problems with the "last accessed" time on a file

[Troy Nightingale]

I have some developer files on a dev server that are owned by a former employee. The account has been disabled, but these outstanding files have become a problem. It seems that he has moved some scripts into place that are both useful and necessary, but they are owned by him. I want to be able to find out how many more of these there are without my last experience in trial and error.

I have tried to use find with the -atime flag. However, it does not appear to work. If a file is opened or read, I would expect that to count as an access. It only seems to change the accessed property when the modified property is changed. Am I doing something wrong? All of these are using HP-UX 11.00 and higher.

Thanks.

[Tim Nelson]

The find command with the -atime switch will find the defined access time ( the first time ). The find command itself will cause an update to the access time when it runs so effectively you can only run this once

( this is stated in the man pages for find )

[James R. Ferguson]

Hi Troy:

Make sure that you are looking at the files you think you are:

# find /tmp -xdev -type f -atime -14 -exec ls -ul {} \+

...would find *files* (but not directories) in the '/tmp' path whose last-access time was during the last 14-days. The files meeting this criteria would have their *last-access* timestamp printed with an 'ls -ul'.

The addition of '-xdev' prevents crossing mountpoints. This is necessary if you are examining the '/' directory and want to visit directories like '/etc/ and '/sbin', but not '/tmp' or '/var'.

By the way, merely opening a file does not change its last access time. You must read/execute it to change this value.

Regards!

...JRF...

[john korterman]

Hi Troy,

you could try a different approach. If the user still exists in /etc/passwd, e.g. name "developerX" you can try searching for files owned by him, e.g.:
# find / -user developerX

If the user does no longer exist you can search for unowned files, e.g.:
find / -nouser

both possibilities can of course be used in combination with other options.

regards,
John K.