30 useful Linux Find commands

In addition to the basic operation of finding files under a directory structure, you can also use the Find command to implement some useful operations to make your command-line journey easier. This article will cover 15 Linux find commands that are useful both for novice and veteran.

First, create the following empty file under your home directory to test the example of the Find command below.


# vim create_sample_files.sh
touch MybashProgram.sh
touch mycprogram.c
touch MyCProgram.c
touch Program.c
mkdir backup
cd backup
touch MybashProgram.sh
touch mycprogram.c
touch MyCProgram.c
touch Program.c
# chmod +x create_sample_files.sh
# ./create_sample_files.sh
# ls -R
.:
backup MybashProgram.sh MyCProgram.c
create_sample_files.sh mycprogram.c Program.c
./backup:
MybashProgram.sh mycprogram.c MyCProgram.c Program.c

1. Find files by file name

This is a basic use of the Find command. The following example shows how to find a file in the current directory and its subdirectories using MYCPROGRAM.C as the lookup name


# find -name "MyCProgram.c"
./backup/MyCProgram.c
./MyCProgram.c

2. Find files by file name, ignoring case

This is a basic use of the Find command. The following example shows how to find a file in the current directory and its subdirectories using MYCPROGRAM.C as the lookup name, ignoring the case.


# find -iname "MyCProgram.c"
./mycprogram.c
./backup/mycprogram.c
./backup/MyCProgram.c
./MyCProgram.c

3. Use mindepth and maxdepth to search the depth of the specified directory to find the passwd file in the root directory and its subdirectories.


# find / -name passwd
./usr/share/doc/nss_ldap-253/pam.d/passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd

Find passwd in the root directory and its 1-deep subdirectory. (e.g. Root-level1, and one Sub-directory-level 2)


# find -maxdepth 2 -name passwd
./etc/passwd

Locate the passwd file in the root directory and in the subdirectories of its maximum two-level depth. (e.g. Root-level 1, and Sub-directories-level 2 and 3)


# find / -maxdepth 3 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd
./etc/passwd

Find the passwd file between the second-level subdirectory and the fourth subdirectory.


# find -mindepth 3 -maxdepth 5 -name passwd
./usr/bin/passwd
./etc/pam.d/passwd

4. Execute the command on the file found by the Find command

The following example shows the Find command to calculate the MD5 validation and for all files that are not case-sensitive with the file name "MYCPROGRAM.C". {} will be replaced by the current file name.


find -iname "MyCProgram.c" -exec md5sum {} \;
d41d8cd98f00b204e9800998ecf8427e ./mycprogram.c
d41d8cd98f00b204e9800998ecf8427e ./backup/mycprogram.c
d41d8cd98f00b204e9800998ecf8427e ./backup/MyCProgram.c
d41d8cd98f00b204e9800998ecf8427e ./MyCProgram.c

5. The opposite match

Displays all names that are not MYCPROGRAM.C files or directories. Because MaxDepth is 1, only the files and directories in the current directory are displayed.


find -maxdepth 1 -not -iname "MyCProgram.c"
.
./MybashProgram.sh
./create_sample_files.sh
./backup
./Program.c

6. Finding files using inode numbers

Each file has a unique inode number, which allows us to differentiate the file. Create two names of similar files, such as one with a space ending, one without.


touch "test-file-name"
# touch "test-file-name "
[Note: There is a space at the end]
# ls -1 test*
test-file-name
test-file-name

The output from LS cannot distinguish which file has a space ending. With option-I, you can see the inode number of the file, which allows you to differentiate between the two files.


ls -i1 test*
16187429 test-file-name
16187430 test-file-name

You can specify the inode number in the Find command as shown below. Here, the Find command renames a file with an inode number.


find -inum 16187430 -exec mv {} new-test-file-name \;
# ls -i1 *test*
16187430 new-test-file-name
16187429 test-file-name

You can use this technique when you want to do something with a poorly named file like the one above. For example, named file?. TXT has a special character in the file name. If you want to execute the RM file?. TXT ", all three files shown below will be deleted. So, take the following steps to remove the "file?." TXT "file.


