Administrative Tasks →easyMultiple ChoiceObjective-mapped

LPIC-1 Administrative Tasks Practice Question

An administrator needs to find all files in the /var/log directory that have been modified in the last 24 hours. Which command should be used?

⚠ Common exam trap

Many exam-takers confuse `-ctime` (inode change time) with `-mtime` (modification time), or mistakenly think `-atime` (access time) is relevant for modification, leading them to pick options that do not match the requirement for content modification.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

find /var/log -mtime 0

The `find` command with `-mtime 0` searches for files whose data modification time is within the last 24 hours. The `-mtime` option uses a 24-hour period, and a value of 0 means modified less than 24 hours ago, which matches the requirement to find files modified in the last 24 hours in /var/log.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
find /var/log -ctime 0
Why it's wrong here
ctime is for status change, not modification.
✓
find /var/log -mtime 0
Why this is correct
mtime 0 matches files modified within the last 24 hours.
✗
find /var/log -atime 0
Why it's wrong here
atime is for access time.
✗
find /var/log -mmin 1440
Why it's wrong here
mmin expects minutes; 1440 minutes is correct but -mtime is more common.

Go deeper

LPIC-1 Administrative Tasks Practice Question

Why each option matters

Option-by-option breakdown

Related to this question