how to list all changed/added files under file systems?

[Hanry Zhou]

I have several file systems, and wanted to list all chnaged/added files under these fs's in last 24 hours. Please help me with commands. Thanks,

[TwoProc]

Well, to do this properly you should be using something like TripWire.

Short of that, go to each file system and run:

cd /filesystema
find . -xdev -depth -mtime 0 -exec ls -al {} \; > /tmp/changed_file_list.log

If you want to do the whole server and are willing to wait...

cd /
find . -depth -mtime 0 -exec ls -al {} \; > /tmp/changed_file_list.log

[James R. Ferguson]

Hi Hanry:

If by "changed" you mean 'modified' do:

# find /path -xdev -mtime -1

This finds all files in /path that have been modified in the last 24-housrs where each increment equals 24-hours.

If you mean an "chage" in permissions, ownership or modification, use:

# find /path -xdev -ctime -1

The 'ctime' tracks changes in a file's inode.

See the manpages for 'find' for more information!

...JRF...

[TwoProc]

In re-reading my prev post, I realized you may not understand how "-mtime 0" gives you "the last 24 hours". This is because that mtime argument is number of days. Day 0 is the last 24 hours (it considers 24 hours from now a "day" - not to be confused with calendar days).

0 = last 24 hours
1 = 24 to 48 hours ago
+1 = more than 48 hours ago
+0 = more than 24 hours ago

etc...

[Hanry Zhou]

can I use "rsync" command to achieve the same? Because it'd be better for me to use rsync.

[TwoProc]

I thought you wanted just to list the files that have changed over the last 24 hours.

Rsync is a tool to sync two file systems together,
but ...

You "can" use rsync in a "dry-run" mode to see the files that need to change since the last rsync, IF that was 24 hours ago, AND the source machine that you're rsyncing from *hasn't* changed in the last 24 hours. It can get a little funny over file deletes though...

man rsync and look for the "dry-run" option...
"--dry-run" would be the command to merely review the changes that rsync would make.

[A. Clay Stephenson]

Rsync is normally used to sync one set of files to another; you could use the -n option to show what files would be copied but in order for that to work you would have to have a reference filetree with which to compare. This is really not a task for rsync. Find will do what you asked; however; (more or less) What about files that have been removed? There is really no easy answer for those unless you do a find each day and list the files and the timestamps and compare that to the current list.

[James R. Ferguson]

Hi (again) Hanry:

You're original query suggested that all you wanted was to list files that have been changed or added during the last 24-hours.

The 'find' command used as I showed accomodates this quite easily. You can redirect your output to a file if you want!

Remote file synchronization/distribution is designed to tranfer from one server to another files that have been changed. You don't need that layer simply to see files modified/changed!

Regards!

...JRF...

[Hanry Zhou]

I tried both following commands as suggested, but they all also pulled out files not in last 24 hours. I believe, the reason is because they listed these files undernead directories that have been modified/new created in last 24 hours. How can we list files, and not old files under the new directories? I need -exec ls -lt, because I need to have the full names, and therefore I can caclulate the total space of being occupied by these files.


find . -xdev -depth -mtime 0 -exec ls -al {} \; > /tmp/changed_file_list.log

# find /path -xdev -mtime -1 -exec ls -at {} \;

[James R. Ferguson · Accepted solution]

Hi Hanry:

I'm sorry, I should have restricted things to *files* only:

# find /path -xdev -type f -mtime -1
# find /path -xdev -type f -ctime -1

Also, far kinder on your system's performance is the use of 'xargs' instead of '-exec':

# find /path -xdev -type f -mtime -1|xargs ls -l

...The above does the same thing as:

# find /path -xdev -type f -mtime -1 -exec ls -l {} \;

...but the 'xargs' filter bundles *multiple* filenames and runs then as "one" instatantiation of 'ls'.

Please see the 'xargs' manpages for more information.

Regards!

...JRF...