Find commands in centos

In linux, finding files that have changed at a specific time and files that have time-related relationships with a given file is particularly important for troubleshooting. The find command is used to do this, find the files that have been modified within the specified time in linux.

The find command has several options for searching files based on your system's timestamp. These timestamps include

Last modification time of mtime file content
Time when the atime file is read or accessed
Ctime file status change time
Mtime and atime are both easy to understand, while ctime requires more explanations. Inode maintains the metadata of each file. Therefore, if the metadata related to the file changes, the inode data also changes. This may be caused by a series of operations, including creating symbolic links to files, changing file permissions, or moving files. In these cases, the file content will not be read or modified, so mtime and atime will not change, but ctime will change.

These time options must be used together with a value of n, specified as-n, n or + n.

N * 24
+ 1 indicates 1x24 + 24 hours away ..
+ 0 indicates 0x24 + 24 hours away
1 indicates the range from 1x24 + 24 to 24 ..
0 indicates 0*24 + 24 to 0 ..
-1 indicates 0*24 + 24, or even the future time...

Find the file modified today

# Find the files modified between the current directory one day ago and now, that is, the files modified in the past 24 hours.
Find./-mtime 0

# Find the modified files in the current directory less than one day (1*24), that is, the files modified within 24 hours. This is the same as the above result.
Find./-mtime-1

# Find the modified files whose current directory is equal to one day (1*24), that is, the files modified 24 hours ago (including 24th hours).
Find./-mtime 1

# Search for the files modified in the current directory more than one day (1*24), that is, the files modified at least two days ago. The parameter after mtime can only be an integer, so it must start from 2 if it is greater than 1. The following command is equivalent to-mtime 2.
Find./-mtime + 1

The time is in the unit of 24 hours, rather than the day, starting from the day rather than before 24 hours.
Start searching for one day at on March 29? Magpie mould? 5/03/28 12:00 ~ ? Que nai? /P>

Comparison between find and specified time option parameters

-Mtime: specifies the file modification time. The last modification to the file data is before n * 24 hours.

-Mmin n: the last modification to the file data was made n minutes ago.

-Ctime n: specifies the file-like modification time. The last modification to the file status is before n * 24 hours.

-Cmin: The last modification to the file status is n minutes ago.

-Atime n: the last access time to the file is before n * 24 hours.

-Amin n: The Last access time. The last access to the file was n minutes ago.

-Mtime: indicates the object that has been modified at the specified time? Hot failover? Tomb? /P>

-Ctime: specifies the time when the file has been changed. This indicates that the file permission has been changed.

-Atime: A file that has been accessed at a specified time, meaning that the file has been read.

Comparison parameters between find and specified files

-Anewer file
The last access to the file is later than the modification time of the file. If-follow in the command line is earlier than-anewer, (and only in this case-anewer will be affected by-follow ).

-Cnewer file
The last modification to the file status is later than the modification time of the file. If-follow in the command line is earlier than-cnewer, (and only in this case-cnewer will be affected by-follow ).

Find instance

Find the files modified three days ago (files earlier than the third day before & rarr;) (> 72 hours)

Find./-mtime + 3-type f-print

3 days? Missing mu ?? Nead ~ ? Que nai? (0 ~ 72 hours ??

Find./-mtime-3-type f-print

Find the files modified in the previous 3rd days ~ ? Que nai? (72 ~ 96 hours)

Find./-mtime 3-type f-print

Find the file that has been modified in the last day (you can also write it like this)

Find./-mtime + 2-mtime-4-type f-print

1. Current time: 24 hours-current time (yesterday-today)

# Find.-mtime 0

2. Current Time 48 hours ago-current time 24 hours ago (the day before yesterday)

# Find.-mtime 1

3. The current time is 48 hours ago (2 days ago)

# Find.-mtime + 1

4. Current time: 24 hours-current time (yesterday-today)

# Find.-mtime-1