349

E.g., a MySQL server is running on my Ubuntu machine. Some data has been changed during the last 24 hours.

What (Linux) scripts can find the files that have been changed during the last 24 hours?

Please list the file names, file sizes, and modified time.

1

7 Answers 7

616

To find all files modified in the last 24 hours (last full day) in a particular specific directory and its sub-directories:

find /directory_path -mtime -1 -ls

Should be to your liking

The - before 1 is important - it means anything changed one day or less ago. A + before 1 would instead mean anything changed at least one day ago, while having nothing before the 1 would have meant it was changed exacted one day ago, no more, no less.

7
  • 29
    nice! how about last 2 hours?
    – JackWM
    Apr 18, 2013 at 14:47
  • 137
    use "-mmin -120" instead of mtime
    – Xavjer
    Apr 18, 2013 at 14:51
  • 1
    why the - before the numeric value?
    – EsseTi
    Feb 19, 2016 at 10:30
  • 7
    The argument to -mtime is interpreted as the number of whole days in the age of the file. -mtime +n means strictly greater than, -mtime -n means strictly less than.
    – Xavjer
    Feb 20, 2016 at 10:07
  • 3
    To the reader: don't forget to remove the -ls when using in a script
    – redolent
    Aug 23, 2018 at 0:39
70

Another, more humanist way, is to use -newermt option which understands human-readable time units (see man find and search for -newerXY).

Unlike -mtime option which requires the user to read find documentation to figure our what time units -mtime expects and then having the user to convert its time units into those, which is error-prone and plain user-unfriendly. -mtime was barely acceptable in 1980s, but in the 21st century -mtime has the convenience and safety of stone age tools.

Example uses of -newermt option with the same duration expressed in different human-friendly units:

find /<directory> -newermt "-24 hours" -ls
find /<directory> -newermt "1 day ago" -ls
find /<directory> -newermt "yesterday" -ls
0
51

You can do that with

find . -mtime 0

From man find:

[The] time since each file was last modified is divided by 24 hours and any remainder is discarded. That means that to match -mtime 0, a file will have to have a modification in the past which is less than 24 hours ago.

15

On GNU-compatible systems (i.e. Linux):

find . -mtime 0 -printf '%T+\t%s\t%p\n' 2>/dev/null | sort -r | more

This will list files and directories that have been modified in the last 24 hours (-mtime 0). It will list them with the last modified time in a format that is both sortable and human-readable (%T+), followed by the file size (%s), followed by the full filename (%p), each separated by tabs (\t).

2>/dev/null throws away any stderr output, so that error messages don't muddy the waters; sort -r sorts the results by most recently modified first; and | more lists one page of results at a time.

2
  • 2
    You could also use | less instead of | more, I suppose. Dec 7, 2016 at 20:29
  • 1
    more or less... ;)
    – Adrian
    Apr 27, 2022 at 13:15
9

For others who land here in the future (including myself), add a -name option to find specific file types, for instance: find /var -name "*.php" -mtime -1 -ls

0
5

This command worked for me

find . -mtime -1 -print
0

Find the files...

You can set type f = file

find /directory_path -type f -mtime -1 -exec ls -lh {} \;

👍

Not the answer you're looking for? Browse other questions tagged or ask your own question.