Find Usage Details

[Root @ WWW ~] # Find [path] [Option] [action]
Option not parameter:
1. Time-related options: Total-atime,-ctime does not-mtime, which is described in-mtime
-Mtime N: N indicates the file of the content that has been changed in "one day" before n days.
Case;
-Mtime + N: list the file names that have been changed before n days (excluding n days;
-Mtime-N: name of the file whose content has been changed within n days (excluding n days.
-Newer file: file is an existing file that lists the file names that are newer than file.
 
Example 1: List Files with changed content (mtime) in the past 24 hours
[Root @ WWW ~] # Find/-mtime 0
# That 0 is the key! 0 represents the current time, so from now until 24 hours ago,
# Files with changed content will be listed! What if it was within 24 hours three days ago?
# Find/-mtime 3. All files that have changed are listed!
 
Example 2: Find the files under/etc. If the file date ratio is/etc/passwd, list the files.
[Root @ WWW ~] # Find/etc-newer/etc/passwd

#-Newer is useful in distinguishing the old and new relationships between two archives!

The time parameter is really loyal! We now know the meaning of atime and ctime is not mtime complete. If you want to find
You can use Example 1 above to change the file name. But what if I want to find the "file name changed in four days? That
You can use find/var-mtime-4 』. If it is the day four days ago, use find/var-mtime 4 』. Yes
Without adding "+,-", there is a big difference! We can use the simple explain diagram to illustrate:

The rightmost part of the image is the current time, and the more to the left, the earlier the timeline. From the figure, we can clearly understand:
+ 4 indicates the sequence name greater than or equal to 5 days ago: Ex> Find/var-mtime + 4
-4 indicates the file name smaller than or equal to four days: Ex> Find/var-mtime-4
4 indicates the file name on the 4-5 day: Ex> Find/var-mtime 4

Very interesting! You can search for the/var/directory to see the differences in output files! Let's take a look at the use of other find
Right!

Options and parameters:
2. parameters related to the user or group name:
-Uid n: N is a number, which is the ID of the user's guest account, that is, uid, which is recorded in
/Etc/passwd does not contain numbers corresponding to the account name.
-Gid N: N is a number. This number is the group name ID, that is, Gid. This GID is recorded in/etc/group.
-User name: name indicates the user account name! For example, dmtsai
-Group Name: name indicates the group name, for example, users;
-Nouser: Find the owner of the archive that exists in/etc/passwd!
-Nogroup: Find the archive owner group in the/etc/group file!
When you install the software on your own, it is likely that there are no file owners in the software attributes,
This is possible! At this time, you can use-nouser not-nogroup to search.

Very interesting! You can search for the output file under/var/category to see the differences in output file category! Next, let's look at other find functions.
Right! Very interesting! You can search for the output file under/var/category to see the differences in output file category! Next, let's look at other find functions.
Right!
Very interesting! You can search for the output file under/var/category to see the differences in output file category! Next, let's look at other find functions.
Right!
Example 3: Search for the vbird logs file under/home
[Root @ WWW ~] # Find/home-user vbird
# This is also useful ~ When we want to find all the files of a user in the system,
# You can use this command to find all files belonging to a user!
 
Example 4: Search for files that do not belong to anyone in the system
[Root @ WWW ~] # Find/-nouser
# Using this command, you can easily find out abnormal files.
# Do not be too nervous when you find anyone who does not belong to the license system to record files,
# Sometimes it is normal, especially when you compile software with the original code.

If you want to find out what a user has set up under the system, you can find out it by using the above "Comment" option without parameters! As
In the-nouser or-nogroup upload option function, except when you download files from the network, if you
An account in the system has been deleted, but this account has already created a large number of files in the system, there may be no owner or exclusive file storage
In! Now you have to use this-nouser plugin to find this type of file!

