1

I am using the find command to find the files which were created with in 30 minutes.

find . -ctime -30m

But it is giving files from up to 30 days. I have tried -mmin too but it is showing that -mmin is not a valid option.

What is wrong in my find command?

Output for uname -rs is AIX 2.

Gilles 'SO- stop being evil'
  • 829,060
Aravind
  • 1,599

4 Answers4

2

AIX's find lacks the nice GNU features.

You can work around this easily. Create two "reference" files with timestamps that mark the boundaries of interest:

touch -amt 201407251200 myref1
touch -amt 201407251230 myref2

Now do:

find . -type f \( -newer myref1 -a ! -newer myref2 \) -exec ls -ld {} +

This references a file's mtime or modification time. This will be a file's creation timestamp if no further modifications (writes) were made to it, otherwise it will represent the last time a change was made to the data. For directories, the mtime is updated when new objects are added or old ones deleted. Classic Unix/Linux lacks a true creation timestamp, although this is implemented (and available for retrieval) on certain platforms. (see further here. MAC OS users can use 'ls -lU' to obtain it.

Don't confuse ctime with "creation". The ctime of the stat() structure represents the last timestamp for inode changes (i.e. permissions, ownership and the name of the object).

Community
  • 1
JRFerguson
  • 14,740
1

You should use -cmin. From man page of find, 

   -cmin n
          File’s status was last changed n minutes ago.

   -ctime n
          File’s status was last changed n*24 hours ago.  See the comments for -atime to understand how rounding affects the  interpreta-
          tion of file status change times.
Ramesh
  • 39,297
1

To complement @JRFerguson's answer.

To obtain a reference file whose modification time is 30 minutes in the past, you can do portably (precision of one second):

TZ=ZZZ0 touch -t "$(TZ=ZZZ0:30 date +%Y%m%d%H%M.%S)" /some/ref/file

And then do:

find . -newer /some/ref/file

That only works for intervals of 50 hours:

TZ=ZZZ-24:59:59 touch -t "$(TZ=ZZZ24:59:59 date +%Y%m%d%H%M.%S)" file

being the oldest file you can obtain portably (POSIXly) with that method.

Community
  • 1
Stéphane Chazelas
  • 544,893
  • @ Stéphane Chazelas Could you please explain TZ=ZZZ0 in the above By using that I got my solution but I don't understand about TZ=ZZZ0. As that is not in the format of [[cc]yy]MMDDhhmm[.ss] – Aravind Jul 29 '14 at 10:35
  • @Aravind, TZ=ZZZ0 touch defines the current timezone as being called ZZZ (the name doesn't matter so picking a random meaningless one to avoid confusion) and being 0 hours off from UTC for the touch command. – Stéphane Chazelas Jul 29 '14 at 10:41
0

You can use perl instead:

#! /usr/bin/perl

use strict;
use warnings;
use File::Find ();
use File::stat;

use vars qw(*name);
*name   = *File::Find::name;
my $now = time;

File::Find::find({wanted => \&wanted}, '.');

sub wanted {
    print "$name\n" if stat($_)->mtime > ($now - 30*60)
                    and $name ne ".";
}

Except OSX or FreeBSD (use ls -U), you can not get creation date of a file.

If you are on ext2/3/4 filesystems, you can use debugfs to get creation date of file.

cuonglm
  • 153,898