Why is find not excluding old files?

Question

I want to copy all gzipped files from my apache logs that were created less than 43 days ago.

As a test, I simply listed my files from find:

sudo find /var/log/apache2/ -mindepth 1 -ctime -43 -name "*.gz" -ls

But the results are including files created all the way back into August (when the server was setup) as well as newer files:

8781890    4 -rw-r-----   1 root     adm           186 Aug 10 06:44 /var/log/apache2/error.log.13.gz
8781923    4 -rw-r-----   1 root     adm          1717 Aug 17 06:29 /var/log/apache2/error.log.12.gz

stat /var/log/apache2/error.log.13.gz
  File: `/var/log/apache2/error.log.13.gz'
  Size: 186             Blocks: 8          IO Block: 4096   regular file
  Device: 807h/2055d      Inode: 8781890     Links: 1
  Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    4/     adm)
  Access: 2014-11-13 10:34:14.444059675 +1030
  Modify: 2014-08-10 06:44:11.000000000 +0930
  Change: 2014-11-09 06:29:48.035930468 +1030

Why is the ctime argument not applying?

Answer 1

Those files were rotated, and during the process their ctime changed. Every time you touch a file or change it contents you're going to modify it's timestamps which will overwrite old ones. This will mislead your find command.

ls listing shows mtime; since this is what ls shows by default unless -c (ctime) flag is specified

So in essence; your ctime criteria matches files and ls displays mtime.

So try to tweak your find command to something like

sudo find /var/log/apache2/ -mindepth 1 -mtime -43 -name "*.gz" -ls

And it should work as you expected