linux-recent-files

Recursively searches the Linux filesystem starting from the root (/) directory to retrieve a list of recently created or modified files. By default, it targets files changed within the past 1 day from the current time. You can adjust the time range using the span or from option.

Command properties

Item	Description
Command type	Driver query
Required permission	Administrator
License usage	Licensed command
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

linux-recent-files [span=INT{s|m|h|d|mon}] [from=STR]

Options

span=INT{s|m|h|d|mon}: Time range to search from the current time. You can specify units of s (seconds), m (minutes), h (hours), d (days), or mon (months). For example, 10s means the range from 10 seconds before the current time. (Default: 1d)
from=STR: Specifies the start time of the search range in yyyyMMddHHmmss format. Omitted trailing digits are filled with 0. When this option is specified, the span option is ignored.

Output fields

Field	Type	Description
`file_path`	string	Absolute path of the file
`file_name`	string	File name
`file_type`	string	File type. `file`: regular file, `directory`: directory
`permissions`	string	POSIX file permission string (e.g., `rwxr-xr-x`). Returns `null` if unreadable.
`file_size`	long	File size (bytes)
`file_ctime`	timestamp	File creation time
`file_mtime`	timestamp	Last modification time
`file_atime`	timestamp	Last access time
`owner_read`	boolean	Whether the owner has read permission
`owner_write`	boolean	Whether the owner has write permission
`owner_execute`	boolean	Whether the owner has execute permission
`group_read`	boolean	Whether the group has read permission
`group_write`	boolean	Whether the group has write permission
`group_execute`	boolean	Whether the group has execute permission
`others_read`	boolean	Whether others have read permission
`others_write`	boolean	Whether others have write permission
`others_execute`	boolean	Whether others have execute permission

Error codes

Parse errors

Error code	Message	Description
`95040`	no-read-permission	Occurs when run without administrator privilege

Runtime errors

N/A

Description

The linux-recent-files command recursively traverses the filesystem starting from the root (/) directory to find files whose creation time (ctime) or last modification time (mtime) is after the specified reference time. You can specify a relative time range from the current time with the span option, or an absolute time with the from option. When from is specified, the span value is ignored. If neither option is specified, the default range of 1 day (1d) is used.

During traversal, the /proc directory is skipped. Files whose paths begin with /sys/fs/, /sys/bus/, /sys/dev/, /sys/devices/, /sys/block/, /sys/class/, /sys/firmware/, /sys/kernel/, or /sys/module/ are also excluded from the results.

The command follows symbolic links to read file attributes. If visiting a file fails (e.g., due to insufficient permissions), that file is skipped and the traversal continues.

This command requires administrator privilege. Without it, an error occurs at the parse stage.

Examples

Retrieve files changed within the last 1 day
```
linux-recent-files
```
Retrieves a list of recently created or modified files using the default range of 1 day.
Retrieve files changed within the last 7 days
```
linux-recent-files span=7d
```
Retrieves a list of files created or modified within the last 7 days.
Retrieve files changed after a specific time
```
linux-recent-files from=20250101
```
Retrieves a list of files created or modified after January 1, 2025.
Filter executable files changed within the last 1 hour
```
linux-recent-files span=1h
| search file_type == "file" and owner_execute == true
```
Filters only files that have execute permission from those changed within the last 1 hour.