Find common usage examples in Linux

Common usage examples of find in Linux

·find path -option [ -print ] [ -exec -ok command ] {} ;

Parameters of the find command;

pathname: the directory path searched by the find command. For example, use . to represent the current directory and / to represent the system root directory.
-print: The find command outputs matching files to standard output.
-exec: The find command executes the shell command given by this parameter on the matching file. The corresponding command is in the form of 'command' { } ;, note the space between { } and ;.
-ok: The same function as -exec, except that it executes the shell command given by this parameter in a safer mode. Before executing each command, a prompt will be given to allow the user to determine whether to execute it. .

#-print Output the found file to the standard output
#-exec command {} ; ---Execute the command operation on the found file, there is a space between {} and;
#-ok is the same as -exec, Just ask the user before operation

Example: find . -name .svn | xargs rm -rf

========================== =============================

-name filename #Find the file named filename
-perm #Search by execution permission
- user username #Search by file owner
-group groupname #Search by group
-mtime -n +n #Search files by file change time, -n means within n days, +n means n days ago
-atime -N +N #to check GIN: 0px "& GT;

-CTime -N +N #according to the file to find the file.

-nogroup                    #Check for files that do not have a valid owner, that is, the file’s group does not exist in /etc/groups
-nouser                         
-newer f1 !f2 Find files, -n refers to within n days, +n refers to n days ago
-ctime -n +n # Search files based on file creation time, -n refers to within n days, +n refers to n days In the past, the files of g-Nogramp #did not have a valid group, that is, the file of the file does not exist in the/etc/group of
-NOUSER #以 以 以 以 以 以, that is, the owner of the file is in/etc/passwd. Stock-Newer F1! F2 #Check the change time than F1, but older F2, but older F2-Type B/D/C/P/L/F #Check Ordinary files
-size n[c] #Check files with a length of n blocks [or n bytes]
-depth But Files older than f2
-type b/d/c/p/l/f #Check whether they are block devices, directories, character devices, pipes, symbolic links, ordinary files
-size n[c] #Check length is n blocks [Or N-byte] file 节-DEPTH #to find the files that are found in this catalog before entering the sub-directory
Fastype #Check the files in a certain type of file system. These file system types can usually be in/ETC/FSTAB Find u-Mount #when checking the file, do not cross the file system Mount point
-Follow #If you encounter a symbol link file, follow the files
-CPIO %; #Check the files in a certain type of file system, These file system types can usually be found in /etc/fstab.
-mount​ #pair matching Use the cpio command to back up the files to the tape device
-prune​​​​​​​​​ #Ignore a directory

==================================================== ====
$find ~ -name "*.txt" -print #Check the .txt file in $HOME and display it
$find . -name "*.txt" -print
$find . -name "[A-Z ]*" -print #Check files starting with capital letters
$find /etc -name "host*" -print #Check files starting with host
$find . -name "[a-z][a-z][0–9 ][0–9].txt" -print #Check txt files starting with two lowercase letters and two numbers
$find . -perm 755 -print
$find . -perm -007 -exec ls -l {} ; #Check files that can be read, written and executed by all users with -perm 777
$find . -type d -print
$find . ! -type d -print
$find . -type l -print

$find . - Size +1000000c -print 10 block file (1 block = 512 bytes)

$cd /

$find etc home apps -depth -print | cpio -ivcdC65536 -o /dev/rmt0

$find /etc -name "passwd*" -exec grep "cnscn" {} ; #Check if cnscn user exists
$find . -name "yao*" | xargs file
$find . -name "yao*" | xargs echo "" > /tmp/core.log
$find . -name " yao*" | xargs chmod o-w

