I originally wanted to find which files have been modified in the last week (before the unexpected results led me onto the quest I describe in this question), so I ran this following command (10080 minutes = 1 week):
find . -mmin -10080 -exec ls -lh {} \;
But to my big surprise, a seemingly never-ending stream of files flew across the screen.
I tried to narrow it down, and found this:
find . -mmin -6704 -exec ls -lh {} \; returns nothing, whilefind . -mmin -6705 -exec ls -lh {} \; returns about 200 files, all of which seem like old files.
I thought there might be something wrong with my version of find, perhaps -mmin used hours or days or something, instead of the usual minutes. But I waited 5 minutes, and got the expected result:
find . -mmin -6709 -exec ls -lh {} \; returned nothing, whilefind . -mmin -6710 -exec ls -lh {} \; returned the same 200 files.
This amount of minutes points to the exact time of Sat Apr 22, 5:20 AM (my local time).
Most of these files are modified some time in 2022, but there are also some even older files, such as this:
$ stat 20130624_141025.jpg
File: 20130624_141025.jpg
Size: 2949509 Blocks: 5768 IO Block: 4096 regular file
Device: 10303h/66307d Inode: 4066298 Links: 1
Access: (0777/-rwxrwxrwx) Uid: ( 1000/ user) Gid: ( 1000/ user)
Access: 2023-03-26 04:35:47.518978140 +0200
Modify: 2013-06-24 11:10:25.000000000 +0200
Change: 2022-10-09 03:28:01.112446868 +0200
Birth: -
I don't understand why files like this seem to have been modified last Saturday according to find (but not according to stat).
What could possibly cause these results?
Here are the journalctl entries from around that time:
april 22 05:16:40 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:16:40 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:16:53 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:16:53 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:17:01 host CRON[906135]: pam_unix(cron:session): session opened for user root by (uid=0)
april 22 05:17:01 host CRON[906136]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
april 22 05:17:01 host CRON[906135]: pam_unix(cron:session): session closed for user root
april 22 05:17:19 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:17:19 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:17:29 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:17:29 host rtkit-daemon[1258]: Supervising 2 threads of 2 processes of 1 users.
april 22 05:20:08 host dbus-daemon[1639]: [session uid=1000 pid=1639] Activating via systemd: service name='org.freedesktop.Tracker1.Miner.Extract' unit='tracker-extract.service' requested by ':1.2' (uid=1000 pid=1635 comm="/usr/libexec/tracker-miner-fs " label="unconfined")
april 22 05:20:08 host systemd[1627]: Starting Tracker metadata extractor...
april 22 05:20:08 host tracker-extract[906637]: Set scheduler policy to SCHED_IDLE
april 22 05:20:08 host tracker-extract[906637]: Setting priority nice level to 19
april 22 05:20:08 host dbus-daemon[1639]: [session uid=1000 pid=1639] Successfully activated service 'org.freedesktop.Tracker1.Miner.Extract'
april 22 05:20:08 host systemd[1627]: Started Tracker metadata extractor.
april 22 05:20:11 host gnome-shell[6085]: Warning: disabling flag --expose_wasm due to conflicting flags
april 22 05:20:18 host systemd[1627]: tracker-extract.service: Succeeded.
april 22 05:20:23 host /usr/lib/gdm3/gdm-x-session[1725]: (EE) event11 - SYNA2393:00 06CB:7A13 Touchpad: kernel bug: Touch jump detected and discarded.
april 22 05:20:23 host /usr/lib/gdm3/gdm-x-session[1725]: See https://wayland.freedesktop.org/libinput/doc/1.15.5/touchpad-jumping-cursors.html for details
april 22 05:25:59 host gnome-shell[6085]: Warning: disabling flag --expose_wasm due to conflicting flags
april 22 05:29:54 host systemd[1627]: vte-spawn-10cbca7f-6f32-4715-9d7b-dd17ed636519.scope: Succeeded.
The same information is in /var/log/syslog. I can't see anything relevant in dmesg or auth.log. Please let me know if there are other relevant logs or information you need.
Although it was an *ahem* unusual time of day, I was in fact awake and on my computer at this time, so I may or may not have triggered anything and everything that might be in the log. I just don't understand what could have caused these weird results from find...?
Find version: find (GNU findutils) 4.7.0)
Kernel/release: 5.15.0-67-generic #74~20.04.1-Ubuntu SMP
Thank you!
