Solved

-atime any pitfalls to using it to find out last time file accessed?

Posted on 2006-10-22
8
247 Views
Last Modified: 2010-05-19
I have the below which I ran to find files older then 90 days but my results don't seem accurate (from glancing at output file)?

find / -type f -name "*.jpg" -o -name "*.jpe" -o -name "*.JPE" -o -name "*.JPG" -o -name "*.MOV" -o -name "*.mov" -o -name "*.mpg" -o -name "*.MPG" -o -name "*.mpeg" -o -name "*.mp3" -o -name "*.MP3" -o -name "*.mp4" -o -name "*.MP4" -o -name "*.gif" -o -name "*.GIF" -o -name "*.zip" -o -name "*.flv" -o -name "*.fla" -o -name "*.png" -o -name "*.PNG" -o -name "*.pdf" -o -name "*.PDF" -o -name "*.swf" -o -name "*.SWF" -o -name "*.wma" -o -name "*.WMA" -o -name "*.wmv" -o -name "*.WMV" -o -name "*.wav" -o -name "*.WAV" -o -name "*.avi" -o -name "*.AVI" -o -name "*.bmp" -o -name "*.BMP" -atime +90 > oldfiles.txt


Can anyone see any issues with this?
0
Comment
Question by:894359
8 Comments
 
LVL 45

Expert Comment

by:sunnycoder
ID: 17783046
Hi 894359,

Command looks good .. why do you think this is not right? What are the inconsistencies in the result?

Cheers!
sunnycoder
0
 
LVL 43

Expert Comment

by:ravenpl
ID: 17783301
> -name "*.BMP" -atime +90
are connected with -and by default. And 'and' operator is stroneger than 'or'. Therefore the '-atime +90' applies to *.BMP files only. Also I suggest You to use single quotes instead doubles.
find / -type f -a \( -name '*.jpg' -o ...... \) -a -atime +90 # is it better?

0
 

Author Comment

by:894359
ID: 17784645
Hi ravenpl.. are you saying that my find only applies  the -aname  +90 to bmps andwill list all other file extentions listed?

So it should look somewhat like this? Confused by the two additional  "-a" added also????

find / -type f -a \(-name '*.jpg' -o -name '*.jpe' -o -name '*.JPE' -o -name '*.JPG' -o -name '*.MOV' -o -name '*.mov' -o -name '*.mpg' -o -name '*.MPG' -o -name '*.mpeg' -o -name '*.mp3' -o -name '*.MP3' -o -name '*.mp4' -o -name '*.MP4' -o -name '*.gif' -o -name '*.GIF' -o -name '*.zip' -o -name '*.flv' -o -name '*.fla' -o -name '*.png' -o -name '*.PNG' -o -name '*.pdf' -o -name '*.PDF' -o -name '*.swf' -o -name '*.SWF' -o -name '*.wma' -o -name '*.WMA' -o -name '*.wmv' -o -name '*.WMV' -o -name '*.wav' -o -name '*.WAV' -o -name '*.avi' -o -name '*.AVI' -o -name '*.bmp' -o -name '*.BMP'\) -a  -atime +90 > oldfiles.txt
0
 
LVL 43

Expert Comment

by:ravenpl
ID: 17786650
That's what I'm suggesting. Also '-type f' applied to '*.jpg' only ;)
-o == OR, -a == AND # it just reads better
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 38

Expert Comment

by:yuzh
ID: 17786990
I suggest you to use "-mtime" or "-ctime" instead of "-atime".  The  access  time  of directories in path is changed by the  find command itself.


man find
to learn more deatils
0
 
LVL 43

Expert Comment

by:ravenpl
ID: 17787010
> I suggest you to use "-mtime" or "-ctime" instead of "-atime".  The  access  time  of directories in path is changed by the  find command itself.
Only for directories. For files it stays untouched. stat(filename) does not update atime.
0
 

Author Comment

by:894359
ID: 17792120
Not following what you mean here/

Also '-type f' applied to '*.jpg' only ;)
-o == OR, -a == AND # it just reads better
0
 
LVL 43

Accepted Solution

by:
ravenpl earned 500 total points
ID: 17793716
> Not following what you mean here
Then focus

You can type
find / -type f -name '*.jpg' -name '*.JPG' # which means same as
find / -type f -a -name '*.jpg' -a -name '*.JPG' # because -a means AND, and it's default operator(when no operator)
also, AND has higher precedence, so
find / -type f -name '*.jpg' -name '*.JPG' -o -type d #means same as
find / \( -type f -name '*.jpg' -name '*.JPG' \) -o -type d # where I assume You know what parens do?

So in Your first example parens and -a are like
find / \( -type f -a -name "*.jpg" \) -o -name "*.jpe" -o -name "*.JPE" -o -name "*.JPG" -o -name "*.MOV" -o -name "*.mov" -o -name "*.mpg" -o -name "*.MPG" -o -name "*.mpeg" -o -name "*.mp3" -o -name "*.MP3" -o -name "*.mp4" -o -name "*.MP4" -o -name "*.gif" -o -name "*.GIF" -o -name "*.zip" -o -name "*.flv" -o -name "*.fla" -o -name "*.png" -o -name "*.PNG" -o -name "*.pdf" -o -name "*.PDF" -o -name "*.swf" -o -name "*.SWF" -o -name "*.wma" -o -name "*.WMA" -o -name "*.wmv" -o -name "*.WMV" -o -name "*.wav" -o -name "*.WAV" -o -name "*.avi" -o -name "*.AVI" -o -name "*.bmp" -o \( -name "*.BMP" -a -atime +90 \)
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Introduction Regular patching is part of a system administrator's tasks. However, many patches require that the system be in single-user mode before they can be installed. A cluster patch in particular can take quite a while to apply if the machine…
Using libpcap/Jpcap to capture and send packets on Solaris version (10/11) Library used: 1.      Libpcap (http://www.tcpdump.org) Version 1.2 2.      Jpcap(http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html) Version 0.6 Prerequisite: 1.      GCC …
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now