Linux – does the behaviour of `find` differ using -mtime -0 vs. +0

findlinuxUbuntu

Ubuntu 14.04 provides log rotating for Tomcat 7 and assumes log files named by day, so it searches for those and existing ones are compressed and deleted. Depending on if log files exist and how often those are changed, this might clash with the monthly naming scheme my own web applications hosted by Tomcat 7 are using:

/etc/cron.daily/tomcat7:

gzip: /var/log/tomcat7/…/RebootDevice/2017-05.log.gz already exists;       not overwritten

I can live with those messages being sent every few days or weeks, because the log messages by default only contain errors and those shouldn't occur too often. The thing that I don't understand is why I get this message the second day already. Ubuntu does the following:

find /var/log/$NAME/ -name \*.$LOGEXT -daystart -mtime +0 -print0

I've tested that on my actual directories with the following results:

root@…:/var/log/tomcat7/…/RebootDevice# ls -lisa
[…]
1089049 0 -rw-r--r-- 1 tomcat7 tomcat7    0 Mai 29 09:09 2017-05.log
1089047 4 -rw-r--r-- 1 tomcat7 adm      402 Mai 26 10:22 2017-05.log.gz

root@…:/var/log/tomcat7/…/RebootDevice# find . -name \*.log -daystart -mtime -0
root@…:/var/log/tomcat7/…/RebootDevice# find . -name \*.log -daystart -mtime +0
./2017-05.log

As you can see, the invocation using +0 finds my file even if it was last written two days ago, while using -0 doesn't. -mtime is defined as n*24 hours, so +/-0 shouldn't make any difference and from my understanding -daystart is anchoring the tests to the beginning of a full day only, should be 00:00.

So why does -0 vs. +0 behave differently in this case? It seems to make a difference of 1*24 hours.

Best Answer

From man find:

-mtime n
File's data was last modified n*24 hours ago. […]

No matter whether you use -daystart or not, regardless of how the rounding works, for the particular find invocation all the files can be divided into several disjoint sets somehow:

  • A: files modified 0 days ago,
  • B: files modified 1 day ago,
  • C: files modified 2 days ago,
  • D: files modified 3 days ago,
  • …

The manual also states:

Numeric arguments can be specified as

+n for greater than n,
-n for less than n,
n for exactly n.

As you can see the minus sign is not a (mathematical) factor of minus one here. Instead:

-mtime -0 matches nothing;
-mtime 0 matches the set A;
-mtime +0 matches B, C, D, … .

-mtime -1 matches the set A;
-mtime 1 matches the set B;
-mtime +1 matches C, D, … .

-mtime -2 matches A and B (it's equivalent to ! -mtime +1);
and so on.

Related Question