Linux file Lookup command find and Xargs detailed

Ps:find is a powerful command that matches the regular and finds the corresponding permissions, which can help you pinpoint files in any directory anywhere in your system. The following is the most detailed article on the use of the Find command, recorded. Also have to note: The semicolon in this article, in fact, are all with the escape character \;, may be the template problem, backstage display but the front desk did not show up. For different systems, direct use of semicolons may have different meanings, using the escape character \ explicitly stated before the semicolon.

Directory

Copyright notice

Preface: About the Find command

One, find command format
1. The general form of the Find command is;
2, the parameters of the Find command;
3, find command options;
4. Use exec or OK to execute shell commands;

Ii. examples of the Find command;

1. Find all files under the current user's home directory;
2, in order to be in the current directory of the file owner has read, write permissions, and the file belongs to the group of users and other users have Read permission files;
3, in order to find all the files in the system file length of 0 ordinary files, and list their full path;
4. Look for common files in the/var/logs directory that were changed before 7th, and ask them before deleting them;
5, in order to find all the files belonging to the root group in the system;
6. The Find command will delete the Admin.log file that contains the digital suffix since the access time in the directory was 7th
7, in order to find all the directories in the current file system and sorting;
8, in order to find all the RMT tape devices in the system;

Third, Xargs

Four, the parameters of the Find command;

1. Use the name option
2. With PERM option
3. Ignore a directory
4. How to avoid a file directory when finding files with find
5. Use the user and Nouser options
6. Use Group and Nogroup options
7, according to change time or access time, etc. find files
8. Find newer or older files than a file
9. Use the Type option
10. Use the SIZE option
11. Using the Depth option
12. Using the Mount option

+++++++++++++++++++++++++++++++++++++++++++++++++
Body
+++++++++++++++++++++++++++++++++++++++++++++++++

Preface: About the Find command

Because find has powerful features, it has a lot of options, most of which are worth taking the time to look at. Even if the system contains a network file system (NFS), the Find command works equally well in the file system, and you only have the appropriate permissions.

When running a very resource-intensive find command, many people tend to put it in the background because it can take a long time to traverse a large file system (this refers to a file system with more than 30G bytes).

One, find command format

1. The general form of the Find command is;

Find Pathname-options [-print-exec-ok ...]

2, the parameters of the Find command;

The directory path that the Pathname:find command looks for. For example, use. To represent the current directory, and/to represent the system root directory. The-print:find command outputs the matched file to standard output. The-exec:find command executes the shell command given by the parameter to the matching file. The corresponding command is in the form of ' command ' {} \;, note the space between {} and \; -ok: The same as-exec, except that the shell command given by the parameter is executed in a more secure mode, prompting the user to determine whether to execute before executing each command.

3. Find command Options

-name finds files by file name. -perm to find files according to file permissions. -prune Use this option to have the Find command not be found in the currently specified directory, and if you use the-depth option at the same time,-prune will be ignored by the Find command. -user Search for files according to the owner of the file. -group finds files according to the group to which the files belong. -mtime-n +n The file changes time to find the file,-n means that the file change time is now less than n days, + n means that the file change time is now N days ago. The Find command also has the-atime and-ctime options, but they both and the-m time option. -nogroup finds a file that does not have a valid owning group, that is, the group to which the file belongs does not exist in/etc/groups. -nouser finds a file without a valid owner, that is, the owner of the file does not exist in the/etc/passwd. -newer file1! File2 look for a file that changes time than the file File1 new but older than the file file2. -type find files of a certain type, such as: B-block device files. D-Directory. C-character device file. P-Pipeline file. L-Symbolic link file. F-Normal file. -size N:[c] finds files with a file length of n blocks, with C indicating the length of the file in bytes. -depth: When looking for a file, first find the file in the current directory, and then look in its subdirectories. -fstype: Find files located in a file system of a certain type, these file system types can usually be found in the configuration file/etc/fstab, which contains information about the file system in this system. -mount: Does not cross the file system mount point when locating files. -follow: If the find command encounters a symbolic link file, it tracks to the file that the link points to. -cpio: Use the cpio command for matching files to back up these files to the tape device.

