finding newly generated files on hpux

[Shivkumar]

Dear Sirs,

Need command to find out newly generated files say today or yesterday in /var file system ?

Thanks,
Shiv

[Raj D.]

Hi Shiv ,

Her it is :


# cd /var
# find . -type f -ctime 0 -print

This will show all todays generated files,
( -ctime 1 , for yesterdays )


hth,
Raj.

[Raj D. · Accepted solution]

Hi Shiv ,

Here it is : (sorry spelling mistake in last post).


# cd /var
# find . -type f -ctime 0 -print

This will show all todays generated files,
( -ctime 1 , for yesterdays )


hth,
Raj.

[Raj D.]

Shiv (again),

Also you can use along with find command ,

-atime & -mtime .


-atime n True if the file access time subtracted from
the initialized time is n-1 to n multiples of
24 h. The initialization time shall be a time
between the invocation of the find utility
and the first access by that invocation of
the find utility to any file specified by its
path operands. The access time of
directories in pathname_list is changed by
find itself.

-mtime n True if the file modification time subtracted
from the initialization time is n-1 to n
multiples of 24 h. The initialization time
shall be a time between the invocation of the
find utility and the first access by that
invocation of the find utility to any file
specified in its path operands.

Further details : # man find

------------------------------------------


hth,
Raj.

[Shivkumar]

Raj, I tried this command but it doesn't seems to be giving the correct output.

# cd /var
# find . -type f -ctime 0 -print


Is this syntax right ?

[Raj D.]

Hi Shiv ,

You can try this ,

# cd /va
# find . -type f -ctime -1 -exec ll {} \;
------------------------------------------

[ -n ( -n means less than n ) ]

hope it helps,

hth,
Raj.

[Raj D.]

Shiv (again) ,

Here is a typical output , to see files created less than 1 day :

#[/var]
# find . -type f -ctime -1 -exec ll {} \;