========================================== =============

find -name april* Find files starting with april in the current directory
find -name april* fprint file Find files starting with april in the current directory and output the results to file
find -name ap* -o -name may* Find files starting with ap or may
find /mnt -name tom.txt -ftype vfat Find files named tom.txt and file system type vfat under /mnt
find /mnt -name t. txt ! -ftype vfat Find the file named tom.txt under /mnt and the file system type is not vfat
find /tmp -name wa* -type l Find the file named starting with wa and the type is a symbolic link under /tmp Files
find /home -mtime -2 Check files that have been changed in the last two days under /home
find /home -atime -1 Check files that have been accessed within 1 day
find /home -mmin +60 in/ Check files under home that were changed 60 minutes ago
find /home -amin +30 Check files that were accessed 30 minutes ago
find /home -newer tmp.txt Check under /home that the update time is more recent than tmp.txt Files or directories
find /home -anewer tmp.txt Check files or directories in /home that have access times more recent than tmp.txt
find /home -used -2 ​​List files or directories that have been modified in 2 Files or directories that have been accessed during the day
find /home -user cnscn List the files or directories belonging to the user cnscn in the /home directory
find /home -uid +501 List the user identification code greater than 501 in the /home directory File or directory
find /home -group cnscn List the files or directories with group cnscn in /home
find /home -gid 501 List the files or directories with group id 501 in /home
find /home -nouser List Files or directories in /home that do not belong to local users
find /home -nogroup List files or directories in /home that do not belong to local groups
find /home -name tmp.txt -maxdepth 4 List tmp in /home. txt The maximum depth when searching is 3 levels
find /home -name tmp.txt -mindepth 3 Start checking from the 2nd level
find /home -empty Find files or empty directories with a size of 0
find /home -size +512k Check Find files larger than 512k
find /home -size -512k Find files smaller than 512k
find /home -links +2 Find files or directories with more than 2 hard links
find /home -perm 0700 Search for files or directories with permissions of 700
find /tmp -name tmp.txt -exec cat {} ;
find /tmp -name tmp.txt -ok rm {} ;

find / -amin -10 # Find files accessed in the last 10 minutes in the system
find / -atime -2 # Find files accessed in the last 48 hours in the system
find / -empty # Find files that are empty in the system Or folder
find / -group cat # Find files belonging to groupcat in the system
find / -mmin -5 # Find files modified in the last 5 minutes in the system
find / -mtime -1 # Find files in the system Files modified in the last 24 hours
find / -nouser #Find files belonging to the invalid user in the system
find / -user fred #Find files belonging to the user FRED in the system

Check all ordinary files in the current directory

# find . -type f -exec ls -l {} ;
-rw-r–r– 1 root root 34928 2003-02-25 ./conf/httpd.conf
-rw-r–r– 1 root root 12959 2003-02-25 ./conf/magic
-RW-R – R — 1 root root 180 2003-02-25 ./conf.d/readme
All ordinary files in the current directory, and in-E x E C C Use the ls -l command in the options to list them

======================================== ============
Find files in the / logs directory with change times older than 5 days and delete them:
$ find logs -type f -mtime +5 -exec -ok rm {};

================================================== =
Query the files modified on the day
[root@book class]# find ./ -mtime -1 -type f -exec ls -l {} ;

============== ===================================
Query the file and ask if you want to display it
[root@book class] # find ./ -mtime -1 -type f -ok ls -l {} ;
< ls … ./classDB.inc.php > ? y
-rw-r–r– 1 cnscn cnscn 13709 January 12 12:22 ./classDB.inc.php
[root@book class]# find ./ -mtime -1 -type f -ok ls -l {} ;
< ls … ./classDB.inc.php > ? n
[root@book class]#

======================================== ===========
Query and hand it over to awk for processing
[root@book class]# who | awk '{print $1"t"$2}'
cnscn pts/0

=== ==============================================
awk—grep —sed

[root@book class]# df -k | awk '{print $1}' | grep -v 'none' | sed s"//dev///g"
File system
sda2
sda1
[ root@book class]# df -k | awk '{print $1}' | grep -v 'none'
File system
/dev/sda2
/dev/sda1

1) Find all in /tmp *.h, and search for "SYSCALL_VECTOR" in these files, and finally print out all file names containing "SYSCALL_VECTOR"

A) find /tmp -name "*.h" | xargs -n50 grep SYSCALL_VECTOR
B) grep SYSCALL_VECTOR /tmp/*.h | cut -d':' -f1| uniq > filename
C) find /tmp -name "*.h" -exec grep "SYSCALL_VECTOR" {} ; -print

2)find / -name filename -exec rm -rf {} ;
Find / -name filename -ok rm -rf {} ;

3) For example, if you want to find files larger than 3M on the disk:
find . -size +3000k -exec ls - ld {} ;

4) Copy the found stuff to another place
find *.c -exec cp '{}' /tmp ';'

If there are special files, you can use cpio, or you can use this Syntax:
find dir -name filename -print | cpio -pdv newdir

6) Find files changed at 2004-11-30 16:36:37
# A=`find ./ -name "*php"` | ls -l –full-time $A 2>/dev/null | grep "2004-11-30 16:36:37"