Options and parameters:
3. parameters related to file permissions and names:
-Name filename: searches for files whose names are filename;
-Size [+-] size: searches for files that are larger (+) or smaller (-) than the size. The size specifications include:
C: represents byte, and K: represents 1024 bytes. Therefore, we need to find a value smaller than 50kb.
A large file is "-size + 50 K 』
-Type: the type of the file to be searched is type. The main types are: General Regular files (f ),
Device File (B, c), directory (D), link file (L), socket (s ),
And FIFO (P.
-Perm mode: searches for files with the File Permission "exactly equal to" mode. This mode is a class.
For example, the attribute value of-rwsr-XR-X is 4755!
-Perm-mode: the permission to search for an archive must include all mode permissions. For example,
We want to search for-rwxr -- r --, that is, 0744 files, using-Perm-0744,
When the permission of an archive is-rwsr-XR-X, or 4755, it is also listed,
Because the attributes of-rwsr-XR-x already include the attributes of-rwxr -- r.
-Perm + mode: searches for archives with the "permission in any mode" permission. For example, we search
-Rwxr-XR-X, that is,-Perm + 755, but the attribute of a file is-RW -------
It will also be listed because it has a property of-RW!
 
Example 5: Find the file named passwd.
[Root @ WWW ~] # Find/-name passwd
# Use this-name to search for the file name!
 
Example 6: Find out the directory/var, which of the following are the names of sockets whose file type is socket?
[Root @ WWW ~] # Find/var-type S
# This-type encoding attribute is also very helpful! Especially to find out the weird archives,
# For example, if the socket does not have a FIFO file, you can use find/var-type P or-type s to find it!
 
Example 7: The search file contains the sgid, SUID, or sbit attributes.
[Root @ WWW ~] # Find/-Perm + 7000
# The so-called 7000 is --- s -- T, which is listed as long as it contains s or T,
# So of course we need to use + 7000, and use-7000 to indicate all three permissions containing --- s -- t.
Limited,
# Therefore, It is + 7000

The interesting example above is the-Perm option! His focus is on finding out files with special permissions! We know SUID
Both SGID and SGID can be set on the binary program. If I want to find the/bin and/sbin directories, the producer must have SUID
Or sgid to list the file. You can do this:

[Root @ WWW ~] # Find/bin/sbin-Perm + 6000

Because SUID is 4 points and SGID is 2 points, a total of 6 points, + 6000 can be used to process this permission! As for finding
Search for multiple directories! In addition, find will search for directories, which requires special attention! Finally, we
Let's take a look at some special features of find!

Option not parameter:
4. You can perform additional seek actions:
-Exec command: Command is another command.-exec can be followed by additional commands.
Process the search results.
-Print: print the result to the screen. This action is a preset action!
 
Example 8: Use LS-L to list the examples in the previous example ~
[Root @ WWW ~] # Find/-Perm + 7000-exec LS-l {}\;
# Note that the LS-L after-exec is an additional command. The alias command is not supported by the alias command,
# So you can only use LS-L and cannot use ll! Note!
 
Example 9: Find the files larger than 1 mb IN THE SYSTEM
[Root @ WWW ~] # Find/-size + 1000 K
# Although M and G can be used to represent MB and GB on man page,
# However, I cannot try this function ~ Therefore, currently, only C is supported!

The special function of find actions is to perform additional actions ). The following is an example of the 8-digit diagram:

The special points in this example include {} And \; and The-exec keyword. The meanings of these things are as follows:
{} Indicates "content found by find", as shown in. The find result is placed in the {} position;
-Exec until \; is a keyword that indicates the START (-exec) of the find extra action to the end (\;).
The extra action in the find command. In this example, it is "ls-l!
Because ';' has special significance in the bash environment, it uses a backslash to escape.
If you want to find out what a user has set up under the system, you can find out the token by using the above-mentioned token option without parameters! To begin
In the-nouser quit-nogroup quit option function, except when you download files from the network
An account in the system has been deleted, but this account has already created multiple archives in the system, there may be a no-owner and no-owner
In! Now you need to use this-nouser token to find the token file of this type!
If you want to find out what a user has set up under the system, you can find out the token by using the above-mentioned token option without parameters! To begin
In the-nouser quit-nogroup quit option function, except when you download files from the network
An account in the system has been deleted, but this account has already created multiple archives in the system, there may be a no-owner and no-owner
In! Now you need to use this-nouser token to find the token file of this type!