Title: Why does the behaviour of `find` differ using -mtime -0 vs. +0?
Tags: linux;ubuntu;find
Question: Ubuntu 14.04 provides log rotating for Tomcat7 and assumes log files named by day, so it searches for those and existing ones are compressed and deleted. Depending on if log files exist and how often those are changed, this might clash with the monthly naming scheme my own web applications hosted by Tomcat7 are using:
/etc/cron.daily/tomcat7:
gzip: /var/log/tomcat7/…/RebootDevice/2017-05.log.gz already exists;       not overwritten
I can live with those messages being sent every few days or weeks, because the log messages by default only contain errors and those shouldn't occur too often. The thing that I don't understand is why I get this message the second day already. Ubuntu does the following:
find /var/log/$NAME/ -name \*.$LOGEXT -daystart -mtime +0 -print0
I've tested that on my actual directories with the following results:
root@…:/var/log/tomcat7/…/RebootDevice# ls -lisa
1089049 0 -rw-r--r-- 1 tomcat7 tomcat7    0 Mai 29 09:09 2017-05.log
1089047 4 -rw-r--r-- 1 tomcat7 adm      402 Mai 26 10:22 2017-05.log.gz
root@…:/var/log/tomcat7/…/RebootDevice# find . -name \*.log -daystart -mtime -0
root@…:/var/log/tomcat7/…/RebootDevice# find . -name \*.log -daystart -mtime +0
./2017-05.log
As you can see, the invocation using +0 finds my file even if it was last written two days ago, while using -0 doesn't. -mtime is defined as n*24 hours, so +/-0 shouldn't make any difference and from my understanding -daystart is anchoring the tests to the beginning of a full day only, should be 00:00.
So why does -0 vs. +0 behave differently in this case? It seems to make a difference of 1*24 hours.

Here is the accepted answer: From man find:
-mtime n
File's data was last modified n*24 hours ago. […]
No matter whether you use -daystart or not, regardless of how the rounding works, for the particular find invocation all the files can be divided into several disjoint sets somehow:
A: files modified 0 days ago,
B: files modified 1 day ago,
C: files modified 2 days ago,
D: files modified 3 days ago,
The manual also states:
Numeric arguments can be specified as
+n for greater than n,
-n for less than n,
n for exactly n.
As you can see the minus sign is not a (mathematical) factor of minus one here. Instead:
-mtime -0 matches nothing;
-mtime 0 matches the set A;
-mtime +0 matches B, C, D, … .
-mtime -1 matches the set A;
-mtime 1 matches the set B;
-mtime +1 matches C, D, … .
-mtime -2 matches A and B (it's equivalent to ! -mtime +1);
and so on.


{'source': 'StackExchangeDataset', 'subset': 'superuser.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 0, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2017:00:05/31/17', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<linux><ubuntu><find>', 'Title': 'Why does the behaviour of `find` differ using -mtime -0 vs. +0?', 'ViewCount': 1636, 'id': 1214566, 'user_AboutMe': '<p>I\'m a software developer mainly using C++, Perl, Java and all that web application "something" like HTML, JS and CSS, but in fact doing whatever we are faced with in our company.</p>\n', 'user_AccountId': 2344577.0, 'user_DisplayName': 'Thorsten Schöning', 'user_Reputation': 848.0, 'user_Views': 154.0, 'user_id': 308859.0}}