find is an amazing command. With the proper manipulation it can be used to massage out the file data you need.
To find files modified in the last 24 hours is straight fowrard. Just look for files with a modified time of now() minus 1 day (24 hours):
find . -type f -mtime -1 -ls
But if you just want files modified today it’s a bit more involved:
touch -t `date +%m%d0000` /tmp/$$
find . -type f -newer /tmp/$$ -ls
touch a file with the timestamp of 12am today. The file can have any name, but we just use the bash pid here. Then find files newer than that file. It will return files modified some time since 12am. Then remove the touched file.
To find the 10 newest items in your home directory you can just use
# ls -lt | head
-rw-r--r-- 1 fordodone fordodone 5353 2013-04-23 10:42 file1
-rw-r--r-- 1 fordodone fordodone 2945 2013-04-23 10:21 file2
drwxr-xr-x 2 fordodone fordodone 12288 2013-04-12 08:53 bin
-rw-r--r-- 1 fordodone fordodone 0 2013-03-27 08:45 file3
-rw------- 1 fordodone fordodone 90420 2013-03-23 09:03 file4
-rw-r--r-- 1 fordodone fordodone 83 2013-03-19 10:35 file5
-rw-r--r-- 1 fordodone fordodone 8683 2013-03-15 10:26 file6
-rw-r--r-- 1 fordodone fordodone 28628 2013-03-15 09:15 file7
-rw-r--r-- 1 fordodone fordodone 81303 2013-03-15 09:15 file8
You could even get more aggressive by throwing the recursive flag in. Simple, right? But what if you need to recurse a large number of files and directories on a storage system, say 123,000 directories and 37 million files. I think
find might be the way to go.
This will find files modified in the last 24 hours:
# find . -type f -mtime -1 -ls
find doesn’t really provide granular control of searching for files with a certain modified time. If you just want to find files that have been modified today (i.e. since 12am) we can use the
-newer flag. First
touch a temporary file with a timestamp to compare to files you want to find. In this case we make a date string of 04240000, or today at 00:00, and
touch a file with that timestamp. Then use
find to find files that are newer than the timestamp of the file you just touched.
# touch -t `date +%m%d0000` /tmp/compare
# find . -type f -newer /tmp/compare
# rm /tmp/compare