[linux] How to find files modified in last x minutes (find -mmin does not work as expected)

I'm trying to find files modified in last x minutes, for example in the last hour. Many forums and tutorials on the net suggest to use the find command with the -mmin option, like this:

find . -mmin -60 |xargs ls -l

However, this command did not work for me as expected. As you can see from the following listing, it also shows files modified earlier than 1 hour ago:

-rw------- 1 user user   9065 Oct 28 23:13 1446070435.V902I67a5567M283852.harvester
-rw------- 1 user user   1331 Oct 29 01:10 1446077402.V902I67a5b34M538793.harvester
-rw------- 1 user user   1615 Oct 29 01:36 1446078983.V902I67a5b35M267251.harvester
-rw------- 1 user user  72365 Oct 29 02:27 1446082022.V902I67a5b36M873811.harvester
-rw------- 1 user user  69102 Oct 29 02:27 1446082024.V902I67a5b37M142247.harvester
-rw------- 1 user user   2611 Oct 29 02:34 1446082482.V902I67a5b38M258101.harvester
-rw------- 1 user user   2612 Oct 29 02:34 1446082485.V902I67a5b39M607107.harvester
-rw------- 1 user user   2600 Oct 29 02:34 1446082488.V902I67a5b3aM465574.harvester
-rw------- 1 user user  10779 Oct 29 03:27 1446085622.V902I67a5b3bM110329.harvester
-rw------- 1 user user   5836 Oct 29 03:27 1446085623.V902I67a5b3cM254104.harvester
-rw------- 1 user user   8970 Oct 29 04:27 1446089232.V902I67a5b3dM936339.harvester
-rw------- 1 user user 165393 Oct 29 06:10 1446095400.V902I67a5b3eM290158.harvester
-rw------- 1 user user 105054 Oct 29 06:10 1446095430.V902I67a5b3fM265065.harvester
-rw------- 1 user user   1615 Oct 29 06:24 1446096244.V902I67a5b40M55701.harvester
-rw------- 1 user user   1620 Oct 29 06:24 1446096292.V902I67a5b41M337769.harvester
-rw------- 1 user user  10436 Oct 29 06:36 1446096973.V902I67a5b42M707215.harvester
-rw------- 1 user user   7150 Oct 29 06:36 1446097019.V902I67a5b43M415731.harvester
-rw------- 1 user user   4357 Oct 29 06:39 1446097194.V902I67a5b56M446687.harvester
-rw------- 1 user user   4283 Oct 29 06:39 1446097195.V902I67a5b57M957052.harvester
-rw------- 1 user user   4393 Oct 29 06:39 1446097197.V902I67a5b58M774506.harvester
-rw------- 1 user user   4264 Oct 29 06:39 1446097198.V902I67a5b59M532213.harvester
-rw------- 1 user user   4272 Oct 29 06:40 1446097201.V902I67a5b5aM534679.harvester
-rw------- 1 user user   4274 Oct 29 06:40 1446097228.V902I67a5b5dM363553.harvester
-rw------- 1 user user  20905 Oct 29 06:44 1446097455.V902I67a5b5eM918314.harvester

Actually, it just listed all files in the current directory. We can take one of these files as an example and check if its modification time is really as displayed by the ls command:

stat 1446070435.V902I67a5567M283852.harvester

  File: ‘1446070435.V902I67a5567M283852.harvester’
  Size: 9065        Blocks: 24         IO Block: 4096   regular file
Device: 902h/2306d  Inode: 108680551   Links: 1
Access: (0600/-rw-------)  Uid: ( 1001/   user)   Gid: ( 1027/   user)
Access: 2015-10-28 23:13:55.281515368 +0100
Modify: 2015-10-28 23:13:55.281515368 +0100
Change: 2015-10-28 23:13:55.313515539 +0100

As we can see, this file was definitely last modified earlier than 1 hour ago! I also tried find -mmin 60 or find -mmin +60, but it did not work either.

Why is this happening and how to use the find command correctly?

