how to find files modified in the last hour?

[Alex Georgiev]

Does anyone know of a good (efficient) way to find files that were modified in the last 1 hour? Preferrably restricted to one mount point.

I'm looking for something other than:

find /mnt -xdev -type f -print | xargs ll | ...
(then awk, then grep for date, so on & so forth)

Maybe some sort of accounting? Maybe a file system level command? Maybe a neat shell trick? Or a little known utility?

Thanks much in advance! Points will be assigned accordingly.

[Steven E. Protter]

shalom,

You are missing the mtime directive

-mtime +1

or

-mtime -1

I always forget plus or minus

:-)

SEP

[James R. Ferguson · Accepted solution]

Hi Alex:

Create a "reference" point:

# touch -mt 06260500 /tmp/myref

# find /path -xdev -type f -newer /tmp/myref

...This finds all files in /path, remains under that directory or mountpoint and returns files modified more recently than the 'mtime' associated with '/tmp/myref'.

Regards!

...JRF...

[James R. Ferguson]

Hi (again):

Note that the '-mtime' switch of 'find' has a granularity of 24-hours or 1-day. See the manpages for 'find'.

Regards!

...JRF...

[Alex Georgiev]

mtime and the rest of the find time arguments (ctime, atime) get rounded up to 24 hour increments. So with -mtime -1 you can find files modified in the last 24 hours... but not the last 1 hour.

Alas, just not granular enough.

P.S. + mean "more than" & - means "less than" if my memory serves me right.

[spex]

Alex,

Create a temp file using the 'touch' command, such that the modification time is one hour in the past. For example:

# date +%m%d%H%m
06261006
# touch -mt 06260906 /tmp/tdate
# ll /tmp/tdate
-rw-r--r-- 1 root root 0 Jun 26 09:06 /tmp/tdate

Then run 'find' with the '-newer' switch, taking advantage of this file:

find /mnt -newer /tmp/tdate -type f -xdev -exec ll {} \;

If the granularity is still too coarse, 'touch' will even let you set seconds in a file's mtime.

PCS