Linux find command details

Reprinted from http://blog.chinaunix.net/u1/53398/showart_478990.html

 

Because find has powerful functions, there are many options, and most of them are worth the time to understand. Even if the system contains a Network File System (NFS), the find command is equally valid in the file system, and you only have the corresponding permissions.

When running a find command that consumes a lot of resources, many people tend to put it in the background for execution, because it may take a long time to traverse a large file system (this is a file system with more than 30 GB bytes ).

I. Find Command Format

1. The common form of the find command is;

find pathname -options [-print -exec -ok ...]

 

2. Parameters of the find command;

Pathname: directory path searched by the find command. For example, use "." To represent the current directory, and use "/" to represent the root directory of the system.
-Print: The find command outputs matching files to the standard output.
-Exec: The find command executes the shell command given by this parameter on the matching file. The corresponding command is in the form of 'command' {}/;. Note the space between {} And.
-OK: The Role of-exec is the same, but the shell command given by this parameter is executed in a safer mode. A prompt is displayed before each command is executed, let the user determine whether to execute.

 

3. Find Command Options

-Name
Search for files by file name.
-Perm
Find the file according to the file permission.
-Prune
This option can make the find command not to be searched in the specified directory. If the-depth option is used at the same time,-prune will be ignored by the find command.
-User
Search for files by file owner.
-Group
Find the file according to the file group.
-Mtime-N + n
Find the file according to the file change time.-N indicates that the file change time is less than N days from now, and + N indicates that the file change time is earlier than N days from now. The find command also has the-atime and-ctime options, but they both have the-M time options.
-Nogroup
Find the file with no valid group, that is, the group to which the file belongs does not exist in/etc/groups.
-Nouser
Find a file without a valid owner, that is, the owner of the file does not exist in/etc/passwd.
-Newer file1! File2
Find the file whose modification time is newer than file1 but earlier than file2.
-Type
Find a type of file, such:
B-block device files.
D-directory.
C-character device file.
P-MPs queue file.
L-Symbolic Link file.
F-common file.
-Size N: [c] searches for files with a length of N blocks. If a file contains C, the file length is measured in bytes.
-Depth: when searching for a file, first find the file in the current directory and then find it in its subdirectory.
-Fstype: searches for files in a certain type of file system. These file system types can usually be found in the configuration file/etc/fstab, this configuration file contains information about the file system in the system.
-Mount: the mount point of the file system is not crossed during file search.
-Follow: If the find command encounters a symbolic link file, it will trace the file to which the link points.
-Cpio: Use the cpio command to back up the files to the tape device.

 

In addition, the following three differences:

-Amin n
Find the files accessed in the last n minutes of the system
-Atime n
Find the last n * 24 hours of files in the system
-Cmin n
Find the file whose status is changed in the last n minutes in the system
-Ctime n
Find the file whose status is changed in the last n * 24 hours in the system.
-Mmin n
Find the file whose data is changed in the last n minutes in the system
-Mtime n
Find the file whose data has been changed for the last n * 24 hours in the system.

 

4. execute shell commands using exec or OK.

When using find, you only need to write the desired operation in a file, you can use exec to search with find, which is very convenient.

In some operating systems, only the-exec option is allowed to execute commands such as l s or LS-L. Most users use this option to find and delete old files. Before executing the RM command to delete files, we recommend that you use the LS command to check whether they are the files to be deleted.

The exec option is followed by the command or script to be executed, followed by a pair of {}, a space, a/, and a semicolon. To use the exec option, you must use the print option at the same time. If you verify the find command, you will find that this command only outputs the relative path and file name from the current path.

For example, to use the LS-l command to list the matched files, you can place the LS-l command in the-exec option of the find command.

 

# find . -type f -exec ls -l { } /;
-rw-r--r-- 1 root root 34928 2003-02-25 ./conf/httpd.conf
-rw-r--r-- 1 root root 12959 2003-02-25 ./conf/magic
-rw-r--r-- 1 root root 180 2003-02-25 ./conf.d/README

 

In the preceding example, the find command matches all common files in the current directory and lists them using the LS-l command in the-exec option.
In the/logs directory, find the files whose changes were earlier than 5 days and delete them:

 

$ find logs -type f -mtime +5 -exec rm { } /;

 

Remember:Before deleting a file in shell, check the corresponding file. Be careful! When using commands such as MV or RM, you can use the-exec option safe mode. It will prompt you before performing operations on each matching file.

In the following example, the find command searches for all file names in the current directory. files whose names end with logs and whose change time is more than five days ago are deleted, but a prompt is provided before the deletion.

