How to find files modified in last x minutes (find -mmin does not work as expected)
Solution 1
I can reproduce your problem if there are no files in the directory that were modified in the last hour. In that case, find . -mmin -60
returns nothing. The command find . -mmin -60 |xargs ls -l
, however, returns every file in the directory which is consistent with what happens when ls -l
is run without an argument.
To make sure that ls -l
is only run when a file is found, try:
find . -mmin -60 -type f -exec ls -l {} +
Solution 2
To search for files in /target_directory and all its sub-directories, that have been modified in the last 60 minutes:
$ find /target_directory -type f -mmin -60
To find the most recently modified files, sorted in the reverse order of update time (i.e., the most recently updated files first):
$ find /etc -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort -r
Solution 3
Manual of find:
Numeric arguments can be specified as
+n for greater than n,
-n for less than n,
n for exactly n.
-amin n
File was last accessed n minutes ago.
-anewer file
File was last accessed more recently than file was modified. If file is a symbolic link and the -H option or the -L option is in effect, the access time of the file it points to is always
used.
-atime n
File was last accessed n*24 hours ago. When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to
have been accessed at least two days ago.
-cmin n
File's status was last changed n minutes ago.
-cnewer file
File's status was last changed more recently than file was modified. If file is a symbolic link and the -H option or the -L option is in effect, the status-change time of the file it points
to is always used.
-ctime n
File's status was last changed n*24 hours ago. See the comments for -atime to understand how rounding affects the interpretation of file status change times.
Example:
find /dir -cmin -60 # creation time
find /dir -mmin -60 # modification time
find /dir -amin -60 # access time
Solution 4
I am working through the same need and I believe your timeframe is incorrect.
Try these:
- 15min change: find . -mtime -.01
- 1hr change: find . -mtime -.04
- 12 hr change: find . -mtime -.5
You should be using 24 hours as your base. The number after -mtime should be relative to 24 hours. Thus -.5 is the equivalent of 12 hours, because 12 hours is half of 24 hours.
Admin
Updated on July 05, 2022Comments
-
Admin almost 2 years
I'm trying to find files modified in last x minutes, for example in the last hour. Many forums and tutorials on the net suggest to use the find command with the -mmin option, like this:
find . -mmin -60 |xargs ls -l
However, this command did not work for me as expected. As you can see from the following listing, it also shows files modified earlier than 1 hour ago:
-rw------- 1 user user 9065 Oct 28 23:13 1446070435.V902I67a5567M283852.harvester -rw------- 1 user user 1331 Oct 29 01:10 1446077402.V902I67a5b34M538793.harvester -rw------- 1 user user 1615 Oct 29 01:36 1446078983.V902I67a5b35M267251.harvester -rw------- 1 user user 72365 Oct 29 02:27 1446082022.V902I67a5b36M873811.harvester -rw------- 1 user user 69102 Oct 29 02:27 1446082024.V902I67a5b37M142247.harvester -rw------- 1 user user 2611 Oct 29 02:34 1446082482.V902I67a5b38M258101.harvester -rw------- 1 user user 2612 Oct 29 02:34 1446082485.V902I67a5b39M607107.harvester -rw------- 1 user user 2600 Oct 29 02:34 1446082488.V902I67a5b3aM465574.harvester -rw------- 1 user user 10779 Oct 29 03:27 1446085622.V902I67a5b3bM110329.harvester -rw------- 1 user user 5836 Oct 29 03:27 1446085623.V902I67a5b3cM254104.harvester -rw------- 1 user user 8970 Oct 29 04:27 1446089232.V902I67a5b3dM936339.harvester -rw------- 1 user user 165393 Oct 29 06:10 1446095400.V902I67a5b3eM290158.harvester -rw------- 1 user user 105054 Oct 29 06:10 1446095430.V902I67a5b3fM265065.harvester -rw------- 1 user user 1615 Oct 29 06:24 1446096244.V902I67a5b40M55701.harvester -rw------- 1 user user 1620 Oct 29 06:24 1446096292.V902I67a5b41M337769.harvester -rw------- 1 user user 10436 Oct 29 06:36 1446096973.V902I67a5b42M707215.harvester -rw------- 1 user user 7150 Oct 29 06:36 1446097019.V902I67a5b43M415731.harvester -rw------- 1 user user 4357 Oct 29 06:39 1446097194.V902I67a5b56M446687.harvester -rw------- 1 user user 4283 Oct 29 06:39 1446097195.V902I67a5b57M957052.harvester -rw------- 1 user user 4393 Oct 29 06:39 1446097197.V902I67a5b58M774506.harvester -rw------- 1 user user 4264 Oct 29 06:39 1446097198.V902I67a5b59M532213.harvester -rw------- 1 user user 4272 Oct 29 06:40 1446097201.V902I67a5b5aM534679.harvester -rw------- 1 user user 4274 Oct 29 06:40 1446097228.V902I67a5b5dM363553.harvester -rw------- 1 user user 20905 Oct 29 06:44 1446097455.V902I67a5b5eM918314.harvester
Actually, it just listed all files in the current directory. We can take one of these files as an example and check if its modification time is really as displayed by the ls command:
stat 1446070435.V902I67a5567M283852.harvester File: ‘1446070435.V902I67a5567M283852.harvester’ Size: 9065 Blocks: 24 IO Block: 4096 regular file Device: 902h/2306d Inode: 108680551 Links: 1 Access: (0600/-rw-------) Uid: ( 1001/ user) Gid: ( 1027/ user) Access: 2015-10-28 23:13:55.281515368 +0100 Modify: 2015-10-28 23:13:55.281515368 +0100 Change: 2015-10-28 23:13:55.313515539 +0100
As we can see, this file was definitely last modified earlier than 1 hour ago! I also tried
find -mmin 60
orfind -mmin +60
, but it did not work either.Why is this happening and how to use the find command correctly?
-
amit prasad over 8 yearsfind -type f -mtime -90
-
Seth Robertson over 8 yearsYou can also use the -r flag to xargs to prevent it from running if there is no input. Of course, I also strongly suggest preventing spaces in the file name from causing problems when using xargs. Example:
find . -mmin 60 -print0 | xargs -0r ls -l
. Newline is usually pretty safe except against active attackersfind . -mmin 60 | xargs '-rd\n' ls -l
The -exec alternative in the answer above of course also solves both problems. -
MSalters over 7 yearsthis finds files older than 60 days, not minutes.
-
Alex Povel about 3 yearsNote,
mmin
andmtime
are two different options. -
robsch almost 3 years
find . -mmin -60 -type f -ls
works as well. -
Gundro over 2 yearsIs there a way to do seconds ? Like 10,20,30 or 43 seconds? Does -mmin 0.5 work?
-
John1024 over 2 years@Gundro Traditionally,
find
does not support fractional parts: it just truncates age to whole minutes (-mmin
) or whole days (-mtime
). Modern GNUfind
, however, does support fractional parts at least for ranges, like-mmin -2.5
or-mmin +2.5
. Note that, if you are on a Mac, you have, by default, a BSDfind
and that's a different codebase and you would need to check its documentation. -
Gundro over 2 years@John1024 Thanks for the answer. I don't know if the machine has modern GNU find (it is a cluster), but i will try it. I was afraid it would break since man didn't explain anything.