Find¶
De Dzone
Encontrar un directorio¶
$ find /path/to/search -type d -name "name-of-dir"
Encontrar ficheros ocultos¶
$ find /path/to/search -name ".*"
Encontrar ficheros de cierto tamaño¶
Busca ficheros mayores de 10MB:
$ find /path/to/search -size +10M
Busca ficheros menores de 10MB:
$ find /path/to/search -size -10M
Busca ficheros de exactamente 100MB:
$ find /path/to/search -size 10M
Busca ficheros entre 100MB y 1GB:
$ find /path/to/search -size +100M -size -1G
Búsqueda desde una lista de ficheros¶
Se puede buscar desde una lista de ficheros (en un .txt, por ejemplo) mediante una combinación de find y grep:
$ find /path/to/search | grep -f filelist.txt
Encontrar los que no estén en la lista¶
$ find /path/to/search | grep -vf filelist.txt
Configurando la profundidad de búsqueda¶
Por defecto find busca recursivamente. Con la opción -maxdepth se especifica el número de subdirectorios a recorrer recursivamente.
Búsqueda en el directorio actual sin mirar en subdirectorios:
$ find . -maxdepth 0 -name "myfile.txt"
Búsqueda en el directorio actual y en profundidad 1 de subdirectorios
$ find . -maxdepth 1 -name "myfile.txt"
Encontrar ficheros vacíos¶
$ find /path/to/search -type f -empty
Para encontrar los directorios vacíos:
$ find /path/to/search -type d -empty
Para borrar todos los ficheros vacíos de un directorio (y sus subdirectorios):
$ find /path/to/search -type f -empty -delete
Encontrar el mayor directorio o fichero¶
Muestra el mayor fichero de un directorio:
$ find /path/to/search -type f -printf "%s\t%p\n" | sort -n | tail -1
Muestra los 5 mayores:
$ find /path/to/search -type f -printf "%s\t%p\n" | sort -n | tail -5
Muestra los 5 ficheros más pequeños:
$ find /path/to/search -type f -printf "%s\t%p\n" | sort -n | head -5
Busca el directorio de mayor tamaño:
$ find /path/to/search -type d -printf "%s\t%p\n" | sort -n | tail -1
Find setuid Set Files¶
Setuid
This can be a security concern for obvious reasons, but these files can be easy to isolate with the find command and a few options.
The find command has two options to help us search for files with certain permissions: -user and -perm. To find files that are able to be executed with root privileges by a normal user, you can use this command:
$ find /path/to/search -user root -perm /4000
In the screenshot above, we included the -exec option in order to show a little more output about the files that find returns with. The whole command looks like this:
$ find /path/to/search -user root -perm /4000 -exec ls -l {} \;
You could also substitute “root” in this command for any other user that you want to search for as the owner. Or, you could search for all files with SUID permissions and not specify a user at all:
$ find /path/to/search -perm /4000
Find sgid Set Files¶
Finding files with SGID set is almost the same as finding files with SUID, except the permissions for 4000 need to be changed to 2000:
$ find /path/to/search -perm /2000
You can also search for files that have both SUID and SGID set by specifying 6000 in the perms option:
$ find /path/to/search -perm /6000
List Files Without Permission Denied¶
When searching for files with the find command, you must have read permissions on the directories and subdirectories that you’re searching through. If you don’t, find will output an error message but continue to look throughout the directories that you do have permission on.
Although this could happen in a lot of different directories, it will definitely happen when searching your root directory.
That means that when you’re trying to search your whole hard drive for a file, the find command is going to produce a ton of error messages.
To avoid seeing these errors, you can redirect the stderr output of find to stdout, and pipe that to grep.
$ find / -name "myfile.txt" 2>%1 | grep -v "Permission denied"
This command uses the -v (inverse) option of grep to show all output except for the lines that say “Permission denied.”
Find Modified Files Within the Last X Days¶
Use the -mtime option on the find command to search for files or directories that were modified within the last X days. It can also be used to search for files older than X days, or files that were modified exactly X days ago.
Here are some examples of how to use the -mtime option on the find command:
Search for all files that were modified within the last 30 days:
$ find /path/to/search -type f -mtime -30
Search for all files that were modified more than 30 days ago:
$ find /path/to/search -type f -mtime +30
Search for all files that were modified exactly 30 days ago:
$ find /path/to/search -type f -mtime 30
If you want the find command to output more information about the files it finds, such as the modified date, you can use the -exec option and include an ls command:
$ find /path/to/search -type f -mtime -30 -exec ls -l {} \;
Sort by Time¶
To sort through the results of find by modified time of the files, you can use the -printfoption to list the times in a sortable way, and pipe that output to the sort utility.
$ find /path/to/search -printf "%T+\t%p\n" | sort
This command will sort the files older to newer. If you’d like the newer files to appear first, just pass the -r (reverse) option to sort.
$ find /path/to/search -printf "%T+\t%p\n" | sort -r
Difference Between Locate and Find¶
The locate command on Linux is another good way to search for files on your system. It’s not packed with a plethora of search options like the find command is, so it’s a bit less flexible, but it still comes in handy.
$ locate myfile.txt
The locate command works by searching a database that contains all the names of the files on the system. The database that it searches through is updated with the upatedb command.
Since the locate command doesn’t have to perform a live search of all the files on the system, it’s much more efficient than the find command. But in addition to the lack of options, there’s another drawback: the database of files only updates once per day.
You can update this database of files manually by running the updatedb command:
$ updatedb
The locate command is particularly useful when you need to search the entire hard drive for a file, since the find command will naturally take a lot longer, as it has to traverse every single directory in real-time.
If searching a specific directory, known to not contain a large number of subdirectories, it’s better to stick with the find command.
CPU Load of Find Command¶
When searching through loads of directories, the find command can be resource-intensive. It should inherently allow more important system processes to have priority, but if you need to ensure that the find command takes up fewer resources on a production server, you can use the ionice or nice command.
Monitor CPU usage of the find command:
$ top
Reduce the Input/Output priority of find command:
$ ionice -c3 -n7 find /path/to/search -name "myfile.txt"
Reduce the CPU priority of find command:
$ nice -n 19 find /path/to/search -name "myfile.txt"
Or combine both utilities to really ensure low I/O and low CPU priority:
$ nice -n ionice -c2 -n7 find /path/to/search -name "myfile.txt"