Of course it's possible to take the output of find . -type f | xargs ls -l and pipe it to a Python script that would sort the lines and output the top 20.

But is there anything faster than that?

migrated from serverfault.com Mar 20 '15 at 12:58

This question came from our site for system and network administrators.

  • Pass -mtime or -mmin to find to reduce the number of entries the Python script has to parse and sort. – Ben Voigt Mar 17 '15 at 23:54
  • Someone down-voted the question. Why? – ijt Mar 18 '15 at 0:00
  • Probably because this question is not unique to professional server administration; an end user might ask the same thing. – Ben Voigt Mar 18 '15 at 0:02
  • I see, so this question should have been asked on stackoverflow. – ijt Mar 18 '15 at 0:24
  • No, definitely not. StackOverflow is for questions about programming; not usage of the system. SuperUser would be more appropriate. (Writing the python script might involve a StackOverflow question, but your overall problem would not) – Ben Voigt Mar 18 '15 at 0:25
find . -xdev -type f -printf "%T@ %Tc %p\n" | sort -n | tail -20
  • 2
    That might work on Linux, but on Mac OS X, it says find: -printf: unknown primary or operator. – ijt Mar 18 '15 at 0:03
  • Try to trim the amount of data being piped to poor overworked sort. – Ben Voigt Mar 18 '15 at 0:03
  • @ijt On OSX, with "brew" you can install usable gnu tools. – peterh Mar 18 '15 at 4:31
  • Which brew package has GNU find? brew install find turns up nothing. – ijt Mar 18 '15 at 6:03

On Mac OS X (10.10.2), try this

find . -xdev -type f -print0 | xargs -0 stat -f "%m%t%Sm %N"

or run a stat directly

stat -f "%m%t%Sm %N" /path

From man stat

 In order to determine the three files that have been modified most recently, you could use the following format:

       > stat -f "%m%t%Sm %N" /tmp/* | sort -rn | head -3 | cut -f2-
       Apr 25 11:47:00 2002 /tmp/blah
       Apr 25 10:36:34 2002 /tmp/bar
       Apr 24 16:47:35 2002 /tmp/foo

You could easily replace 3 with 20 (-:

  • 1
    This works: time find . -xdev -type f -print0 | xargs -0 stat -f "%m%t%Sm %N" | sort -rn | head -n 20 | cut -f2-, but it took 2 minutes, 11 seconds, so it's not quick. – ijt Mar 20 '15 at 19:33
  • You are searching the entire file system, so yes, it will take time. What is your definition of quick? – KM. Mar 20 '15 at 19:38
  • I'm looking for under 50msec. – ijt Mar 20 '15 at 21:44
  • This is how many files you can scan with different disk types in 50ms on paper, assuming 10ms, 50000ns, 20000ns and 10ns access times and ignoring overhead: HDD 5 files, SATA SSD 1000 files, PCIe SSD 2500 files, RAM disk 50 million files. Considering the numbers a RAM disk seems to be your only option if you absolutely need that speed. An alternative might be to cache the results. – Hoov Sep 3 '16 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.