Linux find command

Find an introduction to the find command in Heiji, which is detailed!

Link: http://www.hackbase.com/tech/2008-04-29/40594_1.html

 

Because find has powerful functions, there are many options, and most of them are worth the time to understand. Even if the system contains a Network File System (NFS), the find command is equally valid in the file system, and you only have the corresponding permissions. When running a find command that consumes a lot of resources, many people tend to put it in the background for execution, because it may take a long time to traverse a large file system (this is a file system with more than 30 GB bytes ). 1. Find Command Format 1. The common form of find command is; find pathname-options [-print-Exec-OK...] 2. Parameters of the find command; pathname: directory path searched by the find command. For example, use "." To represent the current directory, and use "/" to represent the root directory of the system. -Print: The find command outputs matching files to the standard output. -Exec: The find command executes the shell command given by this parameter on the matching file. The corresponding command is in the form of 'command' {}\;. Note the space between {} And. -OK: The Role of-exec is the same, but the shell command given by this parameter is executed in a safer mode. A prompt is displayed before each command is executed, let the user determine whether to execute. 3. Find Command Option-name searches for files by file name. -Perm searches for files based on the file permissions. -Prune uses this option to make the find command not to be searched in the specified directory. If the-depth option is used at the same time,-prune will be ignored by the find command. -The user searches for files based on the file owner. -The group searches for files based on the group to which the files belong. -Mtime-N + N: Find the file based on the file change time.-N indicates that the file change time is earlier than N days, and + N indicates that the file change time is earlier than N days. The find command also has the-atime and-ctime options, but they both have the-M time options. -Nogroup: Find the file with no valid group, that is, the group to which the file belongs does not exist in/etc/groups. -Nouser: Find the file without a valid owner, that is, the owner of the file does not exist in/etc/passwd. -Newer file1! File2 searches for files whose change time is newer than file1 but older than file2. -Type: search for a certain type of files, such as B-block device files. D-directory. C-character device file. P-MPs queue file. L-Symbolic Link file. F-common file. -Size N: [c] searches for files with a length of N blocks. If a file contains C, the file length is measured in bytes. -Depth: when searching for a file, first find the file in the current directory and then find it in its subdirectory. -Fstype: searches for files in a certain type of file system. These file system types can usually be found in the configuration file/etc/fstab, this configuration file contains information about the file system in the system. -Mount: the mount point of the file system is not crossed during file search. -Follow: If the find command encounters a symbolic link file, it will trace the file to which the link points. -Cpio: Use the cpio command to back up the files to the tape device. In addition, the following three differences: -Amin N: Find the files accessed in the last n minutes in the system.-atime N: Find the files accessed in the last n * 24 hours in the system.-Cmin N: Find the files whose status is changed in the last n minutes in the system. file-ctime n find the file whose status has changed in the last n * 24 hours in the system-mmin n find the file whose data has been changed in the last n minutes in the system-mtime n find the last file in the system files whose file data is changed in N * 24 hours 4. When using exec or OK to execute shell commands to use find, as long as you write the desired operation in a file, you can use exec to search with find, in some operating systems, it is convenient to only allow the-exec option to execute commands such as l s or LS-L. Most users use this option to find and delete old files. Before executing the RM command to delete files, we recommend that you use the LS command to check whether they are the files to be deleted. The exec option is followed by the command or script to be executed, followed by a pair of {}, a space, a \, and a semicolon. To use the exec option, you must use the print option at the same time. If you verify the find command, you will find that this command only outputs the relative path and file name from the current path. For example, to use the LS-l command to list the matched files, you can place the LS-l command in the-exec option of the find command # Find. -Type F-exec LS-l {}\;-RW-r -- 1 Root 34928. /CONF/httpd. conf-RW-r -- 1 Root 12959. /CONF/magic-RW-r -- 1 Root 180 2003-02-25. /CONF. in