 

$ find . -name "*.conf" -mtime +5 -ok rm { } /;
< rm ... ./conf/httpd.conf > ? n

 

Press Y to delete the file, and press n to not delete the file.

Any form of command can be used in the-exec option.

In the following example, we use the grep command. The find command First matches all files named "passwd *", such as passwd, passwd. Old, passwd. Bak, and then runs the grep command to check whether a SAM user exists in these files.

 

# find /etc -name "passwd*" -exec grep "sam" { } /;
sam:x:501:501::/usr/sam:/bin/bash

 

2. Example of the find command;

1. Search for all files in the current user's home directory:

The following two methods can be used:

 

$ find $HOME -print
$ find ~ -print

2. Grant the file owner in the current directory the read and write permissions, and the users in the file group and other users have the read permissions;

 

 

$ find . -type f -perm 644 -exec ls -l { } /;

 

3. In order to find all common files with a length of 0 in the system and list their full paths;

$ find / -type f -size 0 -exec ls -l { } /;

 

4. Search for Common files that were modified seven days ago in the/var/logs directory and ask them before deletion;

$ find /var/logs -type f -mtime +7 -ok rm { } /;

 

5. To find all the files in the root group in the system;

$ Find.-Group root-exec LS-l {}/;
-RW-r -- 1 Root 595 October 31 01:09./fie1

 

6. The find command will delete the admin. log file that contains the numeric suffix since the access time in the directory was 7 days.

This command only checks three digits, so the suffix of the corresponding file should not exceed 999. Create several Admin. log * files before you can use the following command:

 

$ find . -name "admin.log[0-9][0-9][0-9]" -atime -7 -ok
rm { } /;
< rm ... ./admin.log001 > ? n
< rm ... ./admin.log002 > ? n
< rm ... ./admin.log042 > ? n
< rm ... ./admin.log942 > ? n

 

7. To find and sort all directories in the current file system;

$ find . -type d | sort

 

8. To find all the RMT tape devices in the system;

$ find /dev/rmt -print

 

Iii. xargs

Xargs-build and execute command lines from standard input

When you use the-exec option of the find command to process matched files, the find command passes all matching files to Exec for execution. However, some systems have limits on the length of commands that can be passed to exec, so that an overflow error will occur after the find command runs for several minutes. The error message is usually "the parameter column is too long" or "parameter column overflow ". This is the use of the xargs command, especially used with the find command.

The find command passes the matching file to the xargs command, while the xargs command only obtains part of the file, not all, at a time, unlike the-exec option. In this way, it can first process the first part of the obtained files, then the next batch, and continue like this.

In some systems, the-exec option is used to initiate a corresponding process for processing each matching file, rather than executing all the matching files as parameters once; in this way, in some cases, there may be too many processes and the system performance may decline, resulting in low efficiency;

The xargs command has only one process. In addition, when using the xargs command, whether to obtain all parameters at a time or obtain parameters in batches, and the number of parameters obtained each time is determined based on the options of the command and the corresponding adjustable parameters in the system kernel.

Let's take a look at how the xargs command is used with the find command and give some examples.

The following example finds every common file in the system, and then uses the xargs command to test which files they belong.

 

#find . -type f -print | xargs file
./.kde/Autostart/Autorun.desktop: UTF-8 Unicode English text
./.kde/Autostart/.directory: ISO-8859 text/
......

 

Search for the memory dump file (core dump) in the system and save the result to the/tmp/CORE. log file:

 

$ find / -name "core" -print | xargs echo "" >/tmp/core.log

 

The above execution is too slow. I changed it to search in the current directory.

 

#find . -name "file*" -print | xargs echo "" > /temp/core.log
# cat /temp/core.log
./file6

 

Search for all files in the current directory with read, write, and execution permissions, and revoke the corresponding write permissions:

 

# Ls-l
Drwxrwxrwx 2 Sam ADM 4096 October 30 20:14 file6
-Rwxrwxrwx 2 Sam ADM 0 October 31 01:01 http3.conf
-Rwxrwxrwx 2 Sam ADM 0 01:01 httpd. conf
# Find.-Perm-7-print | xargs chmod o-w
# Ls-l
Drwxrwxr-x 2 Sam ADM 4096 October 30 20:14 file6
-Rwxrwxr-x 2 Sam ADM 0 October 31 01:01 http3.conf
-Rwxrwxr-x 2 Sam ADM 0 October 31 01:01 httpd. conf

 

Use the grep command to search for the hostname word in all common files:

 

# find . -type f -print | xargs grep "hostname"
./httpd1.conf:# different IP addresses or hostnames and have them handled by the
./httpd1.conf:# VirtualHost: If you want to maintain multiple domains/hostnames
on your

 

Use the grep command to search for the hostnames word in all common files in the current directory:

 

# find . -name /* -type f -print | xargs grep "hostnames"
./httpd1.conf:# different IP addresses or hostnames and have them handled by the
./httpd1.conf:# VirtualHost: If you want to maintain multiple domains/hostnames
on your

 

Note: In the above example,/is used to cancel the special meaning of * in shell in the find command.

