find -mtime gives unexpected results

amchargue · 08-12-2010, 03:53 PM

Code:

$ ls -l
-rw-r--r--  1 username vuser 35553 Aug  9 18:15 note.20100809_1815.sql
-rw-r--r--  1 username vuser 35553 Aug 10 00:15 note.20100810_0015.sql
-rw-r--r--  1 username vuser 35670 Aug 10 04:15 note.20100810_0415.sql
-rw-r--r--  1 username vuser 35670 Aug 10 06:15 note.20100810_0615.sql
-rw-r--r--  1 username vuser 35661 Aug 10 12:15 note.20100810_1215.sql

$ date
Thu Aug 12 14:49:54 MDT 2010

$ find -mtime +2
$ find -mtime +1
./note.20100810_0415.sql
./note.20100810_0615.sql
./note.20100810_0015.sql
./note.20100810_1215.sql
./note.20100809_1815.sql

Why doesn't find -mtime +2 give any result? Doesn't that mean 2 or more days ago (or more than 2 days ago)? If today is Aug. 12 then the Aug. 9 file should match, no?

Curiously yours,
a

Tinkster · 08-12-2010, 03:57 PM

What's the filesystem? What does -ctime +2 find?

GrapefruiTgirl · 08-12-2010, 04:06 PM

At 6:15 pm your time, the +2 should match.

It has to do with `find` rounding and disposing of time periods not equal to or greater than a full 24 hour period (i.e fractional 24 hour periods are discarded).

From the man page:

Quote:

-atime n
File was last accessed n*24 hours ago. When find figures out how many 24-hour periods ago the file was last accessed, any fractional
part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago.

The same as above applies to -mtime. So, to match +2, the file must have been modified 3 whole days ago; at this time, it's been accessed about 2.75 days ago.

amchargue · 08-12-2010, 04:19 PM

Thanks for your response, I thought it might be something like that but overlooked it in the man page.

The server where I'm having this issue is RHEL 5.

-ctime +2 doesn't give me anything either.

There's also amin/cmin/mmin which could help in some situations...