On 12 Jan 2001 13:18:13 -0700,  wrote:
> 
> The atime is only changed when the contents of a
> file are read, so a "find -print" or "ls -l" have
> no effect on atime.  Something like
> "find / -type f -exec file {} \;" would change
> the atime, though.
> 
> One use of atime would be after an intrusion
> to determine what files the cracker looked at.
> 
> Another use of atime is disk grooming.  Rather
> than doing a BOFHish
> 
>   rm -rf /home/john
> 
> to free up disk space, you could do
> 
>   find /home/john -type f -atime +365 -exec rm -f {} \;


I was trying to do somehting like this but found that backups also seem
to update atime.  We are useing cpio for backups and im sure there is
probably a setting to tell it not to but I don't think we are useing it.
Just
now thought of that so I guess I should check.  Anyway I was trying to
make a prune script that would clean out old files in our source and 
production directories.  I used -atime but because of backups it didn't
find anything.  I can't seem to think of a way to use it either.

--
Bill Warner
Direct Alliance Corp.
Unix/Linux Admin.