the above example of D/readme, the find command matches all common files in the current directory and uses the LS-l command in the-exec option to list them. Find the files whose modification time is earlier than 5 days in the/logs directory and delete them: $ find logs-type F-mtime + 5-exec RM {}\; remember: before deleting a file in shell, check the corresponding file. Be careful! When using commands such as MV or RM, you can use the-exec option safe mode. It will prompt you before performing operations on each matching file. In the following example, the find command searches for all file names in the current directory. files whose names end with logs and whose change time is more than five days ago are deleted, but a prompt is provided before the deletion. $ Find.-Name "*. conf"-mtime + 5-OK RM {}\;? N: Press Y to delete the file, and press n to not delete the file. Any form of command can be used in the-exec option. In the following example, we use the grep command. The find command First matches all files named "passwd *", such as passwd, passwd. Old, passwd. Bak, and then runs the grep command to check whether a SAM user exists in these files. # Find/etc-name "passwd *"-exec grep "Sam" {}\; Sam: X: 501: 501:/usr/SAM: /bin/bash 2. Example of the find command; 1. Find all files in the current user's home directory: You can use $ find $ home-Print $ find ~ in either of the following methods ~ -Print2: allows the file owner in the current directory to have read and write permissions, and users in the file group and other users to have read permissions; $ find. -Type F-Perm 644-exec LS-l {}\; 3. To find all common files with a length of 0 in the system, and list their full paths; $ find/-type F-size 0-exec LS-l {}\; 4. Find common files whose time is earlier than 7 days in the/var/logs directory, ask them before they are deleted; $ find/var/logs-type F-mtime + 7-OK RM {}\; 5. Find all the files in the root group in the system; $ find. -Group root-exec LS-l {}\;-RW-r -- 1 Root 595 October 31 01:09. /fie16, find command will delete when the directory has been accessed for seven days, with a numeric suffix Admin. log file. This command only checks three digits, so the suffix of the corresponding file should not exceed 999. Create several admin accounts first. the following command $ find. -Name "Admin. log [0-9] [0-9] [0-9] "-atime-7-okrm {}\;? N? N? N? N7. To find and sort all directories in the current file system; $ find. -type D | sort8, in order to find all the RMT tape devices in the system; $ find/dev/RMT-print 3. xargsxargs-build and execute command lines from standard input when you use the-exec option of the find command to process matched files, the find command passes all matching files to Exec for execution. However, some systems have limits on the length of commands that can be passed to exec, so that an overflow error will occur after the find command runs for several minutes. The error message is usually "the parameter column is too long" or "parameter column overflow ". This is the use of the xargs command, especially used with the find command. The find command passes the matching file to the xargs command, while the xargs command only obtains part of the file, not all, at a time, unlike the-exec option. In this way, it can first process the first part of the obtained files, then the next batch, and continue like this. In some systems, the-exec option is used to initiate a corresponding process for processing each matching file, rather than executing all the matching files as parameters once; in some cases, there may be too many processes and the system performance may degrade, so the efficiency is not high. The xargs command has only one process. In addition, when using the xargs command, whether to obtain all parameters at a time or obtain parameters in batches, and the number of parameters obtained each time is determined based on the options of the command and the corresponding adjustable parameters in the system kernel. Let's take a look at how the xargs command is used with the find command and give some examples. The following example finds every common file in the system, and then uses the xargs command to test which files they belong to # Find. -Type F-print | xargs file. /. KDE/autostart/Autorun. desktop: UTF-8 Unicode English text. /. KDE/autostart /. directory: ISO-8859 text \...... search for the memory dump file (core dump) in the system and save the result to/tmp/core. in the log file: $ find/-name "core"-print | xargs echo "">/tmp/core. the execution on the log is too slow. I changed it to search in the current directory # Find. -Name "file *"-print | xargs echo "">/temp/core. log # Cat/temp/core. lo G. /file6 searches for all files with read, write, and execution permissions under the current directory, and revokes the corresponding write permissions: # ls-ldrwxrwxrwx 2 Sam ADM 4096 October 30 20:14 file6-rwxrwxrwx 2 Sam ADM 0 October 31 01:01 