5

I am trying to find the latest modified files in my system say in the last 2 hours or so. The command that I am using is:

sudo find / -mmin -120 -printf '%T@ %p\n' | sort -n | cut -f2- -d" " | more

But the above command outputs a lot of entries that contain the string /proc. So, are there any better ways by which I can remove those lines from the output?

Also, if you have any better methods to deal with the above situation then please suggest. The only criteria is that the output should contain files as well as directories.

EDIT:-

I modified the above command to also include names with newline, then added Arronical's answer and αғsнιη's answer to it. The final outcome is:

sudo find / ! -path '*/proc*' -type f -mmin -120 -exec ls -al {} \; | grep -v anystring | less
Improve this question
4
  • Do the lines all start with /proc?
    – Arronical
    Sep 15 '16 at 11:29
  • @Arronical - Yes.
    – Raphael
    Sep 15 '16 at 11:29
  • 4
    Pipe it through grep -v /proc.
    – You'reAGitForNotUsingGit
    Sep 15 '16 at 11:34
  • 2
    Please don't parse ls. It isn't even helping here. GNU find already has an ls option that does pretty much the same thing as ls -al. In any case, file names with newlines aren't a problem here, not if you just want to see the list. So just do sudo find / ! -path '*/proc*' -type f -mmin -120 | less
    – terdon
    Sep 15 '16 at 14:59
10

You can use grep -v to remove lines containing a string, such as '/proc', you could add this as a pipe to your command to make:

sudo find / -mmin -120 -printf '%T@ %p\n' | grep -v '^/proc' | sort -n | cut -f2- -d" " | more

However, as files in /proc/ are transitory in nature, you'll be likely to get some errors like

find: â?~/proc/22232/fdinfo/5â?T: No such file or directory

You can avoid these by redirecting the STDERR of the find command to /dev/null using, 2>/dev/null like so:

sudo find / -mmin -120 -printf '%T@ %p\n' 2>/dev/null | grep -v '^/proc' | sort -n | cut -f2- -d" " | more

A Better Method

Rather than filtering the results, and getting rid of your error messages, you can alter your find command so that it never looks in /proc:

sudo find / -not -path '/proc/*' -mmin -120 -printf '%T@ %p\n' | sort -n | cut -f2- -d" " | more
Improve this answer
3
  • I fixed a missing single quote and anchored your pattern to the beginning of the line to prevent unwanted matches.
    – Byte Commander ♦
    Sep 15 '16 at 11:46
  • Thanks @ByteCommander, I think modifying the find command is a better solution anyway, just figuring out how.
    – Arronical
    Sep 15 '16 at 11:49
  • There is the -prune option to exclude directories, but it seems not to work well together with other filters...
    – Byte Commander ♦
    Sep 15 '16 at 11:52
5

I would use -prune for this kind of thing e.g.

find / \( -path /proc -o -path /sys -o -path /run \) -prune -o -mmin -120 -printf '%T@ %p\n'
Improve this answer
1
  • I'd been trying to use prune, but with -name rather than -path, or with -path but a trailing slash, oops!
    – Arronical
    Sep 15 '16 at 14:32
2

You can exclude the '/proc' path as following,

[sudo] find / ! -path "/proc" ...

to exclude 'proc' entries in any level of path, use like below 

[sudo] find / ! -path "*/proc/*" ...
Improve this answer
4
  • This doesn't seem to work for me. When I try sudo find / ! -path "/proc" -type d | grep 'proc' | less I find lots of entries from /proc
    – Arronical
    Sep 15 '16 at 12:06
  • change the "/proc" to "*/proc/*" and see the result again
    – αғsнιη
    Sep 15 '16 at 12:11
  • That's not what's written in your answer.
    – Arronical
    Sep 15 '16 at 12:19
  • @Arronical updated
    – αғsнιη
    Sep 15 '16 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.