In addition, the following three differences:

-amin N Find the last n minutes of access to the file in the system-atime N find the last n*24 hours of access to the file in the system-cmin N find the file in the last n minutes of the system changed file status-ctime N Find the last n*24 hours in the System file state file-mmin n Find files that have changed file data in the last N minutes of the system-mtime N find files that have been changed in the last n*24 hours of the system

4. Use exec or OK to execute shell commands

When using find, just write the desired action in a file, you can use the exec to match the Find lookup, very convenient

In some operating systems, only the-EXEC option is allowed to execute commands such as L s or ls-l. Most users use this option to find old files and delete them. It is recommended that you take a look at the LS command before you actually execute the RM command to delete files, confirming that they are the files you want to delete.

The EXEC option is followed by the command or script that you want to execute, followed by a pair of {}, a space and a \, and finally a semicolon. In order to use the EXEC option, you must use the Print option at the same time. If you verify the Find command, you will see that the command outputs only the relative path and file name from the current path.

For example, to list the matching files with the Ls-l command, you can place the Ls-l command in the-exec option of the Find command

# Find.     -type f-exec ls-l {} \;-rw-r--r--1 root root 34928 2003-02-25./conf/httpd.conf-rw-r--r--1 root Root 12959 2003-02-25/conf/magic-rw-r--r--1 root root 2003-02-25./conf.d/readme

In the example above, the Find command matches all the normal files in the current directory and lists them using the Ls-l command in the-exec option.
In the/logs directory, look for files that change time before 5th and delete them:

$ find Logs-type f-mtime +5-exec rm {} \;

Remember: before the shell can delete files in any way, you should look at the appropriate files before you must be careful! You can use the Safe mode of the-EXEC option when using a command such as MV or RM. It will prompt you before you work on each file that is matched to it.

In the following example, the Find command finds all filenames in the current directory. Log end, change files over the 5th, and delete them, but give a hint before deleting them.

$ find. -name "*.log"-mtime +5-ok rm {} \;< rm .... /conf/httpd.conf >? N

Press the Y key to delete the file and press N to not delete it.

Any form of command can be used in the-EXEC option.

In the following example we use the grep command. The find command first matches all files named "passwd*", such as passwd, Passwd.old, Passwd.bak, and then executes the grep command to see if there is a SAM user in these files.

# find/etc-name "passwd*"-exec grep "Sam" {} \;sam:x:501:501::/usr/sam:/bin/bash

Ii. examples of the Find command;

1. Find all files under the current user's home directory:

Here are two ways to use

$ find $HOME-print$ Find ~-print

2, let the current directory of the file owner has read, write permissions, and the file belongs to the group of users and other users have Read permission files;

$ find. -type f-perm 644-exec ls-l {} \;

3, in order to find all the files in the system file length of 0 ordinary files, and list their full path;

$ find/-type f-size 0-exec ls-l {} \;

4. Look for common files in the/var/logs directory that were changed before 7th, and ask them before deleting them;

$ find/var/logs-type f-mtime +7-ok rm {} \;

5, in order to find all the files belonging to the root group in the system;

$find. -group root-exec ls-l {} \;-rw-r--r--1 root root 595 October 01:09./fie1

6. The Find command will delete the Admin.log file that contains the digital suffix since the access time in the directory was 7th.

This command checks only three digits, so the suffix of the corresponding file should not exceed 999. Build several admin.log* files before using this command

$ find. -name "admin.log[0-9][0-9][0-9]"-atime-7-okrm {} \;< rm .... /admin.log001 >? n< rm .... /admin.log002 >? n< rm .... /admin.log042 >? n< rm .... /admin.log942 >? N

7, in order to find all the directories in the current file system and sorting;

$ find. -type D | Sort

8, in order to find all the RMT tape devices in the system;

$ find/dev/rmt-print

Third, Xargs

Xargs–build and execute command lines from standard input

When a matching file is processed using the-EXEC option of the Find command, the Find command passes all matching files to exec execution. However, some systems have a limit on the length of the command that can be passed to exec so that an overflow error occurs after the Find command runs for a few minutes. The error message is usually "parameter column too Long" or "parameter column overflow". This is where the Xargs command is used, especially with the Find command.

The find command passes the matched file to the Xargs command, and the Xargs command takes only a subset of the files at a time instead of all, unlike the-exec option. This allows it to first process a portion of the file that was first fetched, then the next batch, and so on.

In some systems, the use of the-EXEC option initiates a corresponding process for processing each matching file, not all of the matching files are executed once as parameters, so that in some cases there will be too many processes and degraded system performance, so the efficiency is not high;

With the Xargs command, there is only one process. In addition, when using the Xargs command, whether to get all the parameters at once or to get the parameters in batches, and the number of parameters to get each time will be determined according to the command's options and the corresponding tunable parameters in the system kernel.

Take a look at how the Xargs command is used with the Find command, and give some examples.

The following example finds every normal file in the system, and then uses the Xargs command to test what type of file they belong to

#find. -type F-print | Xargs file./.kde/autostart/autorun.desktop:utf-8 Unicode 中文版 text./.kde/autostart/.directory:iso-8859 text ..... .

Find the Memory information dump file (core dump) throughout the system and save the results to the/tmp/core.log file:

$ find/-name "core"-print | Xargs echo "" >/tmp/core.log

The above execution is too slow, I changed to find in the current directory

#find. -name "file*"-print | Xargs echo "" >/temp/core.log# cat/temp/core.log./file6

In the current directory, look for files with read, write, and execute permissions for all users, and reclaim the appropriate write permissions:

# ls-ldrwxrwxrwx    2 sam      adm           4096 October 20:14 file6-rwxrwxrwx    2 sam      adm & nbsp;           0 October 01:01 http3.conf-rwxrwxrwx     2 sam      adm              0 October 01:01 httpd.conf# find. -perm-7-print | Xargs chmod o-w# ls-ldrwxrwxr-x    2 sam      adm           4096 October 20:14 file6-rwxrwxr-x    2 sam       adm             0 October 31 01:01 http3.conf-rwxrwxr-x    2 sam      adm              0 October 31 01:01 httpd.conf 

Use the grep command to search for the word hostname in all common files:

# Find. -type F-print | Xargs grep "hostname"./httpd1.conf:# different IP addresses or hostnames and has them handled by the./httpd1.conf:# V Irtualhost:if want to maintain multiple Domains/hostnameson your

Use the grep command to search for the word hostnames in all normal files in the current directory:

# Find. -name \*-type F-print | Xargs grep "hostnames"./httpd1.conf:# different IP addresses or hostnames and has them handled by the./httpd1.conf:# Virtualhost:if want to maintain multiple Domains/hostnameson your

Note that in the example above, \ is used to cancel the special meaning of the * in the shell in the Find command.

The Find command, with exec and Xargs, allows the user to execute almost all commands against the matching file.

Iv. parameters for the Find command

Here are some examples of find some common parameters, useful to the time to check on the line, like the previous posts above, have used some of the parameters, you can also use man or view other posts in the Forum have find command manual

1. Use the name option

The file name option is the most common option for the Find command, either used alone or in conjunction with other options.

You can use a file name pattern to match files, remembering to enclose the filename pattern in quotation marks.

No matter what the current path is, if you want to find the file name in your root $home that matches *.txt, use ~ as the ' pathname ' parameter, and the tilde ~ represents your $home directory.