http3.conf-rwxrwxrwx 2 Sam ADM 0 October 31 01:01 httpd. conf # Find. -Perm-7-print | xargs chmod o-w # ls-ldrwxrwxr-x 2 Sam ADM 4096 October 30 20:14 file6-rwxrwxr-x 2 Sam ADM 0 October 31 01:01 http3.conf-rwxrwxr-x 2 Sam ADM 0 october 31 01:01 httpd. use the grep command in conf to search for the hostname in all common files. Word: # Find. -Type F-print | xargs grep "hostname ". /httpd1.conf: # different IP addresses or hostnames and have them handled by. /httpd1.conf: # virtualhost: if you want to maintain multiple domains/hostnameson your use the grep command to search for the hostnames word in all common files in the current directory: # Find. -Name \ *-type F-print | xargs grep "hostnames ". /httpd1.conf: # different IP addresses or hostnames and have them handled by. /httpd1.con F: # virtualhost: if you want to maintain multiple domains/hostnameson your note: In the above example, \ is used to cancel the special meaning of * in shell in the find command. The find command works with exec and xargs to allow users to execute almost all the commands on the matched files. 4. The parameters of the find command below are examples of some common parameters of find. When it is useful, you can check the parameters. For example, some parameters are used in the previous posts, you can also use man or view the find command manual in other posts in the forum. 1. Use the name option file name option as the most common option for the find command, or use this option separately, or use it with other options. You can use a certain file name pattern to match the file. Remember to use quotation marks to cause the file name pattern. No matter what the current path is, if you want to find a file with a file name *. txt in your root directory $ home, use ~ As the 'pathname' parameter, the Tilde ~ Represents your $ home directory. $ Find ~ -Name "*. TXT "-print: search for all '* in the current directory and subdirectory '*. TXT file, which can be used: $ find. -Name "*. TXT "-print: Find the file name starting with an uppercase letter in the current directory and subdirectory. You can use: $ find. -Name "[A-Z] *"-print: $ find/etc-name "Host *"-print to search for files in the $ home directory, use: $ find ~ -Name "*"-print or find.-Print: to enable the system to run at high load, search for all files from the root directory. $ Find/-name "*" locate file: $ find. -Name "[a-z1_1_a-z1_1_0--91_0--91_.txt"-print2. Use the perm option to use the-Perm option in File Permission mode and find files in File Permission mode. It is best to use the octal permission notation. For example, in the current directory, find the file with a permission of 755, that is, the file owner can read, write, and execute, and other users can read and execute the file. You can use: $ find. -Perm 755-print: Add a horizontal bar before the octal digit to indicate that all matches. For example,-007 is equivalent to 777, -006 is equivalent to 666 # ls-L-rwxrwxr-x 2 Sam ADM 0 October 31 01:01 http3.conf-RW-1 Sam ADM 34890 October 31 00:57 httpd1.conf-rwxrwxr-x 2 Sam Adm 0 August 15, October 31 01:01 httpd. confdrw-RW-2 gem group 4096 October 26 19:48 Sam-RW-1 Root 2792 October 31 20:19 temp # Find. -Perm 006 # Find. -P Erm-006. /SAM. /httpd1.conf. /temp-Perm mode: The file license conforms to Mode-Perm + mode: The file license partially complies with mode-Perm-mode: the file license fully complies with mode3 and ignores a directory. If you want to ignore a directory when searching for a file, because you know that the directory does not contain the file you want to search, you can use the-prune option to specify the directory to be ignored. Be careful when using the-prune option, because if you use the-depth option at the same time, the-prune option will be ignored by the find command. If you want to search for files in the/apps directory, but do not want to search for files in the/apps/bin directory, you can use: $ find/apps-path "/apps/bin"-prune-o-print4. How can I avoid a file directory when using find to find a file, for example, searching in the/usr/SAM directory? find/usr/SAM-path "/usr/SAM/dir1"-prune-o-printfind [-path ..] [expression] Behind the path list is the expression-path "/usr/SAM"-prune-o-print is-path "/usr/SAM"-a-prune-o -The short expression of print is evaluated in order, -both A and-O are short-circuit values. They are similar to shell's & | if-path "/usr/SAM" is true, the values are-prune and-Pru. Ne returns true, true to the logical expression; otherwise, the value-Prune is not required, and the logical expression is false. If-path "/usr/SAM"-a-Prune is false, evaluate-print,-print to return true, or the logical expression is true; otherwise, do not request a value-print, or the logical expression is true. The special expression combination can be written as if-path "/usr/SAM" then-pruneelse-print to Avoid Multiple folders find/usr/SAM \ (-path/usr/SAM /dir1-o-path/usr/SAM/file1 \) -prune-o-print parentheses indicate