find -ctime

I know that find -ctime +1 will find ALL files that have been modified
that are greater than 1 day old and -ctime 1 will find files that are
ONLY 1 day old -ctime -1 mean files that are less than a day old?

Can find actually use this granularity?

ctime is not modification time, it marks the time when a file was created or had its inode changed -- which includes things like renames, moves, and chmod. mtime is modification time.

Just reverse the logic with ! instead of trying to put negative values of time into find; negative values will either match everything or nothing depending on the exact logic involved...

find ! -mtime +1 ...

I have code that does this:

 
find ${AUDIT_DIR} \( -name "*.txt" -o -name "*.xml" -o  -name "*.aud" \) -ctime -1 > /tmp/list.out
 

Trying to figure out what this does and if the -ctime -1 is needed?

It finds files inside $AUDIT_DIR with the extension xml, aud, or txt. I don't think negative numbers make any sense here -- they're not mentioned in find's documentation, so I think it'd either look for a file changed in the future, or end up as some really old time caused by integer wraparound...

Ask who wrote it what it's intended to do.

1 Like

that person is not around and it did not make sense to me either (ctime -1) so that is why I asked. I will do some more testing and see where it
leads me

a negative number is ok. negative means excatly what the OP said.