problem with script to delete old files

[Matthew Couper]

Not exactly a script, but a line contained in a backup script.

find /usr/tmp -type f -atime +30 | cut -c 10- \
| grep -v -e / -e exp$ -e \' | xargs -i rm /usr/tmp/{}

If run as is (it's been commented out since this started) it takes out almost everything, lucky for me it didn't get anything anyone really cared about so I didn't have to go to tape!

If I take out the xargs at the end and just send it to a file it contains about half the files which include recent files.

So what it was doing before and not now was, removing any files that have not been accessed in the last 30 day excluding sub-directories.
I have no idea what changed but suddenly one day this line started removing the whole directory.

What could be wrong or what other way can I accomplish this?

[Jeff Schussele]

Hi Steve,

If all you want to do is rm files unmodified in the last 30 days in a dir, then all you need is:

find /dir_name -mtime +30 -exec rm {} \;

You don't need to worry about dirs as rm will not delete them - rmdir is needed.

You could add a -i to the rm command to prompt for verification...

HTH,
Jeff

[Steven E. Protter]

We do something similar out of cron

This little honey blows out core files older than 7 days

OLDEST=7

find / -type f -name core -mtime +${OLDEST} -print > ${RemoveList} 2>/dev/null

SEP

[Leif Halvarsson_2]

Hi,
If I understand uou correct you want to remove all files in /usr/tmp older then 30 days but not remove files in subdirectorys.
I found no easy solution but perhaps "dirname" can be used. Something like:

find usr/tmp -type f -atime +30 |while read file
do
if [ `dirname $file` = "/usr/tmp" ]
then
rm $file
fi
done

[John Kittel]

regarding why your command now fails, perhaps you could try putting it back in, but moodifying it so it doesn't remove files, but rather creates a listing of the files with their atime that you can look at later. This would be a better test of what it is doing in situ ( within your backup script) as it were, rather than playing with the command after the fact from a terminal session. for example:

... | xargs -i ls -lu /usr/tmp/{} > mylisting.out

or something like that...

- John

[John Kittel]

after re-reading your original question, I see that my suggestion to modify commmand in script to output to a file was something you already tried... however, if you didn't do that with ls -lu to get the atime in the output, I still think *that* part of my suggestion is worth a try...

- John

[James A. Donovan]

Did you change something in your backup procedure recently? Some backup methods will update atime with the time at which they were backed up.

[Jeff Schussele]

Hi Steve,

Sorry I didn't see that you didn't want to walk the tree with this.
One thought that crosses my mind is to build a file with the find output & then grep -v the file to remove any entry with a "/" in it & use that file to input to an rm command.
Something like:

find /dir_name -mtime +30 -exec ls {} >> /tmp/rm_files \;
grep -v "/" /tmp/rm_files > /tmp/rm_files_rm
while read X
do
rm /tmp/dir_name/$X
done < /tmp/rm_files_rm

I haven't debugged this but have tried it - seems to work OK, so do it with a rm -i the first time to verify.

HTH,
Jeff

[Jeff Schussele]

Sorry - line 5 should be:

rm /dir_name/$X

Jeff

[Matthew Couper]

Good suggestions, thanks
but...

When sending the output to a file and looking at what it captures, it seems to grab too much (files created recently) so I wonder if I need to add a mtime also? I need to preserve files that are still being accessed otherwise they will need to run that report again which might be very inconvient.

I'm looking at the output of this and it might be what I need, don't know why -atime alone doesn't handle it anymore...

find /usr/tmp -type f -atime +30 -mtime +30| cut -c 10- \| grep -v -e / -e exp$ -e \'|xargs -i ll /usr/tmp/{}

I'll swap the ll for an rm and I should see a lot of new space available (hopfully not TOO much! :)

[Jeff Schussele]

Hi Steve,

atime is access - the find itself will modify atime. mtime is modification or change of the file contents. ctime is inode attribute change - owner, perms, links etc.
Just *what* are you looking for in these files in the above?

Jeff

[John Kittel]

not sure if further clarification needed on this point, but if only for sake of interest in why current command fails, in the latest example of the command that you give, ll will output mtime, which will not necessarily illustrate what's heppening with the original version of your command with just -atime. Use ls -lu to get atime in output.

Also, following up on one of the other suggestions, I've also seen virus check s/w twiddle with atimes. So to reiterate that bit, if you've recently changed backup or virus check ( if any) s/w - those could be a cause of your backup script suddenly failing.

- John

[Matthew Couper]

Old files that are no longer needed/used
That last command using the rm did a good job
Doesn't look like find touchs the atime, you would need to open the file to touch it for the atime. I just ran about 20 finds on that directory today and came with the same results everytime
I'm not sure why filtering by atime +30 was giving files created 2 days ago (never been accessed so there was no atime to read?), but the addition of mtime +30 filtered out all of those giving me a list of what was mostly scratch files and forgotten user reports, perfect!
Not sure what was more helpful, all the feedback or me thinking 'outloud', anyway...thanks guys!

[John Kittel]

It's entirely possible to have atime older than modification time. For example, create a file right now. for example,

# touch myfile
# ll myfile
-rw-r--r-- 1 root sys 0 Nov 14 14:23 myfile
# ls -lu myfile
-rw-r--r-- 1 root sys 0 Nov 14 14:23 myfile
# touch -a -t 10010000 myfile
# ll myfile
-rw-r--r-- 1 root sys 0 Nov 14 14:23 myfile
# ls -lu myfile
-rw-r--r-- 1 root sys 0 Oct 1 00:00 myfile
#

- John

[Michael Schulte zur Sur · Accepted solution]

Hi Steve,

try this
find /usr/tmp -type f -atime +30 -prune -exec rm "{}" ";"

greetings,

Michael

[Bill Hassell]

Just a cosmetic note: /usr/tmp has not existed for the last 10 years or so. The directory name is /var/tmp. The reason this works is that /usr/tmp is actually a symbolic link. There is no /bin or /lib directory--same reason. These are called transition links meanung that you will be modifying all your old scripts to use the current V.4 filesystem layout standards. These transition links can be removed with tlremove and may not be the default in future releases of HP-UX.

[Michael Schulte zur Sur]

Hi Steve,

are you still with us? If so, is your problem solved?

greetings,

Michael.

[Matthew Couper]

Just to clearify, here's the final line that works for what I'm looking for...

find /usr/tmp -type f -atime +30 -mtime +30 | cut -c 10- | grep -v -e / -e exp$ -e \' | xargs -i rm /usr/tmp/{}


Thanks again for all the help!