File and directory
timestamps in Unix
Three times tracked for each file in Unix are these:- access
time – atime
- change
time – ctime
- modify
time – mtime
atime – File Access Time
Access time shows the last time the data from a file was
accessed – read by one of the Unix processes directly or through commands and
scripts.
ctime – File Change Time
ctime also changes when you change file's ownership or access
permissions. It will also naturally highlight the last time file had its
contents updated.
mtime – File Modify Time
Last modification time shows time of the last change to
file's contents. It does not change with owner or permission changes, and is
therefore used for tracking the actual changes to data of the file itself.
Find atime, ctime and mtime with
ls
The simplest way to confirm the times associated with a file is
to use ls command.
Timestamps
are shown when using the long-format output of ls command, ls
-l:
suresh@NextGen4IT:~$ ls -l /tmp/file1
-rw-r--r-- 1 suresh
root 9 2008-04-05 07:10 /tmp/file1
This
is the default output of ls -l, which shows you the time of the
last file modification – mtime. In our example, file /tmp/file1 was
last changed around 7:10am.
If
we want to see the last access time for this file, atime – you
need to use -lu options for ls. The output will
probably show some later time:
suresh@NextGen4IT:~$ ls -lu /tmp/file1
-rw-r--r-- 1 suresh
root 9 2008-04-05 07:27 /tmp/file1
In
the example, it's 7:27am.
Lastly, ls
-lc will show you the last time our file was changed, ctime:
suresh@NextGen4IT:~$ ls -lc /tmp/file1
-rw-r--r-- 1 suresh
root 9 2008-04-05 07:31 /tmp/file1
To
show you how this works, I'll change the ownership of the file and then run the
same 3 ls commands to show you that only the ctime had been
updated. I run the date command just before doing anything else so that you can
compare the times:
suresh@NextGen4IT:~$ date
Sat Apr
5 07:35:16 IST 2008
suresh@NextGen4IT:~$ chown root /tmp/file1
suresh@NextGen4IT:~$ ls -lc /tmp/file1
-rw-r--r-- 1 root
root 9 2008-04-05 07:35 /tmp/file1
suresh@NextGen4IT:~$ ls -lu /tmp/file1
-rw-r--r-- 1 root
root 9 2008-04-05 07:27 /tmp/file1
suresh@NextGen4IT:~$ ls -l /tmp/file1
-rw-r--r-- 1 root
root 9 2008-04-05 07:10 /tmp/file1
Show atime, ctime and mtime with stat command
In
Linux distributions, you will probably find a stat command, which can be used
to show all of the times in a more convenient way, and among plenty of other
useful information about your file:
suresh@NextGen4IT:~$ stat /tmp/file1
File: `/tmp/file1'
Size:
9 Blocks:
8 IO Block:
4096 regular file
Device:
811h/2065d Inode: 179420 Links:
1
Access:
(0644/-rw-r--r--) Uid: ( 0/
root) Gid: ( 0/ root)
Access:
2008-04-05 07:27:51.000000000 +0100
Modify:
2008-04-05 07:10:14.000000000 +0100
Change:
2008-04-05 07:35:22.000000000 +0100
·
-mtime
+60 means
you are looking for a file modified 60 days ago.
·
-mtime
-60 means
less than 60 days.
·
-mtime
60 If
you skip + or – it means exactly 60 days.
So to find text files
that were last modified 60 days ago, use
$ find /home/you -iname "*.txt" -mtime -60 -print
$ find /home/you -iname "*.txt" -mtime -60 -print
Display content of file
on screen that were last modified 60 days ago, use
$ find /home/you -iname "*.txt" -mtime -60 -exec cat {} \;
$ find /home/you -iname "*.txt" -mtime -60 -exec cat {} \;
Count total number of
files using wc command
$ find /home/you -iname "*.txt" -mtime -60 | wc -l
$ find /home/you -iname "*.txt" -mtime -60 | wc -l
You can also use access
time to find out pdf files. Following command will print the list of all pdf
file that were accessed in last 60 days:
$ find /home/you -iname "*.pdf" -atime -60 -type -f
$ find /home/you -iname "*.pdf" -atime -60 -type -f
Find Last 50 Days
Modified Files
To find all the files which are modified 50 days back.
# find / -mtime 50
Find Last 50 Days
Accessed Files
To find all the files which are accessed 50 days back.
# find / -atime 50
Find Last 50-100
Days Modified Files
To find all the files which are modified more
than 50 days back and
less than 100 days.
# find / -mtime +50 –mtime -100
Find Changed Files
in Last 1 Hour
To find all the files which are changed in
last 1 hour.
# find / -cmin -60
Find Modified
Files in Last 1 Hour
To find all the files which are modified in
last 1 hour.
# find / -mmin -60
Find Accessed
Files in Last 1 Hour
To find all the files which are accessed in
last 1 hour.
# find / -amin -60
Find 50MB Files
To find all 50MB files, use.
Find Size between 50MB – 100MB
To find all the
files which are greater than 50MB and
less than 100MB.
Find and Delete 100MB Files
To find all 100MB files and delete them using one single command.
EmoticonEmoticon