mtime option in find command

ahmedb72 · 06-23-2009, 03:02 AM

Hi,
What's the difference between the following commands:
#find ~ -mtime 1
#find ~ -mtime -1
#find ~ -mtime +1

Below is what I got:

Code:

#find ~ -mtime 1
/root/.ssh
/root/.ssh/known_hosts
#find ~ -mtime -1
/root
/root/.gconfd
/root/.gconfd/saved_state
/root/testme
/root/MyFile.TXT
/root/.gnome/gnome-vfs/.trash_entry_cache
/root/.gnome2/accels/system-config-network
/root/.gnome2/system-config-network
/root/.gnome2/share/cursor-fonts/fonts.dir
/root/.gnome2/share/fonts/fonts.dir
/root/.bash_history
/root/.bashrc
/root/.viminfo
/root/.gconf
/root/.gconf/desktop/gnome/applications/window_manager
/root/.gconf/desktop/gnome/applications/window_manager/%gconf.xml
/root/.gconf/desktop/gnome/peripherals/keyboard/xkb.sysbackup
/root/.gconf/desktop/gnome/peripherals/keyboard/xkb.sysbackup/%gconf.xml
/root/.gconf/apps/panel/toplevels/bottom_panel
/root/.gconf/apps/panel/toplevels/bottom_panel/%gconf.xml
/root/.gconf/apps/panel/applets/window_list/prefs
/root/.gconf/apps/panel/applets/window_list/prefs/%gconf.xml
/root/.gconf/apps/panel/applets/clock/prefs
/root/.gconf/apps/panel/applets/clock/prefs/%gconf.xml
/root/.gconf/apps/panel/applets/workspace_switcher/prefs
/root/.gconf/apps/panel/applets/workspace_switcher/prefs/%gconf.xml
/root/.gconf/apps/panel/applets/mixer/prefs
/root/.gconf/apps/panel/applets/mixer/prefs/%gconf.xml
/root/.gconf/apps/nautilus
/root/.gconf/apps/nautilus/%gconf.xml
/root/.Xauthority
/root/myfiles
/root/myfiles/doc_mar
/root/myfiles/doc_feb
/root/myfiles/sheet_feb
/root/myfiles/sheet_jan
/root/myfiles/sheet_mar
/root/myfiles/doc_jan
/root/.metacity/sessions
/root/.metacity/sessions/1245662213-3702-3004908851.ms
/root/.ICEauthority
#find ~ -mtime +1
/root/.config
/root/.config/menus
/root/.config/menus/applications.menu
/root/.config/menus/server-settings.menu
/root/.config/menus/preferences.menu
/root/.config/menus/start-here.menu
/root/.config/menus/system-settings.menu
/root/.tcshrc
/root/axjfMqq
/root/.eggcups
/root/find.err
/root/anaconda-ks.cfg
/root/Desktop
/root/.gnome
/root/.gnome/gnome-vfs
/root/.gnome/application-info
/root/.gnome/mime-info
/root/.gtkrc
/root/myfile2.txt
/root/myfile.txt
/root/.gnome2
/root/.gnome2/panel2.d
/root/.gnome2/panel2.d/default
/root/.gnome2/panel2.d/default/launchers
/root/.gnome2/panel2.d/default/launchers/hammer-0010ba6d63.desktop
/root/.gnome2/panel2.d/default/launchers/hammer-008e3fe17e.desktop
/root/.gnome2/panel2.d/default/launchers/greasy-00e3282ea9.desktop
/root/.gnome2/panel2.d/default/launchers/greasy-007fe5b607.desktop
/root/.gnome2/panel2.d/default/launchers/larry-00cefdbc66.desktop
/root/.gnome2/accels
/root/.gnome2/nautilus-scripts
/root/.gnome2/share
/root/.gnome2/share/cursor-fonts
/root/.gnome2/share/fonts
/root/.gnome2/keyrings
/root/.recently-used
/root/.gtkrc-1.2-gnome2
/root/.nautilus
/root/.nautilus/metafiles
/root/.nautilus/metafiles/x-nautilus-desktop:%2F%2F%2F.xml
/root/.nautilus/metafiles/file:%2F%2F%2Fmedia.xml
/root/.dmrc
/root/.gstreamer-0.8
/root/.gstreamer-0.8/registry-i686.xml
/root/testme.txt
/root/find.out
/root/install.log
/root/foundlist.txt
/root/install.log.syslog
/root/tr
/root/.gconf/desktop
/root/.gconf/desktop/gnome
/root/.gconf/desktop/gnome/file_views
/root/.gconf/desktop/gnome/file_views/%gconf.xml
/root/.gconf/desktop/gnome/%gconf.xml
/root/.gconf/desktop/gnome/applications
/root/.gconf/desktop/gnome/applications/%gconf.xml
/root/.gconf/desktop/gnome/peripherals
/root/.gconf/desktop/gnome/peripherals/%gconf.xml
/root/.gconf/desktop/gnome/peripherals/keyboard
/root/.gconf/desktop/gnome/peripherals/keyboard/%gconf.xml
/root/.gconf/desktop/gnome/peripherals/keyboard/xkb
/root/.gconf/desktop/gnome/peripherals/keyboard/xkb/%gconf.xml
/root/.gconf/desktop/%gconf.xml
/root/.gconf/apps
/root/.gconf/apps/panel
/root/.gconf/apps/panel/general
/root/.gconf/apps/panel/general/%gconf.xml
/root/.gconf/apps/panel/objects
/root/.gconf/apps/panel/objects/web_launcher
/root/.gconf/apps/panel/objects/web_launcher/%gconf.xml
/root/.gconf/apps/panel/objects/spreadsheet_launcher
/root/.gconf/apps/panel/objects/spreadsheet_launcher/%gconf.xml
/root/.gconf/apps/panel/objects/email_launcher
/root/.gconf/apps/panel/objects/email_launcher/%gconf.xml
/root/.gconf/apps/panel/objects/wordprocessor_launcher
/root/.gconf/apps/panel/objects/wordprocessor_launcher/%gconf.xml
/root/.gconf/apps/panel/objects/%gconf.xml
/root/.gconf/apps/panel/objects/presentation_launcher
/root/.gconf/apps/panel/objects/presentation_launcher/%gconf.xml
/root/.gconf/apps/panel/toplevels
/root/.gconf/apps/panel/toplevels/%gconf.xml
/root/.gconf/apps/panel/%gconf.xml
/root/.gconf/apps/panel/applets
/root/.gconf/apps/panel/applets/window_list
/root/.gconf/apps/panel/applets/window_list/%gconf.xml
/root/.gconf/apps/panel/applets/%gconf.xml
/root/.gconf/apps/panel/applets/clock
/root/.gconf/apps/panel/applets/clock/%gconf.xml
/root/.gconf/apps/panel/applets/workspace_switcher
/root/.gconf/apps/panel/applets/workspace_switcher/%gconf.xml
/root/.gconf/apps/panel/applets/mixer
/root/.gconf/apps/panel/applets/mixer/%gconf.xml
/root/.gconf/apps/%gconf.xml
/root/.cshrc
/root/.gnome2_private
/root/.esd_auth
/root/.rhn-applet.conf
/root/myfiles/script3.bash
/root/myfiles/script2.bash
/root/myfiles/script1.bash
/root/dir1
/root/dir1/f1
/root/.metacity
/root/.metacity/sessions/1242054980-3886-517714662.ms
/root/.metacity/sessions/1241424185-3683-1385502782.ms
/root/.metacity/sessions/1239207710-3687-3583715016.ms
/root/.metacity/sessions/1237701777-3728-3898001342.ms
/root/.metacity/sessions/1237701383-3705-2173870518.ms
/root/.metacity/sessions/1241449149-3740-1187149246.ms
/root/.metacity/sessions/1245565347-9464-831918735.ms
/root/.metacity/sessions/1241424857-3736-2302033266.ms
/root/.metacity/sessions/1242626674-3780-436040911.ms
/root/.bash_logout
/root/.bash_profile
#

