Linux File Finder Tool--find

Briefly:

The Find command in Linux is a powerful real-time lookup tool that uses the path given by the user to find files in the file system under that path. As a result, it takes time to traverse a larger file system, and the Find command takes up a lot of resources, so its job is to find it slightly slower, but it can achieve exact lookups and real-time lookups. Because of a problem with user permissions, it is possible to search only directories where the user has read and execute permissions. Because the Find command is powerful, it has many options.

Find command usage:

Find command format:

Find Options "find start path" "Find condition" "Process action"

Find [-h] [-l] [-p] [-D debugopts] [-olevel] [path ...] [Expression]

options: [-h] [-l] [-p] [-D debugopts] [-olevel] These are not commonly used, where-h,-l,-p three options are primarily used to handle symbolic links,

-h means to follow only the symbolic links specified in the command line;

-L indicates following all symbolic links;

-P means not following the symbolic link, the default option;

"Find starting Path": Based on the user's target starting path to find, the default is the current directory;

"Find Criteria": Search according to user-specified criteria, the default is to find all the files under the specified path;

The search criteria are broadly divided into the following categories:;

① Search by file name:

-name;-iname

For example: Find files ending with ". Cfg" in the current directory

~]# find. -name "*.cfg"

A regular expression is not supported when Glob wildcard matches are matched here. The use of-iname does not distinguish between character casing.

② Search by Inode number

-inum n Finding files with inode number n

-samefile F1 Find Files F1 the same inode number as the file

-links n files with number of links n

-regex "pattern": matches the entire file path string with pattern, not just the file name

~]# find-inum 1800-ls 1800 0 drwxr-xr-x 2 root root 6 3 23:21./dir1~]# Find. -regex ". *\.sh$"./scripts/a.sh./scripts/arg.sh

③ According to the genus Master Group search

-user USERNAME: Find files that belong to the specified user (UID)

-group GRPNAME: Finding files that belong to a specified group (GID)

-uiduserid: Finds files that belong to the specified UID number

-gidgroupid: Finding files with a specified GID number for the genus Group

-nouser: Finding files that are not owned by the master

-nogroup: Finding files that are not owned by a group

such as: Find the/var directory subordinate to the main root, and belong to the group mail all Files

~]# Find/var-user Root-group Mail/var/spool/mail/var/spool/mail/root

④ Search by File type:

-type (F,d,l,c,b,p,s)

F: Normal file

D: Catalog file

L: Symbolic Link file

C: Character device file

B: Block device files

P: Pipeline File

S: Socket file

For example: Find the directory file under the current directory

~]# Find-type D.. /.ssh./.cache./.cache/abrt

⑤ Search by File size:

-size [+/-] #UNIT (#代表数字, Unit representative unit) common units K,m,g

#UNIT: (#-1,#] indicates a range greater than #-1, less than or equal to #

-#UNIT: [0,#-1] indicates a range greater than or equal to 0, less than or equal to #-1

+ #UNIT: (#,∞) indicates an interval greater than # to positive infinity

such as: Find/etc directory row ah more than 1M and the type is a normal file of all files

~]# find/etc/-size +1m-type f/etc/selinux/targeted/policy/policy.29/etc/udev/hwdb.bin

⑥ Search by Time stamp:

Each file in the Linux file system has three timestamps, in days, respectively:

• Access Time Atime, the last time the file was accessed;
  

• State Change Time CTime (change time), when the State or attribute of a file was last changed
  

• Modified Time Mtime (modity time), last change in file content
  

-atime [+/-]# (#代表数字)

-#: (#,0] Indicates the time of day before #

#:[#,#-1) from # # days ago to the time between #-1 days

+#: (∞,#-1] means including the time before the first #-1 day

-ctime [+/-]#

-mtime [+/-]#

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471329036650644.png "title= "1471329036650644.png" alt= "17.png"/>

There is also a one-minute representation of the time, which is exactly the same between the-amin.-cmin,-mmin usage and the atime, and is no longer an illustrative example.