To search for files in /target_directory and all its sub-directories, that have been modified in the last 60 minutes:

$ find /target_directory -type f -mmin -60

To find the most recently modified files, sorted in the reverse order of update time (i.e., the most recently updated files first):

$ find /etc -type f -printf '%TY-%Tm-%Td %TT %p\n' | sort -r

This may work for you. I used it for cleaning folders during deployments for deleting old deployment files.

clean_anyfolder() {
    local temp2="$1/**"; //PATH
    temp3=( $(ls -d $temp2 -t | grep "`date | awk '{print $2" "$3}'`") )
    j=0;
    while [ $j -lt ${#temp3[@]} ]
    do
            echo "to be removed ${temp3[$j]}"
            delete_file_or_folder ${temp3[$j]} 0 //DELETE HERE
        fi
        j=`expr $j + 1`
    done
}

Actually, there's more than one issue here. The main one is that xargs by default executes the command you specified, even when no arguments have been passed. To change that you might use a GNU extension to xargs:

--no-run-if-empty
-r
If the standard input does not contain any nonblanks, do not run the command. Normally, the command is run once even if there is no input. This option is a GNU extension.

Simple example:

find . -mmin -60 | xargs -r ls -l

But this might match to all subdirectories, including . (the current directory), and ls will list each of them individually. So the output will be a mess. Solution: pass -d to ls, which prohibits listing the directory contents:

find . -mmin -60 | xargs -r ls -ld

Now you don't like . (the current directory) in your list? Solution: exclude the first directory level (0) from find output:

find . -mindepth 1 -mmin -60 | xargs -r ls -ld

Now you'd need only the files in your list? Solution: exclude the directories:

find . -type f -mmin -60 | xargs -r ls -l

Now you have some files with names containing white space, quote marks, or backslashes? Solution: use null-terminated output (find) and input (xargs) (these are also GNU extensions, afaik):

find . -type f -mmin -60 -print0 | xargs -r0 ls -l

I am working through the same need and I believe your timeframe is incorrect.

Try these:

• 15min change: find . -mtime -.01
• 1hr change: find . -mtime -.04
• 12 hr change: find . -mtime -.5

You should be using 24 hours as your base. The number after -mtime should be relative to 24 hours. Thus -.5 is the equivalent of 12 hours, because 12 hours is half of 24 hours.

Manual of find:

   Numeric arguments can be specified as

   +n     for greater than n,

   -n     for less than n,

   n      for exactly n.

   -amin n
          File was last accessed n minutes ago.

   -anewer file
          File was last accessed more recently than file was modified.  If file is a symbolic link and the -H option or the -L option is in effect, the access time of the file it points  to  is  always
          used.

   -atime n
          File  was  last  accessed  n*24 hours ago.  When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to
          have been accessed at least two days ago.

   -cmin n
          File's status was last changed n minutes ago.

   -cnewer file
          File's status was last changed more recently than file was modified.  If file is a symbolic link and the -H option or the -L option is in effect, the status-change time of the file it  points
          to is always used.

   -ctime n
          File's status was last changed n*24 hours ago.  See the comments for -atime to understand how rounding affects the interpretation of file status change times.

Example:

find /dir -cmin -60 # creation time
find /dir -mmin -60 # modification time
find /dir -amin -60 # access time

The problem is that

find . -mmin -60

outputs:

.
./file1
./file2

Note the line with one dot?
That makes ls list the whole directory exactly the same as when ls -l . is executed.

One solution is to list only files (not directories):

find . -mmin -60 -type f | xargs ls -l

But it is better to use directly the option -exec of find:

find . -mmin -60 -type f -exec ls -l {} \;

Or just:

find . -mmin -60 -type f -ls

Which, by the way is safe even including directories:

find . -mmin -60 -ls

I can reproduce your problem if there are no files in the directory that were modified in the last hour. In that case, find . -mmin -60 returns nothing. The command find . -mmin -60 |xargs ls -l, however, returns every file in the directory which is consistent with what happens when ls -l is run without an argument.

To make sure that ls -l is only run when a file is found, try:

find . -mmin -60 -type f -exec ls -l {} +

this command may be help you sir

find -type f -mtime -60