0

From find manual:

mtime n
File's data was last modified n*24 hours ago.

So

find . -mtime 0

should find what was modified n*24 hours ago, which is 0*24 hours ago, which is 0 hours ago. But it doesn't. I think it finds what was modified between 24 hours ago and the present moment.

Then

find . -mtime 0

is equal to

find . -mtime -1

Am I right? Is the manual wrong?

These are my thoughts (edited):

-mtime -1, file was modified less than 24 hours ago
-mtime -0, file was modified less than 24 hours ago
-mtime 1, file was modified **exactly** 24 hours ago

-mtime +1, file was modified more than 24 hours ago
-mtime +0, file was modified more than 24 hours ago.
-mtime 0, file was modified **exactly** 24 hours ago

I think I haven't gotten it right yet, because find . -mtime 0 is bringing up files I didn't modified exactly 24 hours ago

Edit2:

Okay, I really don't understand anything at all, but I guess this is the right cheatsheet:

find . -mtime +0 # find files modified greater than 24 hours ago
find . -mtime 0 # find files modified between now and 1 day ago
# (i.e., in the past 24 hours only)
find . -mtime -1 # find files modified less than 1 day ago (SAME AS -mtime 0)
find . -mtime 1 # find files modified between 24 and 48 hours ago
find . -mtime +1 # find files modified more than 48 hours ago
Student123843
  • 23

1 Answers1

2

This is fairly straightforward to understand, with an empirical test. Let's set up five empty files and set their modification times to the following values:

$ touch -d '50 hours ago' a
$ touch -d '40 hours ago' b
$ touch -d '30 hours ago' c
$ touch -d '20 hours ago' d
$ touch -d '10 hours ago' e

find calculates the results of the atime/mtime/ctime tests by calculating the number of 24-hour periods from the time of executing the command. Fractional parts are ignored during this calculation.

So let's divide these values and find the respective number of 24-hour periods:

a: 50/24 = 2
b: 40/24 = 1
c: 30/24 = 1
d: 20/24 = 0
e: 10/24 = 0

Next, we'll look at the how the arguments are specified. There are three forms allowed by find: n (exact match), +n (greater than), -n (less than).

With that, let's run a few find commands with these files and see the results.

  • find . -mtime 0 returns files d & e (value 0).
  • find . -mtime 1 returns files b & c (value 1).

You'll notice that even though you've specified an exact match (n), you're still getting a range of modification times. This is because of the fractional part being ignored in our calculations.

Let's move on to the next set of commands.

  • find . -mtime +0 returns files a, b & c (values 1 & 2).
  • find . -mtime +1 returns only file a (value 2).

Because find ignores the fractional parts during these calculations, the next value after 0 can only be 1. The same applies for +1, where the next match can only be 2. This is somewhat non-intuitive, so it is also stated in the manual as a key point - 'to match -atime +1, a file has to have been accessed at least two days ago'.

Finally, we'll look at the 'less than' range.

  • find . -mtime -0 returns no files.
  • find . -mtime -1 returns files d & e.

The -0 check will match files with a modification timestamp in the future. This is not a typical scenario, so it has not been included in this experiment. The -1 check will return files that have a value of 0 (i.e. the next lesser value after 1), which are d & e.

Hopefully this clears up the confusion regarding these tests. The bottom line is that even though you specify a single integer on the command line, you are still referring to a range with the atime/ctime/mtime tests.

Haxiel
  • 8,361
  • This is a good explanation. Here a recent confusion, including -daystart...https://unix.stackexchange.com/questions/552749/how-to-get-difference-between-2-dates-in-linux. My bottom line is: natural language in this case is very unclear: "older than two days, counting from midnight" –  Dec 09 '19 at 18:54