ls
file1.txt file2.txt file?.txt

Find the inode number for each file.

ls -i1
804178 file1.txt
804179 file2.txt
804180 file?.txt

As follows: Use inode numbers to delete file names that have special symbols.


find -inum 804180 -exec rm {} \;
# ls
file1.txt file2.txt
[Note: The file with name "file?.txt" is now removed]

7. Find files based on file permissions

The following actions are reasonable:

Locate the file with the specified permissions, ignore other permission bits, check whether and specify permissions to match the permissions that are expressed in the given octal/symbol search for this example, assuming the directory contains the following files. Note The permissions for these files are different.


ls -l
total 0
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
---------- 1 root root 0 2009-02-19 20:31 no_for_all
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r----- 1 root root 0 2009-02-19 20:27
others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27
others_can_only_read

Locate the file that has Read permission for the group. Use the following command to locate a file in the current directory that has read permissions for the same group of users, ignoring other permissions for the file.

find . -perm -g=r -type f -exec ls -l {} \;
-rw-r--r-- 1 root root 0 2009-02-19 20:30
./everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 ./all_for_all
----r----- 1 root root 0 2009-02-19 20:27
./others_can_only_read
-rw-r----- 1 root root 0 2009-02-19 20:27
./others_can_also_read

Locate the file that has read-only permissions for the group user.


find . -perm g=r -type f -exec ls -l {} \;
----r----- 1 root root 0 2009-02-19 20:27
./others_can_only_read

Locate the file that has read-only permissions for the group user (in the form of octal permissions).


find . -perm 040 -type f -exec ls -l {} \;
----r----- 1 root root 0 2009-02-19 20:27
./others_can_only_read

8. Find all the empty files (0 bytes files) in the home directory and sub-directory

Most of the output files for the following command are locked file boxes created by other programs place Hoders

#find ~ -empty

List only the empty files in your home directory.
#find . -maxdepth 1 -empty

Lists only non-hidden empty files under the current directory.
#find . -maxdepth 1 -empty -not -name ".*"

9. Find the 5 largest files
method is similar to finding the 5 largest files, except that the sort order is descending.

#find . -type f -exec ls -s {} \; | sort -n | head -5

10. Find 5 Smallest files
method is similar to finding the 5 largest files, except that the sort order is descending.

#find . -type f -exec ls -s {} \; | sort -n | head -5

In the above command, most likely you see only empty files (0-byte files). So, you can use the following command to list the smallest file instead of the 0-byte file.

#find . -not -empty -type f -exec ls -s {} \; | sort -n | head -5

11. Use-type to find files of the specified file type

Find only socket files

#find . -type s

Find all the Directories

#find . -type d

Find all the general files

#find . -type f

Find all hidden files

#find . -type f -name ".*"

Find all hidden directories

#find -type d -name ".*"

12. Find files by comparing modification times with other files

Displays files that have been modified after the specified file. The Find command below shows all the files that were created after ordinary_file.


#ls -lrt
total 0
-rw-r----- 1 root root 0 2009-02-19 20:27
others_can_also_read
----r----- 1 root root 0 2009-02-19 20:27
others_can_only_read
-rw------- 1 root root 0 2009-02-19 20:29 ordinary_file
-rw-r--r-- 1 root root 0 2009-02-19 20:30 everybody_read
-rwxrwxrwx 1 root root 0 2009-02-19 20:31 all_for_all
---------- 1 root root 0 2009-02-19 20:31 no_for_all
# find -newer ordinary_file
.
./everybody_read
./all_for_all
./no_for_all

13. Find files by file size

Use the-size option to find files by file size. Find files larger than the specified file

#find ~ -size +100M

Find files that are smaller than the specified file

#find ~ -size -100M

Find files that match a given size

#find ~ -size 100M

Note: – refers to smaller than a given size, + refers to larger than a given size. No symbol represents exactly as large as the given size.

14. Alias for common find operations

If you find something useful, you can give him an alias. and execute it wherever you want.
Commonly used to delete a.out files.

#alias rmao="find . -iname a.out -exec rm {} \;"
# rmao
Remove the core file generated by the C program.

