`find /vmfs/volumes/ -mtime +1 -mtime -10 -type -f -name “*00*.vmdk”`

Will locate files that where the file was last modified at least 1 day ago (-mtime +1) but not more then 10 (-mtime -10).

Find has several parameters to work with dates.

ctime – Locate items by the last status change time.

atime – Locate items by the last access time.

mtime – Locate items by the last modified time.

You can also get more granular on the time tests.  With -amin, -cmin, and -mmin.

The -name is not specifically needed, you could also use a regular expression to locate the files that are needed.

find /vmfs/volumes/ -regex ‘.*[0-9]+\.vmdk$’ -type f

While the regular expression is useful it will preform the regex on the path returned as well so the results will differ from searching `/vmfs/volumes/` and `.`.

The full find man page is online here http://linux.die.net/man/1/find or you can type `man find` on the esx console.

`find /vmfs/volumes/ -type f -name "*00*.vmdk" | awk -F "/" '{print $1"/"$2"/"$3"/"$4"/"$5 }' | uniq`

Find is just not limited to locating the files but it is able to preform actions on it. Using the `-exec` allows any command to be executed.

`find /vmfs/volumes/ -type f -name “*00*.vmdk” -exec ls -alh {} \;`

Will execute `ls -alh` on each file that matches the parameters of the find command.  Adding this will provide date stamps on the files if needed.

Find can also work with dates itself, `-mtime` can be used to give find parameters on the last modified time of a file.  This can be specified in blocks of 24 hours, `-mtime +1` will give files last changed two days ago, not 1, this is because fractions of days are ignored.  Find can also be given multiple date parameters to narrow down the returned results as desired.

`find /vmfs/volumes/ -type f -name “*00*.vmdk”` Will look through the /vmfs/volumes/ looking for files with names that match the provided pattern.

More specifically the folders those files are stored in is needed.

AWK can be used to just pull that information back, `find /vmfs/volumes/ -type f -name “*00*.vmdk” | awk -F “/” ‘{print $1″/”$2″/”$3″/”$4″/”$5 }’`.  This output is getting useful but we really don’t need to see the same folder over and over again.

`find /vmfs/volumes/ -type f -name “*000*vmdk*” | awk -F “/” ‘{print $1″/”$2″/”$3″/”$4″/”$5 }’ | uniq` will only return the unique results.  Appending a -c to the `uniq` will provide a count of the number of times that pattern appeared.

I am using this command in two ways, first is the `uniq` with out -c  piped to `wc -l` to get a count of all of the vm’s with snapshots.   The second is with`uniq -c` piped to `sort -rn` to give the number of disks that have snap shots in each VM.