The Find command in Linux

Find

Because find has powerful features, it has a lot of options, most of which are worth taking the time to look at. Even if the system contains a network file system (NFS), the Find command works equally well in the file system as long as you have the appropriate permissions.

When running a very resource-intensive find command, many people tend to put it in the background because it can take a long time to traverse a large file system (this refers to a file system with more than 30G bytes).

One, find command format

1. The general form of the Find command is;

Find Pathname-options [-print-exec-ok ...]

2, the parameters of the Find command;

The directory path that the Pathname:find command looks for. For example, use. To represent the current directory, and/to represent the system root, recursively lookup. The-print:find command outputs the matched file to standard output. The-exec:find command executes the shell command given by the parameter to the matching file. The corresponding command is in the form of ' command ' {  } \;, note   the space between {} and \; -ok: The same as-exec, except that the shell command given by the parameter is executed in a more secure mode, prompting the user to determine whether to execute before executing each command.

3. Find command Options

-name   finds files by file name. -perm   to find files according to file permissions. -prune  Use this option to have the Find command not be found in the currently specified directory, and if you use the-depth option at the same time,-prune will be ignored by the Find command. -user   Search for files according to the owner of the file. -group  finds files according to the group to which the files belong. -mtime-n +n The file changes time to find the file,-n means that the file change time is now less than n days, +n indicates that the file change time is now N days ago. The Find command also has the-atime and-ctime options, but they both and the-m time option. -nogroup finds a file that does not have a valid owning group, that is, the group to which the file belongs does not exist in/etc/groups. -nouser finds a file without a valid owner, that is, the owner of the file does not exist in the/etc/passwd. -newer file1! File2 look for a file that changes time than the file File1 new but older than the file file2. -type   Find files of a certain type, such as:    B-block device files.    D-Directory.    C-Character device file.    P-Pipeline file.    L-Symbolic link file.    F-Normal file. -size N:[c] finds files with a file length of n blocks, with C indicating the length of the file in bytes. -depth   When looking for a file, first find the file in the current directory, and then look in its subdirectories. -fstype  Find files located in a type of file system that are typically found in the configuration file/etc/fstab, which contains information about the file system in the system. -mount   does not cross the file system mount point when locating files. -follow  If the find command encounters a symbolic link file, it tracks to the file that the link points to.

In addition, the following three differences:

-amin N   Find the last n minutes of access to a file in the system-atime N  find the last n*24 hour Access file in the system-cmin N Find the file   in the last n minutes of the system changed file status-ctime N  Find the last n*24 hour in the system file status changed file-mmin n   find the last n minutes in the system file data changed file-mtime n  find the last n*24 hours in the system file data changed file

4. Use exec or OK to execute shell commands

When using find, just write the desired action in a file, you can use the exec to match the find lookup, it is convenient for some operating systems only allow the-EXEC option to execute commands such as LS or ls-l. Most users use this option to find old files and delete them. It is recommended that you take a look at the LS command before you actually execute the RM command to delete files, confirming that they are the files you want to delete.

The EXEC option is followed by the command or script that you want to execute, followed by a pair of {}, a space and a \, and finally a semicolon. In order to use the EXEC option, you must use the Print option at the same time. If you verify the Find command, you will see that the command outputs only the relative path and file name from the current path.

For example, to list the matching files with the Ls-l command, you can place the Ls-l command in the-exec option of the Find command

# Find. -type f-exec ls-l {} \;

In the example above, the Find command matches all the normal files in the current directory and lists them using the Ls-l command in the-exec option.

In the/logs directory, look for files that change time before 5th and delete them:

$ find Logs-type f-mtime +5-exec rm {} \;

Remember: Before the shell can delete files in any way, you should look at the appropriate files before you must be careful! You can use the Safe mode of the-EXEC option when using a command such as MV or RM. It will prompt you before you work on each file that is matched to it.

In the following example, the Find command finds all filenames in the current directory. Log end, change files over the 5th, and delete them, but give a hint before deleting them.

$ find. -name "*.conf"  -mtime +5-ok rm {  } \;< rm .... /conf/httpd.conf >? N

Press the Y key to delete the file and press N to not delete it.

Any form of command can be used in the-EXEC option.

In the following example we use the grep command. The find command first matches all files named "passwd*", such as passwd, Passwd.old, Passwd.bak, and then executes the grep command to see if there is a itcast user in these files.