-rw------- 1 root root 65860 Dec 24 20:00 ./opt/OV/tmp/OpC/itoseq
-rw------- 1 root root 59542 Dec 24 20:00 ./opt/OV/tmp/OpC/msgagtq
-rw-rw-rw- 1 root root 107377 Dec 24 20:19 ./opt/OV/tmp/OpC/monagtq
-rw------- 1 root root 6577016 Dec 24 20:00 ./opt/OV/tmp/OpC/guiagtdf
-rw-r--r-- 1 root root 0 Dec 24 20:19 ./opt/OV/tmp/OpC/moaJAAa02284
-rw-r--r-- 1 root root 0 Dec 24 20:19 ./opt/OV/tmp/OpC/moaKAAa02284
-rw-r--r-- 1 root root 0 Dec 24 20:16 ./opt/OV/tmp/OpC/moaIAAa02284
-rw-r--r-- 1 root root 0 Dec 24 20:16 ./opt/OV/tmp/OpC/moaMAAa02284
-rw-r--r-- 1 root root 0 Dec 24 20:16 ./opt/OV/tmp/OpC/moaNAAa02284
-rw-r--r-- 1 root root 0 Dec 24 20:15 ./opt/OV/tmp/OpC/moaLAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaGAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaDAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaBAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaHAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaAAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaEAAa02284
-rw-r--r-- 1 root root 0 Dec 24 19:55 ./opt/OV/tmp/OpC/moaFAAa02284
-rw-r--r-- 1 root root 0 Dec 23 23:55 ./opt/OV/tmp/OpC/moaCAAa02284
-rw-r--r-- 1 root root 590813 Dec 24 20:20 ./adm/cron/log
-rw-r--r-- 1 adm adm 1386420 Dec 24 19:45 ./adm/wtmp
-rw------- 1 root root 2426 Dec 24 19:45 ./adm/sulog
-rw-r--r-- 1 adm adm 52273 Dec 24 00:05 ./adm/sa/plot/cpu
-rw-r--r-- 1 adm adm 60022 Dec 24 00:05 ./adm/sa/plot/que
-rw-r--r-- 1 adm adm 78654 Dec 24 00:05 ./adm/sa/plot/swap
-rw-r--r-- 1 adm adm 106558 Dec 24 00:05 ./adm/sa/plot/scalls
-rw-r--r-- 1 adm adm 85594 Dec 24 00:05 ./adm/sa/plot/vmst
-rw-r--r-- 1 adm adm 57960 Dec 24 00:05 ./adm/sa/plot/fs1
-rw-r--r-- 1 adm adm 92530 Dec 24 00:05 ./adm/sa/plot/fs2
-rw-r--r-- 1 adm adm 37884 Dec 24 00:05 ./adm/sa/plot/fs3
-rw-r--r-- 1 adm adm 80595 Dec 24 00:05 ./adm/sa/plot/fs4
-rw-r--r-- 1 adm adm 5332 Dec 24 00:05 ./adm/sa/plot/fs5
-rw-r--r-- 1 adm adm 1620 Dec 24 00:05 ./adm/sa/plot/fs6
-rw-r--r-- 1 adm adm 2012 Dec 24 00:05 ./adm/sa/plot/fs7
-rw-r--r-- 1 adm adm 1599 Dec 24 00:05 ./adm/sa/plot/fs8
-rw-r--r-- 1 adm adm 3520 Dec 24 00:05 ./adm/sa/plot/fs9
-rw-r--r-- 1 adm adm 1656 Dec 24 00:05 ./adm/sa/plot/fs10
-rw-r--r-- 1 adm adm 92925 Dec 24 00:05 ./adm/sa/plot/fs11
-rw-r--r-- 1 adm adm 1620 Dec 24 00:05 ./adm/sa/plot/fs12
-rw-r--r-- 1 adm adm 58558 Dec 24 00:05 ./adm/sa/plot/fs13
-rw-r--r-- 1 adm adm 1584 Dec 24 00:05 ./adm/sa/plot/fs14
-rw-r--r-- 1 adm adm 23276 Dec 24 00:05 ./adm/sa/plot/fs15
-rw-r--r-- 1 adm adm 2107 Dec 24 00:05 ./adm/sa/plot/fs16
-rw-r--r-- 1 adm adm 1620 Dec 24 00:05 ./adm/sa/plot/fs17
-rw-r--r-- 1 adm adm 1656 Dec 24 00:05 ./adm/sa/plot/fs18
-rw-r--r-- 1 adm adm 1584 Dec 24 00:05 ./adm/sa/plot/fs19
-rw-r--r-- 1 adm adm 1584 Dec 24 00:05 ./adm/sa/plot/fs20
-rw-r--r-- 1 adm adm 1813 Dec 24 00:05 ./adm/sa/plot/fs21
-rw-r--r-- 1 adm adm 1850 Dec 24 00:05 ./adm/sa/plot/fs22
-rw-r--r-- 1 adm adm 1862 Dec 24 00:05 ./adm/sa/plot/fs23
-rw-r--r-- 1 adm adm 1900 Dec 24 00:05 ./adm/sa/plot/fs24
-rw-r--r-- 1 adm adm 2009 Dec 24 00:05 ./adm/sa/plot/fs25
-rw-r--r-- 1 adm adm 1813 Dec 24 00:05 ./adm/sa/plot/fs26
-rw-r--r-- 1 adm adm 1584 Dec 24 00:05 ./adm/sa/plot/fs27
-rw-r--r-- 1 adm adm 1584 Dec 24 00:05 ./adm/sa/plot/fs28
-rw-r--r-- 1 adm adm 4554 Dec 24 00:05 ./adm/sa/plot/fs29
-rw-r--r-- 1 adm adm 8004 Dec 24 00:05 ./adm/sa/plot/fs30
-rw-r--r-- 1 adm adm 1764 Dec 24 00:05 ./adm/sa/plot/fs31
-rw-r--r-- 1 adm adm 1836 Dec 24 00:05 ./adm/sa/plot/fs32
-rw-r--r-- 1 adm adm 1764 Dec 24 00:05 ./adm/sa/plot/fs33
-rw-r--r-- 1 adm adm 1800 Dec 24 00:05 ./adm/sa/plot/fs34
-rw-r--r-- 1 adm adm 1764 Dec 24 00:05 ./adm/sa/plot/fs35
-rw-r--r-- 1 adm adm 1728 Dec 24 00:05 ./adm/sa/plot/fs36
-rw-r--r-- 1 adm adm 1620 Dec 24 00:05 ./adm/sa/plot/fs37
-rw-r--r-- 1 adm adm 1512 Dec 24 00:05 ./adm/sa/plot/fs38
-rw-r--r-- 1 adm adm 1548 Dec 24 00:05 ./adm/sa/plot/fs39
-rw-r--r-- 1 adm adm 1548 Dec 24 00:05 ./adm/sa/plot/fs40
-rw-r--r-- 1 adm adm 1548 Dec 24 00:05 ./adm/sa/plot/fs41
-rw-r--r-- 1 adm adm 1548 Dec 24 00:05 ./adm/sa/plot/fs42
-rw-r--r-- 1 adm adm 1656 Dec 24 00:05 ./adm/sa/plot/fs43
-rw-r--r-- 1 adm adm 2208 Dec 24 00:05 ./adm/sa/plot/fs44
-rw-r--r-- 1 adm adm 1620 Dec 24 00:05 ./adm/sa/plot/fs45
-rw-r--r-- 1 adm adm 1404 Dec 24 00:05 ./adm/sa/plot/fs46
-rw-r--r-- 1 adm adm 7833 Dec 24 00:05 ./adm/sa/plot/fs47
-rw-r--r-- 1 adm adm 65956 Dec 24 00:05 ./adm/sa/plot/fs48
-rw-r--r-- 1 adm adm 63480 Dec 24 00:05 ./adm/sa/plot/fs49
-rw-r--r-- 1 adm adm 1476 Dec 24 00:05 ./adm/sa/plot/fs50
-rw-r--r-- 1 adm adm 1480 Dec 24 00:05 ./adm/sa/plot/fs51
-rw-r--r-- 1 adm adm 935 Dec 24 00:05 ./adm/sa/plot/fs.map
-rw-r--r-- 1 adm adm 11129 Dec 24 00:05 ./adm/sa/plot/caper.gp
-rw-r--r-- 1 adm adm 0 Dec 23 23:55 ./adm/sa/saerror.log
-rw-r--r-- 1 adm adm 3712 Dec 24 20:20 ./adm/sa/fsmon24.last
-rw-r--r-- 1 adm adm 46683 Dec 23 23:40 ./adm/sa/fsmon23
-rw-r--r-- 1 adm adm 242669 Dec 23 23:58 ./adm/sa/system1.cap.history
-rw-r--r-- 1 adm adm 3312875 Dec 23 23:58 ./adm/sa/system1.fs.history
-rw-r--r-- 1 adm adm 31014 Dec 24 20:20 ./adm/sa/fsmon24
-rw-r--r-- 1 adm adm 3801312 Dec 23 23:40 ./adm/sa/sa23
-rw-r--r-- 1 adm adm 116299 Dec 23 23:55 ./adm/sa/sar23
-rw-r--r-- 1 adm adm 69972 Dec 23 23:56 ./adm/sa/caper23
-rw-r--r-- 1 adm adm 3273352 Dec 24 20:20 ./adm/sa/sa24
-rw-r--r-- 1 adm adm 13752 Dec 24 00:00 ./adm/sa/vmst23
-rw-r--r-- 1 adm adm 10887 Dec 24 20:00 ./adm/sa/vmst24
-rw------- 1 adm adm 0 Dec 24 20:00 ./spool/cron/tmp/croutPQGa01871
-rw------- 1 adm adm 0 Dec 24 20:00 ./spool/cron/tmp/croutOQGa01871
-rw-r--r-- 1 root root 532 Dec 24 20:20 ./spool/pwgr/status
-rw-r--r-- 1 root root 48737 Dec 24 04:05 ./stm/data/ioscan_cksum.cur
-rw-r--r-- 1 root root 155720 Dec 24 20:13 ./stm/logs/os/ccbootlog
-rw-r--r-- 1 root sys 104527 Dec 24 19:45 ./log/sudo.log
-rw------- 1 root root 403318 Dec 24 20:20 ./ibm/tivoli/common/HCV/logs/msgHCV_Client.log
-rw------- 1 root root 1051315 Dec 24 16:30 ./ibm/tivoli/common/HCV/logs/msgHCV_Client1.log
-rw------- 1 root root 1051423 Dec 24 06:30 ./ibm/tivoli/common/HCV/logs/msgHCV_Client2.log
-rw-r--r-- 1 root sys 13 Dec 24 17:21 ./rjtest
-rw-r--r-- 1 root sys 144 Dec 24 19:46 ./test1

