I am trying to track the completion of a silent installer by detecting the presence of the last file created by it, but in order to do that I need to find out which file that is. Is there any way to do this? I have found a lot of answers on how to find the most recently modified file, but that is not effective since many of these files were modified by the original creator in a different order than they are added to the system by the installer.
Agreeing that change-time (aka ctime) is the most portable feature that can be observed on a *nix filesystem, OP may need more detail.
<sys/stat.h> documents three timestamps for every file, directory, device on a filesystem: access, modification and changed. The first two can be set to arbitrary values using
utimes (widely available though tagged as an extension), but the last cannot. It is updated to the current time as a side-effect of many system calls, including
utimes. Likely it most often is updated by
chmod, but also moving or renaming a file does this as well.
However, if you happen to be looking for clues about when a file was created, the ctime is as good a clue as you are likely to find. Access time can also be useful, but some filesystems can be configured to avoid updating that. Look first at ctime.
find program (also documented in POSIX) includes an option to use ctime:
The primary shall evaluate as true if the time of last change of file status information subtracted from the initialization time, divided by 86400 (with any remainder discarded), is n.
86400 refers to the number of seconds in a day; n is an integer (the number of days). Some implementations of
find provide for smaller units, but those are not in POSIX.
You could use it like this to get a list of files changed within the past day:
find . -ctime -1 -print
Some implementations may allow a non-integer value for n, but POSIX is explicit here:
In the descriptions, wherever n is used as a primary argument, it shall be interpreted as a decimal integer optionally preceded by a plus ( '+' ) or minus-sign ( '-' )
so it is not possible to have a POSIX-compliant extension in that direction. Other implementations may provide alternate options which (for example) specify the time difference as a number of minutes. You should consult the manual for
find for the system you are using, to see if this applies to you.
One of the comments mentioned some filesystems with an extension (aka non-standard) to get the actual file creation time. Various systems have had this over the years including
- VMS (later renamed to OpenVMS), with creation, backup, revision and expiration timestamps.
- Windows, with creation, access and modification timestamps (noting that while the names are similar, the rules for updating differ from POSIX).
There is more pertinent discussion in How to get file creation date in Linux?, which mentions a
st_birthtime member for the
stat structure. That is documented in manual pages for both OSX
stat(2) and FreeBSD
stat(2), as well as in the system-specific FreeBSD
stat(1) and OSX
stat(1) utilities. (NetBSD also documents this extension). Call it a feature of modern BSD systems, for short.
find utility supports the extension as well (see for example OSX find(1)):
all of the -B* birthtime related primaries are extensions to IEEE Std 1003.1-2001 (``POSIX.1'').
Other systems do not have this extension. For discussion: