10 Example Scenarios To Learn Linux Find Command

April 30, 2011 | By
| 1 Reply More

The linux command “find” is a very powerful command which is basically used for searching files under a directory structure. This command can be used to find files using a variety of options such as by name,file type, inode number, file permissions etc. The output of "find" command can be used to perform other operations (using “exec”) and that makes it a very useful command.

The basic syntax of find is as follows:

find path_to_start_check [options] file_to_check

In this article, we will go through some practical examples of “find” command to help you understand this command quite easily.

Example 1: Finding a file under a particular directory

a. Suppose you want to check for the file “testfile.txt” under the directory “/”, you can use the following command.

# find / -name "testfile.txt"

This will find the file “testfile.txt” under “/” and from any subdirectories of “/”. But this will not find “Testfile.txt”.

b. If you want to search for a file ignoring the case, you can do it by following:

# find / -iname "testfile.txt"

This command will be able to find both testfile.txt and Testfile.txt

c. If you want to search for the file “testfile.txt” in the directories /tmp and /var/tmp, you can do it by following:

# find /tmp /var/tmp -iname "testfile.txt"

Example 2: Finding files owned by a specific user

If you want to check for all files owned by the user “sam” under /home, you can do it as follows:

#find /home -user sam

Example 3: Limiting search to a particular depth

Suppose you want to check for the file testfile.txt in “/” and “its subdirectories” and not in the next level subdirectories, you need to use “maxdepth” to 2 as follows:

# find / -maxdepth 2 -name testfile.txt

Example 4: Finding files using inode number

In some cases, you may need to find files using inode numbers. This usually happens when the filename contains some characters which make the operation using filename impossible. In that case, you need to use the inode number of the file to perform the operation.

For example, if you want to remove the file “testfile?.txt”. If you directly use rm command to remove this file (rm testfile?.txt) it will remove all files that starts with “testfile”. So, in such situations, you need to use the inode number of the file to remove it.

# ls -i testfile*

This will show the inode number of all files that start with “testfile”. Suppose, the inode number of “testfile?.txt” is “752010”, you can remove the file as follows:

# find -inum 752010 -exec rm {} \;

The command “exec” can be used to execute a command using the output of a previous command. Here, “{}” will get replaced by each file provided by find command.

Example 4: Finding files using timestamp

a. Suppose you want to find all files that are modified in the last 3 days, you can use the following find command.

# find . -type f -mtime -3

Here “-type f” corresponds to a regular file type and “-3” corresponds to the fact that the modified time of the file is in the last 3 days time period.

b. Suppose, you want to remove all files that were older than 3 days (not modified in last 3 days), you can use the following command:

# find . -type f -mtime +3 –exec rm –f {} \;

c. If you want to find files that are modified second last week (before 7 days and less than 14 days) and archive them, you can use the following command:

# find . -type f -mtime +7 -mtime -14 | xargs tar -cvf `date ‘+%d%m%Y’_archive.tar`

Note that ‘xargs’ is used to construct argument list for “tar” command from the output of “find” command.

d. If you want to find all files that were not accessed in the last 100 days ago, you can use the following command:

# find /home -atime +100

e. If you want to find files which have been changed in the last 1 hour, you can use “-cmin” option. As we discussed, “-mtime/-atime/-ctime” refers to time in days (24 hour multiples), and “-mmin/-amin/-cmin” refers to time in minutes.

# find . -cmin -60

Example 5: Finding files based on file type

a. To find all regular files that start with "stat", you can use the following command:

# find . -type f –iname stat*

b. If you want to find all hidden files in your current directory, you can find it using the command below. The hidden files are preceded with a dot(.).

# find . -type f -name ".*"

c. To find all directories that start with "stat", you can use the following command:

# find . -type d –iname stat*

d. If you want to find all symbolic links under a specific folder, you can use “xtype” instead of “type” as follows:

# find –L –xtype l

Here “-L” tells find command to follow symbolic links.

Example 6: Finding using file permissions

a. If you want to find files which have 644 permission, you can use the following command:

# find . -perm 644 -type f -exec ls -l {} \;

b. In many situations, you may need to find directories with full permission (777) and change it to 755 recursively. You can achieve this as follows:

# find /home -type d -perm 777 -print -exec chmod 755 {} \;

Example 7: Finding files using size

a. If you want to find files that are larger than 2GB, you can find it as follows:

# find . -type f -size +2G

b. If you want to find the top 5 bigger files, you can do it as follows. You may need this command during disk space cleanup.

# find . -type f -exec ls -s {} \; | sort -n -r | head -5

Note that “ls –s” will output the size of the file and the sort option “-n” will do the numeric sorting (ascending order) and –r option will reverse the result.

Example 8: If you want to take the backup of all “php” files under /home, you can execute the following command:

# find -name "*.php" –exec cp {} {}.bak \;

Note the usage of {} twice will get replaced by each filename provided by "find" command without any problem.

Example 9: If you want to count the number of files and directories under a specific folder, you can do it as follows:

# find . -type d -exec basename {} \; | wc –l
# find . -type f -exec basename {} \; | wc -l

The find command will output the results in full path and the “basename” linux command will stripe the parent directories and will output only the particular directory/file name.

Example 10

You may encounter some situations where buggy softwares may create core dump files that make use of heavy file system storage. In such a case, you can use the following command to find the core files (which will start with core*) and then remove them by following this single command:

# find . -name “core” -exec rm -f {} \;

Filed Under : LINUX COMMANDS, LINUX HOWTO

Tagged With :

Free Linux Ebook to Download

Comments (1)

Trackback URL | Comments RSS Feed

  1. Emmanuel Borlet says:

    Ok very nice recap ;)

    But i think it’s better to use
    -delete

    instead of
    -exec rm {} \;

Leave a Reply

Commenting Policy:
Promotion of your products ? Comment gets deleted.
All comments are subject to moderation.