Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have to find those files which have been modified before one day. There are lots of files which are modified before one day. I am doing find ./ -type f -mtime -1. But, I observed that my disk util went to 100%. It was probably because of the access time modification for each file. Is there any way to find files without modification of the access time?

share|improve this question
2  
find doesn't modify the atime of files. –  bahamat Nov 26 '12 at 7:49
2  
Sounds to me like perfectly expected behavior that when you do a heavy find, disk usage goes up. What makes you think that find updated the atime for the files? –  Michael Kjörling Nov 26 '12 at 10:20
add comment

3 Answers

up vote 1 down vote accepted

Your disk usage spiked high because the find was scanning through a lot of directories. Your disk usage monitor is probably reporting both reads and writes in the same graph.

Often, if you do several finds in a row on the same directory structure, the subsequent finds do not access the disk because all the disk blocks the find needs (i.e. the directory listings) are cached in memory from the previous find.

Other than having the blocks already cached in memory, there is no way to reduce the disk load of a find operation (well, you could nice it or stick a sleep in there, but that wouldn't reduce the number of disk accesses required).

share|improve this answer
add comment

Normally find doesn't modify the access time of file .To get the modification time and access time for a file you can use stat command

eg :

$ stat filename

Output

  File: `filename'
  Size: 683             Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 34177055    Links: 1
Access: (0777/-rwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2012-11-26 03:50:01.000000000 -0500
Modify: 2012-11-26 03:22:04.000000000 -0500
Change: 2012-11-26 03:22:04.000000000 -0500
share|improve this answer
add comment

You may want to mess with the noatime attribute in your filesystem mounts.

I believe there is now very little reasons to keep the filesystem updating its atime (there may be some left, for example old mail programs used to use those to know if some files were read since last time the person accessed the mail program... But this should be really old behaviour now). However it still is the default on many filesystems and unix/linux systems. I'd welcome information about why it's still needed nowadays...

More info there : http://tldp.org/LDP/solrhe/Securing-Optimizing-Linux-RH-Edition-v1.3/chap6sec73.html

(I took the first link when I searched for "noatime" in my search engine... Should be good enough, but you can probably find more info elsewhere)

share|improve this answer
    
A big bonus is that every file access now won't commit a write to change the atime... Could be quite a performance improvement! And if it does breaks something, try to see if that thing can be parametered to not rely on atime, or move the files it needs to look atime on to a separate partition which has the atime option (ie, which hasn't the noatime option set) if you can. –  Olivier Dulac Dec 6 '12 at 18:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.