AIX Tip of the Week: Locating Recently Modified AIX Files

Audience: AIX Administrators and End Users

Date: February 11, 2000

The find / -mtime -nn -ls command can be used to identify files that have changed within the past "nn" days. However, it often useful to locate files that have changed in the past 24 hours. Here's a trick to identify these files. The trick involves creating an empty file with a time stamp that is at the end of the desired time frame, then using the find command's "-newer" flag to locate the files.

touch -t mmddhhmm touched_file
find / -newer touched_file -ls

Where:

• touched_file is any file name you choose
• mm is month
• dd is day
• hh is hour (24 hour format)
• mm is minute

This trick is useful for finding log files with new entries, or files that are filling up a directory. Other useful find options include "-size =nn" for identifying files larger than nn blocks, "-user" for locating file by user, and "-type" by type of file. See the AIX man pages for more information.

The following Korn shell script illustrates the use of these commands.

#!/usr/bin/ksh
# Purpose: identify files starting in the current directory 
# that have changed *today* within the past nn hours
# You'll have to modify this script to work around midnight
# Bruce Spencer, IBM 2/11/00
USAGE="Usage:  $0 n \t\t\t# where n= 1-24 hours"

# check for syntax errors

if [[ $# -ne 1 ]] then
	 echo $USAGE
	 exit 1 
fi

if [[ $1 -gt 24 ]] then
	echo $USAGE
	exit 1
fi

HH=$(date +%H)

if [[ $1 -gt $HH ]] then
	echo "Error: The requested time span $1 is greater than current time $HH"
	exit 1
fi

# Passed checks

let hh=HH-$1

if [[ $hh -lt 10 ]] then
	#hours must be two digits
	timestamp="$(date +%m%d)0${hh}00"
else
	timestamp="$(date +%m%d)${hh}00"
fi

# Create a "touch file" in /tmp to avoid write permissions problem
touch_file="/tmp/${LOGNAME}junk"

touch -t $timestamp  $touch_file
find . -xdev -type file -newer $touch_file -ls
rm $touch_file