#[/var]
# date
Sat Dec 24 20:20:27 EST 2005
------------------------------------


Cheers ,
Raj.

[Shivkumar]

Raj,

I am not sure why this is not working for me ?

Please see the below output:-

# pwd
/var
# find . -type f -ctime -1 -exec ll {} \;
-rwxr-xr-x 1 root root 1 Feb 8 2004 ./adm/crash/bounds
-rwxr-xr-x 1 sksonkar users 68372480 Jun 2 2005
-rwxr-xr-x 1 root sys 1154 Jun 10 2005 ./adm/crash/wsrecord
-rwxr-xr-x 1 sksonkar users 0 Jun 13 2005 ./adm/crash/logtest/out
-rw-r----- 1 sksonkar users 1523712 Jun 24 2005 ./adm/crash/logtest/libHttpPlugin.sl

# date;pwd
Sat Dec 24 18:13:20 PST 2005
/var
# id
uid=0(root) gid=3(sys) groups=0(root),1(other),2(bin),4(adm),5(daemon),6(mail),7(lp),20(users)
#

Thanks,
Shiv

[A. Clay Stephenson]

Sadly, what you ask is impossible. UNIX has no notion of the time of creation of a file. ctime does not mean creation time but change time (time of last chmod, chown, chgrp). If ctime happens to be the time a file was created it is only coincidence.

