LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Find command confusion (https://www.linuxquestions.org/questions/linux-newbie-8/find-command-confusion-4175558370/)

skoda 11-09-2015 01:52 AM

Find command confusion
 
Hi folks,

what is the diffrent between below two commands.

Code:

#find /home/*/mail/ -type f -mtime +547 -exec du -ch {} +
it shows only 208 MB Total

But, if i execute the below command, i get 1.1G total
Code:

#find -P /home/*/mail/ -mindepth 1 -maxdepth 1 -mtime '+547' -exec du -ch {} +
:)

pan64 11-09-2015 02:03 AM

the first thing I would try is just echo /home/*/mail/ to see what is that exactly. Next, you can try strace the find command to see how is it working.

skoda 11-09-2015 02:10 AM

Quote:

Originally Posted by pan64 (Post 5446760)
the first thing I would try is just echo /home/*/mail/ to see what is that exactly. Next, you can try strace the find command to see how is it working.

Hi buddy,
here is a sample out oput for echo.

Quote:

echo /home/*/mail/
/home/ichilan/mail/
/home/imssafe/mail/
/home/lbilad1/mail/
/home/lhamidh/mail/
/home/lhudalk/mail/
/home/lwasath/mail/
/home/namdesi/mail/
/home/onelk/mail/
/home/iyawan/mail/

skoda 11-09-2015 02:12 AM

actually this is the exim mail server folder in a web server.

pan64 11-09-2015 02:14 AM

that won't help me to solve it but you can now check strace find to see what's happening.

skoda 11-09-2015 02:35 AM

Thanks buddy for the introduction of strace command. ill have a look.

berndbausch 11-09-2015 02:45 AM

Quote:

Originally Posted by skoda (Post 5446756)
Hi folks,

what is the diffrent between below two commands.

Code:

#find /home/*/mail/ -type f -mtime +547 -exec du -ch {} +
it shows only 208 MB Total

But, if i execute the below command, i get 1.1G total
Code:

#find -P /home/*/mail/ -mindepth 1 -maxdepth 1 -mtime '+547' -exec du -ch {} +

Puzzling! To get to the bottom of this, strace is perhaps a bit too heavy of a tool.

I would start with a simple
Code:

#find /home/*/mail/ -type f -mtime +547 -exec /bin/echo {} + >/tmp/findout1
#find -P /home/*/mail/ -mindepth 1 -maxdepth 1 -mtime '+547' -exec /bin/echo {} + >/tmp/findout2

then compare findout1 and findout2. Breathlessly awaiting your result!

skoda 11-09-2015 03:11 AM

Quote:

Originally Posted by berndbausch (Post 5446788)
Puzzling! To get to the bottom of this, strace is perhaps a bit too heavy of a tool.

I would start with a simple
Code:

#find /home/*/mail/ -type f -mtime +547 -exec /bin/echo {} + >/tmp/findout1
#find -P /home/*/mail/ -mindepth 1 -maxdepth 1 -mtime '+547' -exec /bin/echo {} + >/tmp/findout2

then compare findout1 and findout2. Breathlessly awaiting your result!


findout1 sample

Quote:

/home/chxxxxx/mail/xxxflower.com/mayada/.Sent/cur/1373376578.M370013P26657.host.xxxxx.com,S=365561,W=370345:2,S
/home/starxxxxx/mail/xxxaent.com/rizan/dovecot-uidvalidity.50cc8dbb
/home/abxxxxx/mail/xxxxxings.co/khan/.hiltiop/cur/1388727241.H349616P6578.host.cxxxxxx.com,S=1590:2,S
findout2 sample
Quote:

/home/xxxxlan/mail/xxxxxx.com
/home/xxxxsath/mail/.Drafts
/home/xxxxtain/mail/dovecot.index.log
:)

berndbausch 11-09-2015 04:36 AM

Quote:

Originally Posted by skoda (Post 5446805)
findout1 sample
...
findout2 sample
...

You have to check what's different between the two; samples won't cut it. A simple diff should suffice.
And if there is no difference, I will be even more puzzled :)

grail 11-09-2015 04:42 AM

From the current output I would think the answer is already obvious, the one with a min/max depth stops at the first level after /home/*/mail and then you get a total of that, whereas the other find
works its way down to a single file level and provides the information back, some of these files may never be found if first level after mail does not hold true to the mtime used in first example.

Of course, I could be wrong, but that is what I see :)

berndbausch 11-09-2015 05:35 AM

What's strange though is the fact that the find that stops at the first level yields 1.1GB, whereas the unlimited find only comes up with 200MB. Had it been the opposite, it would have been a clear cut case for me.
Another difference: The unlimited find only looks at regular files. But can there be 900MB of directories and symbolic links?

grail 11-09-2015 06:05 AM

hmmm ... I see where you are coming from, however, if the directory in the second command, where there is no restriction on file, could easily contain more than files matching the criteria add up to.
My thinking is that whilst the directory now matches the mtime, there may be little to no actual files that do, so the first find would not have gone there.

rknichols 11-09-2015 07:33 AM

Quote:

Originally Posted by skoda (Post 5446756)
Hi folks,

what is the diffrent between below two commands.

Code:

#find /home/*/mail/ -type f -mtime +547 -exec du -ch {} +
it shows only 208 MB Total

That totals the space for all ordinary files older than 547 days.

Quote:

But, if i execute the below command, i get 1.1G total
Code:

#find -P /home/*/mail/ -mindepth 1 -maxdepth 1 -mtime '+547' -exec du -ch {} +
:)
That shows the total space used (all the files) under any directories older than 547 days.


All times are GMT -5. The time now is 09:29 PM.