/var/log has filled the root filesystem. Which command lists every regular file at or below /var/log whose contents were last modified more than 30 days ago?
LPIC-1 Exam 101-500, objective 104. Devices, Linux filesystems, filesystem hierarchy standard medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct find /var/log -type f -mtime +30
Correct. -type f restricts matches to regular files, and -mtime +30 means a modification age greater than 30 twenty-four-hour periods.
Not correct find /var/log -type f -mtime -30
Wrong, and the exact inverse. A leading minus means less than, so this matches files touched within the last 30 days.
Not correct find /var/log -type f -atime +30
Wrong timestamp. -atime tests last access, which changes on reads and is frequently suppressed by the relatime mount option, so it is a poor proxy for staleness.
Not correct find /var/log -type f -size +30
Wrong test entirely. -size measures size, and with no suffix the unit is 512-byte blocks, so this matches everything over about 15 KB regardless of age.
Why
find's numeric arguments carry a sign convention that is the usual source of error: +n means strictly greater than n, -n means strictly less than n, and a bare n means exactly n. For -mtime the unit is a 24-hour period, and any fractional remainder is discarded, which is why -mtime 0 matches files changed in the last day. Distinguish the three timestamps: mtime is content modification, ctime is inode metadata change, atime is access.
Where this comes from
- Cited
- manual page find(1)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 104 and space the ones you get wrong.
More questions on this objective
- A new disk /dev/sdb has no partition table at all. Which command writes an empty GPT partition table onto it without dropping you into an interactive editor? machine-checked
- You need the partition /dev/sdc1 on a USB stick to carry a FAT32 filesystem so that Windows machines can read and write it. Which command creates it? machine-checked
- You have just run `mkswap /dev/sdb2`. Which command makes the kernel start using that swap area immediately, without a reboot? machine-checked
- Why is it dangerous to run e2fsck against an ext4 filesystem that is currently mounted read-write? machine-checked
- On an ext4 filesystem at /dev/sda1 you want an automatic check to be forced after every 30 mounts. Which command sets that? machine-checked
- `df -h /var` reports the filesystem 100% full, but `du -sh /var` accounts for only about half that space. Nothing is hidden under a mount point. What is the most likely explanation? machine-checked
All questions on Devices, Linux filesystems, filesystem hierarchy standard