the combination of expressions. \ Indicates a reference, that is, it indicates that shell does not give a special explanation for the subsequent characters, but leaves it to the find command to explain its meaning. Find a specific file, -Name and other options after-o # Find/usr/SAM \ (-path/usr/SAM/dir1-o-path/usr/SAM/file1 \) -prune-o-name "Temp"-print5: Use the user and nouser options to search for files by file owner. For example, in the $ home directory, find files whose file owner is Sam, available: $ find ~ -User Sam-print: $ find/etc-user uucp-print: in order to find the files that have been deleted by the owner account, you can use the-nouser option. In this way, you can find the files whose owner does not have a valid account in the/etc/passwd file. When you use the-nouser option, you do not need to give a user name. The find command can complete the corresponding work for you. For example, if you want to search for all such files in the/home directory, you can use: $ find/home-nouser-print6 and use the group and nogroup options, just like the user and nouser options, the find command also has the same options for the user group to which files belong. To find files belonging to the Gem user group in the/apps directory, you can use: $ find/apps-group GEM-print you can use the nogroup option to find all files in the user group that do not have a valid value. The following find command looks for such files from the root directory of the file system $ find/-nogroup-print7, by change time or access time, if you want to look for files by change time, you can use the mtime, atime, or ctime options. If the system suddenly has no available space, it is very likely that the length of a file will increase rapidly during this period, then you can use the mtime option to find such a file. Use minus signs-to limit the files whose change time is earlier than N days ago, and use the plus sign + to limit the files whose change time is earlier than N days ago. To search for files whose modification time is less than 5 days in the root directory of the system, you can use: $ find/-mtime-5-print: $ find/var/adm-mtime + 3-print8. Search for new or old files than a file. If you want to find all files whose change time is newer than a file but older than another file, you can use the-newer option. The general format is: newest_file_name! Oldest_file_name where ,! Is a logical non-sign. Find the files whose modification time is newer than the file Sam but older than the file temp: Example: there are two files-RW-r -- 1 Sam ADM 0 October 31 01:07 fiel-RW-1 Sam ADM 34890 October 31 00:57 httpd1.conf-rwxrwxr-x 2 Sam ADM 0 October 31 01:01 httpd. confdrw-RW-2 gem group 4096 October 26 19:48 Sam-RW-1 Root 2792 October 31 20:19 temp # Find-newer httpd1.conf! -Newer temp-ls1077669 0-rwxrwxr-x 2 Sam ADM 0 October 31 01:01. /httpd. conf1077671 4-RW-1 Root 2792 October 31 20:19. /temp1077673 0-RW-r -- 1 Sam ADM 0 October 31 01:07. /Fiel: Find the file whose change time is newer than the temp file: $ find. -newer temp-print9: Use the type option to find all directories in the/etc directory. You can use: $ find/etc-type D-print searches all types of files except directories in the current directory. You can use: $ find .! -Type D-print: searches for all symbolic link files in the/etc directory. You can use $ find/etc-type L-print10 and the Size Option to find files by file length, the file length referred to here can be measured by block or byte. The length of a byte metering file is n C. The length of a block metering file is represented by only numbers. When searching for a file based on the file length, this file length in bytes is generally used. You can view the file system size because block metering is easier to convert. Find a file with a length greater than 1 MB in the current directory: $ find. -Size + 000000c-print: In the/home/Apache directory, find a file with a length of exactly 100 bytes: $ find/home/Apache-size 100c-print search for files with more than 10 blocks in the current directory (one equals 512 bytes): $ find. -Size + 10-print11: when using the find command using the depth option, you may want to match all the files first and then search for them in the subdirectory. Use the depth option to run the find command. One reason for this is that when you use the find command to back up the file system on the tape, you want to back up all the files first, and then back up the files in the subdirectories. In the following example, the find command starts from the root directory of the file system and looks for a file named con. File. It will first match all the files and then go to the subdirectory to find them. $ Find/-name "con. file "-depth-print12. Use the mount option to search for files in the current File System (do not enter other file systems). You can use the mount option of the find command. Find the file whose name ends with XC in the current directory: $ find.-Name "*. XC"-mount-print