The find command works with exec and xargs to allow users to execute almost all the commands on the matched files.

Iv. Parameters of the find command

The following is an example of some common parameters to find. You can check the useful parameters. For example, some parameters are used in the previous posts, you can also use man or view the find command manual on other posts in the Forum.

1. Use the name Option

The file name option is the most common option for the find command. You can either use this option independently or use it with other options.

You can use a certain file name pattern to match the file. Remember to use quotation marks to cause the file name pattern.

No matter what the current path is, if you want to find a file with a file name *. txt in your root directory $ home, use ~ As the 'pathname' parameter, the Tilde ~ Represents your $ home directory.

 

$ find ~ -name "*.txt" -print

 

To find all '*. txt' files in the current directory and subdirectory, you can use:

 

$ find . -name "*.txt" -print

 

To search for a file whose name starts with an uppercase letter in the current directory and subdirectory, you can use:

 

$ find . -name "[A-Z]*" -print

 

To search for a file whose file name starts with host in the/etc directory, use:

 

$ find /etc -name "host*" -print

 

To search for files in the $ home directory, you can use:

 

$ Find ~ -Name "*"-print or find.-Print

 

To make the system run at a high load, search for all the files from the root directory.

 

$ find / -name "*" -print

 

Secret file:

 

$find . -name "[a-z][a-z][0--9][0--9].txt" -print

 

2. Use the perm Option

Use the-Perm option according to the File Permission mode and find the file in the File Permission mode. It is best to use the octal permission notation.

For example, in the current directory, find a file with a permission of 755, that is, the file owner can read, write, and execute the file. Other users can read and execute the file. You can use:

 

$ find . -perm 755 -print

 

There is also a way to express: Add a horizontal bar before the octal number to indicate that all matches. For example,-007 is equivalent to 777, and-006 is equivalent to 666.

 

# Ls-l
-Rwxrwxr-x 2 Sam ADM 0 October 31 01:01 http3.conf
-RW-1 Sam ADM 34890 00:57 httpd1.conf
-Rwxrwxr-x 2 Sam ADM 0 October 31 01:01 httpd. conf
Drw-RW-2 gem group 4096 October 26 19:48 Sam
-RW-1 Root 2792 October 31 20:19 temp
# Find.-Perm 006
# Find.-Perm-006
./SAM
./Httpd1.conf
./Temp

 

-Perm mode: The file license exactly matches the mode.

-Perm + mode: The file license part complies with the Mode

-Perm-mode: The file license fully complies with the mode.

3. Ignore a directory

If you want to ignore a directory when searching for a file because you know that there is no file in the directory, you can use the-prune option to specify the directory to be ignored. Be careful when using the-prune option, because if you use the-depth option at the same time, the-prune option will be ignored by the find command.

If you want to search for files in the/apps directory, but do not want to search for files in the/apps/bin directory, you can use:

 

$ find /apps -path "/apps/bin" -prune -o -print

 

4. How to avoid a file directory when searching for files using find

For example, you need to find all files not in the dir1 subdirectory under the/usr/SAM directory.

 

find /usr/sam -path "/usr/sam/dir1" -prune -o -print

 

 

Find [-path...] [expression] After the path list is an expression

 

-Path "/usr/SAM"-prune-o-print is-path "/usr/SAM"-a-prune-o
-The short expression of print is evaluated in order.-A and-O are short-circuit values. It is similar to shell & | if-path "/usr/SAM" is true, evaluate-Prune,-prune returns true, and is true with the logical expression; otherwise, do not seek a value-Prune, and the logical expression is false. If-path "/usr/SAM"-a-Prune is false, evaluate-print,-print to return true, or the logical expression is true; otherwise, do not request a value-print, or the logical expression is true.

The special expression combination can be written

 

if -path "/usr/sam" then
           -prune
else
           -print

 

Avoid Multiple folders

 

find /usr/sam /( -path /usr/sam/dir1 -o -path /usr/sam/file1 /) -prune -o -print

 

Parentheses indicate the combination of expressions.

/Indicates the reference, that is, it indicates that shell does not give a special explanation for the subsequent characters, but leaves it to the find command to explain its meaning.

 

Search for a specific file, and add-name and other options after-o

 

#find /usr/sam /(-path /usr/sam/dir1 -o -path /usr/sam/file1 /) -prune -o -name "temp" -print

 

5. Use the user and nouser options

Search for files by file owner. For example, to find files whose file owner is Sam in the $ home directory, you can use:

 

$ find ~ -user sam -print

 

Find the uucp file under the/etc directory:

 

$ find /etc -user uucp -print

 

You can use the-nouser option to find files that have been deleted by the owner account. In this way, you can find the files whose owner does not have a valid account in the/etc/passwd file. When you use the-nouser option, you do not need to give a user name. The find command can complete the corresponding work for you.

For example, to search for all such files in the/home directory, you can use:

$ find /home -nouser -print

 

6. Use the group and nogroup options

Like the user and nouser options, the find command also has the same options for the user group to which the file belongs. To find files belonging to the Gem user group in the/apps directory, you can use:

 

$ find /apps -group gem -print

 

You can use the nogroup option to find all files that do not have a valid user group. The following find command looks for such a file from the root directory of the file system

 

$ find / -nogroup-print

 

7. Search for files based on the change time or access time

You can use the mtime, atime, or ctime option to find files based on the change time. If the system suddenly has no available space, it is very likely that the length of a file will increase rapidly during this period, then you can use the mtime option to find such a file.

Use minus signs-to limit the files whose change time is earlier than N days ago, and use the plus sign + to limit the files whose change time is earlier than N days ago.

To search for files whose modification time is less than 5 days in the root directory of the system, you can use:

 

$ find / -mtime -5 -print

 

To search for files whose modification time is earlier than 3 days in the/var/adm directory, you can use:

 

$ find /var/adm -mtime +3 -print

 

8. Search for new or old files than a file

You can use the-newer option to find all files whose modification time is newer than a file but older than the other file. It generally takes the following form:

 

newest_file_name ! oldest_file_name

 

Here ,! Is a logical non-sign.

Find the files whose modification time is newer than the file Sam but older than the file temp:

For example, there are two files.

 

-RW-r -- 1 Sam ADM 0 October 31 01:07 fiel
-RW-1 Sam ADM 34890 00:57 httpd1.conf
-Rwxrwxr-x 2 Sam ADM 0 October 31 01:01 httpd. conf
Drw-RW-2 gem group 4096 October 26 19:48 Sam
-RW-1 Root 2792 October 31 20:19 temp
# Find-newer httpd1.conf! -Newer temp-ls
1077669 0-rwxrwxr-x 2 Sam ADM 0 October 31 01:01./httpd. conf
1077671 4-RW-1 Root 2792 October 31 20:19./temp
1077673 0-RW-r -- 1 Sam ADM 0 October 31 01:07./fiel

 

Find the file whose change time is newer than the temp file:

 

$ find . -newer temp -print

9. Use the type option

 

Find all directories under the/etc directory. You can use:

 

$ find /etc -type d -print

 

Find all types of files except directories in the current directory. You can use:

$ find . ! -type d -print

 

Find all symbolic link files in the/etc directory. You can use

$ find /etc -type l -print

 

10. Use the Size Option

You can search for a file based on the file length. The file length referred to here can be measured by block or byte. The length of a byte metering file is n C. The length of a block metering file is represented by only numbers.

When searching for a file based on the file length, this file length in bytes is generally used. You can view the file system size because block metering is easier to convert.
Find a file with a length greater than 1 MB in the current directory:

$ find . -size +1000000c -print

 

In the/home/Apache directory, find the file with a length of exactly 100 bytes:

 

$ find /home/apache -size 100c -print

 

Search for files with more than 10 blocks in the current directory (one block equals 512 bytes ):

 

$ find . -size +10 -print

 

11. Use the depth Option

When using the find command, you may want to match all the files first and then search for them in the subdirectory. Use the depth option to run the find command. One reason for this is that when you use the find command to back up the file system on the tape, you want to back up all the files first, and then back up the files in the subdirectories.

In the following example, the find command starts from the root directory of the file system and looks for a file named con. File.

It will first match all the files and then go to the subdirectory to find them.

 

$ find / -name "CON.FILE" -depth -print

 

12. Use the Mount Option

You can use the mount option of the find command to find files in the current file system (not to access other file systems.

Start from the current directory to find the files whose names end with XC in the current file system:

 

$ find . -name "*.XC" -mount -print