Linux-all, Linux | No Comments »

find Example

April 18th, 2006

　To find all in /usr/linux *.h, and search for "SYSCALL_VECTOR" in these files, and finally print out all file names containing "SYSCALL_VECTOR". There are several ways to achieve this
find /usr/linux -name "*.h" | xargs -n50 grep SYSCALL_VECTOR
grep SYSCALL_VECTOR /usr/linux/*.h | cut -d':' -f1 | uniq > filename
find /usr/linux -name "*.h" -exec grep "SYSCALL_VECTOR" {} ; -print

　 I used find / -name filename | rm -rf, but it was unsuccessful. Why was it unsuccessful?
find / -name filename -exec rm -rf {} ;
find . -name filename |rm -rf try {} to indicate the result you found.
; is equivalent to the "Constitution", there is nothing to say, it is just stipulated in this way, a symbol indicating the end of the command is required after -exec. The answer can be found in man find.
To make rm recognize the result of find, as follows:
find / -name filename |
Find files containing a specific string
For example, find files containing the string "the string you want find..." in the current directory:
$find . -type f -exec grep "the string you want find..." {} ; - print

　Start from the root directory to check tmpfile, delete it immediately once found

find / -name "tmpfile" -exec rm {};

　Perm problem with find

What does the following command mean? The key is the - before the number, everyone else knows it
find -name ".*" -perm -007
I know
find -name ".*" -perm 755
This is used to find hidden files with permission bit 755 File
Oh, by the way, I omitted the pathname parameter of find in the above commands. Does find search the current working directory by default?
If I use -ok instead of -exec, do I still need to add {} ;?
This is already clear, but it is still needed, because -ok is just the prompt mode of -exec. It just adds one more step to confirm the operation. I didn’t understand the meaning of those E-texts just now. Sorry
-007 means to find all users. Be careful with files that can be read, written, and executed~~~
Explain?
Is there any difference between find -name ".*" -perm -007 and find -name ".*" -perm 777?
-007 How did you get it?
But there is a problem
I use find . -perm -100 to list the current directory . , why is this?

The following is quoted from the content published by explorer at 2002/10/01 06:15am:

-007 refers to searching for files that can be read, written, and executed by all users. Be careful~~~
-007 refers to searching for files containing other Files that can be read, written, and executed by users (different groups, not owners). It does not have to be readable and writable by the same group, which means that the minimum permission is 007.
The following is quoted by a Xiaobaicai on 2002/10/01 Posted at 10:16am:
OK, haha
But there is a problem
I use find. -perm -100 to list the current directory. Why is this?
This method will not accurately find the directory. -100 means that the permissions are at least runnable by the owner.
In unix systems, you can enter a directory only if you have execution rights to the directory files. This is The reason why directory files are listed.
find . -perm -001 -print usually finds directory files.
Of course I don’t mean to use this method to find directories, but I just don’t understand the meaning of -100
Then then By analogy, does -010 mean that the permissions are executable by at least the owner and the same group? In other words, 010 and - here are actually separate, - means at least, and 010 is really used to describe the permission bit?
I understand now, thank you

Copy the found stuff to another place?

find *.c -exec cp '{}' /tmp ';'
If there are special files, you can use cpio, or You can use this syntax:
find dir -name filename -print | cpio -pdv newdir

Find files within a certain size range on the disk

For example, to find files larger than 3M on the disk:
find . -size +3000k -exec ls -ld {} ;

　How to use find to find files changed on a certain day?

You can use this line of command to achieve:
A=`find ~ -print` | ls -l –full-time $A 2>/dev/null | grep "Jun 27" | grep 1998

　 How to use the find command to find the shell of a certain time period. For example, from 11 o'clock to 12 o'clock. thanks
Create a script judgetime with the following content:
ls -l $*|awk '{split($8,hour,":");if((hour[1]>23 || hour[1] < 1 )&&hour[1]<24)print}'
Go to the directory you want to find and run
find ./ -name "*" -exec judgetime {} ;
Note that the time format is 24-hour format.
Thank you, what if I want to be accurate to minutes
touch -t 04241112 starttemp #Accurate to 12 minutes
touch -t 04241220 endtemp #As of 12:20
find [dir] -newer starttemp -a ! -newer endtemp -exec ls -l {} ;
ｎｗｅｒ?
How about the document at 12:10 yesterday?
When executing every day, wouldn’t it be enough to replace it with the date and timestamp of that day?
I don’t know if he found all the ones from 11:00 to 12:00, did he execute it only once or every day?
In this case, I guess I forgot where I put my things. I just remember that it was late at night.
That makes sense!
As expected of Bamboo!
Not only do you know how to solve problems, but you also know under what circumstances such problems arise. I admire you!
The problem arises again. when creating this file. The column that was supposed to be the time now says 2002 instead of 12:00.
Wait until 12:00 passes!

