November and December 2006, using 2006 as the 'awk' argument will *miss* file last modified in those months. This, of course, is the standard way 'ls' reports timestamps.

Regards!

...JRF...

Re: Inquiry on File

Pando — Sun, 15 Apr 2007 19:44:13 GMT

Dear Gurus,

Thanks for that wonderful insight! I am just curious, are the file with sticky bit safe to remove? :-(

Thanks!

Re: Inquiry on File

Sandman! — Sun, 15 Apr 2007 21:01:26 GMT

The sticky bit is meaningful only for executable files. No harm removing them as long you have valid backups in case the users suddenly find their apps no longer working.

Re: Inquiry on File

Dennis Handly — Mon, 16 Apr 2007 02:15:42 GMT

>JRF: Sandman's solution needs to escape the "+" character since it is special to the shell.

Which shell treats "+" special??

Re: Inquiry on File

James R. Ferguson — Mon, 16 Apr 2007 07:15:11 GMT

Hi (again):

Dennis > JRF: Sandman's solution needs to escape the "+" character since it is special to the shell. Which shell treats "+" special??

OK, this is interesting. If you examine the 'find(1)' manpages (either for 11.11, 11.23 or 11.31) they note under the discussion of '-exec cmd':

/* begin quote */

The end of cmd must be punctuated by a semicolon (;) or a plus sign (+) (semicolon and plus are special to the shell and must be escaped).

/* end quote */

I will agree, however, that the absence of the escape character doesn't seem to matter. Perhaps I tend to be very sensitive to regular expresssion quantifiers ;-)

Regards!

...JRF...

Re: Inquiry on File

Dennis Handly — Mon, 16 Apr 2007 20:54:13 GMT

>JRF: I will agree, however, that the absence of the escape character doesn't seem to matter.

The last time I asked this question, I postulated it could be due to context dependent files, which were removed with diskless workstations. But the main thing is that you don't know more about this than I do. ;-)

Re: Inquiry on File

James R. Ferguson — Tue, 17 Apr 2007 06:00:02 GMT

HI:

Dennis: But the main thing is that you don't know more about this than I do. ;-)

Excuse me, I'm missing something. Please enlighten me as to how I should interpret that. Given that you work for HP and have access to internals that the rest of us folks don't, I would assume that is a given. Perhaps you would clarify your remark.

...JRF...

Re: Inquiry on File

Dennis Handly — Tue, 17 Apr 2007 07:22:27 GMT

>JRF: Please enlighten me as to how I should interpret that.

The fact you don't have an existence proof other than the man page. An existence proof trumps hand waving and lack of an example. ;-)
I'm assuming there might be a reason for that man page entry, perhaps a different shell. Other than they just copied the ";" case.

Re: Inquiry on File

Patrick Wallek — Tue, 17 Apr 2007 08:16:02 GMT

Dennis,

I think you need to take a few chill pills!

You said: "The fact you don't have an existence proof other than the man page. An existence proof trumps hand waving and lack of an example. ;-)"

OK, so WHAT "existence proof" do you have? Perhaps you would be so kind as to share?

I would ask what we are supposed to go by other than man pages and documentation? That is all us non-HP types have access to. If the man pages are incorrect perhaps you should do something about it other than berating a Forums member that is quite knowledgeable and rather well respected.