Find modifies the Access Time

Question

I have to find those files which have been modified before one day. There are lots of files which are modified before one day. I am doing find ./ -type f -mtime -1. But, I observed that my disk util went to 100%. It was probably because of the access time modification for each file. Is there any way to find files without modification of the access time?

Answer 1

Your disk usage spiked high because the find was scanning through a lot of directories. Your disk usage monitor is probably reporting both reads and writes in the same graph.

Often, if you do several finds in a row on the same directory structure, the subsequent finds do not access the disk because all the disk blocks the find needs (i.e. the directory listings) are cached in memory from the previous find.

Other than having the blocks already cached in memory, there is no way to reduce the disk load of a find operation (well, you could nice it or stick a sleep in there, but that wouldn't reduce the number of disk accesses required).

Answer 2

Normally find doesn't modify the access time of file .To get the modification time and access time for a file you can use stat command

eg :

$ stat filename

Output

  File: `filename'
  Size: 683             Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 34177055    Links: 1
Access: (0777/-rwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-11-26 03:50:01.000000000 -0500
Modify: 2012-11-26 03:22:04.000000000 -0500
Change: 2012-11-26 03:22:04.000000000 -0500

Answer 3

You may want to mess with the noatime attribute in your filesystem mounts.

I believe there is now very little reasons to keep the filesystem updating its atime (there may be some left, for example old mail programs used to use those to know if some files were read since last time the person accessed the mail program... But this should be really old behaviour now). However it still is the default on many filesystems and unix/linux systems. I'd welcome information about why it's still needed nowadays...

More info there : http://tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap6sec73.html

(I took the first link when I searched for "noatime" in my search engine... Should be good enough, but you can probably find more info elsewhere)