PROBLEMS FACED IN COMMAND LINE OPERATIONS

[rajesh.bahl]

Hi All !

I am facing a few problems with command line operations:

1. I need to list hidden files ONLY in a particular directory. How to use ls command for the same ?
2. I need to search files created in last few days ( let's say in last 10 days ). I tried :
find / -ctime  -10 -print
command but this gives so many files which were "not created" by anyone but were there since installation of the system.
Also is there a way to see the "creation time" of a file ?

3. I suspect that somebody has tried to sneak into my computer. How and where can I see logs through command line indicating above activity captured ?


I have tried reading man pages also but have not been able to sort out these issues.
Kindly help !!



Regards
rajesh.bahl

[Ricky]

I will rather use find command for above.
Since in linux hidden files names starts with a dot (.) hence you search it with find -name directive. Also we need to escape . & * so that will go as real . & * to find command.

Code: [Select]

find -name \.\*

For second..
Try

Code: [Select]

find / -mtime -10
Reason for using -mtime is that -ctime actually looks for file status last time means if any file's group , permission etc. is changed then -ctime should not report currectly as will show you according to file status change.
Though your command is fine using -ctime too.

You can get file details by :

Code: [Select]

ls -ld <filename>
For answer 3 ..
Look for details for commands "last" and "lastlog"
Also look into files at /var/logs

[rajesh.bahl]

Thanks Ricky !

Even if you try to run find -mtime  -10   -- still the result is same as so many files are listed which are not created by me. I just need the files created by me in last 10 days. Can we somehow put a filter to these "non-required" files ?



Regards
rajesh.bahl

[rajesh.bahl]

Also can you please explain what ls -ld filename will give ?

Actually I tried both -------------------  ls -l filename and ls -ld filename. Both are showing the same result.
But how to see the "creation time of file" ?



Regards
rajesh.bahl

[Ricky]

OK try "ls -cl"

Add name of owner of the file (ie. under username you created it) so should be like

Code: [Select]

find / -mtime -10 -owner <username>   

Well, looking all around I found that every where ie. man pages of ls, find etc. are talking about last modification / file status change time but no one is talking about file creation. Means.. linux do not really have difference between last modification and creation time. Though I am not sure about this as have to look into it a bit more.

[rajesh.bahl]

Thanks Ricky once again !

I have been scratching my head on this "creation time" issue since last almost two years but have not found any satisfactory answer !
If you come across any solution --kindly let me know.


Regards
rajesh.bahl

[gauravbajaj]

Have u tried

find / -mtime -10 -user username  { give username which created the last 10 days files  }

?