Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

With the find command it is easy to find files that have been modified or accessed within a given period.

When a file is created, the acesss time is the same as the modify time. But as soon it is accessed (read), the access time changes, but the modify time does not.

I need to find files that been accessed at all, ie. files which have access time newer than modify time.

How do I do that?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This should work:

find -type f -print0 | xargs -0 -I % find -path % -anewer %
share|improve this answer
    
This works great! Can you explain how it works? –  marlar Sep 10 '10 at 20:21
    
Btw, in the meantime I constructed this ugly command: find . -exec sh -c "stat {} | awk --re-interval '/File:/ {file=\$2} /(Access|Modify): [0-9]{4}/ {if(\$1==\"Access:\")access=\$3; else modify=\$3} END {if(access!=modify) print file}'" \; –  marlar Sep 10 '10 at 20:22
    
@marlar: It finds all files then sends them via xargs through another find which compares the access time to its own modified time. The -I % acts like a variable which holds the filename and is used twice in the second find command. If there are a lot of files it could be slow since it goes through all of them twice. –  Dennis Williamson Sep 10 '10 at 21:46

I don't think there's a way to do this in a single traversal with GNU find (let alone POSIX find). It's a simple one-liner with Perl's File::Find:

perl -MFile::Find -e 'find({wanted => sub {print "$File::Find::name\n" if -f && -M _ > -A _}}, @ARGV);' .

Make sure that your files are mounted without the noatime or relatime option — recent Linux distributions tend to use it by default.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.