For example, to find files or directories on the current system that are not owned by the master or group and have been visited in the last week

~]# Find/\ (-nouser-o-nogroup \)-atime-7-L

⑦ Search by permissions:

-perm [/|-]mode

/mode: Indicates that any one (r,w,x) of the permissions of any class of users (U,g,o) satisfies the condition and that there is a "or" relationship between 9-bit permissions

such as: As long as any person has write permission, find-perm/222 will match

-mode: Indicates that each of the user's permissions satisfies the condition at the same time, and that there is a relationship between the 9-bit permissions

such as: Only when everyone has write permission, find-perm-222 will match

0 indicates no concern

such as: find-perm-002 matches only if other people (other) have permission to write

-perm mode means exact match

Example: Find-perm 755 matches a file with a permission pattern of exactly 755

⑧ condition limits, combined use, matching multiple

With:-A default combination logic

Or:-O

Non:-not or!

De Morgan Law:

Non (p and q) = (not P) or (not Q)

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471317529654266.png "title= "1471317529654266.png" alt= "11.png"/>

Non (p or q) = (not P) and (non-Q)

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471318047539995.png "title= "1471318047539995.png" alt= "12.png"/>

So:

! A-a! B =! (A-o B)

! A-o! B =! (A-a B)

For example: Find all files in the/var directory that are not root, LP, GDM

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471318407503713.png "title= "1471318407503713.png" alt= "13.png"/>

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471318416624302.png "title= "1471318416624302.png" alt= "14.png"/>

You can see that the two cases are equal

When find is based on permissions, it can be used in conjunction with the De Morgan Law , the previous article has mentioned that there is a "or" relationship between the-perm/mode 9-bit permissions, and there is a "and" relationship between the-perm-mode permissions. So when the permission lookup is combined with the De Morgan law.

! -perm/mode means: All users do not have the corresponding permissions;

! -perm-mode means that at least one user does not have the appropriate permissions;

Such as:

1. Find files with no write permission for all users in/etc directory

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471326886971328.png "title= "1471326886971328.png" alt= "15.png"/>

2. Find at least one file in the/root directory where the user does not have permission to execute

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471327078854281.png "title= "1471327078854281.png" alt= "16.png"/>

the "Processing action" operates on files that match the search criteria, and defaults to the output value standard output.

-print: Output to callout output, default action

-ls: Performs a ls-l command similar to the found file. Details of the output file

-delete: Delete the found file

-fls/path/to/somefile: Keep The long format information of all files found in the specified file

-ok command{}\;: Executes the command that comand represents for each file found, and each operation is confirmed by the user;

-exec command{}\;: Executes the command comand represents for each file found;

Note: {} indicates a matching file

For example: Find the file in the/etc directory at the end of a WD, and find the file containing the root row

~]# find/etc-name "*wd"-exec grep "root" {} \;

650) this.width=650; "src=" Http://www.178linux.com/ueditor/php/upload/image/20160816/1471329623639743.png "title= "1471329623639743.png" alt= "18.png"/>

However, when using the-EXEC option, find is passing all matching files to exec one at a time, but some files are too long and overflow errors can occur.

It is important to note that when find passes the file path found to the following command, it is the first time to find out all eligible file paths and pass them to the following commands at once, but some commands cannot accept too long arguments, and the command execution will fail; we can use another way to circumvent this problem: Find | Xargs COMMAND

in this brief xargs command , the reason can use this command, mainly in real-time because many commands do not support the pipeline to pass parameters, and usually work often need, so there is a xargs command . Xargs is a filter that passes parameters to the command, and is also a tool for combining commands. It divides a data stream into small enough to make it easier for the command to handle. Xargs reads data from a pipe or stdin, and splits it with whitespace characters, so there are some file names that contain white space characters or nouns that have special meanings, and are prone to miscalculation.

For Example: find files ending with ". Cfg" in the current directory and delete

~]# find. -name "*.cfg" | Xargs RM-RF

This article is from the "I ' m Groot" blog, so be sure to keep this source http://groot.blog.51cto.com/11448219/1839226

Linux File Finder Tool--find