Linux – Why ‘find -mtime’ Doesn’t Work as Expected with Different Timezones

centosfindlinuxmtimetimezone

I have some files on a server with the date several months ago, but they are invisible to find -mtime 7 search.

When I list them with ls -l, they look perfectly normal:

-rw-r--r-- 1 root root    347253 Jun 12 16:26 pedia_main.2010-06-12-04-25-02.sql.gz
-rw-r--r-- 1 root root 490144578 Nov 24 16:26 gsmforum_main.2010-11-24-04-25-02.sql.gz

The top file is invisible to "find . -mtime 1", but the bottom one is visible.

I almost banged my head against the wall trying to understand why. I tried some random things and came across ls --full-time command. And it shows that these two are somehow a little bit different

-rw-r--r-- 1 root root    347253 2010-06-12 16:26:20.000000000 +0400 pedia_main.2010-06-12-04-25-02.sql.gz
-rw-r--r-- 1 root root 490144578 2010-11-24 16:26:12.000000000 +0300 gsmforum_main.2010-11-24-04-25-02.sql.gz

The date seems to be ok. Bit one has +0400 as a timezone, and another one is +0300. How come find fails to find the ones with +0400?

The OS is CentOS 5.5 Final with latest updates, and ls version is (GNU coreutils) 5.97.

Also, the thing is that I don't understand where this "timezone" of the file is stored. The inode does not have any extra attributes to store them it seems. The file system on the server is ext4.

Best Answer

It's possible that the time zone issue is a red herring.

find . -mtime 7

should find files that are exactly seven days old ("seven" meaning between 7.000 and 7.999 days, give or take, and "old" meaning "since last modification"). If you want files that are more than seven days old, which judging by the date on your first file (June 2010) you do, try

find . -mtime +7

I agree with you about the apparent timezone being odd, but I think it's explicable. man stat is clear that a time_t is stored, as Sean R says below. What ls is doing is displaying that as a local time, and it's being kind enough to take account of local daylight-saving conventions when it does so.

My system is the same: file times which happen to fall in Mar-Oct are shown with a +0100 timezone while those which fall in Oct-Mar are shown with a +0000 timezone, not because this is stored in the file system, but because the time zone file tells my system that in June, when I touched the file, I would have done it at a time that I thought was 8am, not it-would-be-7am-if-it-were-winter. ls is kind enough, when displaying times that happen to be in summer, to show them as they would have appeared in summer, that's all.

If you can find any time zones in your ls output that aren't either summer or winter according to your local convention, then I'm wrong - but I can't find any on my system.

Related Topic