　Delete files with a specified date
find ./ -name file name-exec rm -f {} ;
Example: To delete files that have not been used within the current 30 days, use the following command:
find / -atime +30 -exec rm -f {} ;
I tried to write a short section of SHELL myself, and also used ll, grep, and rm commands, but they were not satisfactory.
Use a FOR statement in the filtered file name list, and then execute rm. Now I want to extend this SHELL so that it can be run regularly every day to delete files n days ago. Can anyone give me some tips? Thank you!
There is another question. Regarding the "find / -atime +30 -exec rm -f {} ;
" method mentioned by the friend before, I have tried it several times a long time ago, but it seems that the parameters are not quite right. -atime n searches for files that were accessed n days ago. What I don’t understand is what the time reference point here is and how n days are calculated.
Question 2: Did I use the wrong command "ll |cut -f 1"? I just wanted to remove the file names listed in ll, but I couldn't do it with the cut -f command. I had to use ll | instead. cut -c 59- This way I get the file name I want, but it's a pool idear! I've also tried using awk, but it doesn't seem to be right. Let me see if anyone can give me some tips, TKS SO MUCH
Question 3. How to change the date format of the I node. The format displayed by my current system is:
- rw-r—– 1 msahz01 users 2253 February 2, 2002 poheader.i
I want to change this to
-rw-rw-rw- 1 house users 2193 Apr 19 2001 hkdisp.p
How can I do this ?
awk should work
ll | awk '{print $9}'
Delete files older than how many days
find /yourpath -mtime +31 -exec rm {} ;
find /yourpath -mtime +366 -exec rm {} ;

In find, what is the difference between -ctime, -mtime and -atime?

What is the relationship between -ctime and -mtime?
If the ctime of the parent directory changes, will the ctime of the files below it change automatically? ?
Where does the information about -ctime, -mtime, and -atime exist?

I used -mtime -1 to find newly created or modified files.
But how can I find files mv'd within a day (their time is Original time, earlier than one day) ?

Use the -newer option.
You can first touch a file with the time you want as follows:
$ touch -t 08190800 test
$ ls -l test
-rw-r–r– 1 dba other 0 Aug 19 08:00 test
Then
$ find . -newer test -print
.
./.sh_history
$ ls -l .sh_history
-rw——- 1 dba other 154 Aug 20 17:39 .sh_history

Use touch to write whatever you want time file, and then use -newer,! -newer option to succeed.

1. ctime contains the time when inode information is modified. mtime only refers to the time when the file content is created or modified.
2 No.
3. This information should be stored in the super block of the file system.

I checked the book - ctime refers to the change of inode (or file status change).
What information is stored in inode?
I did some small tests. If -mtime is changed, -ctime will definitely change.
If the file name is changed, -ctime will also change.
Who can answer what is stored in i-node?

vi /usr/include/sys/inode.h

Master, I cannot access /usr/include/sys/inode.h.
The excerpt is as follows:
Directories contain directory entries. Each entry contains a file or subdirectory name and an index node reference number (i-node number). To increase speed and enhance use of disk space, the data in a file is stored at various locations in the computer's memory. The i-node contains the addresses used to locate all the scattered blocks of data associated with a file. records other information about the file including time of modification and access, access modes, number of links, file owner, and file type.
But I found that -atime has been changed, but -ctime has not been changed. why?
( I will cat it first For ASCII files, use -atime -1. Use -ctime -1 if it is available. But it doesn’t exist.)
Wouldn’t it be inconsistent with the change of inode information and the change of ctime?

