Shell Programming and Scripting

Ive been a vocal of FIND command even before. Command below doesnt really give me the file that is older than two weeks.. Is there a script that will list me the log files that i want like for this date December 10, 2014, it shud list me the date between November 26, 2014 and below.

When i run that command, it gives me Novemebr 11, we all know nvember 11 is more than two weeks ago.

Code:

find /tmp/logs* -type f -mtime +14 -exec ls -lrt {} \;

that command seems to work fine for me ... shows me files from Nov 17, Nov 3, and older,
but not a file from Nov 28.

Can you show some ls -ltr commands and getfacl commands on the files you believe it should pull back .. and show the command running and not picking them up?

(setup a smaller test directory if you need to .. )

[edit]

Code:

 
touch -d "2014-12-01 13:12:01" test_dec.txt
touch -d "2014-11-28 13:12:01" test_nov28.txt
touch -d "2014-11-17 13:12:01" test_nov17.txt
touch -d "2014-11-01 13:12:01" test_nov1.txt
ls -ltr
-rw-r-----   1 user    group          0 Nov  1 13:12 test_nov1.txt
-rw-r-----   1 user    group          0 Nov 17 13:12 test_nov17.txt
-rw-r-----   1 user    group          0 Nov 28 13:12 test_nov28.txt
-rw-r-----   1 user    group          0 Dec  1 13:12 test_dec.txt
find . -type f -mtime +14 -exec ls -ltr {} \;
-rw-r-----   1 user    group          0 Nov 17 13:12 ./test_nov17.txt
-rw-r-----   1 user    group          0 Nov  1 13:12 ./test_nov1.txt

[/edit]

Well, I disagree. 11. November fits exactly into the range you specified to find.
c.f. man find:

Can you show an example? I read over the man page and couldn't see any reason it should exclude a date 29 days ago, when you indicate 14


That seems like a pretty generous round off to me.

I disagreed with the quoted sentence from post#1, which means I'm d'accord with your (Ditto's) statement. -mtime points to a given point in time n *24 hours ago, +n opens that to a range larger than n, meaning everything older than that point in time.

mtime works days made of epoch seconds, see the stat structure for st_mtime.
There are 86400 seconds per day. -mtime 14 means EXACTLY, to the second, 86400*14 seconds ago. -mtime +14 means any file mtime equal to or greater than 86400*14,
-mtime -14 means less than 86400*14.


Some ways to get file by filetime using find (in the context of post #1)

With:
Today = Dec 12, two weeks ago = Nov 27

These examplesrefer to mtime, the last time the file was opened and written to. NOT
when it was created, but it usually works out to the same thing in most
users view. This is using POSIX find. Linux find is slightly different but
will work with these examples.

Note: touch examples are accurate to the minute only. touch -t syntax seems to vary.
Check your system.
Note: some filesystems have more precision on filetimes than others.

Note: "start" and "end" are dummy files in the current directory, a
directory that you can write in. I personally use dummy, dummy1, and
dummy2 so I know what they are and why they are empty. start and end are
clearer for this example. IMO.

1. get files last written exactly before Nov 27 at midnight

Code:

touch -t 201411270000 end
find /path -type f ! -newer end

2. get files written after Nov 27, i.e., from the first second of Nov 28 -> present

Code:

# you should add seconds to the touch -t value
touch -t 201411272359 start
find /path -type f -newer start

3. Using mtime for files older than some number of days. mtime uses days
based on 86400 seconds per day. STARTING RIGHT NOW. So if you execute this
at 1500 you will get files which will have filetime of 1521 (and greater)
on what seems to be the wrong day. mtime does understand the calendar.

Code:

# older files more then 14 * 86400 seconds old.
find /path -type f -mtime +14
# newer - files written after (the time and date of) 84600 * days in the past
find /path -type f -mtime -14

4. get files from two past times - a range Nov 7 -> Nov 20.
No files from Nov 6 and earlier, and no files dated Nov 21 -> now

Code:

# mind the touch seconds
touch -t 201411070000 start
touch -t 201411202359 stop
find /path -type f \( -newer start -a  ! -newer end \)

Ah, must have misread you then .. no worries