I found it! 15 excellent Linuxfind command examples

Some time ago, we reviewed 15 examples of practical find commands (part 1 ). The search command can do much better than simply searching for name-based files (part 1). in this article, let's discuss 15 examples of advanced find commands, including-access based on them, modify or change the LinuxFindLinux command

Some time ago, we reviewed 15 examples of practical find commands (part 1 ). The search command can do much better than simply searching for name-based files (part 1). in this article, let's discuss 15 AdvancedFind commandExample, including-find a file based on its access, modification or change time, find the file, and execute the operation to find the file.

Search for files based on access/modify/change time

You can find the file based on the time attribute of the following three files.

1. Access time.File AccessThe access time is updated.
2. FileModification time.File content modificationThe modification time is updated.
3. The time when the file was changed. UpdatedInode data changes.

In the following example, the difference between min options and the time options are parameters.

• PointsSet its parameterMinutes. For example, 60 minutes (1 hour) = 60 minutes.
• Time parameter, Set its parameter24 hours. For example, the time is 2 = 2*24 hours (2 days ).
• Although the 24-hour calculation is ignored, the decimal part is 24 hours for 25 hours, and the 47-hour value is 24 hours for 48 hours. For clearer reference to atimeFind command.

Example 1: Find the file that was changed within 1 hour

You can use the-mmin-mtime parameter to find the file through the file modification time. The following are definitions of mmin and mtime in the man manual.

• -Mmin nThe last modification to the file is inN minutesWithin
• -Mtime nThe last modification to the file is inN * 24 hoursWithin (Translator's note: it's n days)

Run the commands in the following example to find the files or directories in the current directory and its sub-directories. The last modification time is within 1 hour (60 minutes ).

# find . -mmin -60

In the same way, execute the commands in the following example and find the modified files (under the root directory of the file system/) within 24 hours (one day)

# find / -mtime -1

Example 2: find the file that has been accessed within one hour

You can use the-amin-atime parameter to find the file through the file access time. The following are definitions of amin and atime in the man manual.

• -Amin nThe last access to the file is inN minutesWithin
• -Atime nThe last access to the file is inN * 24 hoursWithin

Run the commands in the following example to find the files or directories in the current directory and its sub-directories. the last access time is within 1 hour (60 minutes ).

# find . -amin -60

In the same way, execute the commands in the following example to find the files accessed within 24 hours (one day) (under the root directory of the file system)

# find / -atime -1

Example 3: find the file whose status is changed within one hour

(Translator's note: Here the change is more than 1st examples. changing the file content time is different concepts. here we change the inode data of the file, such as the file permission and owner information)

To find the inode change time of the file, use the-cmin and-ctime options.

• -Cmin nThe file status is changed within n minutes.
• -Ctime nThe file status is changed within n * 24 hours (that is, within n days ).

(Note: If n is in the-n format, it indicates that n minutes/day, and n is + n, it indicates n minutes/day before)

In the following example, find the file whose status changes within one hour (that is, within 60 minutes) under the current directory and its sub-directories ):

# find . -cmin -60

In the same way, the following example shows the list of files whose status is changed in the root directory/and its subdirectories within the next day (within 24 hours:

# find / -ctime -1

Example 4: only files are searched and folders are not displayed.

The above example shows that there are not only files, but also folders. Because when a file is accessed, its folder will also be accessed. if you are not interested in the folder, you can use the-type f option.

The following example shows the modified files within 30 minutes, but not the folders:

# Find/etc/sysconfig-amin-30 .. /console. /network-scripts. /i18n. /rhn. /rhn/clientCaps. d. /networking. /networking/profiles. /networking/profiles/default. /networking/profiles/default/resolv. conf. /networking/profiles/default/hosts. /networking/devices. /apm-scripts [Note: The above output contains files and folders] # find/etc/sysconfig-amin-30-type f. /i18n. /networking/profiles/default/resolv. conf. /networking/profiles/default/hosts [Note: The above output only contains files]

Example 5: only search for non-hidden files (hidden files are not displayed ):

If you do not want to hide the file when searching, you can use the following regular expression:

The following command displays the files whose contents have been modified in the current directory and its subdirectories within 15 minutes, and only lists non-hidden files. That is, files starting with "." are not displayed.

# find . -mmin -15 \( ! -regex ".*/\..*" \)

　　Search commands based on File comparison

We usually compare other things to make it easier to remember some things. For example, I want to find the file that I edited after I edited the test file. You can use the editing time of the test file as the benchmark to find the edited file:

Example 6: find the file modified after a file is modified:

Syntax: find-newer FILE

The following example shows the files modified after/etc/passwd. For the system administrator, it is helpful to track the activity status of the system after you add a new user (if the new user is not honest, it will be a mess when it comes up, soon you will know ^_^ ):

# find -newer /etc/passwd

Example 7: search for files whose access time is after the modification time of a file:

# find -newer /etc/passwd

The following example shows all files accessed after the/etc/hosts file is modified. If you add a host/Port record in the/etc/hosts file, you may be wondering which file is accessed after that. the following command is used:

# find -anewer /etc/hosts

Example 8: find the file whose status changes after the modification time of a file:

Syntax: find-cnewer FILE

The following example shows all files whose status has changed after the/etc/fstab file is modified. If you add a mount point in/etc/fstab, you may find that the status of those files has changed since then. you can use the following command:

# find -cnewer /etc/fstab

Run the following command on the result of the file list:

Previously, you have seen that if you use the find command to find the list of files with various conditions. If you are not familiar with these find commands, I suggest you read the first part above.

