Find out recently updated or written files.

[Gulam Mohiuddin]

On our HP-UX server we have 4 mount points created on EMC DMX storage with about 200GB used space (storing about 50,000 static data files).

Although these mount points /u01, /u02, /u03 & /u04 should have absolutely static files and they should not grow or zero percent growth.

But some how used space on those mounts points is increasing, I would like to know which files are being updated or being written recently?

Need to figure out recently updated or written files.


Thanks,

Gulam.

[RAC_1]

ls -ltr --> Recently modified files
ls -lur --> Recently accesses files
ls -lcr --> Recently changed files

ls -ltr|sort -nk5, ls -lur|sort -nk5 and
ls -lcr | sort -nk5 also helps.

Anil

[Kasper Hedensted]

Hi Gulam,

You can use find
use option mtime

find . -mtime -2

it will list files modified within the last 2 days

Cheers,
Kasper

[Gulam Mohiuddin]

Thanks.

What about if we have lots of deep recursive directories.

Thanks,

Gulam.

[Pete Randall]

You can use find with either the -mtime or the -newer option. Check the man page for find.


Pete

[Gopi Sekar]

find is the best friend in these sort of situations where deep recursive is required and you are interested only for the resulting records.

check the -mtime option of find which should help you in this case

Regards,
Gopi

[Stefan Schulz]

Hi Guiam,

i think find is the tool for you. You can do a find with mtime for modification time or even ctime for creation time. Check the man page for more information.

If you have links in these directories i also would use -xdev so that symlinks to another device are not followed.

For large directories i would create a script to collect all this info and run it at night. Searching for files only and piping them to ll to get more informaiton:

find /u01 -type f -mtime -7 | ll > logfile

Hope this helps

Regards Stefan

[Mel Burslan]

as everyone agreed, find command is your best bet.

-mtime switch only has granularity of days level. If you are interested in finding files changed in the last few hours, you have to follow Pete's sugestion and use -newer switch. How you ask ? easy.

touch -t DDMMhhmm /tmp/reffile
find /directory/level -newer /tmp/reffile

hope this helps

[Gulam Mohiuddin]

Thanks everybody for your prompt responses and great help.

Regards,

Gulam.