Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm executing a command which updates a file in an unknown location on my system. What is the the find/locace/whatever command that will tell me, which file was the last to update on the system? This command needs to know not to look in proc or any other locations which are not relevant.

share|improve this question

migrated from Nov 11 '13 at 23:27

This question came from our site for professional and enthusiast programmers.

If you can run the command again, run strace -o log.txt thecommand. The log file will show all system calls, including those that will help identify all the files created or written to by the command. Look for open and write system calls in the log. You may also have to look at chdir and mmap calls to be thorough. – Mark Plotnick Nov 12 '13 at 19:52
Actually this is a great idea. Not a s clean as I wanted but will definitely do the trick. – e271p314 Nov 13 '13 at 7:53

Is this any help for you?

find / -mtime -5 | head -1

This tells you which files were changed in last 5 minutes and outputs the first line..

You can of course specify it to look only for png files for example:

find / -name "*.png" -mtime -5 | head -1

Where / is the directory where the search starts - in this case system root, -name "*.png" is a filter for your search, -mtime -5 is a filter used to select only files modified in last 5 minutes and | head -1 takes the output of everything before the pipe and prints just the first line.

Take in mind that without the first filter it also checks directories, so the use of the filename filter is advised.

mtime reference

Edit: If you want to exclude some folders it would probably better to write a bash script which has N folders specified for searching and then does the command for each of them.

That means your script would execute:

find /your/first/folder -name "*.png" -mtime -5 | head -1


find /your/second/folder/location -name "*.png" -mtime -5 | head -1

and so on..

share|improve this answer
But this will look in many places which are not relevant like /proc, /boot and so on, I'm interested in find command which can locate configuration files and let me know which one was last updated – e271p314 Nov 11 '13 at 14:58
well if you know where they are located, then just use find {location} -mtime -5 where {location} is the path to your directory or even specify a filename filter.. or you can search only your home directory with find ~/ -name "*.png" -mtime -5 | head -1 for example – Dropout Nov 11 '13 at 15:00
in other words: you can't find something somewhere if you're not looking in that place - either specify where to look or search everything – Dropout Nov 11 '13 at 15:03
Well, your answer was useful in a way, I had to filter out the results which didn't match configuration files location to find what I was looking for, something like sudo find / -mtime -5 | grep -v ^/proc/ | grep -v ^/dev/ | grep -v ^/run/ | grep -v ^/sys/ | grep -v ^/var/ | grep -v ^/usr/. As you can see, it's not too pretty, any other suggestions to automate this process? – e271p314 Nov 11 '13 at 15:17
As I mentioned: Write a script which only uses the folders which are relevant a searches in each of them.. Unfortunately nothing else comes to my mind at the moment :( – Dropout Nov 11 '13 at 15:40

you could see which files are currently being changed with inotifywait command.

inotifywait -rme modify /folder/to/monitor/

this will list all files and directories modified in /folder/to/monitor/ and all its subdis.

-r : recursive

-m : monitor file system until killed by user

-e : specify event types to monitor

and you can also tell the command to ignore some directories

inotifywait --exclude '^/proc/' -rme modify /

Be aware that setting such monitoring on the whole file system will take quite some time to set up and you may also have to increase the user_watches limit (8k by default).

Please increase the amount of inotify watches allowed per user via `/proc/sys/fs/inotify/max_user_watches'

This command may be more appropriate when using on specific locations.

share|improve this answer
Indeed, interesting command which I wasn't aware of, but my main problem is that I must look under root directory since I can't know for sure where is the configuration file which I'm looking for so I can't make any assumptions about the directory which contains it. – e271p314 Nov 11 '13 at 16:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .