Linux command to find files changed in the last n seconds
Solution 1
The solution with mtime specifying seconds doesn't work on my linux systems that use find --version
== find (GNU findutils) 4.4.2
.
I get the following error:
mycomputer:~/new$ find . -mtime -60s
find: missing argument to `-mtime'
mycomputer:~/new$ find . -mtime -60seconds
find: missing argument to `-mtime'
However, I can use -mmin
(for modified in the last m minutes), and can it can take in a decimal argument; e.g., the following finds files modified in the last 30 seconds.
find . -mmin 0.5
So for example; creating files last modified 1s, 6s, 11s, ... ago for the past 120 seconds, this command finds:
mycomputer:~/new$ for i in $(seq 1 5 120); do touch -d "-$i seconds" last_modified_${i}_seconds_ago ; done
mycomputer:~/new$ find . -mmin 0.5
.
./last_modified_1_seconds_ago
./last_modified_26_seconds_ago
./last_modified_11_seconds_ago
./last_modified_16_seconds_ago
./last_modified_21_seconds_ago
./last_modified_6_seconds_ago
So if you really need it in seconds you can do something like:
localhost:~/new$ for i in $(seq 1 1 120); do touch -d "-$i seconds" last_modified_${i}_seconds_ago ; done
localhost:~/new$ N=18; find . -mmin $(echo "$N/60"|bc -l)
./last_modified_1_seconds_ago
./last_modified_9_seconds_ago
./last_modified_14_seconds_ago
./last_modified_4_seconds_ago
./last_modified_12_seconds_ago
./last_modified_13_seconds_ago
./last_modified_8_seconds_ago
./last_modified_3_seconds_ago
./last_modified_5_seconds_ago
./last_modified_11_seconds_ago
./last_modified_17_seconds_ago
./last_modified_16_seconds_ago
./last_modified_7_seconds_ago
./last_modified_15_seconds_ago
./last_modified_10_seconds_ago
./last_modified_6_seconds_ago
./last_modified_2_seconds_ago
Solution 2
Use find command like this:
find . -name "*.txt" -mtime -60s
To find all *.txt
files modified in last 60 seconds.
Solution 3
Similar to what glenn suggested, if you want to find everything modified, say, in the time during which an installer process was running, it might be easier to do something like:
touch /tmp/checkpoint
<do installer stuff>
find / -newer /tmp/checkpoint
Then you don't have to do the time calculation; you just find things changed after the checkpoint file.
Solution 4
The simplest way to do this is:
find . -name "*.txt" -newermt '6 seconds ago'
The -mtime -60s
option, mentioned in an answer, doesn't work on many versions of find
, even in 2016. -newermt
is a much better option to us. It can parse many different date and time formats.
An alternative method using mmin
is this:
find . -name "*.txt" -mmin -0.5
# Finds files modified within the last 0.5 minute, i.e. last 30 seconds
This option might not work for all find
versions.
Solution 5
If you have a version of find that doesn't support -mtime -60s
then a better solution is
touch -d '-60 seconds' /tmp/newerthan
find . -name "*.txt" -newer /tmp/newerthan
Related videos on Youtube
Peter Mortensen
Updated on September 18, 2022Comments
-
Peter Mortensen over 1 year
I would like a Linux command to find files changed in the last
n
seconds.Is there a shell script or other tool that I can run from command line interface or GUI?
-
dannysauer over 9 years-60s isn't a valid argument to
-mtime
. Nor is "60s" even a valid option in POSIX or GNU find. The argument to-mtime
is a number which specifies the number of 24-hour periods ago when a file was modified. -
rednoah over 7 yearsThis is clearly the best solution.