As you know, sometimes log dumps are shared among the users for further processing. Some people store the log for later use, even after the job is done.

Instead of becoming useful, it’s become large trash, which needs to be removed from the system.

When you look at the file, there are a large number of files available, and among them, you are looking to remove the file that is X days older, or maybe X times older, than when you last accessed or modified the file.

If you do have a similar kind of requirement, then I believe this article will surely help you.

Which command do you use for this task?

In this kind of scenario, the best option is to use the find command, which will first find the file according to one of the following options: -amin, -atime, -cmin, -ctime, -mmin, and -mtime.

Once the find command finds the file as per your set parameters, then you can use the -delete option or else use xargs to remove the file from your system.

Pretty simple, right? Let’s take some of the scenario-based commands.

Find and Delete Files Older Than X or N Days

Let’s say I want to find and remove a file that I have not used for more than seven days. In this case, I would say -atime is the hour of need, so let me first introduce you to command syntax. Then we will invoke the command on the system.

$ find /specify-path/ -atime +N

• find : you all are well aware of find program
• /specify/path/ : define the path where you want to execute the find command
• -atime : file was accessed less than, more than, or exactly 24 hours ago
• +N : mention the number of days in the day’s format

The above command will show you the file name that has not been accessed for more than N number of days.

If you are sure of the behaviour of the above command, then you need to add some more lines to the default command to execute the rm function on the filtered result, and once the file is deleted from the system, their file names will be printed.

$ find /specify-path/ -atime +N -exec rm {} \; -print

It’s always recommended that you first check the find command result, and after that, you should execute the rm function to avoid any data loss.

Also read: Where Do Files Go When the rm Command Is Executed?

To explain it to you better, let me create a couple of files that are more than 7 days old using the touch command. The touch command is typically used to create a new file, but you can also use it to change access and modification times.

However, we can do this to our old file, but instead of doing this, it will create a new file using the -t (timestamp) option by using the following command.

$ touch -t 202208281024 sample_A
$ touch -t 202208291024 sample_B
$ touch -t 202208301024 sample_C
$ touch -t 202208311024 sample_D
$ touch -t 202209011024 sample_E
$ touch -t 202209021024 sample_F
$ touch -t 202209031024 sample_G
$ touch -t 202209041024 sample_H

If you want to learn how to decode the timestamp, check out this article:

After that, execute one portion of the command to see the filenames, and once you are satisfied with the filenames, add the other part of the command to see the results.

$ find . -atime +7

Below is the output of the above command.

If you want to be more sure about the output, then you can use the stat command to check the last access time by executing the below command:

Once you are sure of the result, you can execute the command to remove the file from your system using the below command, which will again find the file name on the basis of your timeline, then it will remove the file and print the file name.

$ find . -atime +7 -exec rm {} \; -print

The behaviour of the above command:

You can make the above command more robust by adding the type of file.

As you know, we are looking for regular files that have not been used for more than 7 days, and I don’t want to touch any directory that has not been accessed within a week. In that case, I definitely need to explicitly mention the type of file.

$ find . -atime +7 -type f -exec rm {} \; -print

Alternatively, you can also use the -newerXY option to remove a file on the basis of your specified date. XY needs to be replaced with the following characters: 'a'(access),'B'(birth),'c'(inode change),'m'(modified),'t'(time) refrence.

You can follow the below syntax to remove a file on the basis of your preference using regular date format.

$ find /specify-path/ -type f -not -newerat "YYYY-MM-DD HH:MI:SS" -delete -print

Let’s say I want to remove all the files that were accessed prior to 2022-08-31 using the -not and -newerat options.

For this scenario, I have come up with a command that looks perfect to me. I know you are asking about time, but you can avoid this.

$ find . -not -newerat "2022-08-31" -delete -print

The behaviour of the above command.

Find and Delete File that has been modified within X minutes

There might be a time when you want to remove files on the basis of the modified time, like removing all the files from the current directory that have been accessed in the last X minutes.

Let’s say I want to remove the files that have been modified in the last 30 minutes. At that time, you should run the below command, which will delete all the files that have been modified recently.

$ find . -mmin -30 -type f -delete -print

The behaviour of the above command.

Instead of directly removing the file, you can first check the result of the find command by invoking the below code. After that, you can invoke the above command to remove the file.

$ find . -mmin -30 

You can even make your output result concise using –mmin as a conditional but how can I make –mmin as conditional? It is simple to let’s take an example.

Say you want to find a file that has been modified in the last 50 minutes of the time frame, and in the same time frame, you also want to know which file has recently been modified in 30 minutes.

In that case, you should use the following command:

$ find . -mmin -50 -mmin +30

The behaviour of the above command.

Also read: How to Find the Total Size of a Directory in Linux

Find and Delete Files Older Than X Days With a Prompt

It is not safe to run to execute rm or use the -delete option until you are sure whether the find the result has found the right result for you.

And it’s common for us to make mistakes while typing the filename or using the wrong parameters, which will remove all the files from the current and subdirs because the find command checks for the specified pattern recursively throughout the specified path.

I believe you get what I mean to say. Therefore, it’s better to first check the result using -print, or else you can use the below command, which will ask for your permission before removing it from your system.

$ find . -atime +7 -exec rm -i {} \; -print

The behaviour of the above command.

Also read: 20+ Find command which you can use daily

Wrap up

That’s all for now!

Well, in this article you have learned how to find and remove a file that has not been accessed in a long time using -atime and other various options.

You can learn more about the find command from the manual, which you can read from the terminal by typing the simple command man find.

If this article helped you, then please leave a comment about your experience. With that, I’m wrapping this article. We will meet again with a new topic. Till then, Bye Bye!