up vote 3 down vote favorite
1
share [g+] share [fb]

With the find command it is easy to find files that have been modified or accessed within a given period.

When a file is created, the acesss time is the same as the modify time. But as soon it is accessed (read), the access time changes, but the modify time does not.

I need to find files that been accessed at all, ie. files which have access time newer than modify time.

How do I do that?

link|improve this question
80% accept rate
feedback

2 Answers

up vote 2 down vote accepted

This should work:

find -type f -print0 | xargs -0 -I % find -path % -anewer %
link|improve this answer
This works great! Can you explain how it works? – marlar Sep 10 '10 at 20:21
Btw, in the meantime I constructed this ugly command: find . -exec sh -c "stat {} | awk --re-interval '/File:/ {file=\$2} /(Access|Modify): [0-9]{4}/ {if(\$1==\"Access:\")access=\$3; else modify=\$3} END {if(access!=modify) print file}'" \; – marlar Sep 10 '10 at 20:22
@marlar: It finds all files then sends them via xargs through another find which compares the access time to its own modified time. The -I % acts like a variable which holds the filename and is used twice in the second find command. If there are a lot of files it could be slow since it goes through all of them twice. – Dennis Williamson Sep 10 '10 at 21:46
feedback
up vote 2 down vote

I don't think there's a way to do this in a single traversal with GNU find (let alone POSIX find). It's a simple one-liner with Perl's File::Find:

perl -MFile::Find -e 'find({wanted => sub {print "$File::Find::name\n" if -f && -M _ > -A _}}, @ARGV);' .

Make sure that your files are mounted without the noatime or relatime option — recent Linux distributions tend to use it by default.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.