Find files based on Access/modify/change Time
You can find a file based on the time attributes of the following three files.
- The time the file was accessed . Access time is updated when files are accessed .
- The modified time of the file. The modification time is updated when the contents of the file are modified .
- The time that the file was changed . Changes to the inode data that were updated when the time was changed.
In the following example, the difference between themin option and the time option is a parameter.
- divide the argument into minutes . For example, 60 minutes (1 hours) = 60 Minutes.
- Time parameter, set its parameter to 24 hours . For example, time 2 = 2 * 24 hours (2 days).
- Although this 24-hour calculation, the decimal part will be ignored, so 25 hours for 24 hours, and 47 hours for 24 hours, only 48 hours for 48 hours. To get a clearer reference to the Atime section of the Find command , the manual page.
Example 1: Finding files that have been changed within 1 hours
To find files by file modification time, you can use the parameter-mmin-mtime. The following is the definition of mmin and Mtime in the Man Handbook.
- -mmin n files were last modified within n minutes
- -mtime n File The last modification is within n*24 hours (translator Note: That is, n days the chant)
Execute the command in the following example to find a file or directory with the current directory and its subdirectories, with the last modification time within 1 hours (60 minutes)
In the same way, execute the command in the example below and you will find the modified file within 24 hours (1 days) (file system root/Bottom)
Example 2: Find a file that has been accessed within 1 hours
You can use the parameter-amin-atime if you want to find the file through the file access time. The following is the definition of Amin and Atime in the Man Handbook.
- -amin n File The last access is within n minutes
- -atime n file last accessed within n*24 hours
Execute the command in the following example to find a file or directory with the current directory and its subdirectories, with the last access time within 1 hours (60 minutes)
In the same way, the command in the example below will find the files accessed within 24 hours (1 days) (file system root/Bottom)
Example 3: Finding files with state changed within one hours
(Translator Note: Changes to the 1th example here change the content time of the file is different concept, here is the file inode data, such as file permissions, the owner and so on information)
To find the time to change the inode for a file, use the-cmin and-ctime options
- The state of the -cmin n file is changed within n minutes
- -ctime n file status changed within n*24 hours (i.e. n days)
(Translator Note: If the above n is the-n form, it means n minutes/day, n is +n = n minutes/day ago)
The following example finds files with file status changes within one hours (i.e. within 60 minutes) under the current directory and its subdirectories:
The same goes for the following example in the root directory/its subdirectories within a day (within 24 hours) file status changed file list:
Example 4: Search is only limited to files, no folders are displayed
The above example searches for more than just files, but also displays folders. Because when a file is accessed, the folder It is in is also accessed, and if you are not interested in the folder, you can use the-type F option
The following example shows the files that have been modified in 30 minutes, and the folders do not display:
01 |
# find /etc/sysconfig -amin -30 |
10 |
./networking/profiles/default |
11 |
./networking/profiles/default/resolv.conf |
12 |
./networking/profiles/default/hosts |
17 |
# find /etc/sysconfig -amin -30 -type f |
19 |
./networking/profiles/default/resolv.conf |
20 |
./networking/profiles/default/hosts |
Example 5: Find only non-hidden files (hidden files are not shown):
If we don't want to hide the files when we look for them, we can find them using the following regular expressions:
The following command displays files that have been modified in the current directory and its subdirectories for 15 minutes, and lists only non-hidden files. That is, the files that begin with. are not displayed.
1 |
# find . -mmin -15 \( ! -regex ".*/\..*" \) |
Find command based on file comparison
It's easier to remember something by comparing it with something else. For example, I want to find out which files I edited after I edited the test file. You can use the edit time of the test file as a baseline to find the edited file:
Example 6: Find file modification time in a file after a modified file:
The following example shows a file that has been modified since/etc/passwd was modified. For system administrators, it is helpful to know that you have added a new user to track the active state of the system (in case it is not honest, you will soon know ^_^):
1 |
# find -newer /etc/passwd |
Example 7: Find file access time after the modified time of a file:
1 |
# find -newer /etc/passwd |
The following example shows all files that have been accessed after the/etc/hosts file has been modified. If you add a host/port record in the/etc/hosts file, you'll probably want to know what files have been accessed after that, and here's the command:
1 |
# find -anewer /etc/hosts |
Example 8: Find a file that has a state change time after a file modification time:
The following example shows files that have changed the state of all files after modifying the file/etc/fstab. If you add a mount point to the/etc/fstab, you probably want to know which files have changed in the following state, and you can use the following command:
1 |
# find -cnewer /etc/fstab |
Execute the command directly on the results of the found file list:
You've seen this before, if you go through the Find command to look up a list of files for various conditions. If you're not familiar with these find commands, I suggest you read the first part.
In the next section we'll show you how to perform various commands on the Find command, i.e. how to manipulate the list of files found by the Find command.
