atimes

On 12 Jan 2001 13:18:13 -0700, wrote:
>
> The atime is only changed when the contents of a
> file are read, so a "find -print" or "ls -l" have
> no effect on atime. Something like
> "find / -type f -exec file {} \;" would change
> the atime, though.
>
> One use of atime would be after an intrusion
> to determine what files the cracker looked at.
>
> Another use of atime is disk grooming. Rather
> than doing a BOFHish
>
> rm -rf /home/john
>
> to free up disk space, you could do
>
> find /home/john -type f -atime +365 -exec rm -f {} \;


I was trying to do somehting like this but found that backups also seem
to update atime. We are useing cpio for backups and im sure there is
probably a setting to tell it not to but I don't think we are useing it.
Just
now thought of that so I guess I should check. Anyway I was trying to
make a prune script that would clean out old files in our source and
production directories. I used -atime but because of backups it didn't
find anything. I can't seem to think of a way to use it either.

--
Bill Warner
Direct Alliance Corp.
Unix/Linux Admin.