CODEWITHSUNDEEP
linuxfile-io
lugger1
lugger1

Reputation: 1917

how to find files written right now in linux?

I need to find files written by some script at the current moment in linux. The script is working and writing to some log, txt, some other files, and i would like to find which files exactly are involved. Is it possible?

I tried to do it with find, first by creating the file temp.cnewer with specific timestamp:

touch temp.cnewer -t 201012091145

and then by finding all files modified after it was created:

find / -type f -newer temp.cnewer

but it shows too many results. When i checked stat for few of them it shows that modification time is in the future time (don't know how it happen, system time is correct):...

Access: 2010-12-09 18:09:14.214730466 +0000
Modify: 2010-12-09 18:09:14.214730466 +0000
Change: 2010-12-09 18:09:14.214730466 +0000

Is there other way to select those files?

Upvotes: 0

Views: 3538

Answers (3)

Karl Bielefeldt
Karl Bielefeldt

Reputation: 49018

It looks like your modification times are in UTC (time zone +0000), which is why it looks to be in the future. I believe touch -t also uses UTC, which would explain the extra results. Your original method would probably work OK if you use UTC to set the modification time of your temp.cnewer file.

Upvotes: 2

Karl Bielefeldt
Karl Bielefeldt

Reputation: 49018

Depending on how long the files are kept open, the lsof command might do what you want. Another option is to run it under strace and look for the file open system calls.

Upvotes: 4

Chris Stratton
Chris Stratton

Reputation: 40347

It it still has the file open, you could find the script's pid and then

ls -l /proc/PIDNUMBER/fd

Upvotes: 1

Related Questions