find - mtime vs mmin - Weird results

Question

So I am working on a bash script to purge out temp files and ran into inexplicable behavior.

# Find using mmin flag
find /usr/local/store/file/temp/3_day/ -mmin +$((60*24*3)) -type f > /tmp/old_files_by_mmin.txt

# Find using mtime flag
find /usr/local/store/file/temp/3_day/ -mtime +3 -type f > /tmp/old_files_by_mtime.txt

diff -u /tmp/old_files_by_mmin.txt /tmp/old_files_by_mtime.txt

First several lines:

--- /tmp/old_files_by_mmin.txt  2016-08-03 16:56:42.535458820 +0000
+++ /tmp/old_files_by_mtime.txt 2016-08-03 16:56:58.310681524 +0000
@@ -117,59 +117,6 @@
/usr/local/store/file/temp/3_day/image/resize/2016/07/29/11/15/36/1296924350
/usr/local/store/file/temp/3_day/image/resize/2016/07/29/11/47/52/1950191632
/usr/local/store/file/temp/3_day/image/resize/2016/07/29/11/30/01/711250694
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/10/04/15/44313759
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/10/04/15/1589177813
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/10/04/15/1189074525
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/10/56/44/91382315
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/09/43/45/1622776054
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/01/44/57/1465920226
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/01/23/17/1467026748
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/01/15/58/1990201487
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/01/13/19/1990298215
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/01/35/59/518813467
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/12/10/53/1962045410
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/12/31/27/290517373
-/usr/local/store/file/temp/3_day/image/resize/2016/07/31/12/05/08/547481306

Why is the -mmin flag picking up files that the mtime flag is not? If both are supposed to find any files older than now + 3 days?

It might have something to do with rounding up days. Why `bash`, by the way? `find` is not a built-in, as far as I know. — mustaccio, Aug 03 '16 at 17:33
@mustaccio: I suspect you are correct. Not sure what you mean about find not being a "built-in". It's a linux system, so bash/find are always available. — Mike Purcell, Aug 03 '16 at 17:49
@MikePurcell, "builtin" means "part of the shell", vs an external tool. If it's not part of the shell, then you need to specify your exact OS, and which version of the tool(s) your OS provides. — Charles Duffy, Aug 03 '16 at 17:51
@MikePurcell, ...BSD `find` is very different from GNU `find` is very different from busybox `find`, even though all three of those can be invoked from bash (or *without* bash, or any other shell at all). — Charles Duffy, Aug 03 '16 at 17:52
@CharlesDuffy: Makes sense. My system is purely CentOS, hence portability is a non-issue. — Mike Purcell, Aug 03 '16 at 17:53
If it's CentOS, **specify** that it's CentOS! Otherwise we don't know what to answer for. Linux isn't the One True Operating System that everyone answers questions for by default. (Arguably, the One True Standard is POSIX, since everything else tries to be a superset). — Charles Duffy, Aug 03 '16 at 17:54

score 1 · Accepted Answer · edited Jun 20 '20 at 09:12

Given the distinction between implementations, it's worth looking at what the POSIX standard for find mandates:

-mtime n

The primary shall evaluate as true if the file modification time subtracted from the initialization time, divided by 86400 (with any remainder discarded), is n.

Similarly, per the manual (for BSD find):

-mtime n[smhdw]

If no units are specified, this primary evaluates to true if the difference between the file last modification time and the time find was started, rounded up to the next full 24-hour period, is n 24-hour periods.

...thus: In BSD find, the default behavior is to round to full 24-hour periods.

For GNU find, there's a measure of configurability; see -daystart:

-daystart

Measure times (for -amin, -atime, -cmin, -ctime, -mmin, and -mtime) from the beginning of today rather than from 24 hours ago. This option only affects tests which appear later on the command line.

However, the default behavior is as given in the definition for -atime:

-atime n

File was last accessed n*24 hours ago. When find figures out how many 24-hour periods ago the file was last accessed, any fractional part is ignored, so to match -atime +1, a file has to have been accessed at least two days ago.

find - mtime vs mmin - Weird results

1 Answers1