return filename and file creation date after grep

Question

I am using below to retrieve certain files based on content and filename:

find /labels/ -type f -iname '*.*' -exec grep -l 'MB2306' {} +

Now I also need to know the creation date of the returned files. What do I need to change here to achieve that?

find is running on 4.6.0 on Red Hat Enterprise 8.8

Answer 1

With recent versions (4.9 or newer for -files0-from) of GNU find and GNU grep or compatible:

find /labels/ -type f -name '*.*' -exec grep -Zl MB2306 {} + |
  find -files0-from - -prune -printf '%TFT%TT%Tz %p\n'

With other find implementations or older versions of GNU find and if you also have GNU xargs and GNU stat available:

find /labels/ -type f -name '*.*' -exec grep -Zl MB2306 {} + |
  xargs -r0 stat -c '%y %n' --

%T (%y for stat) is for the last modification time, which can also be seen as the creation time of the contents of those files. You can replace with %B (%w for GNU stat) for the file's birth time, but that is not available on all systems and file systems and is not often a useful metric depending on what exactly you're after.

Note that -name '*.*' (-iname doesn't make much sense as there's no letter in that pattern) is to report files whose name is made entirely of text and contains at least one .. Note that it also matches on a file called .bashrc for instance. If you wanted to match on files that have an extension, whether the file name is made of text or not, you'd want LC_ALL=C find ... -name '?*.*'¹. If you wanted any file regardless of their name, you'd just omit those -name pattern.

The zsh shell has most of find's features available in its globs which support recursion and filtering by file type and has a stat builtin (since 1997, predates GNU stat), so in that shell, that can be done with:

zmodload zsh/stat
stat -nLF %FT%T.%N%z +mtime ${(0)"$(
  grep -lZ MB2306 /labels/**/?*.*(ND.))"}

(still assuming GNU grep or compatible for its -Z option and here not restricting to text-only file names).

The %FT%T.%N%z strftime() specification (extended with %N for nanoseconds here) or GNU find's -printf equivalent %TFT%TT%Tz give you a standard non-ambiguous 2023-06-14T10:23:05.047789132+0100-like format. You can adapt to your preference, see man strftime for details of the format.

GNU stat's format is 2023-06-14 10:23:05.047789132 +0100 and is not customisable, though you can also use %Y for 1686734585 and %.Y for 1686734585.047789132.

---

^{¹ that LC_ALL=C would also affect grep and how it interprets the contents of files, but as you're looking for a fixed string here, that shouldn't make any different and if anything would likely even speed things up.}

Answer 2

The find command AND's all predicates (unless you use the -o predicate) so you could append ls -l --time=creation (which your OS should support, I verified on Alma 9.1), and get a list of creation times of matching files:

find /labels/ -type f -iname '*.*' -exec grep -q 'MB2306' {} \; -exec ls -l --time=creation {} \;`

I changed grep to -q since you only need to know whether or the file matches: If it does, the ls runs; if it doesn't, the ls doesn't run.