Red Hat Certified Systems Admin (RHCSA) EX200 Practice Exam

The command uses the find utility with modification-time semantics. The -mtime option compares a file’s data modification time in 24-hour days. A minus sign before the number means “less than that many days ago.” So -mtime -3 finds files whose data was last modified within the last 3 days (0, 1, or 2 days ago). It’s about modification time, not creation time (creation time isn’t typically tracked on most Linux filesystems). If you wanted files modified more than 3 days ago you’d use -mtime +3; if you wanted files modified exactly 3 days ago, you’d use -mtime 3 (which actually covers the 3–4 day window due to the way the time buckets are defined). The command starting at / searches the entire filesystem, which can be slow and may require appropriate permissions.