$ find ~-name "*.txt"-print

To find all the ' *.txt ' files in the current directory and subdirectories, you can use:

$ find. -name "*.txt"-print

You want the current directory and subdirectories to find file names that begin with an uppercase letter, which can be used:

$ find. -name "[a-z]*"-print

To find files with the file name beginning with host in the/etc directory, you can use:

$ find/etc-name "host*"-print

To find files in the $home directory, you can use:

$ find ~-name "*"-print or find. -print

To get the system running at a high load, start looking for all the files from the root directory.

$ find/-name "*"-print

If you want to find the file name in the current directory with two lowercase letters, followed by two digits, and finally the. txt file, the following command will be able to return a file named Ax37.txt:

$find. -name "[A-z][a-z][0--9][0--9].txt"-print

2. With PERM option

Follow the file permission mode with the-perm option to find files by file permission mode. It is best to use the octal permission notation.

For example, in the current directory to find file permission bit 755 file, that is, the file owner can read, write, execute, other users can read, execute files, can be used:

$ find. -perm 755-print

There is also a way of expression: in front of the octal number to add a bar-, the expression is matched, such as 007 is equivalent to 777,-006 equivalent to 666

# ls-l-rwxrwxr-x 2 Sam Adm 0 October 01:01 http3.conf-rw-rw-rw-1 Sam Adm 34890 October 31        00:57 httpd1.conf-rwxrwxr-x 2 Sam adm 0 October 01:01 httpd.confdrw-rw-rw-2 Gem Group 4096 October 19:48 sam-rw-rw-rw-1 root root 2792 October 20:19 temp# find. -perm 006# Find. -perm-006./sam./httpd1.conf./temp

-perm mode: File license exactly matches mode

-perm +mode: File License section complies with mode

-perm-mode: File license fully complies with mode

3. Ignore a directory

If you want to ignore a directory when you're looking for a file, because you know that directory doesn't have the file you're looking for, you can use the-prune option to indicate which directories you want to ignore. Be careful when using the-prune option, because if you use the-depth option at the same time, the-prune option is ignored by the Find command.

If you want to find the file under the/apps directory but do not want to find it in the/apps/bin directory, you can use:

$ find/apps-path "/apps/bin"-prune-o-print

4. How to avoid a file directory when finding files with find

For example, to find all files in the/usr/sam directory that are not within the DIR1 subdirectory

Find/usr/sam-path "/usr/sam/dir1"-prune-o-print

Find [-path ...] [Expression] In the path list is followed by expressions

-path "/usr/sam"-prune-o-print is-path "/usr/sam"-a-prune-o
-print shorthand expressions are evaluated sequentially,-A and-O are short-circuit evaluated, with Shell's && and | | Similarly, if-path "/usr/sam" is true, then the evaluation-prune,-prune returns True, and the logical expression is true; otherwise, the-prune is not evaluated, and the logical expression is false. If the-path "/usr/sam"-a-prune is false, the-print is evaluated, the-print returns True, or the logical expression is true, otherwise no value-print, or the logical expression is true.

This combination of expressions can be written in pseudo-code

If-path "/usr/sam" Then-pruneelse-print

Avoid multiple folders

Find/usr/sam \ (-path/usr/sam/dir1-o-path/usr/sam/file1 \)-prune-o-print

Parentheses represent the combination of expressions.

\ denotes a reference, which instructs the shell not to give a special explanation of the characters that follow, leaving the Find command to explain its meaning.

Find a certain file,-name and other options after-O

#find/usr/sam \ (-path/usr/sam/dir1-o-path/usr/sam/file1 \)-prune-o-name "Temp"-print

5. Use the user and Nouser options

Find files by file owner, such as files in the $home directory where the file belongs to Sam, you can use:

$ find ~-user Sam-print

Look for files in the/etc directory that belong to the main UUCP:

$ find/etc-user Uucp-print

In order to find files that are already deleted from the master account, you can use the-nouser option. This will enable you to find files that are not valid accounts in the/etc/passwd file. When using the-nouser option, you do not have to give the user name; the Find command can do the work for you.

