当前位置：文江博客话题详情

如何在unix中查找最近一小时内创建的文件

发布于 2024-10-20 17:56:39 字数 28 浏览 3 评论 0原文

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

恰似旧人归 2024-10-27 17:56:39

如果要搜索的目录是srch_dir，则要么要么

$ find srch_dir -cmin -60 # change time

要么

$ find srch_dir -mmin -60 # modification time

显示

$ find srch_dir -amin -60 # access time

元数据已更改的文件 (ctime)，文件内容本身已被修改 (mtime) code>) 或在过去一小时内访问过 (atime)。

ctime 并不直观，需要进一步解释：

ctime< /a>:
与仅与文件内的内容相关的mtime不同，更改的时间戳指示文件的某些元数据最后一次更改的时间。 ctime指的是文件元数据的最后时间。
例如，如果文件的权限设置被修改，ctime将会指示它。

If the dir to search is srch_dir then either

$ find srch_dir -cmin -60 # change time

$ find srch_dir -mmin -60 # modification time

$ find srch_dir -amin -60 # access time

shows files whose metadata has been changed (ctime), the file contents itself have been modified (mtime), or accessed (atime) in the last hour, respectively.

ctime is non-unintuitive and warrants further explanation:

ctime:
Unlike mtime, which is only related to the contents inside a file, changed timestamp indicates the last time some metadata of a file was changed. ctime refers to the last time when a file’s metadata.
For example, if permission settings of a file were modified, ctime will indicate it.

回复收藏 0 原文

云朵有点甜 2024-10-27 17:56:39

UNIX 文件系统（通常）不存储创建时间（也称为“出生时间”）。相反，只有访问时间、（数据）修改时间和（inode）更改时间。

话虽如此，find 有 -atime -mtime -ctime 谓词：

$ find --version | head -n1
find (GNU findutils) 4.8.0


$ MANWIDTH=999 man 1 find | grep -A1 -- '^ *-.time' | fold --spaces
       -atime n
              File was last accessed less than, more than or exactly n*24 hours
ago.  When find figures out how many 24-hour periods ago the file was last
accessed, any fractional part is ignored, so to match -atime +1, a file has to
have been accessed at least two days ago.
--
       -ctime n
              File's status was last changed less than, more than or exactly
n*24 hours ago.  See the comments for -atime to understand how rounding affects
the interpretation of file status change times.
--
       -mtime n
              File's data was last modified less than, more than or exactly
n*24 hours ago.  See the comments for -atime to understand how rounding affects
the interpretation of file modification times.

因此 find -ctime 0 查找不到一小时前 inode 已更改的所有内容（例如，包括文件创建，但也计算链接计数和权限以及文件大小更改）。

UNIX filesystems (generally) don't store creation times (AKA "birth time"). Instead, there are only access time, (data) modification time, and (inode) change time.

That being said, find has -atime -mtime -ctime predicates:

$ find --version | head -n1
find (GNU findutils) 4.8.0


$ MANWIDTH=999 man 1 find | grep -A1 -- '^ *-.time' | fold --spaces
       -atime n
              File was last accessed less than, more than or exactly n*24 hours
ago.  When find figures out how many 24-hour periods ago the file was last
accessed, any fractional part is ignored, so to match -atime +1, a file has to
have been accessed at least two days ago.
--
       -ctime n
              File's status was last changed less than, more than or exactly
n*24 hours ago.  See the comments for -atime to understand how rounding affects
the interpretation of file status change times.
--
       -mtime n
              File's data was last modified less than, more than or exactly
n*24 hours ago.  See the comments for -atime to understand how rounding affects
the interpretation of file modification times.

Thus find -ctime 0 finds everything for which the inode has changed (e.g. includes file creation, but also counts link count and permissions and filesize change) less than an hour ago.

回复收藏 0 原文

初心未许 2024-10-27 17:56:39

查看此链接，然后帮助您自己。

基本代码是：

#create a temp file
echo "hi" > t.tmp

# set the file time to 2 hours ago
touch -t 200405121120 t.tmp

# then check for files
find /admin/dump -type f -newer t.tmp -print -exec ls -lt {} \; | pg

check out this link and then help yourself out.

the basic code is:

#create a temp file
echo "hi" > t.tmp

# set the file time to 2 hours ago
touch -t 200405121120 t.tmp

# then check for files
find /admin/dump -type f -newer t.tmp -print -exec ls -lt {} \; | pg

回复收藏 0 原文

a√萤火虫的光℡ 2024-10-27 17:56:39

查找 ./ -cTime -1 -type f

或

查找 ./ -cmin -60 -type f

回复收藏 0 原文

浅暮の光 2024-10-27 17:56:39

sudo find / -Bmin 60

从 man 页面：

-Bmin n
如果文件 inode 创建时间与
find 开始的时间（四舍五入到下一个整分钟）为 n
分钟。

显然，您可能需要进行一些不同的设置，但此主选项似乎是搜索最近 N 分钟内创建的任何文件的最佳解决方案。

sudo find / -Bmin 60

From the man page:

-Bmin n
True if the difference between the time of a file's inode creation and
the time find was started, rounded up to the next full minute, is n
minutes.

Obviously, you may want to set up a bit differently, but this primary seems the best solution for searching for any file created in the last N minutes.

回复收藏 0 原文