LPIC-1 Administrative Tasks Practice Question
An administrator needs to find all files in the /var/log directory that have been modified in the last 24 hours. Which command should be used?
⚠ Common exam trap
Many exam-takers confuse `-ctime` (inode change time) with `-mtime` (modification time), or mistakenly think `-atime` (access time) is relevant for modification, leading them to pick options that do not match the requirement for content modification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
find /var/log -mtime 0
The `find` command with `-mtime 0` searches for files whose data modification time is within the last 24 hours. The `-mtime` option uses a 24-hour period, and a value of 0 means modified less than 24 hours ago, which matches the requirement to find files modified in the last 24 hours in /var/log.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
find /var/log -ctime 0
Why it's wrong here
-ctime matches inode status-change time, not file content modification, so files whose metadata changed within 24 hours are returned instead of those written to. It tempts because ctime is often mistaken for creation time; it would fit auditing permission or ownership changes.
- ✓
find /var/log -mtime 0
Why this is correct
The -mtime 0 predicate matches files whose data was modified less than 24 hours ago, since find counts in 24-hour periods and 0 covers the current partial day. This precisely satisfies the requirement to list recently modified files under /var/log.
- ✗
find /var/log -atime 0
Why it's wrong here
-atime matches access time, recording when a file was last read, not modified, so recently viewed but unchanged logs are returned. It tempts because access and modification are easily confused; it would correctly find files read within 24 hours.
- ✗
find /var/log -mmin 1440
Why it's wrong here
-mmin 1440 matches files modified exactly 1440 minutes ago, not within the last 24 hours; the correct form is -mmin -1440. It tempts because 1440 minutes equals one day, but the missing minus sign inverts the range.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-1 question from scratch — 402 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.