0

i run this command

find BAR -type f -mtime +1095 # older than 3 years

and find this file:

BAR/foo.pdf

So i run this:

stat BAR/foo.pdf
Access: 2020-01-03 01:32:05.584393000 -0500
Modification: 2017-12-04 07: 59: 36.963225900 -0500
Change: 2020-01-02 10: 26: 28.907127100 -0500
# or
find BAR/foo.pdf -type f -printf "%p\n%a\n%c\n\n"
Fri Jan  3 01:32:05.5843930000 2020
Thu Jan  2 10:26:28.9071271000 2020

'Access' and 'Change' date is less than 3 years old

and if a run

find BAR -type f -ctime +1095 # older than 3 years

get nothing

What I want is to delete any files that have not been used (access or change or modify) in 3 years

PD: in the example, only 2 criteria are met. I would like my command to search for files that meet the 3 criteria: That has not been accessed, modified or changed for more than 3 years

acgbox
  • 844

2 Answers2

2

find combines tests using implicit -a (AND operator). In your command:

find BAR -type f -ctime +1095

there are already two tests: -type f and -mtime +1095. The command may be written as:

find BAR -type f -a -ctime +1095

You can straightforwardly add more tests. Example:

find BAR -type f -ctime +1095 -mtime +1095 -atime +1095
# or with explicit -a
find BAR -type f -a -ctime +1095 -a -mtime +1095 -a -atime +1095

Each of the above two commands will print the pathname of a file if the file matches all the four tests (-type f, -ctime +1095, -mtime +1095, -atime +1095). It seems this is what you want (but note if find BAR -type f -ctime +1095 gives you nothing then adding more tests that must match will also give you nothing; this is only because there are no regular files in BAR that match your criteria, in general the command may find something).

With (implicit or explicit) -a, if the test(s) before -a fails then the test(s) after -a will not be performed (because they cannot change the outcome). Some implementations of find change the order of tests for performance, trying hard not to break the logic.

There is also -o (OR operator). Its usage is sometimes non-intuitive because -a takes precedence (compare this answer of mine). And there is ! to negate a test. In general you can combine multiple tests to build any(?) logic you want (see the "Theory" section of this another answer of mine).

To actually delete files you need -delete or -exec rm {} + (see this question to learn the difference).

Kamil Maciorowski
  • 81,893
1

Quoting from this answer:

There are 3 kind of "timestamps":

  • Access - the last time the file was read
  • Modify - the last time the file was modified (content has been modified)
  • Change - the last time meta data of the file was changed (e.g. permissions)

The man page of find says:

   -ctime n
          File's status was last changed less than, more than or
          exactly n*24 hours ago.  See the comments for -atime to
          understand how rounding affects the interpretation of file
          status change times.

-mtime n
          File's data was last modified less than, more than or
          exactly n*24 hours ago.  See the comments for -atime to
          understand how rounding affects the interpretation of file
          modification times.

So mtime corresponds to Modify, while ctime corresponds to Change.

The results are correct according to the stat data:

Modification: 2017-12-04 07: 59: 36.963225900 -0500
Change: 2020-01-02 10: 26: 28.907127100 -0500

For access-time, you should use atime.

harrymc
  • 498,455