Next, we will introduce how to execute different commands on the find command, that is, how to operate the file list found by the find command.

We can specify any operation on the list of file names found by the find command:

# find 
 
   -exec 
  
    \;
  
 

OPERATION can be any command, which is commonly used as follows:

• Rm command to delete the files found by find
• Mv command, used to rename the searched file
• Ls-l command to display the detailed information of the searched file
• Md5sum is used to perform the md5sum operation on the searched file to obtain a string used to check the validity of the file content.
• Wc command, used to count the number of words in the computing file, the file size is waiting
• Execute any Unix shell command
• Execute your own shell script. the parameter is the name of each searched file.

Example 9: use ls-l in the find command output to list the details of the file edited within one hour.

# find -mmin -60./cron./secure# find -mmin -60 -exec ls -l {} \;-rw-------  1 root root 1028 Jun 21 15:01 ./cron-rw-------  1 root root 831752 Jun 21 15:42 ./secure

Example 10: Search only in the current file system

Sometimes the system administrator only wants to search for/mounted file system partitions, rather than other mount partitions, such as/home/Mount partitions. If you have multiple partitions mounted and want to search under/, you can follow the steps below

The following command searches for the names of all. log files in the root directory/and its subdirectories. If you have multiple partitions under/, this search will search for all mounted partitions:

# find / -name "*.log"

If we use the-xdev option, we will only search in the current file system. The following is a definition of-xdev found on the man page of xdev:

• -Xdev Don't descend directories on other filesystems.

The following command searches for all the files in the current file system (that is, the/mounted file system) in the/directory and its subdirectories. file ending with log, that is, if you have multiple partitions mounted under/, the following search will not search for other partitions (such as/home /)

# find / -xdev -name "*.log"

Example 11: use multiple {} in the same command {}

The linux manual says that only one {} can be used in the command, but you can use multiple {} in the same command as below {}

# find -name "*.txt" cp {} {}.bkup \;

Note: This {} can be used in the same command, but it won't work in different commands. that is to say, it won't work if you imagine renaming a file like this.

find -name "*.txt" -exec mv {} `basename {} .htm`.html \;

Example 12: use multiple {} instances

You can write a shell script like the following to simulate the renaming example above.

# mv "$1" "`basename "$1" .htm`.html"

The double quotation marks are used to prevent spaces in the file name. Then you save the shell script as mv. sh. you can use the find command as follows.

find -name "*.html" -exec ./mv.sh '{}' \;

Therefore, if you want to use the same file name multiple times during the execution of the find command, write a script and execute the script through-exec in the find command, it is the easiest way to pass the file name parameter.

Example 13: redirect an error to/dev/nul

Redirection error output is generally not a good idea. It is important for an experienced programmer to understand how to display errors on the terminal and correct them in time.

In particular, it is not a good practice to redirect errors in the find command. But if you really don't want to see the annoying errors, you want to redirect all the errors to the null device (that is, the black hole device on linux, anything that is lost disappears without a trace ). You can do this as follows:

find -name "*.txt" 2>>/dev/null

Sometimes this is useful. For example, if you want to use your account to find all *. conf file, you will get a lot of "Permission denied" error messages, as shown below:

$ find / -name "*.conf"/sbin/generate-modprobe.conffind: /tmp/orbit-root: Permission deniedfind: /tmp/ssh-gccBMp5019: Permission deniedfind: /tmp/keyring-5iqiGo: Permission deniedfind: /var/log/httpd: Permission deniedfind: /var/log/ppp: Permission denied/boot/grub/grub.conffind: /var/log/audit: Permission deniedfind: /var/log/squid: Permission deniedfind: /var/log/samba: Permission deniedfind: /var/cache/alchemist/printconf.rpm/wm: Permission denied[Note: There are two valid *.conf files burned in the "Permission denied" messages]

Are you annoying? Therefore, if you only want to see the real search results of the find command instead of the "Permission denied" error messages, you can redirect these error messages to/dev/null.

$ find / -name "*.conf" 2>>/dev/null/sbin/generate-modprobe.conf/boot/grub/grub.conf[Note: All the "Permission denied" messages are not displayed]

Example 14: Replace spaces in the file name with underscores

Many audio files downloaded from the internet contain spaces. However, file names with spaces are not good in linux (Unix-like) systems. You can use the find command followed by the rename command replacement function to rename these files and convert spaces into underscores.

The following shows how to replace spaces in all mp3 file names _

$ find . -type f -iname “*.mp3″ -exec rename “s/ /_/g” {} \;

Example 15: execute two commands simultaneously in the find result

On the find man page, the following is an example of the syntax for using two commands in a file search traversal.

The following find command is used to traverse the file system once, list the files and directories with the setuid attribute, and write the/root/suid.txt file. if the file size exceeds 100 MB, record it to/root/big.txt

# find / \( -perm -4000 -fprintf /root/suid.txt '%#m %u %p\n' \) , \ \( -size +100M -fprintf /root/big.txt '%-10s %p\n' \)

Find command example (part 1)

If you like this article about the find command Daddy, don't forget to take a look at the first part of the article about the find command Mommy.

Original article address: 15-practical-unix-linux-find-command-examples-part-2