# find/etc-name "passwd*"-exec grep "Itcast" {  } \;itcast:x:1000:1000::/home/itcast:/bin/bash

Detailed options

1. Use the name option

The file name option is the most common option for the Find command, either used alone or in conjunction with other options.

You can use a file name pattern to match files, remembering to enclose the filename pattern in quotation marks.

No matter what the current path is, if you want to find the file name in your root $home that matches *.txt, use ~ as the ' pathname ' parameter, and the tilde ~ represents your $home directory.

$ find ~-name "*.txt"-print

To find all the ' *.txt ' files in the current directory and subdirectories, you can use:

$ find. -name "*.txt"-print

You want the current directory and subdirectories to find file names that begin with an uppercase letter, which can be used:

$ find. -name "[a-z]*"-print

To find files with the file name beginning with host in the/etc directory, you can use:

$ find/etc-name "host*"-print

To find files in the $home directory, you can use:

$ find ~-name "*"-print or find. -print

To get the system running at a high load, start looking for all the files from the root directory:

$ find/-name "*"-print

If you want to find the file name in the current directory with two lowercase letters, followed by two digits, and finally the. txt file, the following command will be able to return files such as the file named Ax37.txt:

$find. -name "[A-z][a-z][0-9][0-9].txt"-print

2. With PERM option

Follow the file permission mode with the-perm option to find files by file permission mode. It is best to use the octal permission notation.

For example, in the current directory to find file permission bit 755 file, that is, the file owner can read, write, execute, other users can read, execute files, can be used:

$ find. -perm 755-print

There is also a way of expression: in front of the octal number to add a bar-, the expression is matched, such as 007 is equivalent to 777,-006 equivalent to 666

# ls-l# Find. -perm 006# Find. -perm-006-perm mode: The file license is exactly in accordance with Mode-perm +mode: The file License section complies with Mode-perm-mode: The file license is fully compliant with mode

3. Ignore a directory

If you want to ignore a directory when you're looking for a file, because you know that directory doesn't have the file you're looking for, you can use the-prune option to indicate which directories you want to ignore. Be careful when using the-prune option, because if you use the-depth option at the same time, the-prune option is ignored by the Find command.

If you want to find the file under the/apps directory but do not want to find it in the/apps/bin directory, you can use:

$ find/apps-path "/apps/bin"-prune-o-print

4. How to avoid a file directory when finding files with find

For example, to find all files in the/home/itcast directory that are not within the DIR1 subdirectory

Find/home/itcast-path "/home/itcast/dir1"-prune-o-print

Avoid multiple folders

Find/home \ (-path/home/itcast/f1-o-path/home/itcast/f2 \)-prune-o-print

Note (before the \, note (after the space.)

5. Use the user and Nouser options

Find files by file owner, such as in the $home directory to find files belonging to the main itcast file, you can use:

$ find ~-user Itcast-print

Look for files in the/etc directory that belong to the main UUCP:

$ find/etc-user Uucp-print

In order to find files that are already deleted from the master account, you can use the-nouser option. This will enable you to find files that are not valid accounts in the/etc/passwd file. When using the-nouser option, you do not have to give the user name; the Find command can do the work for you.

For example, to find all such files in the/home directory, you can use:

$ find/home-nouser-print

6. Use Group and Nogroup options

Just like the user and Nouser options, the Find command has the same options for the group of users that the file belongs to, in order to find files belonging to the Itcast user group under the/apps directory, you can use:

$ find/apps-group Itcast-print

To find all files that do not have a valid group of users, you can use the Nogroup option. The following find command looks for such files from the root directory of the file system

$ find/-nogroup-print

7, according to change time or access time, etc. find files

You can use the Mtime,atime or CTime option if you want to find the file by changing the time. If the system suddenly does not have free space, it is possible that the length of a file grows rapidly during this period, you can use the Mtime option to find such a file.

Use a minus sign-to limit the time to change the file within the current n days, and use the Plus + to limit the change time before the current n days of the file.

To find files that change within 5th of the system root directory, you can use:

$ find/-mtime-5-print

In order to find files that change time before 3rd in the/var/adm directory, you can use:

$ find/var/adm-mtime +3-print

8. Find newer or older files than a file

You can use the-newer option if you want to find all files that have changed time than one file but older than the other. The general form of it is:

Newest_file_name! Oldest_file_name

Among them,! is a logical non-symbol.

9. Use the Type option

To find all the directories in/etc directory, you can use:

$ find/etc-type D-print

To find all types of files except directories in the current directory, you can use:

$ find. ! -type D-print

In the/etc directory to find all the symbolic link files, you can use

$ find/etc-type L-print

10. Use the SIZE option

files can be searched by file length, and the length of the file referred to here can be measured either in blocks or in bytes. The length of the measured file in bytes is expressed as n C, and the length of the block measurement file is only represented by a number.

When looking up files by file length, this is generally the size of the file in bytes, and it is easier to convert by using blocks to measure the file system. In the current directory, look for files with a file length greater than 1 m bytes:

$ find. -size +1000000c-print

Look for files with a file length of exactly 100 bytes in the/home/apache directory:

Look for files that are longer than 10 blocks in the current directory (a block equals 512 bytes):

$ find/home/apache-size 100c-print

$ find. -size +10-print

11. Using the Depth option

When you use the Find command, you may want to match all the files and find them in the subdirectory. Use the depth option to enable the Find command to do so. One reason for this is that when you use the Find command to back up the file system to tape, you want to back up all the files first, and then back up the files in the subdirectories.

In the following example, the Find command starts at the root of the file system and looks for a file named Con.file.

It will first match all the files and then go to the subdirectory to find them.

$ find/-name "CON. FILE "-depth-print

12. Using the Mount option

You can use the Mount option of the Find command to find a file in the current file system (without entering another file system).

From the current directory, look for files in the file system with the file name ending in XC:

$ find. -name "*. XC "-mount-print

Exercise: Find the. c and. cpp files that you have accessed or modified within 10 days.

Example of the Find command;

1. Find all files under the current user's home directory:

Here are two ways to use

$ find $HOME-print$ Find ~-print

2, let the current directory of the file owner has read, write permissions, and the file belongs to the group of users and other users have Read permission files;

$ find. -type f-perm 644-exec ls-l {  } \;

3, in order to find all the files in the system file length of 0 ordinary files, and list their full path;

$ find/-type f-size 0-exec ls-l {  } \;

4. Look for common files in the/var/logs directory that were changed before 7th, and ask them before deleting them;

$ find/var/logs-type f-mtime +7-ok rm {  } \;

5, in order to find all the files belonging to the root group in the system;

$find. -group root-exec ls-l {  } \;

6. The Find command will delete the Admin.log file that contains the digital suffix since the access time in the directory was 7th.

This command checks only three digits, so the suffix of the corresponding file should not exceed 999. Build several admin.log* files before using this command

$ find. -name "admin.log[0-9][0-9][0-9]"-atime-7  -ok rm {  } \;

7, in order to find all the directories in the current file system and sorting;

$ find. -type D | Sort

Third, Xargs

Xargs-build and execute command lines from standard input

When a matching file is processed using the-EXEC option of the Find command, the Find command passes all matching files to exec execution. However, some systems have a limit on the length of the command that can be passed to exec so that an overflow error occurs after the Find command runs for a few minutes. The error message is usually "parameter column too Long" or "parameter column overflow". This is where the Xargs command is used, especially with the Find command.

The find command passes the matched file to the Xargs command, and the Xargs command takes only a subset of the files at a time instead of all, unlike the-exec option. This allows it to first process a portion of the file that was first fetched, then the next batch, and so on.

In some systems, the use of the-EXEC option initiates a corresponding process for processing each matching file, not all of the matching files are executed once as parameters, so that in some cases there will be too many processes and degraded system performance, so the efficiency is not high;

With the Xargs command, there is only one process. In addition, when using the Xargs command, whether to get all the parameters at once or to get the parameters in batches, and the number of parameters to get each time will be determined according to the command's options and the corresponding tunable parameters in the system kernel.

Take a look at how the Xargs command is used with the Find command, and give some examples.

The following example finds every normal file in the system, and then uses the Xargs command to test what type of file they belong to

#find. -type F-print | Xargs file

In the current directory, look for files with read, write, and execute permissions for all users, and reclaim the appropriate write permissions:

# ls-l# Find. -perm-7-print | Xargs chmod o-w# ls-l

Use the grep command to search all common files for the word hello:

# Find. -type F-print | Xargs grep "Hello"

Use the grep command to search for the word hello in all normal files in the current directory:

# Find. -name \*-type F-print | Xargs grep "Hello"

Note that in the example above, \ is used to cancel the special meaning of the * in the shell in the Find command.

The Find command, with exec and Xargs, allows the user to execute almost all commands against the matching file.

The Find command in Linux