#alias rmc="find . -iname core -exec rm {} \;"
# rmc

15. Delete large packaged files with the Find command

The following command deletes a *.zip file larger than 100M.

#find/-type f-name *.zip-size +100m-exec rm-i {} \; "

Use alias rm100m to delete all *.tar files with heavy rain of 100M. Using the same idea, you can create a class of aliases for rm1g,rm2g,rm5g to delete all files that are larger than 1g,2g,5g.


#alias rm100m="find / -type f -name *.tar -size +100M -
exec rm -i {} \;"
# alias rm1g="find / -type f -name *.tar -size +1G -exec
rm -i {} \;"
# alias rm2g="find / -type f -name *.tar -size +2G -exec
rm -i {} \;"
# alias rm5g="find / -type f -name *.tar -size +5G -exec
rm -i {} \;"
# rm100m
# rm1g
# rm2g
# rm5g

16. Find files that have been changed within 1 hours

To find files by file modification time, you can use the parameter-mmin-mtime. The following is the definition of mmin and Mtime in the Man Handbook.

-mmin n files were last modified within n minutes

-mtime N File The last modification is within n*24 hours (translator Note: That is, n days the chant)

Execute the command in the following example to find a file or directory with the current directory and its subdirectories, with the last modification time within 1 hours (60 minutes)

#find . -mmin -60

In the same way, execute the command in the example below and you will find the modified file within 24 hours (1 days) (file system root/Bottom)

#find / -mtime -1

17. Find files that have been accessed within 1 hours

You can use the parameter-amin-atime if you want to find the file through the file access time. The following is the definition of Amin and Atime in the Man Handbook.

-amin N File The last access is within n minutes

-atime n file last accessed within n*24 hours

Execute the command in the following example to find a file or directory with the current directory and its subdirectories, with the last access time within 1 hours (60 minutes)

#find . -amin -60

In the same way, the command in the example below will find the files accessed within 24 hours (1 days) (file system root/Bottom)

#find / -atime -1

18. Find the file with state changed within one hours

(Translator Note: Changes to the 1th example here change the content time of the file is different concept, here is the file inode data, such as file permissions, the owner and so on information)

To find the time to change the inode for a file, use the-cmin and-ctime options

The state of the-cmin n file is changed within n minutes

-ctime N file status changed within n*24 hours (i.e. n days)

(Translator Note: If the above n is the-n form, it means n minutes/day, n is +n = n minutes/day ago)

The following example finds files with file status changes within one hours (i.e. within 60 minutes) under the current directory and its subdirectories:

#find . -cmin -60

Similarly, the following command is in the root directory/and its subdirectories within a day (within 24 hours) file status changed file list:

#find / -ctime -1

19. Search is only limited to files, do not display folders

The above command searches for more than just files, but also displays folders. Because when a file is accessed, the folder It is in is also accessed, and if you are not interested in the folder, you can use the-type F option

The following command displays files that have been modified within 30 minutes, and the folders do not display:

#find /etc/sysconfig -amin -30

20. Find only non-hidden files (hidden files are not shown)

If we don't want to hide the files when we look for them, we can find them using the following regular expressions:

The following command displays files that have been modified in the current directory and its subdirectories for 15 minutes, and lists only non-hidden files. That is, the files that begin with. are not displayed.

#find . -mmin -15 \( ! -regex ".*/\..*" \)

21. Find file modification time in a file after a modified file

The following example shows a file that has been modified since/etc/passwd was modified. For system administrators, it is helpful to know that you have added a new user to track the active state of the system (in case it is not honest, you will soon know ^_^):

#find -newer /etc/passwd

22. Find file access time files after the modified time of a file

The following example shows all files that have been accessed after the/etc/hosts file has been modified. If you add a host/port record in the/etc/hosts file, you'll probably want to know what files have been accessed after that, and here's the command:

#find -anewer /etc/hosts

23. Look for a file that has changed state time after a file modification time

The following example shows files that have changed the state of all files after modifying the file/etc/fstab. If you add a mount point to the/etc/fstab, you probably want to know which files have changed in the following state, and you can use the following command:

