Some time ago, we reviewed 15 examples of practical find commands (part 1 ). The search command can do much better than simply searching for name-based files (Part 1). In this article, let's discuss 15 examples of advanced find commands, including-access based on them, modify or change the time to search for a file. In comparison to a file, perform operations to find the file.
Search for files based on access/modify/Change Time
You can find the file based on the time attribute of the following three files.
- Access time file. When the file is accessed, the access time is updated.
- File modification time. When the file content is modified, the modification time is updated.
- The time when the file was changed. The update inode data changes when the time is changed.
In the following example, the difference between min options and the time options are parameters.
- The parameter is minute. For example, 60 minutes (1 hour) = 60 minutes.
- Time Parameter. Set the parameter to 24 hours. For example, the time is 2 = 2*24 hours (2 days ).
- Although the 24-hour calculation is ignored, the decimal part is 24 hours for 25 hours, And the 47-Hour value is 24 hours for 48 hours. For more information, see the find command manual page in atime.
Example 1: Find the file that was changed within 1 hour
You can use the-mmin-mtime parameter to find the file through the file modification time. The following are definitions of mmin and mtime in the man manual.
- -The last modification to the mmin n file is within n minutes.
- -The last modification to the mtime n file is within n x 24 hours)
Run the commands in the following example to find the files or directories in the current directory and its sub-directories. The last modification time is within 1 hour (60 minutes ).
- # Find.-mmin-60
In the same way, execute the commands in the following example and find the modified files (under the root directory of the file system/) within 24 hours (one day)
- # Find/-mtime-1
Example 2: Find the file that has been accessed within one hour
You can use the-amin-atime parameter to find the file through the file access time. The following are definitions of amin and atime in the man manual.
- -The last access to the amin n file is within n minutes.
- -The last access to the atime n file is within n x 24 hours.
Run the commands in the following example to find the files or directories in the current directory and its sub-directories. The last access time is within 1 hour (60 minutes ).
- # Find.-amin-60
In the same way, execute the commands in the following example to find the files accessed within 24 hours (one day) (under the root directory of the file system)
- # Find/-atime-1
Example 3: Find the file whose status is changed within one hour
(Translator's note: here the change is more than 1st examples. Changing the file content time is different concepts. Here we change the inode data of the file, such as the File Permission and owner information)
To find the inode change time of the file, use the-cmin and-ctime options.
- -The status of The cmin n file is changed within n minutes.
- -The ctime n File status is changed within n * 24 hours (that is, within n days ).
(Note: If n is in the-n format, it indicates that n minutes/day, and n is + n, it indicates n minutes/day before)
In the following example, find the file whose status changes within one hour (that is, within 60 minutes) under the current directory and its sub-directories ):
- # Find.-cmin-60
In the same way, the following example shows the list of files whose status is changed in the root directory/and its subdirectories within the next day (within 24 hours:
- # Find/-ctime-1
Example 4: Only files are searched and folders are not displayed.
The above example shows that there are not only files, but also folders. Because when a file is accessed, its folder will also be accessed. If you are not interested in the folder, you can use the-type f option.
The following example shows the modified files within 30 minutes, but not the folders:
- # Find/etc/sysconfig-amin-30
- .
- ./Console
- ./Network-scripts
- ./I18n
- ./Rhn
- ./Rhn/clientCaps. d
- ./Networking
- ./Networking/profiles
- ./Networking/profiles/default
- ./Networking/profiles/default/resolv. conf
- ./Networking/profiles/default/hosts
- ./Networking/devices
- ./Apm-scripts
[Note: The above output contains files and folders]
- # Find/etc/sysconfig-amin-30-type f
- ./I18n
- ./Networking/profiles/default/resolv. conf
- ./Networking/profiles/default/hosts
[Note: The above output only contains files]
Example 5: Only search for non-hidden files (hidden files are not displayed ):
If you do not want to hide the file when searching, you can use the following regular expression:
The following command displays the files whose contents have been modified in the current directory and Its subdirectories within 15 minutes, and only lists non-hidden files. That is, files starting with "." are not displayed.
- # Find.-mmin-15 \(! -Regex ".*/\..*"\)
Search commands based on file comparison
We usually compare other things to make it easier to remember some things. For example, I want to find the file that I edited after I edited the test file. You can use the editing time of the test file as the benchmark to find the edited file:
Example 6: Find the File Modified after a file is modified:
Syntax: find-newer FILE
The following example shows the files modified after/etc/passwd. For the system administrator, it is helpful to track the activity status of the system after you add a new user (if the new user is not honest, it will be a mess when it comes up, soon you will know ^_^ ):
- # Find-newer/etc/passwd
Example 7: Search for files whose access time is after the modification time of a file:
- # Find-newer/etc/passwd
The following example shows all files accessed after the/etc/hosts file is modified. If you add a host/port record in the/etc/hosts file, you may be wondering which file is accessed after that. The following command is used:
- # Find-anewer/etc/hosts
Example 8: Find the file whose status changes after the modification time of a file:
Syntax: find-cnewer FILE
The following example shows all files whose status has changed after the/etc/fstab file is modified. If you add a mount point in/etc/fstab, you may want to know which files have changed their statuses. In this case, you can use the following command:
- # Find-cnewer/etc/fstab
Run the following command on the result of the file list:
Previously, you have seen that if you use the find command to find the list of files with various conditions. If you are not familiar with these find commands, I suggest you read the first part above.
Next, we will introduce how to execute different commands on the find command, that is, how to operate the file list found by the find command.
We can specify any operation on the list of file names found by the find command:
- # Find <CONDITION to Find files>-exec <OPERATION> \;
OPERATION can be any command, which is commonly used as follows:
- Rm command to delete the files found by find
- Mv command, used to rename the searched File
- Ls-l command to display the detailed information of the searched File
- Md5sum is used to perform the md5sum operation on the searched file to obtain a string used to check the validity of the file content.
- Wc command, used to count the number of words in the computing file, the file size is waiting
Powerful and Common commands in Linux: find and grep
Basic usage and advanced usage of the find command in Linux
Linux O & M tool-find command
Common usage examples of find in Linux
Linux find command details
How to Use the find command in Linux
Find basic usage commands