I have developed the following script to zip and then remove all files with "*.log" extension in the file name that were modified yesterday. It's definitely not 100% at the moment. For example, it misses files from yesterday that have a modified time of 00:00.


yest=$(date --date="yesterday" +"%m_%d_%Y")

find /path/to/dir/ -daystart -name "*.log" -type f -mtime 1 -print | zip /path/to/dir/"logbackup-$yest.zip" -@
if [ $? -eq 0 ]; then
    find /path/to/dir/ -daystart -name "*.log" -type f -mtime 1 -exec rm -f {} \;

It seems that using -daystart OR using mtime exclusively are not returning the correct results for me. Only files "c" and "a" should be returned.

[user@computer log]$ ls -lart
drwxr-xr-x 23 user user     4096 Sep  5 22:27 ..
-rw-rw-r--  1 user user        0 Nov 18 14:00 d
-rw-rw-r--  1 user user        0 Nov 19 00:00 c
-rw-rw-r--  1 user user        0 Nov 19 12:30 a
-rw-rw-r--  1 user user        0 Nov 20 12:30 b
drwxr-xr-x  2 user user    16384 Nov 20 12:32 .
[user@computer log]$ find . -mtime 1 -type f | xargs ls -lart
-rw-rw-r-- 1 user user 0 Nov 18 14:00 ./d
-rw-rw-r-- 1 user user 0 Nov 19 00:00 ./c
-rw-rw-r-- 1 user user 0 Nov 19 12:30 ./a
[user@computer log]$ find . -daystart -mtime 1 -type f | xargs ls -lart
-rw-rw-r-- 1 user user 0 Nov 19 12:30 ./a

1 Answer 1


Put /path/to/dir/ in a variable to avoid writing it repeatedly.

Instead of running the command and checking $? after, you can put the command inside an if.

The script would become shorter, for example:


if find $path -daystart -type f -mtime 1 -name "*.log" -print | zip $path/"logbackup-$yest.zip" -@
    find $path -daystart -type f -mtime 1 -name "*.log" -exec rm -f {} \;

In my tests, it seems that simply dropping -daystart will have the desired effect of matching the right files. For example:

touch -d yesterday a
touch -d '2014-11-19 00:00:00' b
touch -d '2014-11-18 00:00:00' c
touch -d '2 days ago' d
ls -l


-rw-r--r-- 1 janos users 0 Nov 19 12:35 a
-rw-r--r-- 1 janos users 0 Nov 19 00:00 b
-rw-r--r-- 1 janos users 0 Nov 18 00:00 c
-rw-r--r-- 1 janos users 0 Nov 18 12:38 d

And then:

$ find . -daystart -mtime 1 -type f
$ find . -mtime 1 -type f
  • \$\begingroup\$ Thanks Janos for your recommendations. My understanding is that if we drop "-daystart", and only use "-mtime 1" we will grab the files that have been modified within the last 24 hours, not necessarily from yesterday 00:00 - 23:59? This has been the behavior I have seen on RHEL anyway. Let me try this and verify again. \$\endgroup\$ Nov 20, 2014 at 12:10
  • \$\begingroup\$ @gr8odinsraven can you give an example date in terms of the example I gave above, where with -daystart you will get the correct result and without it you won't? Use the example commands I gave for your testing. Btw, on Code Review we don't troubleshoot, we review fully working code. Anything that's not working as intended, it would be better to ask on Stack Overflow instead. \$\endgroup\$
    – janos
    Nov 20, 2014 at 12:20
  • \$\begingroup\$ shouldn't it be -mtime -1 ? \$\endgroup\$ Nov 20, 2014 at 21:40
  • \$\begingroup\$ and for those questions it's not stackoverflow but unix.stackexchange.com that should be used \$\endgroup\$ Nov 20, 2014 at 21:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.