find and -atime

[Dean Ross-Smith]

this has been discussed many times but I'm getting inexplicable results.

I have a spooler directory that has 25,000 files in it. It regularly get wacked to remove files older than six months but stays at the 25k threshold.
I'd like to cut that down to just a couple of thousand files, hopefully by using -atime. Most of these files are looked at once or not at all by the users.

From what I've seen I need to create a reference file with an atime on it such as
touch -a 200906031707 /tmp/reference.file
would create a file with an access time of 20 days ago.
Then run a find command
find ./ -type f ! -newera /tmp/reference.file
to find files older than the reference date.

My problem is I always get back 12k files no matter what I touch the access time to be- 3 years ago or today
touch -a 200606031707 /tmp/reference.file
touch -a 200906231707 /tmp/reference.file
gives the same results. I'd expect the 2006 atime to give zero files back.
The only thing I can think of is the vxfs file system was mounted with no some sort of noatime switch.

Ideas appreciated.

[Steven Schweda]

I've never used a fancy "-newerXY" option,
but you seem to be setting the access time
("touch -a") of your reference file, while
"-newera" is equivalent to "-neweram", that
is, "find" is comparing the access time of
the current file with the _modify_ time of
your reference file.

I'd vote for a plain
touch
and then
find [...] -newera

But, as usual, many things are possible.

man find
man touch

[Steven Schweda]

> [...] I'm getting inexplicable results.

"unexplained" and "inexplicable" are spelled
differently for a reason.

[Dennis Handly]

Any reason you are using access time instead of modification time?
I would have thought that file in the spooler directory are only accessed when they are printed. Unless you have used disable(1) and still have accept(1m)?

And even if you have, a normal user can't access these files??
-r--r----- 1 lp lp 121 Jun 23 20:24 cA0351hpcll183
-r--r----- 1 lp lp 6588 Jun 23 20:24 dA0351hpcll183

[Dean Ross-Smith]

I should clarify that the directories involved are spooler directories for the app on the server but this isn't the print spooler- the files in these directories can be viewed onscreen or printed to the print spooler (over 200 queues there) at any time.
Just using -mtime doesn't work in this case. The system generates 2-3k files a week and I'd like to have less than that number of files left after cleanup. I'm hoping to use atime so I can figure out what files have been accessed after they were generated and dump the rest

[James R. Ferguson]

Hi Dean:

> The only thing I can think of is the vxfs file system was mounted with no some sort of noatime switch.

That's possible on 11.23 or later. You can verify this by examining the entry for the filesystem in question in '/etc/mnttab'. If 'noatime' is enabled, you will see it there.

Regards!

...JRF...

[Dean Ross-Smith]

After looking around a bit I found that I'm using nodatainlog as a mount option:
mount
/app on /dev/dsk/c19t0d6 delaylog,nodatainlog,nolargefiles on Tue Oct 14 20:14:42 2008


according to the mount_vxfs man page it says that this may affect a time stamp:

mount_vxfs(1M)

NAME
mount, umount - mount and unmount a VxFS file system
....snip....
datainlog|nodatainlog
Generally, VxFS does O_SYNC or O_DSYNC writes by
logging the data and the time change to the
inode (datainlog). If the nodatainlog option is
used, the logging of synchronous writes is
disabled; O_SYNC writes the data into the file
and updates the inode synchronously before
returning to the user.

So does using nodatainlog cause my time problem or is it just changing the write method?

[TTr]

> but this isn't the print spooler- the files in these directories can be viewed onscreen or printed to the print spooler (over 200 queues there) at any time.

How are the files viewed? Is ther an app that reads the files to generate a listing so that the files are selected for viweing from an on sceen list? If so that's what makes the atime current. Do these files have a name that has a number sequence in it like the lp spooled files? If so you can use the sequence part to cleanup the old files.

It does not look like the (no)datainlog option has anything to do with atime of closed files.

[Dean Ross-Smith]

That's what's happening...
I verified with the users that when a list of reports is being viewed the atime is updated on the unix side of things. The report viewer is looking at a header line in the file.
Nuts to me I guess- I'll have to come up with another way of getting done what needs to be done. Thanks all!

[TTr]

What about the file naming? Do they have a pattern with a number sequence in them just like printer spooled files?