如何查找最近x分钟内修改的文件(查找-mmin不能按预期工作)

Question

我正在尝试查找最近x分钟内修改的文件,例如在最后一小时内.网上的许多论坛和教程建议使用带有-mmin选项的find命令,如下所示:

find . -mmin -60 |xargs ls -l

但是,这个命令对我不起作用.从下面的清单中可以看出,它还显示了早于1小时前修改过的文件:

-rw------- 1 user user   9065 Oct 28 23:13 1446070435.V902I67a5567M283852.harvester
-rw------- 1 user user   1331 Oct 29 01:10 1446077402.V902I67a5b34M538793.harvester
-rw------- 1 user user   1615 Oct 29 01:36 1446078983.V902I67a5b35M267251.harvester
-rw------- 1 user user  72365 Oct 29 02:27 1446082022.V902I67a5b36M873811.harvester
-rw------- 1 user user  69102 Oct 29 02:27 1446082024.V902I67a5b37M142247.harvester
-rw------- 1 user user   2611 Oct 29 02:34 1446082482.V902I67a5b38M258101.harvester
-rw------- 1 user user   2612 Oct 29 02:34 1446082485.V902I67a5b39M607107.harvester
-rw------- 1 user user   2600 Oct 29 02:34 1446082488.V902I67a5b3aM465574.harvester
-rw------- 1 user user  10779 Oct 29 03:27 1446085622.V902I67a5b3bM110329.harvester
-rw------- 1 user user   5836 Oct 29 03:27 1446085623.V902I67a5b3cM254104.harvester
-rw------- 1 user user   8970 Oct 29 04:27 1446089232.V902I67a5b3dM936339.harvester
-rw------- 1 user user 165393 Oct 29 06:10 1446095400.V902I67a5b3eM290158.harvester
-rw------- 1 user user 105054 Oct 29 06:10 1446095430.V902I67a5b3fM265065.harvester
-rw------- 1 user user   1615 Oct 29 06:24 1446096244.V902I67a5b40M55701.harvester
-rw------- 1 user user   1620 Oct 29 06:24 1446096292.V902I67a5b41M337769.harvester
-rw------- 1 user user  10436 Oct 29 06:36 1446096973.V902I67a5b42M707215.harvester
-rw------- 1 user user   7150 Oct 29 06:36 1446097019.V902I67a5b43M415731.harvester
-rw------- 1 user user   4357 Oct 29 06:39 1446097194.V902I67a5b56M446687.harvester
-rw------- 1 user user   4283 Oct 29 06:39 1446097195.V902I67a5b57M957052.harvester
-rw------- 1 user user   4393 Oct 29 06:39 1446097197.V902I67a5b58M774506.harvester
-rw------- 1 user user   4264 Oct 29 06:39 1446097198.V902I67a5b59M532213.harvester
-rw------- 1 user user   4272 Oct 29 06:40 1446097201.V902I67a5b5aM534679.harvester
-rw------- 1 user user   4274 Oct 29 06:40 1446097228.V902I67a5b5dM363553.harvester
-rw------- 1 user user  20905 Oct 29 06:44 1446097455.V902I67a5b5eM918314.harvester

实际上,它只列出了当前目录中的所有文件.我们可以将其中一个文件作为示例,并检查其修改时间是否真的与ls命令一样:

stat 1446070435.V902I67a5567M283852.harvester

  File: ‘1446070435.V902I67a5567M283852.harvester’
  Size: 9065        Blocks: 24         IO Block: 4096   regular file
Device: 902h/2306d  Inode: 108680551   Links: 1
Access: (0600/-rw-------)  Uid: ( 1001/   user)   Gid: ( 1027/   user)
Access: 2015-10-28 23:13:55.281515368 +0100
Modify: 2015-10-28 23:13:55.281515368 +0100
Change: 2015-10-28 23:13:55.313515539 +0100

我们可以看到,这个文件肯定比1小时前更早修改!我也试过find -mmin 60或find -mmin +60,但它也不能工作.

为什么会发生这种情况以及如何正确使用find命令？

Answer 1

如果目录中没有文件在过去一小时内被修改,我可以重现您的问题.在这种情况下,find . -mmin -60什么都不返回.find . -mmin -60 |xargs ls -l但是,该命令返回目录中的每个文件,这与ls -l在没有参数的情况下运行时发生的情况一致.

要确保ls -l仅在找到文件时运行,请尝试:

find . -mmin -60 -type f -exec ls -l {} +

Answer 2

问题是

find . -mmin -60

输出:

.
./file1
./file2

注意带有一个点的线？
这使得ls列表整个目录与ls -l .执行时完全相同.

一种解决方案是仅列出文件(而不是目录):

find . -mmin -60 -type f | xargs ls -l

但最好直接使用find的-exec选项:

find . -mmin -60 -type f -exec ls -l {} \;

要不就:

find . -mmin -60 -type f -ls

哪个,顺便说一下,即使包括目录也是安全的:

find . -mmin -60 -ls

Answer 3

要搜索/ target_directory及其所有子目录中的文件,这些文件在过去60分钟内已被修改:

$ find /target_directory -type f -mmin -60

要查找最近修改的文件,请按照更新时间的相反顺序排序(即,最近更新的文件首先):

$ find /etc -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort -r

Answer 4

查找手册：

   Numeric arguments can be specified as

   +n     for greater than n,

   -n     for less than n,

   n      for exactly n.

   -amin n
          File was last accessed n minutes ago.

   -anewer file
          File was last accessed more recently than file was modified.  If file is a symbolic link and the -H option or the -L option is in effect, the access time of the file it points  to  is  always
          used.

   -atime n
          File  was  last  accessed  n*24 hours ago.  When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to
          have been accessed at least two days ago.

   -cmin n
          File's status was last changed n minutes ago.

   -cnewer file
          File's status was last changed more recently than file was modified.  If file is a symbolic link and the -H option or the -L option is in effect, the status-change time of the file it  points
          to is always used.

   -ctime n
          File's status was last changed n*24 hours ago.  See the comments for -atime to understand how rounding affects the interpretation of file status change times.

例子：

find /dir -cmin -60 # creation time
find /dir -mmin -60 # modification time
find /dir -amin -60 # access time

Answer 5

我正在解决同样的需求，我相信你的时间表不正确。

试试这些：

• 15分钟改变：找到 . -mtime -.01
• 1小时变化：找到 . -mtime -.04
• 12 小时变化：找到 . -mtime -.5

您应该以 24 小时为基础。-mtime 之后的数字应该是相对于 24 小时的。因此 -.5 相当于 12 小时，因为 12 小时是 24 小时的一半。