Linux find command proficiency Guide

Linux
Find

Command is allLinux
One of the most useful and confusing commands. It is difficult because its syntax is similar to otherLinux
The standard syntax of a command is different. However, it is powerful because it allows you to search for files by file name, file type, user, or even timestamp. UseFind

Command, you can not only find files with any combination of these attributes, but also perform operations on the files it finds.

The purpose of this article isFind

The purpose and potential of a command to simplify the learning and use of the command. At the same time, it willFind

Some of the most powerful but messy aspects of the Command provide a basic guide and reference.

[Note:Find
The version is GNU, so some details may beFind

Different.]

Basic Format

Before we start, let's take a look.Find

Basic Structure of the command:

find   start_directory  test  options   criteria_to_match
action_to_perform_on_results
                          

In the following command,Find

Search for any file with the extension "Java" in the current directory (represented:

find . -name  "*.java"  

The following is a scaling list of the commands found by the command:

find . -name  "*.java"
./REGEXPvalidate/src/oracle/otnsamples/plsql/ConnectionManager.java
./REGEXPvalidate/src/oracle/otnsamples/plsql/DBManager.java
..

[Note: If you cut and paste this document to runFind
Command, you may need to replace double quotation marks ("") with your keyboard to get the correct result.]

The following command will perform the same operation. In both cases, you need to escape the wildcard to ensure that it is passedFind
Commands cannot be explained by shell. Therefore, put your search string in quotation marks or add a backslash before it:

find . -name  /*.java

AlthoughFind
All parameters are optional, but if you do not specify where to start the search, the search will start in the current directory by default. If you do not specify the test connection, option, or value to match, your results will be incomplete or have no difference.

Run the following threeFind
Command to get the same result-the complete list of all files (including hidden files) in the current directory and all subdirectories:

find 
find .
find . -print

This is similar to running an LS command with the-La option. If you want the output of the above command to contain the complete path name (perhaps for backup), you will need to specify the full path of the starting directory:

find /home/bluher -name /*.java
/home/bluher/plsql/REGEXPvalidate/src/oracle/otnsamples/plsql/ConnectionManager.java
/home/bluher/plsql/REGEXPvalidate/src/oracle/otnsamples/plsql/DBManager.java/
...

You can also specify multiple start directories in the search string. If you run the command as a user with the relevant permissions, run the following command to find all jar files in the/usr,/home/tmp directories:

find /usr /home  /tmp -name "*.jar"

However, if you do not have the required permissions, an error message is generated when you start browsing many System directories. The following is an example:

find:  /tmp/orbit-root: Permission denied

You can append your search string to avoid confusion, as shown below:

find /usr /home  /tmp -name "*.jar" 2>/dev/null

This will send all error messages to an empty file, so the cleaner output is provided.

By default,Find
Is case sensitive. For case-insensitiveFind
Replace the-INAME test with the-name test.

find downloads  -iname "*.gif"
downloads/.xvpics/Calendar05_enlarged.gif
downloads/lcmgcfexsmall.GIF

In addition to file names, you can also search for files by type. For example, you can use the following command to find all subdirectories in a directory:

find . -type d         

You can use the following command to find all symbolic links in your/usr directory:

find /usr -type l

This may list more than 3,000 links. Any of the following commands run with the root permission will list the links in the/usr directory and the files it points:

# find /usr/bin  -type l  -name "z*" -exec ls  -l {} /;
lrwxrwxrwx 1 root  root 8 Dec 12 23:17 /usr/bin/zsh -> /bin/zsh
lrwxrwxrwx 1 root  root 5 Dec 12 23:17 /usr/bin/zless -> zmore
lrwxrwxrwx 1 root  root 9 Dec 12 23:17 /usr/bin/zcat -> /bin/zcat

find /usr/bin -type  l  -name "z*" -ls

However, the second shorter command will list more files, as well as the Directory and inode information: in the subsequent sections of this article, we will discuss the usage of-exec and-ls operations.

OthersFind
The following file types are available:

• B-block (cache) Special
• C-character (not cached) Special
• P-Named Pipe (FIFO)
• S-socket

Use rootFind

The starting point of the command greatly reduces the system speed. If you have to run such a command, you can run it during off-peak hours or at night. You can use the following syntax to redirect the output to a file:

find  /   -print > masterfilelist.out

If you enterFind
Command to generate a lot of unnecessary output, just interrupt the command by CTRL-C, which will stop the recent command.

Restrictions on Enterprise Networks with multiple file systemsFind
The file to be searched is also a particularly useful method. Use as many options and tests as possible to reduce the load on the system. The two most useful options for this purpose are-xdev and-mount. They are blockedFind
Reduced search times in directories on other file systems (such as MS-dos, CD-ROM, or AFS)Range
. This restricts the search to a file system of the same type as the starting directory.

