1

I am on linux and have tried to figure out the find command for a while to be able to list the directories modified in a 24 hour period a certain number of days ago, but I can't get it to work. Among other things I have tried:

find -type d -mtime +1 -mtime -2

But it returns 0 matches, while find -type d -mtime +1 gives 16721 matches and find -type d -mtime -2 gives 120 matches. I should get around 50-60 matches.

I have also tried the -a option for AND in between but it makes no difference.

2 Answers 2

3

The arguments for the -mtime option to find are a little counter-intuitive. Basically, what you're asking for there is "show me everything that's older than two days ago, and younger than two days ago"... the '+' option is a little wonky (from find(1)):

When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago.

For a single day range, you can just use -mtime 2, otherwise I suggest going to using -mmin and a bit of shell arithmetic to get where you want to go.

5
  • 1
    Ah just not using either + or - seem to be that I want.
    – Zitrax
    Nov 25, 2009 at 16:05
  • +1 - I remember wrestling with that for several hours before find would finally do what I wanted it to.
    – RainyRat
    Nov 25, 2009 at 16:23
  • Yeah, the find manpage is only for people who can truly write "detail oriented" in their CV. Took me years to really grok it.
    – womble
    Nov 25, 2009 at 16:58
  • Also, be aware that you can do -mtime 0 (the current 24-hour period) and -mtime 0 (more than 24 hours ago) and even -mtime -0 (future-dated). Nov 25, 2009 at 18:10
  • I think you meant -mtime +0 for that second one...
    – womble
    Nov 25, 2009 at 18:39
3

I'd use a script:

STARTTIMEFILE=`mktemp` || exit 1
touch -d '2009-10-01 00:00' "$STARTTIMEFILE" || exit 1

ENDTIMEFILE=`mktemp` || exit 1
touch -d '2009-11-01 00:00' "$ENDTIMEFILE" || exit 1

find . -newer "$STARTTIMEFILE" -and -not -newer "$ENDTIMEFILE" -ls

rm -f "$STARTTIMEFILE" "$ENDTIMEFILE"

Much easier to understand than -mtime.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .