Find command Detailed (reprint)

Features:Searches for a file in the directory structure and performs the specified action. This command provides quite a few look-up conditions and is powerful.
Syntax:Find start directory looking for conditional actions
Description:The Find command starts with the specified starting directory, searches its subdirectories recursively, finds the file that satisfies the search criteria, and takes relevant action on it.

The search condition provided by this command can be a compound condition consisting of a logical operator not, and, or. The meaning of the logical operator and, or, is:

(1) and: Logic and, in the command with "-a", is the system default option, indicating that only when the given conditions are satisfied, the search condition is satisfied. For example:

$ Find–name ' tmp ' –xtype c-user ' inin '

This command looks for all the files that are satisfied with the three given criteria.

(2) or: logical OR, denoted by "-O" in the command. The operator indicates that the search condition is satisfied as long as one of the given conditions is satisfied. For example:

$ Find–name ' tmp ' –o–name ' mina* '

This command queries the file name ' tmp ' or all files that match ' mina* '.

(3) Not: Logical, in command "! Said The operator indicates that a file was found that did not meet the given criteria. For example:

$ find! –name ' tmp '

This command queries all files that have a file name that is not ' tmp '.

It is necessary to note that these options can be enclosed in parentheses when using a number of logical options. To avoid the shell itself being misunderstood, it is necessary to add the escape character "" to remove the meaning of the parentheses before the session number.

Example: $ find (–name ' tmp ' –xtype c-user ' inin ')

The search criteria have the following options:

First, the n values in each of the following options can be entered in three ways, assuming that N is 20:

+20 means after 20 (21,22,23 etc.)

-20 means before 20 (19,18,17, etc.)

20 means it's exactly 20.

1. Find by name and file attributes.

-the name ' string ' finds the file name that matches all the given string's files, and the wildcard character within the string * 、?、 [].

-lname ' string ' Find file name matches all symbolic link files of the given string, wildcard characters * 、?、 [] are available within the string.

-gid N finds all files belonging to the user group with ID number n.

-uid N finds all files belonging to a user with ID number n.

-group ' string ' finds all the files that belong to the user group named the given string.

The-user ' string ' finds all the files that belong to the user name of the given string.

-nogroup finds a file that does not have a valid owning group, that is, the group to which the file belongs does not exist in the/E t c/g r o u P S.
-nouser finds a file without a valid owner, that is, the owner of the file does not exist in the/E T c/p a s S W D.
-newer file1! File2 find change time than file F i l e 1 new but newer than file F i l e 2 old file.


-empty look for a directory or file of size 0.

The-path ' string ' lookup path name matches all the files given to the string, and the wildcard characters * 、?、 [] are available within the string.

-perm permissions find files and directories with the specified permissions, which can be represented as 711,644.

-size n[bckw] Finds files of the specified file size, the characters following n represent units, the default is B, which represents 512-byte blocks.

-type x finds a file of type X, and X is one of the following characters:

B-Block device files

C-Character device files

D catalog File

P Named Pipes (FIFO)

F Common Files

L Symbolic Link file (Symbolic links)

s socket file

-xtype x is basically the same as-type, but finds only symbolic link files.

2. Find time-based conditions

-Amin N finds all files that were accessed N minutes ago.

-Atime n finds all files that were accessed N days ago.

-Cmin n finds all files that have been modified for n minutes before the file status.

-CTime n finds all files that have been modified by the file status N days ago.

-Mmin n finds all files where the contents of the file have been modified before n minutes.

-Mtime n finds all files where the contents of the file have been modified before n days.

3. Actions that can be performed

-EXEC command name {} \; Executes a given UNIX command against a qualifying file without asking the user if the command needs to be executed. {} indicates that the argument to the command is the found file, and the end of the command must be "\;" End, "{}" and "\;" Must have a space between them.

-OK command name {} \; Unlike exec, which executes a given Linux command on a qualifying file, it asks the user if the command needs to be executed.

-LS lists all files found in detail.

-fprintf file name writes the found file name to the specified files.

-Print Displays the found file name on the standard output device.

-Please refer to the C language book for the format of the printf format.

Use the name option   the
file name option is the most common option for the f i n d command, or it is used alone. It is either used with other options.  
You can use a file name pattern to match files, remembering to enclose the filename pattern in quotation marks.  
Regardless of the current path, if you want to find the file name in your root directory $ h o m E in accordance with *. t files,  
Use ~ as ' p a t H n a M e parameter, tilde ~ represents your $ h o m e directory. &NBSP
$ find ~-name "*.txt"-PRINT 
you want to find all the ' *. T x t ' files in the current directory and subdirectories, you can use:  
$ find.-name "*.txt"-pri nt 
to find files in the current directory and subdirectories where the file name begins with an uppercase letter, you can use:  
$ find-name "[a-z]*"-PRINT 
want to find the file name in the/E T C directory with H o S T begins with a file that can be used:  
$ find/etc-name "host*"-PRINT 
to find files in the $ H O M e directory, you can use:  
$ find ~-name "*"-print or find. -print 
to get the system running at a high load, start looking for all the files from the root directory. If you want to   the system administrator;
Keep a good impression, it's best to think it over before you do it!  
$ find/-name "*"-PRINT 
If you want to find the file name in the current directory with two lowercase letters, followed by two numbers, and finally the text of *. T x t  
, the following command can return a name of a X 3 7 . T x t files:  

$ find.-name "[a-z][a-z][0--9][0--9].txt"-print

Use the perm option  
If you want to find files in file permission mode, you can choose the-P e r m option. You may need to find all the   the
user has a file that performs permissions or wants to see the file permission type in a user directory. When using this option  
, it is best to use the octal permission notation.  
in order to find the file permission bit in the current directory of 7 5 5 files, that is, the file owner can read, write, execute, and other  
user can read and execute the file, can be used:  
$ find-perm 755-print  
If you want to find files in the current directory that all users can read, write, and execute (be careful about this), we  
You can use the-P e r m option of the f i n d command. Add a horizontal bar before the octal digit-. In the following command-P e r m generation   The
table is looked up by file permissions, and ' 0 0 7 ' is exactly the same as the representation you used in the absolute mode of the C H o d command.  
$ find-perm-007-print 
ignores a directory  
If you want to ignore a directory when looking for a file, because you know that the directory does not have the file you are looking for,  
You can then use the-P r u n e option to indicate which directories need to be ignored. Be careful when using the-P r u n e option, because if you are with  
when the-D e p t h option is used, then the-P r u n e option is ignored by the f i n d command.  
If you want to find a file in the/a P s directory, but do not want to find it in the/a P s/b i n directory, you can use:  
$ find/apps-name "/apps/bin"-prune-o-print< /p>

using the user and Nouser options
If you want to follow the file owner to find the file, you can give the corresponding user name. For example, find in the H O M e Directory
The file belongs to a file of D a v e, which can be used:
$ find ~-user Dave-print
Find files in the/E T C directory where the file belongs to U-C p:
$ find/etc-user Uucp-print
In order to find files that are already deleted from the master account, you can use the-N o u S e r option. So that we can find those who belong to the Lord
There are no valid account files in the/E T c/p a s S w d file. When using the-N o u S e r option, you do not have to give the user name; f i n d command
Be able to do the work for you. For example, to find all such files in the/h o m e directory, you can use:
$ find/home-nouser-print
Using the group and Nogroup options
Just like the U S e r and N o u S e r options, the f i n d command also has the same option for the user group to which the file belongs,
To find files belonging to a C C T s user Group under the/a P s directory, you can use:
$ find/apps-group Accts-print
To find all files that do not have a valid owning user group, you can use the N o g r o u p option. The following f i n d commands from the file
Find such a file at the root of the system
$ fine/-nogroup-print

find files by change time
If you want to find the file by changing the time, you can use the M t i m e option. If the system suddenly does not have free space,
It is very likely that the length of a file will grow rapidly during this period, and you can find such a file with the M t i m e option.
Use a minus sign-to limit the time to change the file within the current n days, and use the Plus + to limit the change time before the present n days
File.
To find files that change within 5th of the system root directory, you can use:
$ find/-mtime-5-print
In order to find files that change time before 3rd in the/V a r/a d m directory, you can use:
$ find/var/adm-mtime +3-print
Find new or older files than a file
If you want to find all files that have changed time than one file but older than the other, you can use-n e w e R selected
Item The general form of it is:
Newest_file_name! Oldest_file_name
Among them,! is a logical non-symbol.
There are two files, and their change time is about two days apart.
The following gives the f i n d command to be able to look for a change time than file a G E. A W k new but more than file B E L t S. A w k old file:
If you want to use this option for the f i n d command to find files that change within two hours, unless there is a ready-made
file that was changed exactly two hours ago, otherwise there is no file that can be used to compare the time of the change. In order to solve
This problem, you can first create a file and set its date and time stamp to the required time. This can be used with t o u c h
command to implement.
Assuming that the current time is 2 3:4 0, and you want to find files that change within two hours, you can first create such
A file:
A compliant file has been created; Here we assume today is May 4, and the file change time
is 2 1:4 0, just two hours earlier than now.
Now we can use the f i n d command of the-N e w e r option in the current directory to find all change times in two hours
Within the file:
$ find. -newer Dstamp-print

Use the type option
There are several different file types in the U n i x or L n u x system, which we have already done in the previous section
Introduction, we will not repeat it here. If you want to find all the directories in the/e T-C directory, you can use:
$ find/etc-type D-print
In order to find all types of files except directories in the current directory, you can use:
$ find. ! -type D-print
In order to find all the symbolic link files in the/E T C directory, you can use:
$ find/etc-type L-print

Use the size option
Files can be found by file length, where the length of the file is measured either in blocks (b l o C k) or
To be measured in bytes. The length of the measured file in bytes is expressed as n C, and the length of the block measure file is only represented by numbers
Can
As far as I am concerned, I always use a byte-count method, when looking up files by file length, most people
Prefer to use this file length in bytes, rather than the number of blocks, unless you are viewing the file system's large
Small because it is easier to convert by using blocks to measure.
In order to find files with a file length greater than 1 m bytes in the current directory, you can use:
$ find. -size +1000000c-print
In order to find files with a file length of exactly 1 0 0 bytes in the/h o m e/a p a c h e directory, you can use:
$ find/home/apache-size 100c-print
In order to find files with a length of more than 1 0 blocks in the current directory (a piece equals 5 1 2 bytes), you can use:
$ find. -size +10-print

use depth option  
When using the f i n d command, you might want to match all the files first. Look in the subdirectory again. Use the D e p t h option to  
enables the f i n d command to do so. One reason for this is that when you back up the file system to tape using the f i n d command,  
you want to back up all the files first, and then back up the files in the subdirectories.  
In the following example, the f i n d command starts at the root of the file system and looks for a name C O N. F I L E's file.  
It will first match all of the files and then go to the subdirectories to find them.  
$ find/-name "CON. FILE "-depth-print

Use the Mount option  
Find a file in the current file system (without entering another file system), you can use F The M o u n T option for the i n d command.  
In the following example, we begin by looking at the file in the current directory that ends in x C for the file name in this filesystem:  
$ find.-name "*. XC "-MOUNT-PRINT&NBSP;
Use the Cpio option  
The C P i o command can be used to back up or recover files from a tape device. You can use the f i n-d command to   the entire file,
in the system (more in the case of some file systems), and then use the C P i o command to back up the file to tape.  
If you want to use the C P i o command backup/E t C,/h o m e and/P s directory files, you can use the commands given below, but remember that you are at the root of the file system:
(in the example above, the first line at the end of \ Tell S H e l l command is not finished, ignore the carriage return after. )  
In the above example, you should be aware of missing/in the path. This is known as a relative path. The reason for using relative paths is  
because you can choose the path to recover files when you restore these files from tape. For example, you can   these files first,
revert to another directory, perform some operations on them, and then revert to the original directory. If you use   at backup time,
an absolute path, such as/E T C, then when recovering, you can only revert to the/E T C directory and have no other choice. In the example of the above  , I told the f i n d command to first enter the/e T C directory, then the/h o m e and/a P s directories, match the files in those directories, and then match the files in their subdirectories, all of which will be routed through the pipeline to the C P i o command for backup 。  
by the way, in the above example the C p i o command uses the C 6 5 5 3 6 option, I could have used the B option, but this  
like the size of each block is only 5 1 2 bytes, and with the C 6 5 5, 3 6 option, the size of the block becomes 6 4 K byte  
(6 5 5 3 6/1 0 2 4).

use exec or OK to execute shell commands
When you match some files, you might want to do something about it, and then you can use the-e x E c option. Once
The f i n d command matches the corresponding file and can be manipulated using the commands in the-e x E C option (in some operating systems
Only allow-e x E C option to execute commands such as L s or ls-l. Most users use this option to find old text
and delete them. Here I strongly recommend that you first use the L S command to see a file before actually executing the r m command.
, verify that they are the files that you want to delete.
The E x E C option is followed by the command to be executed, followed by a pair of {}, a space and a \, and finally a
Semicolon.
To use the E x E C option, you must use the P r i n t option at the same time. If you verify the f i n d command, you will find that the command only
Outputs the relative path and file name from the current path.
In order to list the matched files with the Ls-l command, you can place the Ls-l command in the-e x E c option of the f i n d command, for example:
In the above example, the f i n d command matches all normal files in the current directory and uses ls-l in the-e x E c option
command to list them.
In order to find files that change time before 5th in the/L o G S directory and delete them, you can use:
$ find Logs-type f-mtime +5-exec rm {} \;
Remember, before you delete files in any way in the S H e l L, you should look at the appropriate files first, be careful!
When using commands such as M V or R m, the safe mode of the-e x E C option can be used. It will be on each match to the file
Prompt you before doing the operation. In the following example, the f i n d command finds all filenames in the current directory. L O G End,
Change files that are older than 5th, and delete them, but give a hint before deleting them.
Press the Y key to delete the file and press N to not delete it.
Any form of command can be used in the-e x E c option. In the following example we use the G r e P command. f i n d command

First match all files named "p a s W d *", such as p a s S W D, p a s S W D. o l D, p a s S W D. b A k, then
Line g r e p command to see if there is an R o u n d e r user in these files.
Example of the Find command
We have introduced the basic options for the f i n d command, and below are some other examples of the f i n d command.
In order to match all the files in the $ H O M e directory, the following two methods are available:
$ find $HOME-print
$ find ~-print
In order to find the S U i d position in the current directory, the file owner has read, write, execute permissions, and the file belongs to the group
The user and other users have read and execute permissions for the file, which can be used:
$ find. -type F-perm 4755-print
In order to find all normal files with file lengths of 0 in the system and list their full paths, you can use:
$ find/-type f-size 0-exec ls-l {} \;
In order to find/V a r/l o G S directory to change the normal file time before 7th, and remove them, you can use:
$ find/var/logs-type f-mtime +7-exec rm {} \;
In order to find all files in the system that belong to the a U d i t group, you can use:
$find/-name-group Audit-print
One of our audit systems creates an audit log file every day. The log file name contains a number at the end so that I
We can see at a glance which file is up-to-date and which is the oldest. A d m i n. L o g files are numbered:
A d m i n. L o G. 0 0 1, a d m i n. L o G. 0 0 2 and so on. The following f i n d command will delete/L o G S Directory access time prior to 7th,
A d m i n containing a numeric suffix. L o g file. This command checks only three digits, so the corresponding log file suffix does not exceed
9 9 9.
$ Find/logs-name ' admin.log[0-9][0-9][0-9] '-atime +7-exec rm {} \;
In order to find and sort all the directories in the current file system, you can use:
$ find. -type D-print-local-mount |sort
In order to find all the R m T tape devices in the system, you can use:
$ find/dev/rmt-print

Xargs
When you use the-EXEC option of the Find command to process a matching file, the f i n d command passes all matching files together
To E x e C execution. Unfortunately, some systems have a limit on the length of the command that can be passed to E x e C, so that the f i n d command runs
After a few minutes, an overflow error occurs. The error message is usually "parameter column too Long" or "parameter column overflow". This is
The usefulness of the X a RG s command, especially with the f i n d command. The F i n d command passes the matched file to the X a RG s life
The X a RG s command gets only a subset of the files at a time instead of all, unlike the-e x E c option. So it can handle it first.
Get the first part of the file, then the next batch, and so on. In some systems, using the-e x E C option will
initiating a corresponding process to process each matching file, not all of the matching files as parameters once
In some cases, the problem of excessive process, degraded system performance, and therefore inefficient;

The X a RG s command has only one process. In addition, when using the X a RG s command, is it necessary to get all the parameters at once, or
The batch acquisition parameters, and the number of parameters to be obtained each time, are based on the options of the command and the corresponding tunable parameters in the system kernel.
Number to determine.
Let's take a look at how the X a RG s command is used with the f i n d command, and gives some examples.
The following example finds every normal file in the system and then uses the X a RG S command to test which class they belong to
File:
The following example finds the memory information dump file (core dump) throughout the system, and then saves the results to
In the/tmp/core.log file:
$ find. -name "Core"-print | Xargs echo "" >/tmp/core.log
The following example finds files in the/apps/audit directory for which all users have read, write, and execute permissions and reclaims the corresponding
Write Permissions for:
$ find/apps/audit-perm-7-print | Xargs chmod o-w
In the following example, we use the grep command to search for the word device in all common files:
$ find/-type F-print | Xargs grep "Device"
In the following example, we use the G r e P command to search all ordinary files in the current directory for the word d B o:
$ find. -name \ *-type F-print | Xargs grep "DBO"
Note that in the above example, \ is used to cancel the special meaning of * in the S H e L in the f i n d command.

Summary
The Find command is a very good tool that can match files according to user-specified criteria. Using exec and Xargs allows the user to execute almost all commands against the file that is matched to.

Find command Detailed (reprint)