Date: Sat, 1 Nov 2003 01:04:22 +0000 (GMT) From: David Carter-Hitchin <david@carter-hitchin.clara.co.uk> To: Drew Tomlinson <drew@mykitchentable.net> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: Help With 'find' Syntax Message-ID: <Pine.BSF.4.21.0311010038570.656-100000@localhost> In-Reply-To: <008301c39fd5$6dce6880$6e2a6ba5@lc.ca.gov>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Drew, Find is one of those classic commands for confusing people. One just gets used to it over time. The behaviour of find varies significantly with different unixes under different shells. Which shell are you using? Under bash this command does what you want: find / -mtime 7 -size +1024c -ls -o -ctime 7 -size +1024c -ls the sense here is: find / (-mtime 7 -size +1024c -ls) -o (-ctime 7 -size +1024c -ls) meaning "find (i.e. examine all files) from / and either a) print (-ls) files modified exactly 7 days old and greater than size 1024 chars (bytes). or (-o) b) print (-ls) files whose inode creation times are exactly 7 days old and greater than size 1024 chars. If neither a) nor b) are true for a file found under / then it is silently ignored. You may find the following note from man find helpful: # All primaries which take a numeric argument allow the number to be pre- # ceded by a plus sign (``+'') or a minus sign (``-''). A preceding plus # sign means ``more than n'', a preceding minus sign means ``less than n'' # and neither means ``exactly n''. So that is why I put a "+" in from of 1024 - to find files over 1024 bytes (c). So in your example below: > find /usr \( -mtime 6 -ls -size 100 \) -o \( -ctime 6 -ls -size 100 > \) -print You are trying to find files that are exactly 100 512k blocks in size. Admittedly the files you found were not of this size and I don't know why they were found - I can replicate this on my machine here, but I don't know why - perhaps it is the file allocation. This is why I chose 1024c instead of block size. > (And why is this file listed twice, anyway?) Perhaps because there was a symbolic link pointing to it (as shown by the '2' before the permissions). HTH, David On Fri, 31 Oct 2003, Drew Tomlinson wrote: > ----- Original Message ----- > From: "David Carter-Hitchin" <david@carter-hitchin.clara.co.uk> > To: "Drew Tomlinson" <drew@mykitchentable.net> > Cc: "FreeBSD Questions" <freebsd-questions@freebsd.org> > Sent: Thursday, October 30, 2003 5:55 PM > Subject: Re: Help With 'find' Syntax > > > > Hi Drew, > > > > This should find all files created or modified on 25th October: > > > > find / -mtime 6 -ls -o -ctime 6 -ls > > > > (As today is 31st October which is 6 days after 25th. You may need to > > widen your search a little with a seperate search with 7 as the paramter > > as 6 may not catch files that were created over 6 * 24 hours ago (but were > > still on the 25th); not sure about that). > > Thank you for your reply. I tried your suggestion and it seems to get what > I want. However there are so many little files that I thought I'd modify > the command to: > > find /usr \( -mtime 6 -ls -size 100 \) -o \( -ctime 6 -ls -size 100 > \) -print > > If I understand the '-size' primary correctly, this means I would find files > that are '100 512-byte blocks' in size or '50k'. Yet I still get output > like this: > > 762155 2 -r--r--r-- 1 root wheel 928 Oct > 25 15:12 /usr/local/man/man3/pcre_compile.3.gz > > 762155 2 -r--r--r-- 1 root wheel 928 Oct > 25 15:12 /usr/local/man/man3/pcre_compile.3.gz > > (And why is this file listed twice, anyway?) So I guess my question is "how > can I find files created or modified on Oct. 25 and are larger than <size>?" > > Thanks for any help. This is really confusing to me. > > Drew > > > > > HTH, > > David > > > > On Wed, 29 Oct 2003, Drew Tomlinson wrote: > > > > > On October 25, my /usr partition lost nearly 50% of it's available > space. > > > This disk hasn't had any significant size changes since I built the > system > > > as it basically serves as a gateway. > > > > > > I'm trying to use the find command to determine what may have been > written > > > to the disk but am not having any luck. I see primaries such > > > as -atime, -mtime, -ctime, and -newer and have read the man pages but do > not > > > understand what the best combination to find those files. Basically how > do > > > I use 'find' to show me all file that were created or modified on > October > > > 25? I've tried commands such as "find /usr \( -newerct 4d \! -newerct > 3d > > > \) -print" but nothing is returned. > > > > > > Thanks, > > > > > > Drew > > > > > > _______________________________________________ > > > freebsd-questions@freebsd.org mailing list > > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" > > > > > > > > > > > > > > > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0311010038570.656-100000>