What tar command should I use to get files changed after a given date--including changes to ownership, permissions, etc.--but excluding files that were simply restored from backup?

On the other hand, would it be preferable to walk through all files following a restore and change each one's status change time as part of the restoration?

I have been using a command similar to the following to tar all recently-modified files since a given date fora periodic poor-man's backup:

$ SINCE=20190501
$ tar cf - --after-date="${SINCE} 00:00:00" . | tar tvf -

This isn't the real command, but it illustrates the point I'm trying to make. This command simply dumps out the list of files that should be going into the tar file if I was sending the output to a tar file instead.

Till now, I thought this command was working fine until I replaced my hard drive and restored all files from backup. Looking at the output of stat, it appears the change date is the date when I restored all the files from the backup, so now all the files are being selected in my tar command above.

$ stat restore_file.txt
Modify: 2019-04-01 23:52:12.000000000 -0500
Change: 2019-05-25 01:52:10.737688040 -0500

Even --newer-mtime doesn't seem to help:

$ tar cf - --newer-mtime="${SINCE}" . | tar tvf -

UPDATE: I tried the following as well, and that also didn't seem to help any as it still selected more files than I want:

$ SINCE=201905010000
$ touch -t "${SINCE}" /tmp/timestamp
$ stat /tmp/timestamp
Access: 2019-05-01 00:00:00.000000000 -0500
Modify: 2019-05-01 00:00:00.000000000 -0500
Change: 2019-06-30 18:29:19.277267874 -0500
$ tar cf - --after-date /tmp/timestamp . | tar tvf -

By filtering out directories:

$ tar cf - --after-date="${SINCE} 00:00:00" . | tar tvf - | grep -v '^d'

I see that the files I wanted to grab are indeed being grabbed and nothing more.

For some reason, tar does grab all directories without regard for the timestamp, but I guess I can live with that, so the command above is still fine most of the time and that's why I saw no problem with it till I restored my backup.

Now regarding the restore, I stated that this set the Change attribute on each restored file; therefore, --after-date was useless as my next backup ended up getting all the files.

To get past this, for the first time only following the restore, I switched to using --newer-mtime:

$ tar cf - --newer-mtime="${SINCE} 00:00:00" . | tar tvf -

This let me get all new files since the restore, and I plan to use the original --after-date once again beginning with the next backup.

This has one drawback as described further below: If there were any permission or ownership changes between the time I restored files and my first backup, I'm not picking that up and I probably never will unless those same files have their permissions/ownership change again, and then I'll only get the update at that time and all my backups until that point would restore with the wrong permissions/ownership.

The GNU tar manual states the following:

A file's status is considered to have changed if its contents have been modified, or if its owner, permissions, and so forth, have been changed.

I'm not clear on what "and so forth" means, but I'm missing out on that as well.

Given what I'm backing up here, I'm not concerned about this so I'm fine with it this time; however, in the cases I did care about it, I could either throw away my incremental backups and start all over with a brand new full backup, or I could conclude my restore process with one incremental backup following the steps above using --newer-mtime immediately following the restore. The latter would happen before folks start using the restored files, so I get a good incremental backup before switching back to --after-date.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.