I don’t agree with the article you posted, as As I mentioned, atime, ctime, and mtime are placed in the super block. Under sco unix, it is a structure called stat. (stat_32). Different system file systems may be different. The structure of inode under sco is as follows:

typedef struct inode

{
struct inode *i_forw; /* inode hash chain */
struct inode *i_back; /* '' */
struct inode *av_forw; /* freelist chain */
struct inode *av_back; /* '' */
int *i_fsptr; /* "typeless" pointer to fs dependent */
ino32_t i_number; /* i number, 1-to-1 with dev address */
ushort i_ftype; /* file type = IFDIR, IFREG, etc. */
short i_fstyp; /* File system type */
off_t i_size; /* size of file */
ushort i_uid; /* owner */
ushort i_gid; /* group of owner */
ushort i_flag;
ushort i_want; /* i_flag extension to avoid MP races */
ushort i_count; /* reference count */
short i_nlink; /* directory entries */
dev_t i_rdev; /* Raw device number */
#define i_namtype i_rdev /* i_ftype==IFNAM subtype */
dev_t i_dev; /* device where inode resides */
struct mount *i_mton;/* ptr to mount table entry that */
/* this directory is mounted on * /
struct region *i_rp; /* ptr to shared region if any */
struct stdata *i_sp; /* ptr to associated stream */
struct iisem *isem; /* ptr to XENIX semaphores */
struct iisd *isd ; /* ptr to XENIX shared data */
} i_un;
#define i_mnton i_un.i_mton /* i_ftype==IFDIR IMOUNT */
#define i_rptr i_un.i_rp /* i_ftype==IFREG || i_ftype==IFBLK * /
#define i_sptr i_un.i_sp /* i_ftype==IFCHR || i_ftype==IFIFO */
#define i_sem i_un.isem /* i_ftype==IFNAM && i_namtype==IFSEM */
#define i_sd i_un.isd / * i_ftype==IFNAM && i_namtype==IFSHD */

struct fstypsw *i_fstypp; /* ptr to file system switch FSPTR */

long *i_filocks; /* pointer to filock (structure) list */
unsigned long i_mappages; /* number of pages currently cached */
unsigned long i_vcode; /* read-ahead block save (NFS) */
short i_wcnt; /* write open count or ITEXT count */
struct lockb i_cilock; /* tas to synchronize i_flag changes */
ushort i_rdlocks; /* count of non-exclusive lockers */
} inode_t;

So, accessing a file cannot change the inode information.

Use chown, chgrp, chmod commands to compare mtime and ctime
chown changes the owner of a file. You can find it with ctime, but you can’t find it with mtime.
Try it.

Thank you, Buzhu! I was interviewed on Solaris. I don’t understand -ctime.

The results of the test As follows:
Modify files, -mtime is changed, -ctime will also change.
Access files, -atime is changed, -ctime remains unchanged.
chown, chgrp, chmod, mv, will cause -ctime to change, but will not affect - atime and -mtime.
touch can change -mtime and/or -atime, but when touch -a only changes the access time, -ctime is also changed.
touch -m changes the modification time, of course -ctime is also changed.
It seems that there are many other things that can change -ctime, I can’t figure it out.
Is there any way to display -mtime, atime, ctime?
Can -ctime be used to back up or transfer the incremental files of the directory? ?
Thank you!

There is no tool displayed, (maybe I don’t know)

Replace st_mtime in the following program with st_ctime, or st_atime and you will get what you want.
#include
int
main (int argc, char **argv)
{
struct stat buf;
char date[80];
char fname[80];
printf("Enter filename (with full path) to check mtime : ");
scanf("%s ",fname);
stat(fname, &buf);
printf ("mtime (in sec) of %s = %ldn", fname, buf.st_mtime);
strcpy(date, ctime((time_t *)&( buf.st_mtime)));
printf ("mtime (in date) of %s = %sn", fname, date);
}

As for file backup, is there anything you can’t do?

mtime ls -l The time when the file content was recently modified

atime ls -lu The time when the file was recently accessed
ctime ls -li The status of the recent file changes, such as file modifications, attribute owner changes, node, link changes, etc. It should not be limited to time. Changes before and after

I looked at the help of ls and thought it was just sorting by ctime or atime, and the displayed time was still mtime.

After comparing it carefully, what ayhan said is right. Thank you ayhan.

Thank you ahyan for the tip! I tried the following on Solaris:
mtime is seen with ls -l
atime is seen with ls -lu
ctime is seen with ls -lc. (ls -li only has inode number)
Excerpt from the book is as follows :
-c Uses time of last modification of the i-node (file
created, mode changed, and so forth) for sorting (-t)
or printing (-l or -n).
-u Uses time of last access instead of last modification
for sorting (with the -t option) or printing (with the
-l option).
-i For each file, prints the i-node number in the first
column of the report.