Thanks in advance.

kirukan · 06-23-2009, 03:09 AM

Did you go through the man page clearly?
+n - for greater than n,
-n - for less than n,
n - for exactly n.

Tinkster · 06-23-2009, 03:50 AM

The reference to the man page is brilliant, and here's one to
best practice; don't - I repeat - DON'T do your day to day
stuff as root. Nasty habit. There's a good reason for the
separation of powers, and a reason why you don't need to have
tons of antivirus and ant-spyware programs in Linux; you're on
the road to undoing this if you work as root all the time.

Cheers,
Tink

ahmedb72 · 06-23-2009, 04:23 AM

Quote:

Originally Posted by kirukan

Did you go through the man page clearly?
+n - for greater than n,
-n - for less than n,
n - for exactly n.

Well, I'll try to make my question more precise.

First, let's take the following case:
#find ~ -mtime 1

It should mean: Files modified exactly 24 hours ago.

One file of the returned results was: /root/.gconf/apps/panel/toplevels/bottom_panel/%gconf.xml

Now consider the following:

Code:

#date
Tue Jun 23 13:20:34 GST 2009
#ls -l /root/.gconf/apps/panel/toplevels/bottom_panel/%gconf.xml
-rw-------  1 root root 123 Jun 22 13:17 /root/.gconf/apps/panel/toplevels/bottom_panel/%gconf.xml

As you see, there is time difference. Not EXACTLY 24 hours ago.