For example, to find all such files in the/home directory, you can use:

$ find/home-nouser-print

6. Use Group and Nogroup options

Just like the user and Nouser options, the Find command has the same options for the group of users that the file belongs to, in order to find files belonging to the Gem User group in the/apps directory, you can use:

$ find/apps-group Gem-print

To find all files that do not have a valid group of users, you can use the Nogroup option. The following find command looks for such files from the root directory of the file system

$ find/-nogroup-print

7, according to change time or access time, etc. find files

You can use the Mtime,atime or CTime option if you want to find the file by changing the time. If the system suddenly does not have free space, it is possible that the length of a file grows rapidly during this period, you can use the Mtime option to find such a file.

Use a minus sign-to limit the time to change the file within the current n days, and use the Plus + to limit the change time before the current n days of the file.

To find files that change within 5th of the system root directory, you can use:

$ find/-mtime-5-print

In order to find files that change time before 3rd in the/var/adm directory, you can use:

$ find/var/adm-mtime +3-print

8. Find newer or older files than a file

You can use the-newer option if you want to find all files that have changed time than one file but older than the other. The general form of it is:

Newest_file_name! Oldest_file_name

Among them,! is a logical non-symbol.

Look for files that change time than file Sam new but older than file temp:

Example: There are two of files

-rw-r--r--    1 sam      adm              0 October 01:07 fiel-rw-rw-rw-    1 sam      ADM          34890 October 00:57 httpd1.conf-rwxrwxr-x    2 Sam       adm             0 October 01:01 httpd.confdrw-rw-rw-    2 gem      group         4096 October 19:48 sam-rw-rw-rw-    1 root     root  & nbsp;      2792 October 20:19 temp# find-newer httpd1.conf ! -newer temp-ls1077669    0-rwxrwxr-x   2 sam      adm              0 October 01:01 ./httpd.conf1077671    4-rw-rw-rw-   1 root     root         2792 October 20:19 ./temp1077673    0-rw-r--r--   1 sam      ADM              0 October 01:07/fiel

Look for a new file that changed in time than the temp file:

$ find. -newer Temp-print

9. Use the Type option

To find all the directories in/etc directory, you can use:

$ find/etc-type D-print

To find all types of files except directories in the current directory, you can use:

$ find. ! -type D-print

In the/etc directory to find all the symbolic link files, you can use

$ find/etc-type L-print

10. Use the SIZE option

files can be searched by file length, and the length of the file referred to here can be measured either in blocks or in bytes. The length of the measured file in bytes is expressed as n C, and the length of the block measurement file is only represented by a number.

When looking up files by file length, this is generally the size of the file in bytes, and it is easier to convert by using blocks to measure the file system.
In the current directory, look for files with a file length greater than 1 m bytes:

$ find. -size +1000000c-print

To find files larger than 10M in the current directory:

Find. -size +10000k-exec ls-ld {};

Copy the find out file to another location:

Find *.c-exec cp ' {} '/tmp '; '

Look for files with a file length of exactly 100 bytes in the/home/apache directory:

$ find/home/apache-size 100c-print

Look for files that are longer than 10 blocks in the current directory (a block equals 512 bytes):

$ find. -size +10-print

11. Using the Depth option

When you use the Find command, you may want to match all the files and find them in the subdirectory. Use the depth option to enable the Find command to do so. One reason for this is that when you use the Find command to back up the file system to tape, you want to back up all the files first, and then back up the files in the subdirectories.

In the following example, the Find command starts at the root of the file system and looks for a file named Con.file.

It will first match all the files and then go to the subdirectory to find them.

$ find/-name "CON. FILE "-depth-print

12. Using the Mount option

You can use the Mount option of the Find command to find a file in the current file system (without entering another file system).

From the current directory, look for files in the file system with the file name ending in XC:

$ find. -name "*. XC "-mount-print

Linux file Lookup command find and Xargs detailed