0

i run this command

find BAR -type f -mtime +1095 # older than 3 years

and find this file:

BAR/foo.pdf

So i run this:

stat BAR/foo.pdf
Access: 2020-01-03 01:32:05.584393000 -0500
Modification: 2017-12-04 07: 59: 36.963225900 -0500
Change: 2020-01-02 10: 26: 28.907127100 -0500
# or
find BAR/foo.pdf -type f -printf "%p\n%a\n%c\n\n"
Fri Jan  3 01:32:05.5843930000 2020
Thu Jan  2 10:26:28.9071271000 2020

'Access' and 'Change' date is less than 3 years old

and if a run

find BAR -type f -ctime +1095 # older than 3 years

get nothing

What I want is to delete any files that have not been used (access or change or modify) in 3 years

PD: in the example, only 2 criteria are met. I would like my command to search for files that meet the 3 criteria: That has not been accessed, modified or changed for more than 3 years

acgbox
  • 785
  • I do not understand your question. I have modified my question for clarity – acgbox Nov 02 '21 at 14:42
  • Are you asking how to use -ctime and -mtime within one find command? Or how to make find actually delete files? – Kamil Maciorowski Nov 02 '21 at 14:50
  • I would like all 3 to match (access, change, modify) so that the search criteria is met, if this is possible – acgbox Nov 02 '21 at 14:51
  • If you wanted files that match -type f and -ctime +1095, you would use find BAR -type f -ctime +1095. And you did. So you're already using two tests that must match simultaneously. What keeps you from adding more tests this way? – Kamil Maciorowski Nov 02 '21 at 14:56
  • let me see if I understand. according to you can I do the following? find BAR -type f -ctime +1095 -mtime +1095 -atime +1095 – acgbox Nov 02 '21 at 14:58
  • Yes. Note if find BAR -type f -ctime +1095 gives you nothing then adding more tests that must match will also give you nothing. In BAR there are no files that match the criteria. But in general this is how you add tests that must all match. In another directory there may be files that pass the tests. – Kamil Maciorowski Nov 02 '21 at 15:01
  • So, just to be clear, could you answer the question and put, according to your criteria, what should be the correct command (with the correct order) to find any file that has not been used for more than 3 years. Thanks (to do the tests, and if it is correct select the answer as correct) – acgbox Nov 02 '21 at 15:05

2 Answers2

2

find combines tests using implicit -a (AND operator). In your command:

find BAR -type f -ctime +1095

there are already two tests: -type f and -mtime +1095. The command may be written as:

find BAR -type f -a -ctime +1095

You can straightforwardly add more tests. Example:

find BAR -type f -ctime +1095 -mtime +1095 -atime +1095
# or with explicit -a
find BAR -type f -a -ctime +1095 -a -mtime +1095 -a -atime +1095

Each of the above two commands will print the pathname of a file if the file matches all the four tests (-type f, -ctime +1095, -mtime +1095, -atime +1095). It seems this is what you want (but note if find BAR -type f -ctime +1095 gives you nothing then adding more tests that must match will also give you nothing; this is only because there are no regular files in BAR that match your criteria, in general the command may find something).

With (implicit or explicit) -a, if the test(s) before -a fails then the test(s) after -a will not be performed (because they cannot change the outcome). Some implementations of find change the order of tests for performance, trying hard not to break the logic.

There is also -o (OR operator). Its usage is sometimes non-intuitive because -a takes precedence (compare this answer of mine). And there is ! to negate a test. In general you can combine multiple tests to build any(?) logic you want (see the "Theory" section of this another answer of mine).

To actually delete files you need -delete or -exec rm {} + (see this question to learn the difference).

Kamil Maciorowski
  • 74,068
  • It did not work for me in the tests carried out, but since it is a fairly accurate explanation, I select it, so as not to extend the question further. Keep investigating. Thanks – acgbox Nov 02 '21 at 15:52
1

Quoting from this answer:

There are 3 kind of "timestamps":

  • Access - the last time the file was read
  • Modify - the last time the file was modified (content has been modified)
  • Change - the last time meta data of the file was changed (e.g. permissions)

The man page of find says:

   -ctime n
          File's status was last changed less than, more than or
          exactly n*24 hours ago.  See the comments for -atime to
          understand how rounding affects the interpretation of file
          status change times.

-mtime n
          File's data was last modified less than, more than or
          exactly n*24 hours ago.  See the comments for -atime to
          understand how rounding affects the interpretation of file
          modification times.

So mtime corresponds to Modify, while ctime corresponds to Change.

The results are correct according to the stat data:

Modification: 2017-12-04 07: 59: 36.963225900 -0500
Change: 2020-01-02 10: 26: 28.907127100 -0500

For access-time, you should use atime.

harrymc
  • 480,290
  • all 3 must match (access, change, modify) for the criteria to be met – acgbox Nov 02 '21 at 14:50
  • You could use more than one condition in find, even all three, but ctime is not a very good criteria. – harrymc Nov 02 '21 at 14:53
  • Could you explain why ctime is not a good criterion? Thanks. (I just restored the original data information. It was a problem of mine when editing the question. Sorry) – acgbox Nov 02 '21 at 14:55
  • The meta data can be changed because of actions that happened to the parent folder, such as permissions change. This doesn't mean that the file itself has changed in any way. You risk finding all the files in the folder after such a change (or none). – harrymc Nov 02 '21 at 14:59
  • let me try to summarize your argument. According to what you explain, for the criteria to match the command should be find BAR -type f -mtime +1095 -atime +1095 ? – acgbox Nov 02 '21 at 15:02
  • Yes, that's what I mean. – harrymc Nov 02 '21 at 15:12
  • Well, joining these parameters does not work for me. anyway thanks – acgbox Nov 02 '21 at 15:54