Also note in the following code the difference even in the dates:

Code:

#find ~ -mtime 1 -exec ls -lt {} \;
-rw-r--r--  1 root root 356 May 11 19:16 1242054980-3886-517714662.ms
-rw-r--r--  1 root root 356 May  4 18:59 1241449149-3740-1187149246.ms
-rw-r--r--  1 root root 356 May  4 12:14 1241424857-3736-2302033266.ms

I hope you got my point in the question.

colucix · 06-23-2009, 05:11 AM

It is explained in the man page:

Code:

-atime n
       File was last accessed n*24 hours ago.  When find figures out how many 24-hour periods ago the
       file was last accessed, any fractional part is ignored, so to match -atime +1, a file  has  to
       have been accessed at least two days ago.
-mtime n
       File’s data was last modified n*24 hours ago.  See the comments for -atime to  understand  how
       rounding affects the interpretation of file modification times.

This means that a file modified one day ago, is a file that has been modified between 47h 59m ago and 24h 00m ago.

ahmedb72 · 06-23-2009, 05:21 AM

Quote:

Originally Posted by colucix

It is explained in the man page:

Code:

-atime n
       File was last accessed n*24 hours ago.  When find figures out how many 24-hour periods ago the
       file was last accessed, any fractional part is ignored, so to match -atime +1, a file  has  to
       have been accessed at least two days ago.
-mtime n
       File’s data was last modified n*24 hours ago.  See the comments for -atime to  understand  how
       rounding affects the interpretation of file modification times.

This means that a file modified one day ago, is a file that has been modified between 47h 59m ago and 24h 00m ago.

Thanks for your comments. Please notice that the difference is sometimes even in Month!

Code:

#date
Tue Jun 23 14:16:55 GST 2009
#find ~ -mtime 1 -exec ls -l --time-style=iso {} \;
total 48
-rwx------  1 root root 44022 06-22 13:37 saved_state
-rwx------  1 root root 44022 06-22 13:37 /root/.gconfd/saved_state
-rw-r--r--  1 root root 7 06-22 13:16 /root/.gnome/gnome-vfs/.trash_entry_cache
...
...
-rwxrw-rw-  1 root root 124 06-17 10:19 script1.bash
-rwxrw-rw-  1 root root 119 06-17 10:50 script2.bash
-rwxrw-rw-  1 root root 185 06-17 10:47 script3.bash
-rw-r--r--  1 root root   0 06-22 13:20 sheet_feb
-rw-r--r--  1 root root   0 06-22 13:20 sheet_jan
-rw-r--r--  1 root root   0 06-22 13:20 sheet_mar
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/doc_mar
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/doc_feb
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/sheet_feb
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/sheet_jan
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/sheet_mar
-rw-r--r--  1 root root 0 06-22 13:20 /root/myfiles/doc_jan
total 80
-rw-r--r--  1 root root 356 03-22 09:56 1237701383-3705-2173870518.ms
-rw-r--r--  1 root root 356 03-22 10:02 1237701777-3728-3898001342.ms
-rw-r--r--  1 root root 356 04-08 20:21 1239207710-3687-3583715016.ms
-rw-r--r--  1 root root 356 05-04 12:03 1241424185-3683-1385502782.ms
-rw-r--r--  1 root root 356 05-04 12:14 1241424857-3736-2302033266.ms
-rw-r--r--  1 root root 356 05-04 18:59 1241449149-3740-1187149246.ms
-rw-r--r--  1 root root 356 05-11 19:16 1242054980-3886-517714662.ms
-rw-r--r--  1 root root 356 05-18 10:04 1242626674-3780-436040911.ms
-rw-r--r--  1 root root 356 06-21 10:22 1245565347-9464-831918735.ms
-rw-r--r--  1 root root 356 06-22 13:16 1245662213-3702-3004908851.ms
-rw-r--r--  1 root root 356 06-22 13:16 /root/.metacity/sessions/1245662213-3702-3004908851.ms
-rw-------  1 root root 1512 06-22 13:15 /root/.ICEauthority

colucix · 06-23-2009, 05:34 AM

Nope. In your example the find command gives some directories whose modification time is "1 day ago", then it passes the directory name to the ls command and the content of the directory is listed, regardless the modification time of every single file. To avoid that you can do either

Code:

find ~ -type f -mtime 1 -exec ls -l --time-style=iso {} \;

to restrict the result to files only, or

Code:

find ~ -mtime 1 -exec ls -ld --time-style=iso {} \;

to not list the content of the directory.

ahmedb72 · 06-23-2009, 09:48 AM

Thanks colucix. You made it now really clear to me.