#find -cnewer /etc/fstab

24. Use ls-l on the Find command output to enumerate the details of the files edited within 1 hours </strong>

#find -mmin -60 -exec ls -l {} \;

25. Search only in the current file system

System administrators sometimes just want to search on/mount file system partitions instead of searching for other mount partitions, such as/home/mount partitions. If you have multiple partitions being mounted and you want to search under/under, you can generally do this as follows

The following command searches for the file names at the end of all. log directories in the root directory/its subdirectories. If you have multiple partitions under/below, then this search will search for all mounted partitions:

#find / -name "*.log"

The following command searches the/directory and its subdirectories for all files ending in. Log in the current file system (i.e./mounted file system), meaning that if you have multiple partitions attached to/below, the following search will not search for other partitions (such as/home/)

#find / -xdev -name "*.log"

26. Use multiple {} in the same command

The Linux manual says only one {} is used in the command, but you can use more than one {} in the same command as follows

#find -name "*.txt" cp {} {}.bkup \;

Note that it is possible to use this {} in the same command, but not in a different command, that is, if you imagine that renaming the file below is not feasible

#find -name "*.txt" -exec mv {} `basename {} .htm`.html \;

27. Using Multiple {} instances

You can write a shell script like the following to simulate the example of the renaming above

#mv "$1" "`basename "$1" .htm`.html"

The double quotation marks above are intended to prevent the occurrence of spaces in the file name, which can be problematic if not added. Then you save the shell script as mv.sh, and you can use the Find command as follows

#find -name "*.html" -exec ./mv.sh ‘{}‘ \;

So, in any case you want to use the same file name multiple times in the Find command execution, write a script first, then execute the script in Find by-exec, and pass in the file name parameter, which is the simplest way.

28. Redirect the error to/dev/nul

Redirecting error output is generally not a good idea. An experienced programmer knows that it is important to display errors at the terminal and correct them in a timely manner. In particular, redirecting errors in the Find command is not a good practice. But if you really don't want to see those annoying mistakes, and want to redirect the error to a null device (that is, a black hole device on Linux), anything that goes in disappears. You can do it like this.

#find -name "*.txt" 2>>/dev/null

Sometimes this is very useful. For example, if you want to find all the *.conf files in the/directory under your own account, you will get a lot of "Permission denied" error messages, just like this:


$ find / -name "*.conf"
/sbin/generate-modprobe.conf
find: /tmp/orbit-root: Permission denied
find: /tmp/ssh-gccBMp5019: Permission denied
find: /tmp/keyring-5iqiGo: Permission denied
find: /var/log/httpd: Permission denied
find: /var/log/ppp: Permission denied
/boot/grub/grub.conf
find: /var/log/audit: Permission denied
find: /var/log/squid: Permission denied
find: /var/log/samba: Permission denied
find: /var/cache/alchemist/printconf.rpm/wm: Permission
denied
[Note: There are two valid *.conf files burned in the
"Permission denied" messages]

You mean annoying? So, if you just want to see the real results of the Find command instead of these "Permission denied" error messages, you can redirect these error messages to/dev/null


$ find / -name "*.conf" 2>>/dev/null
/sbin/generate-modprobe.conf
/boot/grub/grub.conf
[Note: All the "Permission denied" messages are not
displayed]

29. Change the space in the file name to underline

Many of the file names you download from the Web are marked with spaces. But filenames with spaces are bad for Linux (Unix-like) systems. You can rename these files by using the Replace function of the Rename command followed by the find and then convert the spaces to underline

The following shows how to change the space in the file name of all MP3 files to _


$ find . -type f -iname “*.mp3″ -exec rename “s/ /_/g” {} \;

30. Execute two commands simultaneously in the Find result

In the man page of Find, the following is a sample syntax for using two commands in a file lookup traversal

The following example of the Find command, traversing the file system once, lists the files and directories that have the setuid attribute, writes the/root/suid.txt file, and records it to/root/big.txt if the file size exceeds 100M


#find / \( -perm -4000 -fprintf /root/suid.txt ‘%#m %u %p\n‘ \) , \
\( -size +100M -fprintf /root/big.txt ‘%-10s %p\n‘ \)

30 useful Linux Find commands