We can specify any action on the list of file names found by the Find command:
1 |
# find <CONDITION to Find files> -exec <OPERATION> \; |
One of the operation can be any command, the following list is more commonly used:
- RM command to delete files found by find
- MV command, used to rename a found file
- Ls-l command, showing the details of the found file
- Md5sum, md5sum the found file, you can get a string that detects the legality of the file contents
- WC command, used to count the number of words in the calculation file, file size wait
- Execute any UNIX shell command
- Execute your own shell script, which is the name of each file you find.
Example 9: Use ls-l on the Find command output to enumerate the details of a file that has been edited within 1 hours
5 |
# find -mmin -60 -exec ls -l {} \; |
6 |
-rw------- 1 root root 1028 Jun 21 15:01 ./cron |
7 |
-rw------- 1 root root 831752 Jun 21 15:42 ./secure |
Example 10: Search in the current file system only
System administrators sometimes just want to search on/mount file system partitions instead of searching for other mount partitions, such as/home/mount partitions. If you have multiple partitions being mounted and you want to search under/under, you can generally do this as follows
The following command searches for the file names at the end of all. log directories in the root directory/its subdirectories. If you have multiple partitions under/below, then this search will search for all mounted partitions:
If we use the-xdev option, we will only search the current file system, and here is a definition of-xdev found on the Xdev man page:
- -xdev Don ' t descend directories on other filesystems.
The following command searches the/directory and its subdirectories for all files ending in. Log in the current file system (i.e./mounted file system), meaning that if you have multiple partitions attached to/below, the following search will not search for other partitions (such as/home/)
1 |
# find / -xdev -name "*.log" |
Example 11: Using multiple {} in the same command
The Linux manual says only one {} is used in the command, but you can use more than one {} in the same command as follows
1 |
# find -name "*.txt" cp {} {}.bkup \; |
Note that it is possible to use this {} in the same command, but not in a different command, that is, if you imagine that renaming the file below is not feasible
1 |
find-name "*.txt" -exec mv {} `basename{} .htm`.html \; |
Example 12: Using multiple {} instances
You can write a shell script like the following to simulate the example of the renaming above
1 |
# mv "$1" "`basename "$1" .htm`.html" |
The double quotation marks above are intended to prevent the occurrence of spaces in the file name, which can be problematic if not added. Then you save the shell script as mv.sh, and you can use the Find command as follows
1 |
find-name "*.html" -exec ./mv.sh ‘{}‘\; |
So, in any case you want to use the same file name multiple times in the Find command execution, write a script first, then execute the script in Find by-exec, and pass in the file name parameter, which is the simplest way
Example 13: Redirecting an error to/dev/nul
Redirecting error output is generally not a good idea. An experienced programmer knows that it is important to display errors at the terminal and correct them in a timely manner.
In particular, redirecting errors in the Find command is not a good practice. But if you really don't want to see those annoying mistakes, and want to redirect the error to a null device (that is, a black hole device on Linux), anything that goes in disappears. You can do it like this.
1 |
find-name "*.txt"2>>/dev/null |
Sometimes this is very useful. For example, if you want to find all the *.conf files in the/directory under your own account, you will get a lot of "Permission denied" error messages, just like this:
01 |
$ find/ -name "*.conf" |
02 |
/sbin/generate-modprobe.conf |
03 |
find: /tmp/orbit-root: Permission denied |
04 |
find: /tmp/ssh-gccBMp5019: Permission denied |
05 |
find: /tmp/keyring-5iqiGo: Permission denied |
06 |
find: /var/log/httpd: Permission denied |
07 |
find: /var/log/ppp: Permission denied |
09 |
find: /var/log/audit: Permission denied |
10 |
find: /var/log/squid: Permission denied |
11 |
find: /var/log/samba: Permission denied |
12 |
find: /var/cache/alchemist/printconf.rpm/wm: Permission denied |
13 |
[Note: There are two valid *.conf files burned inthe "Permission denied"messages] |
You mean annoying? So, if you just want to see the real results of the Find command instead of these "Permission denied" error messages, you can redirect these error messages to/dev/null
1 |
$ find/ -name "*.conf"2>>/dev/null |
2 |
/sbin/generate-modprobe.conf |
4 |
[Note: All the "Permission denied"messages are not displayed] |
Example 14: Change a space in a file name to an underscore
Many of the file names you download from the Web are marked with spaces. But filenames with spaces are bad for Linux (Unix-like) systems. You can rename these files by using the Replace function of the Rename command followed by the find and then convert the spaces to underline
The following shows how to change the space in the file name of all MP3 files to _
1 |
$ find. -type f -iname “*.mp3″ -execrename “s/ /_/g” {} \; |
Example 15: Execute two commands simultaneously in the Find result
In the man page of Find, the following is a sample syntax for using two commands in a file lookup traversal
The following example of the Find command, traversing the file system once, lists the files and directories that have the setuid attribute, writes the/root/suid.txt file, and records it to/root/big.txt if the file size exceeds 100M
1 |
# find / \( -perm -4000 -fprintf /root/suid.txt ‘%#m %u %p\n‘ \) , \ |
2 |
\( -size +100M -fprintf /root/big.txt ‘%-10s %p\n‘\)
|
15 excellent examples of Linux find commands