If you run the mount command, you can use these options on the dual-boot system. If Windows partition is involved, you can install it using a command similar to the following:

mount -t vfat  /dev/sda1 /mnt/msdos

The actual command you use depends on your systemSet
. You can run DF or the following command to verify that the partition has been installed:

find /mnt/msdos  -name "*.txt" 2> /dev/null

You should have seen a lot of files listed on the MS windows partition. Run the following command with the-mount or-xdev options:

find / -name  "*.txt" -mount 2> /dev/null

Or

find / -name  "*.txt" -xdev 2> /dev/null

You can also use the-fstype test to clearly informFind
Find in which file system, as shown in the following example:

find / -name  "*.txt" -fstype vfat 2> /dev/null

Search Time

Find

The command has several options for searching files based on your system timestamp. These timestamps include

•
Mtime-
Last modification time of File Content
•
Atime-time when the file is read or accessed
•
Ctime-File status change time

Mtime and atime are both easy to understand, while ctime requires more explanations. Because inode
The metadata of each file is maintained. Therefore, if the metadata related to the file changes, inode
Data will also change. This may be caused by a series of operations, including creating symbolic links to files, changing file permissions, or moving files. In these cases, the file content is not read or modified.
Mtime and atime will not change, but ctime will change.

All these time options must be associated with a valueN
In combination, specify-N, N
Or+ N
.

•-N
The return value is smallerN

• + N
The return value is greaterN

• N
The returned items exactly matchN
Equal

Next, let's look at several examples to facilitate understanding. The following Command finds all the files modified in the last hour:

find . -mtime -1
./plsql/FORALLSample
./plsql/RegExpDNASample
/plsql/RegExpSample

Replace-1 with 1 and run the same command to find all the files modified just one hour ago:

find . -mtime 1

The preceding command does not generate any results because it must be completely consistent. Run the following command to search for all files modified more than one hour ago:

find . -mtime +1

By default,-mtime,-atime, and-ctime indicate the last 24 hours. However, if the start time option is added before them, the 24-hour cycle starts from the start time of the day. You can also use mmin, Amin, and Cmin to find the timestamp that has changed in less than one hour.

If you run the following command immediately after logging on to your account, you will find all the files read less than one minute ago:

find . -amin -1
./.bashrc
/.bash_history
./.xauthj5FCx1

It should be noted thatFind
Command to find the file itself will change the access time of the file as part of its metadata.

You can also use the-newer,-anewer, and-cnewer options to find the modified or accessed files and compare them with specific files. This is similar to-mtime,-atime, and-ctime.

•-Newer indicates the file whose content has been recently modified.
•-Anewer refers to the file that has recently been read
•-Cnewer indicates the file whose status has changed recently.

To find all the files edited in some way since the previous tar file in your home directory, run the following command:

find . -newer  backup.tar.gz

Search for files by size

-Size
Option to find the files that meet the specified size conditions. To find all user files larger than 5 MB, use

find / -size  +5000000c 2> /dev/null
/var/log/lastlog
/var/log/cups/access_log.4
/var/spool/mail/bluher

The ending "C" reports our results in bytes. By default,Find
Report size in 512 bytes. If we replace "C" with "K", we will also see the results reported in kilobytes. If we use "W ", the result of the Two-byte number report is displayed.

-Size
This option is often used to search for all zero-byte files and move them to the/tmp/zerobyte folder. The following command exactly completes this task:

find test -type f  -size 0 -exec mv {} /tmp/zerobyte /;

-Exec operation allowedFind
Execute any shell command on the file it encounters. Later in this article, you will see more examples of its usage. Each empty file can be moved with braces.

Option-empty can also be used to find empty files:

find test -empty         
test/foo
test/test

Search by permission and owner

To monitor your system security, you mustFind
Command. You can use symbols or octal notation to find files open to users, as shown below:

find . -type f  -perm a=rwx -exec ls -l {} /;

Or

find . -type f  -perm 777 -exec ls -l {} /;
-rwxrwxrwx 1 bluher  users 0 May 24 14:14 ./test.txt

In this section, we use the-exec LS-l operation in the above and below commands. Therefore, you can see the actual permissions of the returned file. The following Command finds the files that can be written by other and group:

find plsql -type f  -perm -ug=rw -exec ls -l {} /; 2>/dev/null

Or

find plsql -type f  -perm -220 -exec ls -l {} /; 2>/dev/null 
-rw-rw-rw- 1 bluher users 4303  Jun  7   2004 plsql/FORALLSample/doc/otn_new.css
-rw-rw-rw- 1 bluher users 10286 Jan  12  2005  plsql/FORALLSample/doc/readme.html
-rw-rw-rw- 1 bluher users 22647 Jan  12  2005  plsql/FORALLSample/src/config.sql
..