[James R. Ferguson]

Hi Shiv:

It amazes me how misunderstood the 'ctime' is. 'ctime' is the time of the last status change for a file. This is spoken of as the *inode* change timestamp. There is *no* structure to specify the creation timestamp of a file.

Altering permissions; ownership; the name of a file; or using 'touch' to change a file's 'mtime' or 'atime', will alter the file's 'ctime'.

Some backup utilities, notably 'fbackup', will change the 'ctime' of a file since the utility copies a file and then resets its (last)access timestamp ('atime') to what it was before the copy began. This preserves a record of the file's last access for something other than backup at the expense of triggering an inode ('ctime') change.

When you use 'find' expressions the next time, first take a closer look at its manpages'. The value of 'n' that follows '-mtime' or '-atime' or '-ctime' can be negative, positive or unsigned. As noted there, an unsigned 'n' means exactly 'n'; a positve ('+n') means more than 'n'; and a negative ('-n') means less than 'n'. This is important when constructing expresssions using 'mtime', 'atime' and less often, 'ctime'.

Another way of finding files generated after some date is to use '-newer' as for example:

# touch -amt 12242359 /tmp/myref
# find /var -type f -newer /tmp/myref -exec ls -l {} \;

This will find all files in the '/var' directory that are more recently modified than December 24th at 23:59. For each file found, a long listing ('ls -l' will be executed for it).

You obtained confusing results when you erroneously mixed your use of '-ctime' with 'll'. Using '-ctime' in your 'find' expression looked for all files whose *inode* had changed, but when coupled with 'll' to list the file details, you got, by default, the *modification* or 'mtime' timestamp!

Similar 'find' expressions for finding files *accessed* before or after a particular time, or even finding files whose 'ctime' has *changed*, can be built with variations of the '-newer' operand. See the manpages for the appropriate syntax.

Have a look, too, at the manpages for 'stat(5). This will give you a clearer insight into the information that 'ls' returns and that 'find' can operate upon.

Regards!

...JRF...

[Rory R Hammond]

Shivkumar,

When I am looking for growing files in var,
I use the mtime and size of options

rory

[Shivkumar]

Rory, Which command syntax do you use ?

[James R. Ferguson]

Hi (again) Shiv:

The manpages provide most of the answer again. To see files in '/var' that exceed 10,000 bytes in size, for instance, and have been modified today, you could do:

# touch -amt 12242359 /tmp/myref

# find /var \( -newer /tmp/myref -a -size 10000c \) -exec ls -l {} \;

This finds files that are more recently modified than December 24 at 23:49 AND ('-a') are larger than 10,000 octets in size. When a file meets this criteria, a long-listing of its attributes are printed.

Note, that the normal specification of a size to 'find' is in 512-blocks. The 'c' modifier to the size dentoes a size in characters as opposed to blocks of 512-characters (octets).

Note that the parentheses surrounding the 'find' expression are escaped with back-slahses to prevent their interpretation by the shell. Their use, as is always the case, make boolean and algebraic logic unambigous. 'find' expects an expression to evaluate to "true" in order to return results.

Regards!

...JRF...

[Arunvijai_4]

Hi Shiv, As Clay and JRF said, you can't creation time in Unix, only the last modification time is stored in the table. Reading this thread may give good understanding,

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=956122

-Arun

[Yogeeraj_1]

hi,

in simple terms, you can just do the following to list the last files created by running:

ll -rtl |grep "`date "+%b\ %d"`"

hope this helps!

kind regards
yogeeraj

[Cem Tugrul]

Hi Shiv,

As an adition to other replies;Here are also
some good links;

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=816074

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=946914

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=746698

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=827930

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=947049

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=71495

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=127163

Good Luck,

[Arturo Galbiati]

Hi,
to see today files:
ll|grep "$(date +%b" "%e)"

HTH,
Art

[Elif Gius]

What you can try is to use the software called "tripwire".
You can configure "tripwire" which directories/files he has to watch.
Tripwire can say you which directories/files has been added/changed/deleted.

Maybe this is something for you.

[Henk Geurts]

we use not Tripwire but VSM-software with an agent on every unix-box reporting to a mainframeserver.
it can report every change in every filesystem, configurable from the server.

regards,

[Henk Geurts]

we use not Tripwire but VSM-software with an agent on every unix-box reporting to our mainframe.
it can report every change in every filesystem, configurable from the server.

regards,