Question

I ran the following command :

find . -type f | xargs ls -ltrhg

In order to get the most recently written file when a program was running.

The result was odd : at the bottom of the list, I got recent files, but the MOST VERY recently created file was missing… That is to test, I directly ran

touch asdf

followed by

find . -type f | xargs ls -ltrhg

yet asdf was not the most recent.

Any thoughts on why this command seems to ignore the most recently written file, yet is returning several hundred files, in the correct order which they were edited?

Answer 1

Programs call write() ultimately when they are writing to a file. write does not immediately put anything to disk.

Unless you program calls fdatasync() or one its cousins like fflush() the data stays in kernel buffers until the kernel decides to put the data to disk. You can write a bunch of data a file without it begin physically written to disk. This is a performance feature. Disk I/O is very slow compared to memory access.

This means, in practice, your program can find other disk files newer than the one it is currently writing.