The next command searches for files written by users, groups, or both:

find plsql -type f  -perm /ug=rw -exec ls -l {} /; 2>/dev/null, or,
find plsql -type f  -perm /220 -exec ls -l {} /; 2>/dev/null 
-rw-r--r-- 1 bluher users 21473  May  3 16:02 plsql/regexpvalidate.zip
-rw-rw-rw- 1 bluher users 4303  Jun  7   2004 plsql/FORALLSample/doc/otn_new.css
-rw-rw-rw- 1 bluher users 10286 Jan  12  2005  plsql/FORALLSample/doc/readme.html
-rw-rw-rw- 1 bluher users 22647 Jan  12  2005  plsql/FORALLSample/src/config.sql

You may see the following commands referenced in the Web and earlier manuals:

find . -perm +220  -exec ls -l {} /; 2> /dev/null

+ The role of a symbol is the same as that of A/symbol. However, the new version of GNU findutils does not support this symbol.

To find all files that can be written by all users on your system, run the following command:

find / -wholename  '/proc' -prune  -o  -type f -perm -0002 -exec ls -l {} /;
-rw-rw-rw- 1 bluher users 4303  Jun  7   2004/home/bluher/plsql/FORALLSample/doc/otn_new.css
-rw-rw-rw- 1 bluher users 10286 Jan  12  2005  /home/bluher/plsql/FORALLSample/doc/readme.html
...

The 4th permissions will be discussed later, but "2" in the last field is the "other" field in the File Permission, also known as the write bit. We used a break number before permission mode 0002 to indicate that we want to see it as otherSet
Files with write permission, regardless of other PermissionsSet
Why.

The preceding commands also introduce three new concepts. Use-wholename for testing the file mode "/proc". If this mode is found,-prune can preventFind
Go to the directory. Boolean Type "-o"Find
Other parts of the command can be processed in other directories. Since each expression has a hypothetical implicitAnd
Operator (-a). Therefore, if the expression on the left side is calculated as false,And
The following expressions are not computed. Therefore, the-O operator is required.Find
Boolean-not ,!, Just like using parentheses to force priority.

Frequently used by system administratorsFind
Search regular files of a specific user or group by user or group name or ID:

[root] $  find / -type f -user bluher -exec ls -ls {}  /;

The following is an example of a highly streamlined output of such a command:

4 -rw-r--r-- 1 bluher users 48  May  1 03:09  /home/bluher/public_html/.directory
4 -rw-r--r-- 1 bluher users 925  May  1 03:09 /home/bluher/.profile

You can also useFind
Search for files by group:

[root] $ find /  -type f -group users

find / -type d -gid  100

This command will list the directories owned by the Group ID 100. To find the UID or GID, you can run more or cat commands on the/etc/passwd or/etc/group file.

In addition to searching for files of specific known users and groups, you will also find it useful for searching for files without such information. The next command identifies files not listed in the/etc/passwd or/etc/group file:

find / -nouser -o  -nogroup

The above command may not generate actual results on your system. However, it can be used to identify files that may not have users or groups after frequent movement.

Now, we can solve the very important permissions mentioned at the beginning of this section.

SGID and SUID are special access permission signs that can be assigned to files and directories on UNIX-based operating systems.Set
They are used to allow common users who access computer systems to execute binary executable files with temporary elevation permissions.

find /  /( -perm -2000 -o -perm -4000 /) -ls
167901    12 -rwsr-xr-x    1 root      root          9340 Jun 16  2006 /usr/bin/rsh
167334    12 -rwxr-sr-x    1 root      tty          10532 May  4  2007 /usr/bin/wall

In the preceding command, you can see the use of escape brackets. You can also see different permissions. First fileSet
The SGID permission is granted to the second file.Set
SUID permission. The last operation in the preceding command and the operation with-exec LS-dilsFind
The effect is similar.

Control Find

AndLinux
Many Commands in are different,Find
You do not need the-R or-r option to go down to the subdirectory. It performs this operation by default. However, you may want to limit this line. Therefore, options-depth,-maxdepth,-mindepth, and operation-prune come in handy.

We have seen how useful-Prune is. Let's take a look at the-depth,-maxdepth, and-mindepth options.

-The maxdepth and-mindepth options allow you to specifyFind
Find the level that goes deep into the directory tree. If you wantFind
You can only search at one directory level. You can use the maxdepth option.

Run the following command to search for log files in the first three levels of the directory tree. You can see the effect of-maxdepth. Using this option produces much less output than not using this option.

find / -maxdepth 3  -name "*log"

You can alsoFind
Search for at least three levels of directories in the directory tree:

find / -mindepth 3  -name "*log"

-The depth option ensures that you first search in a directory before searching in its subdirectory. The following command provides an example:

find -name "*test*" -depth
./test/test
./test
./localbin/test
./localbin/test_shell_var
./localbin/test.txt
./test2/test/test
./test2/test
./test2

Find
World

We have already seenFind
Some of the more useful and obscure functions of the command,Find
You can also execute more tasks. For example, multiple options can be usedFind

It is compatible with lower UNIX versions and other operating systems and allows you to print and output data to multiple files. After reading this article, you have understoodFind

In reference to the background of the guide, I encourage you to study this powerful and useful tool in depth.